# DF-5162 — bktr_mem stored-address registry goes stale across METEORSETGEO grow → write-after-free on driver reload

**PoC verdict: not_reproduced on audit guest (no Bt848 hardware) — defect
certain at source level.**

## Reproduce (on hardware)

```
cc -O2 -Wall -o grow_stale grow_stale.c     # build.sh
./grow_stale                                # unprivileged: METEORSETGEO grow
sudo sh reload_stale.sh                     # root: kldunload bktr; kldload bktr
```

## Expected (on hardware)

- `grow_stale` prints that the grow ioctl was accepted — the bktr_mem
  registry for unit 0 now holds a `kmem_free()`d KVA in `BKTR_MEM_BUF`.
- After reload, `common_bktr_attach()` reinstalls that pointer and executes
  `bzero(bigbuf, 3.5 MB)` on freed KVA (bktr_core.c:429-432); any capture
  then DMAs into it. Watch dmesg for the re-attach buffer line
  (`buffer size ... addr 0x...` — the address equals the *old* freed one,
  not a fresh contigmalloc), then start streaming and observe corruption of
  whatever kernel objects were reallocated into the range (typically panic
  or silent data corruption).

## What was run here

Guest DragonFly 6.5-DEVELOPMENT X86_64_GENERIC: build OK; run blocked at
`open(/dev/bktr0): ENOENT` — no Brooktree PCI device in QEMU
(see `env.txt`). See `VERDICT.md` for the full source-level proof with
`path:line` citations and the fix (`fix.diff`).