# Fix validation — DF-5287 (combined kernel with DF-5288 fix)

## Baseline (unpatched `with-src` kernel)

| check | result |
|---|---|
| `./df5287 3000` (read side) | `EIO after 2938 iterations` — endpoint refcount exhausted; `vmstat -m` USB 16→331 allocs / 19.8K→1.10M; permanent EIO on re-run at iteration 0 |
| `./df5287c` (write side, usb-storage bulk-OUT) | M_USB 34.3K → 1.24M before the run was stopped (`run.3.log`, `mem_after.txt`) |

## Patched kernel (`fix.diff`: `flag_setup_busy` guard in
`ugen_transfer_setup()` + fifo buffer swap under `priv_lock`)

Kernel: same validated build as DF-5288 (`#1: Fri Oct 2 05:05:50 UTC 2026`,
BUILD_RC=0/INSTALL_RC=0).

| check | result |
|---|---|
| `./df5287 3000` | **`no EIO after 3000 iterations`, rc=0** (`run.patched.log`) — endpoint never locks out |
| `vmstat -m` across the run | USB allocation count **flat: 270 → 270** (32.0K total requests; ~3000 additional open/setup/close cycles added zero leaked allocations). The small MemUse delta (844K→908K) with a flat count is transient churn of the 256-slot delayed-free ring, not permanent orphans — compare the unpatched run where the *count* grew without bound and the endpoint died. |
| read()/write() functional | PoC threads performed 4 non-blocking reads per open × 3000 opens with no spurious EIO/EBUSY beyond the race marker; guest stayed up throughout |