{
  "finding_id": "DF-4751",
  "verdict": "reproduced",
  "impact": "panic",
  "severity": "Low",
  "confidence": "certain",
  "summary": "dm_modcmd(MOD_UNLOAD) checks dm_dev_counter without a lock (admitted 'race window here' comment) and tears down the module while create ioctls may still be in flight; compounding at the framework level, dev_dioctl dispatches through dev->si_ops with no ops/module reference and destroy_dev()'s dead_dev_ops revector is asynchronous, so a NETBSD_DM_IOCTL already executing dmioctl runs in module text freed by the linker — Fatal trap 12 (four signatures captured, incl. inside dmioctl+0x2bf with a sync_devs()-augmented fix installed).",
  "reproduce": {
    "build": "cc -O -Wall -o /tmp/dm_unloadrace dm_unloadrace.c -lprop -lpthread",
    "run": "kldload dm; /tmp/dm_unloadrace 30",
    "expected": "kernel Fatal trap 12 within ~30-60s (dev_dioctl+0x1b / IP=0x0 / freed-text / dmioctl+0x2bf); console shows 'malloc_uninit: 1984 bytes of dm still allocated'; guest down at db> prompt."
  },
  "kernel_refs": [
    "sys/dev/disk/dm/device-mapper.c:154",
    "sys/dev/disk/dm/device-mapper.c:161",
    "sys/dev/disk/dm/device-mapper.c:163",
    "sys/dev/disk/dm/device-mapper.c:190",
    "sys/dev/disk/dm/device-mapper.c:241",
    "sys/dev/disk/dm/dm_dev.c:193",
    "sys/kern/kern_device.c:237",
    "sys/kern/kern_device.c:258",
    "sys/vfs/devfs/devfs_core.c:759"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dm_unloadrace.c", "build.sh", "run.sh",
    "run.log", "panic.txt", "env.txt", "fix.diff", "fix_build.log",
    "manifest.json", "verdict.json"
  ]
}