{
  "finding_id": "DF-4671",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED as a fault-time race on this rig. The TOCTOU is source-proven (device pager re-executes d_mmap on first fault of each page index, device_pager.c:348-390; bktr_mmap reads alloc_pages/bigbuf unlocked at bktr_os.c:680/683; the grow block frees and reassigns bigbuf with no lock at bktr_core.c:1669-1672; the bare kmem_free performs no pmap_remove for the object-less entry, vm_map.c:3300-3370, so stale PTEs resolve throughout the window), but across 12+ hardened runs (~1,700 kernel-verified grow windows, ~10^4 genuine first-fault d_mmap executions, 1-2 growers incl. kernel_map-contention dual-grower, 1-4 faulters over 8 cdevs with fresh pager objects) no dangling resolution was caught: the window is empirically sub-microsecond. Two measurement discoveries are documented: (1) the old-style device pagers fake-page cache SURVIVES munmap (--seqcheck: 64/64 stale markers re-served with zero concurrency), so d_mmap re-query happens only on first fault of a pindex -- this both disproved naive rigs (464 false catches disqualified) and narrows the findings premise; (2) a HELD mapping stays a live RW alias onto the orphaned pages after the grow frees the buffer beneath it (--holdcheck: 64/64 markers alive, still writable, deterministic, race-free) -- the same missing buffer-lifetime root cause, demonstrated without the race.",
  "exploit_chain": "",
  "evidence": "run.log (consolidated): race11.log/race12.log zero catches under the final protocol; race2/race3 logs show the 464 disqualified pager-cache artifacts; seqcheck + holdcheck transcripts in run.log; race_diag.log per-grow KVA/PA traces proving buffer churn and KVA reuse (stale-PTE window mechanics).",
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_os.c:656",
    "sys/dev/video/bktr/bktr_os.c:680",
    "sys/dev/video/bktr/bktr_os.c:683",
    "sys/dev/video/bktr/bktr_core.c:1669",
    "sys/dev/video/bktr/bktr_core.c:1672",
    "sys/vm/device_pager.c:348",
    "sys/vm/device_pager.c:360",
    "sys/vm/vm_map.c:3300",
    "sys/vm/vm_kern.c:311"
  ],
  "poc_changes": "Complete rewrite of the seed: rig device path; per-run nonces; kernel-truth generation counters (SETGEO returns success without growing unless strictly larger -- fixed); never-faulted pindex groups only (8 cdevs for fresh pager objects after proving the fake-page cache survives munmap); marker generations sampled after faults making catches false-positive-proof; single/dual grower + 1-4 faulters; plus --seqcheck/--holdcheck diagnostic modes.",
  "attempts": 12,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (baseline) / #0: Thu Oct 15 00:54:24 UTC 2026 DF467XFIX (fix)",
  "runtime_sec": 7200,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -pthread -o poc_race poc_race.c",
  "run_cmd": "./run.sh  (--seqcheck, --holdcheck, then ./poc_race 300 as maxx)",
  "code_hash": "9ce33da61d8b3fe1a5043cac577fc619fe77596aa260a1d4c1f591a4e44e611f",
  "notes": "INCIDENTAL OBSERVATIONS (verdict notes only, not new findings): (a) device-pager fake-page cache survives munmap on this kernel -- cached phys_addr is re-served indefinitely with no d_mmap re-query and no lifetime tie to the drivers buffer; held mappings therefore alias orphaned (stock) or freed-and-reused (fixed) pages -- poc_race --holdcheck on the FIXED kernel shows the mapping still writable over pages that have already been recycled into other allocations, which is a real residual hazard for every old-style d_mmap driver, recommend a follow-up audit item; (b) vm_mmap.c:368-371 denies PROT_WRITE without FWRITE on VCHR mappings, so the findings RW alias ceiling requires a writable-open node -- real /dev/bktr0 is 0444, limiting unpriv users to read-only dangling disclosure; (c) per-fault re-query only on first fault per pindex per cdev lifetime.",
  "recommended_fix": "Serialize the grow block against bktr_mmap (consistent sampling + install-before-free + vtophys==0 fail-closed as in fix.diff; complete fix needs pager-referenced buffer lifetimes).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "The race itself never reproduced on the baseline, so no behavioral A/B of the race is possible; fix.diffs bktr_mmap hardening and the shared grow-block fixes were built and boot-validated on the DF467XFIX kernel (fix_build.log, fix_run.log in the DF-4672/4673 packs), and the fixed bktr_mmap compiles and serves mappings normally (4672/4673 A/B exercised the same grow+mmap paths)."
}