{
  "finding_id": "DF-4759",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Analysis-only. vinums MOD_UNLOAD decides it may free the entire configuration via two unsynchronized heuristics (vinum_inactive TOCTOU vs vinumopen; the state > volume_down gap that skips open-but-down volumes; boolean VF_OPEN/VF_DAEMONOPEN flags instead of refcounts), then frees DRIVE/SD/PLEX/VOL and bzeros vinum_conf with no lock held for the duration -- a UAF-class teardown window. Not guest-verified: both racing parties are privileged (kldunload = root; volume nodes 0640 root:operator) and the interleaving is nondeterministic; the same unlocked-teardown class was guest-confirmed by sibling DF-4478.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4759/README.md (code-cited gaps; no guest artifacts)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinum.c:171-189",
    "sys/dev/raid/vinum/vinum.c:295-358",
    "sys/dev/raid/vinum/vinum.c:198-259",
    "sys/dev/raid/vinum/vinum.c:372-476"
  ],
  "poc_changes": "none (no PoC attempted; race requires privileged parties)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: no unprivileged entry. Fix is structural: hold lock_config across the unload decision + teardown, lock vinumopens state-test+flag-set, and stop treating boolean flags as refcounts.",
  "recommended_fix": "Serialize MOD_UNLOAD teardown with lock_config(), fix the state>volume_down open-check gap, and replace boolean VF_OPEN/VF_DAEMONOPEN open-flags with per-object open refcounts",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not tested (finding not guest-reproduced; fix is structural and cited in README)",
  "fix_evidence": ""
}