# DF-5191 — sio_pccard_detach races the sio core without tty_token (UAF / double-free)

## Verdict in one line

`sys/dev/serial/sio/sio_pccard.c:117-143` — `sio_pccard_detach()` sets
`com->gone`, calls `ttyclose(com->tp)` and frees `com->ibuf` **without taking
`tty_token`**, the exact token every sio-core path holds while touching those
fields (`sioopen` sio.c:1273/1277, `sioclose` sio.c:1460/1475-1482,
`siosetwater` sio.c:2446). Card eject (or `pccardc power off` / `kldunload`)
racing an open/close in flight double-frees `com->ibuf` (M_DEVBUF) or
double-executes the tty close sequence. **Medium / likely / CWE-362 →
CWE-415/CWE-416.**

## Reproduce

**Cannot run on the audit guest** (QEMU i440fx: no PCMCIA bridge, no `pccard`
in dmesg.boot; `sio_pccard.c` is `optional sio pccard`). On hardware, or on
any DragonFly system with a pccard serial device:

```
cc -O2 -o race_harness race_harness.c
./race_harness /dev/ttyd0 &          # unprivileged
# as root, repeatedly:
pccardc power off 0 ; sleep 1 ; pccardc power on 0
```

Success criterion: kernel panic or M_DEVBUF double-free diagnostics.

## Contents

* `VERDICT.md` — four concrete interleavings (detach∥close double-free,
  detach∥open UAF+double-free, duplicated ttyclose/clist free, ibufold UAF),
  relationship to DF-2191 / DF-3902, why isa/pci/puc sio are unaffected
  (they have no detach method at all)
* `race_harness.c` — illustrative trigger harness (not runnable on guest)
* `fix.diff` — token + drain + NULL-out fix (coordinates DF-2191/DF-3902)
* `verdict.json` / `manifest.json`