{
  "finding_id": "DF-4721",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "launch_requests() (vinumrequest.c:395-440) continues iterating after an inline (md) completion has run complete_rqe()->complete_raid5_write()->freerq() and freed the whole request: trailing skipped XFR_BAD_SUBDISK entries make the loop read rqe->flags from freed memory and rqg->next from the freed group header (kmalloc freelist pointer) -> wild pointer dereference. Reached by the ORDINARY degraded RAID-5 write (single down data subdisk; trailing bad rqe is the standard layout); reproduced 2/2 with identical Fatal-trap-12 signature at launch_requests+0xc2. This is the previously-unidentified arm of the DF-4482 UAF cluster (their patched kernels still panicked; this arm needs no revive/waitlist). Patched kernel: degraded write completes correctly, no panic.",
  "exploit_chain": "root: RAID-5 vinum volume on md-backed drives with one data subdisk down; unprivileged: any single write() spanning both data columns of a stripe (e.g. filesystem I/O on the mounted volume) -> inline completion frees the request mid-launch -> launch_requests dereferences freed/garbage pointers -> kernel panic",
  "evidence": "panic.txt (Fatal trap 12, launch_requests+0xc2, designed-degraded run); ../DF-4714/panic.txt (same signature via DF-4714-B); run.patched.log step 3 (fixed: write OK, readback matches, no panic)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumrequest.c:399",
    "sys/dev/raid/vinum/vinumrequest.c:408",
    "sys/dev/raid/vinum/vinumrequest.c:436",
    "sys/dev/raid/vinum/vinuminterrupt.c:211",
    "sys/dev/raid/vinum/vinuminterrupt.c:240"
  ],
  "poc_changes": "no seeded PoC; trigger.c written from scratch (single 32KB write, distinct per-block patterns)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT (baseline #0 Thu Jul 2 / patched #1 Wed Sep 23 01:37:18 UTC 2026) x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 0,
  "build_cmd": "fix build: cd /usr/src && git apply fix.diff (plus DF-4714 fix) && make -j8 nativekernel KERNCONF=X86_64_GENERIC && make installkernel && reboot",
  "run_cmd": "sh ../DF-4714/setup_vinum.sh && vinum setstate -f down rv.p0.s2 && ./trigger",
  "code_hash": "5776d4f8c71a00624dde8e21ed7ce6828e5c9504aff79ac7bd8949a71f8ac876",
  "notes": "discovered during the vinumraid5.c pass-2 while verifying DF-4714 (the badsdno overwrite produces the same trailing-bad layout); root cause lives in vinumrequest.c. DF-4482 cross-reference: their fix attempts did not stop panics - this is the waitlist-independent arm.",
  "recommended_fix": "snapshot rqg->next before any I/O and bound the launch loop to the last non-BAD rqe so no group memory is read after an inline completion can free it (fix.diff, validated)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "patched kernel: the designed degraded write completes with correct readback and no panic; DF-4714s panicking trigger gets a clean EIO - run.patched.log steps 3,4",
  "fix_evidence": "run.patched.log"
}