{
  "finding_id": "DF-4830",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "SMP race, low impact: sc->unit = mdunits++ at md.c:410 has no global lock - the per-unit token serializes nothing global, and mdopens auto-create (:135-136) is the only multi-threaded caller. Two CPUs opening the top unit can both read mdunits==N, minting two md_s with the same unit/cdev name (devfs never dedups), duplicate devstat entries, and later double dispose of the shared name/minor space at cleanup. Operator-group trigger (open only), tiny window, uncertain downstream - Low. The growth aspect of auto-create was re-confirmed live on the guest (opening /dev/md0 created md1). Distinct from DF-2477/2478. Serialize-creation fix.",
  "exploit_chain": "N processes on separate CPUs loop open(/dev/md<TOP>) -> duplicate-named units -> devstat duplication and double dispose at cleanup",
  "evidence": "findings/poc/DF-4830/ (this verdict)",
  "kernel_refs": [
    "sys/dev/disk/md/md.c:410",
    "sys/dev/disk/md/md.c:135-136"
  ],
  "guest_uname": "",
  "code_hash": ""
}