{
  "finding_id": "DF-5171",
  "title": "vcdstrategy() panics on BUF_CMD_FLUSH/BUF_CMD_FREEBLKS - guest-root HAMMER mount on a vcd device kills the vkernel",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh (inside guest, as root; builds VKERNEL64 with two documented test-enablers, the static PoC and the images)",
    "run": "sh run.sh (boots vkernel64 -m 256M -r root.img -c hammer.img -e init_path=/poc)",
    "expected": "baseline: 'panic: vcd: bad b_cmd 5' ~3s after boot, mount(2) never returns; with fix.diff applied: 'mount(hammer) returned OK' + 'RESULT: no-panic (STILL ALIVE after 15s)'"
  },
  "kernel_refs": [
    "sys/dev/virtual/vkernel/cdrom/vcd.c:154",
    "sys/dev/virtual/vkernel/cdrom/vcd.c:165",
    "sys/vfs/hammer/hammer_io.c:1985",
    "sys/vfs/hammer/hammer_flusher.c:784",
    "sys/kern/subr_diskslice.c:91",
    "sys/dev/virtual/vkernel/disk/vdisk.c:332"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "vcd_flush_poc.c", "vcd_trim_poc.c", "odcat.c",
    "guest_prep.sh", "build.sh", "run.sh", "build.log", "fix_build.log",
    "run.log", "fix_run.log", "panic.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json", "hashes.txt"
  ]
}