{
  "finding_id": "DF-4646",
  "title": "nvme(4) teardown vs in-flight data-path I/O: UAF -> div0 panic",
  "verdict": "reproduced / panic / certain",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh  (in guest; nvme guest via dfbsd-qemu/vm_nvme.sh)",
    "run": "sh run.sh",
    "expected": "Fatal trap 18 ... Stopped at nvme_get_request+0x34: divl 0x40(%r13),%eax; DDB prompt; ssh dead"
  },
  "kernel_refs": [
    "sys/dev/disk/nvme/nvme_disk.c:115",
    "sys/dev/disk/nvme/nvme_disk.c:172",
    "sys/dev/disk/nvme/nvme_disk.c:189",
    "sys/dev/disk/nvme/nvme_disk.c:379",
    "sys/dev/disk/nvme/nvme_disk.c:394",
    "sys/dev/disk/nvme/nvme_attach.c:470",
    "sys/dev/disk/nvme/nvme_admin.c:110",
    "sys/dev/disk/nvme/nvme_admin.c:185",
    "sys/dev/disk/nvme/nvme.c:446"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "nvio.c", "nvzombie.c", "nvmebang.c",
    "build.sh", "run.sh", "build.log", "base_build.log", "run.log",
    "panic.txt", "fix.diff", "env.txt", "hashes.txt", "verdict.json",
    "manifest.json"
  ]
}