# DF-4671 — bktr_mmap fault-time re-query races the unlocked METEORSETGEO buffer swap

**Status: NOT REPRODUCED as a race on this rig (source-proven mechanism;
sub-µs window not caught across ~1,700 grow windows / ~10⁴ genuine
first-fault queries). Two discoveries documented: (1) the device pager's
fake-page cache survives munmap (stale phys_addr re-served, d_mmap never
re-queried for already-faulted pindexes); (2) a HELD mapping stays a
live RW alias onto the orphaned pages after the grow path frees the
buffer — deterministic, race-free (`--holdcheck`).**

## Build

```
./build.sh    # poc_race (unpriv; includes --seqcheck and --holdcheck modes)
```

## Run

```
./run.sh      # seqcheck (confounder proof), holdcheck (deterministic alias),
              # then the hardened grow-vs-fault race as uid 1001
```

## Expected

- `--seqcheck`: 64/64 stale markers re-served with zero concurrency
  (pager fake-page cache survives munmap — disqualifies naive rigs).
- `--holdcheck`: 64/64 markers alive + mapping still WRITABLE after the
  mapped buffer was kmem_free'd (orphaned-page alias).
- hardened race: `catches=0` (the in-window dangling resolution was not
  caught; see VERDICT.md for the full attempt accounting).