# DF-5094 — vinum: unbounded daemon instantiation + pid-blind abdication
## (multi-consumer double-free hypothesis REFUTED by MP-token serialization)

## Build / Run (root on the DragonFly guest)

```
kldload vinum
cc -O2 -pthread -o /tmp/df5094 /tmp/df5094_multidaemon.c   # = build.sh
/tmp/df5094 90                                              # = run.sh
```

## What to expect

* **Corruption hypothesis (double Free of one daemonq element by two concurrent
  daemons): does NOT reproduce.** Two runs pushed 27,798,967 + 18,707,189
  elements through 3 concurrent daemon threads; no panic, no slab messages,
  guest healthy. Root cause of the refutation: `vinum_ops` is not
  `D_MPSAFE`, so every vinum ioctl (including the whole `vinum_daemon()` loop)
  runs under the MP token (`kern_device.c:570-577`), and every daemonq producer
  holds the same token — the queue is fully serialized despite the crit-only
  guard. See VERDICT.md.
* **Residual defect (reproduces):** N daemons run concurrently (abdication at
  `vinumdaemon.c:83` is pid-based; same-process threads are never ousted, and a
  busy daemon never re-checks); the daemon threads park in a non-PCATCH
  `tsleep`, so after the producers stop the process **survives `kill -9`**
  (D-state), and the module cannot be unloaded.

## Files
`df5094_multidaemon.c` — 3 daemon threads (VINUM_DAEMON ioctl) + 4 producer
threads (VINUM_SAVECONFIG ioctl storm). `run.log`/`run.2.log` — decisive runs.
`threadstate.txt` — live wchan capture (2× `vinum`, 1× `mp_token`) + kill -9.
`dmesg.txt`, `env.txt`, `build.log` — environment and compiler evidence.