{
  "finding_id": "DF-5116",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Mechanism is certain in code and the window is wide: dcons_crom.c:196 NULLs sc->fd.post_busreset with no lock, while fw_busreset (firewire.c:652-658, invoked from the fwohci interrupt handler at fwohci.c:1798 on every physical bus reset) snapshots children, passes the >= DS_ATTACHED guard for the whole duration of a concurrent detach (no DS_DETACHING state exists in sys/sys/bus.h:76-82), and makes an unlocked check-then-indirect-call on the same pointer. A dispatch that reads non-NULL before the store proceeds to run dcons_crom_post_busreset (dcons_crom.c:102-122) on softc freed right after dcons_crom_detach returns (module unload deletes the unit): bzero(&sc->unit) at :113 and crom_add_* stores via &sc->spec/&sc->ver at :115-121 become interrupt-context UAF writes into a freed ~100-byte slab - realistically a crash, theoretically groomable corruption. Not reproduced: the audit guest has no OHCI FireWire controller (pciconf/env.txt), so dcons_crom never instantiates and neither side of the race can execute. Root (kldunload) + hardware + race cap severity at Low.",
  "exploit_chain": "requires FireWire hardware + root kldload/kldunload dcons_crom loop racing physical bus resets -> fw_busreset dispatch vs dcons_crom_detach -> post_busreset called on freed softc -> interrupt-context UAF write (panic; heap-groomed corruption theoretical)",
  "evidence": "VERDICT.md (interleaving trace with path:line); env.txt (no class 0x0c0010 device, no /dev/fw*, dcons_crom.ko loads but identify never runs); trigger.sh (hardware-gated race hammer)",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons_crom.c:196",
    "sys/dev/misc/dcons/dcons_crom.c:113",
    "sys/dev/misc/dcons/dcons_crom.c:115",
    "sys/bus/firewire/firewire.c:652",
    "sys/bus/firewire/firewire.c:654",
    "sys/bus/firewire/firewire.c:656",
    "sys/bus/firewire/fwohci.c:1798",
    "sys/sys/bus.h:76"
  ],
  "poc_changes": "n/a - no seed could run: guest lacks FireWire controller; trigger.sh encodes the hardware-gated race hammer instead",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "none",
  "run_cmd": "sh findings/poc/DF-5116/trigger.sh",
  "code_hash": "2888b5ba2f79a0009c9025d8965300ba9f3a5c614e51411a5445aedfdea8d5c4",
  "notes": "status untested per orchestrator enum (hardware absent). Same dispatch race class exists for sbp (sys/dev/disk/sbp/sbp.c:1924 assigns post_busreset and its detach never clears it) - separate file, noted for follow-up, not reported here.",
  "recommended_fix": "Reference-count the fw_busreset child dispatch (fd_cb_ref taken before the post_busreset NULL check) and make dcons_crom_detach clear the callback and drain the refcount before returning.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (firewirereg.h + firewire.c + dcons_crom.c) implements the take-ref-before-check / clear-and-drain pattern; it cannot be build- or race-validated on this guest because no FireWire controller exists to instantiate the dispatch. Authored statically against the read-only sys/ tree; never applied.",
  "fix_evidence": "fix.diff; VERDICT.md failure-interleaving section"
}