{
  "finding_id": "DF-5109",
  "status": "reproduced",
  "verdict": "reproduced (panic, 2/2 runs: panic: BADFREE2, full intact trace _kfree<-_kfree<-mapped_ioctl<-syscall2, guest wedged in DDB; run2 fired in 3-6s with 6 racers). Confidence certain the race kills the kernel; likely on the exact pid-recursion arm (attribution caveat recorded in VERDICT.md - the warning line was not captured on the flooded console).",
  "reproduced": true,
  "impact": "panic",
  "confidence": "likely",
  "exploit_chain": "root process issues VINUM_DAEMON (daemon runs in issuers process) then races VINUM_SETSTATE(down)+VINUM_REMOVE(force) against VINUM_CREATE(force-up)+label rewrite on the same drive: lockdrive()s pid check admits any same-process thread while the section sleeps in vn_close (MP token dropped, VF_LOCKED still set) -> concurrent close_locked_drive() executions -> double vn_close (vnode refcount underflow) and double/stale Free(drive->freelist) -> BADFREE2 double-free panic.",
  "evidence": "panic.txt (run2 full trace), VERDICT.md (runs 1+2, static chain, attribution caveat), lockdrive_recursion.c, setup.sh, fix.diff",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumlock.c:59",
    "sys/dev/raid/vinum/vinumlock.c:87",
    "sys/dev/raid/vinum/vinumioctl.c:296",
    "sys/dev/raid/vinum/vinumio.c:205",
    "sys/dev/raid/vinum/vinumio.c:216",
    "sys/dev/raid/vinum/vinumconfig.c:576",
    "sys/dev/raid/vinum/vinumio.c:648"
  ],
  "poc_changes": "PoC races several ioctls at once (the only way to keep drives cycling through the section); unconditional already locking warning not captured pre-panic - honest attribution caveat in VERDICT.md",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 150,
  "guest_dirty": 1,
  "build_cmd": "sh build.sh; sh setup.sh",
  "run_cmd": "./lockdrive_recursion 60 6",
  "code_hash": "",
  "notes": "Interrupted reviewer - verdict.json reconstructed by orchestrator from VERDICT.md+manifest.json+panic.txt. Guest left down; reset required.",
  "recommended_fix": "remove the pid-based recursion early-return (all callers wait), crit sections around the flag RMWs, == to >= fullness checks (fix.diff shared with DF-5108)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to guest /usr/src, kernel rebuilt and booted; the identical PoC re-run was in progress when the reviewer run was interrupted - the patched-run capture is absent from the pack, so fix validation is honestly recorded as inconclusive rather than claimed.",
  "fix_evidence": "fix.diff; rebuilt-kernel boot noted in VERDICT.md; patched-run log not captured (interrupt)"
}