# DF-5116 evidence pack

**Finding:** `dcons_crom_detach` (dcons_crom.c:196) clears `post_busreset`
with no synchronization against `fw_busreset`'s dispatch loop
(firewire.c:652-658), which runs in the fwohci interrupt handler on every
physical bus reset (fwohci.c:1798). DragonFly has no DS_DETACHING state, so a
mid-detach child still passes the `>= DS_ATTACHED` guard; a dispatch that has
already loaded the non-NULL pointer proceeds to call
`dcons_crom_post_busreset` on a softc freed by the completed detach/unload →
interrupt-context UAF write (`bzero(&sc->unit)` + `crom_add_*` stores).

**Status: untested** — needs FireWire hardware and a won race; the audit
guest has no OHCI controller (`env.txt`).

## Contents

- `VERDICT.md` — full interleaving trace and family notes (sbp twin)
- `trigger.sh` — hardware-gated unload/reload vs bus-reset hammer
- `env.txt` — live guest proof of FireWire absence
- `fix.diff` — fw-core dispatch reference count + detach drain
  (firewirereg.h / firewire.c / dcons_crom.c), authored statically

## Reproduce (on real hardware only)

```sh
sh trigger.sh     # + generate bus resets (cable events) during the loop
```

Success criterion: panic with `dcons_crom_post_busreset` / `crom_add_*` in the
backtrace while `dcons_crom.ko` is unloaded.