{
  "finding_id": "DF-5420",
  "status": "not_reproduced",
  "verdict": "Pass-2 finding on the pmap_inval.c invalidation engine: the single-cpu shortcut in pmap_inval_smp()/pmap_inval_smp_cmpset() samples pmap->pm_active BEFORE acquiring (or without acquiring) the CPULOCK_EXCL interlock, the mask source pm_active is not a sound no-live-TLB indicator (descheduled cpus keep TLB state until a reactivation %cr3 reload the engine does not enforce), and the originator returns after clearing only its own done bit while targets trailing invlpgs are still outstanding. The unprivileged rig reproduces phantom TLB accesses (successful user load of a va whose PTE is provably 0; kernel copyin EFAULTs; phantom dies at the first syscall) at 0.2-18/min on the QEMU/KVM guest, but kernel-level branch instrumentation shows the full-path state machine executing correctly, and the phenomenon SURVIVES shortcut-disabled, all-cpu-broadcast, and a fix kernel that drains every target done bit before munmap returns \u2014 an outcome architecturally impossible on real hardware. The residual signal is therefore attributed to the virtualization layer (QEMU 7.2/KVM virtual TLB dropping guest invlpg/mov-cr3 flush effects; host uninspectable without root). The three source-level ordering flaws remain real (protocol-construction proof for the shortcut TOCTOU) but were not demonstrable above the artifact noise floor; severity downgraded to hardening-class Medium.",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "exploit_chain": "",
  "evidence": "run.base.log (18 hits/60s stock unpriv), run.ctrl.log / run.ctrl2.log (hits persist with shortcut disabled and with all-cpu broadcast), rootprobe.log (root-pinned hits), run.probe4.log + rootinstr.log (frozen probe: kernel copyin -1/EFAULT while user read succeeds; phantom gone after one syscall), instrument_ring_hit.txt (kernel ring: full-path command completing correctly on both cpus; last command before dump = shortcut with pm_active={cpu0}), fixrun1.log (185 hits/180s on the exhaustion fix kernel), VERDICT.md (full attribution narrative)",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/pmap_inval.c:282",
    "sys/platform/pc64/x86_64/pmap_inval.c:289",
    "sys/platform/pc64/x86_64/pmap_inval.c:374",
    "sys/platform/pc64/x86_64/pmap_inval.c:418",
    "sys/platform/pc64/x86_64/pmap_inval.c:427",
    "sys/platform/pc64/x86_64/pmap_inval.c:460",
    "sys/platform/pc64/x86_64/pmap_inval.c:524",
    "sys/platform/pc64/x86_64/pmap_inval.c:552",
    "sys/platform/pc64/x86_64/swtch.s:408",
    "sys/platform/pc64/x86_64/swtch.s:445"
  ],
  "poc_changes": "Evolved the seed rig through: correct DFly cpumask size (32-byte for usched_set), Q stretcher initial-map fix, freeze-in-unmapped-hold probe, kernel-side ring dump via sysctl at hit time, dual false-positive-proof detectors (phase-bracketed load + magic comparison). The orchestrator seeds syscall numbers were N/A (pure userland rig).",
  "attempts": 14,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 760,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o stale_tlb_race stale_tlb_race.c",
  "run_cmd": "./stale_tlb_race 60 1   (plus pinned/control/instrumented/fix variants; see run.sh and logs)",
  "code_hash": "1610fd6d92249364b3ee94a68125424f6430c8a7905a73e32d0edd1b8cd2ca76",
  "notes": "Guest reset to clean with-src snapshot after the run (guest_dirty=0). Instrumented and fix kernels were built on-guest via make -j6 nativekernel KERNCONF=X86_64_GENERIC (rc=0) and booted (kernels #2/#3/#4); /tmp build logs were lost at reboot but builds were observed rc=0 and kernels booted and are reflected in env.txt/boot.log. DF-1061 (LOOPRECOVER abandonment) was not re-reported and remains distinct.",
  "recommended_fix": "Hoist pmap_inval_init() before any pm_active sample, drop the single-cpu shortcut for user-pmap PTE-modifying ops, broadcast those to smp_active_mask, and drain target done-bits before returning (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": true,
  "fix_verdict": "fix.diff built and booted (kernel #4). Baseline phantom rate ~12-18/min; under the fix the rate was 185/180s (~1/s, higher). Because the fix guarantees by construction that every active cpu executed invlpg(va) before munmap returned (drain completed; runs did not hang), the surviving entries cannot be kernel misses on real hardware \u2014 fix efficacy is untestable on this guest because the measurable baseline signal itself is dominated by the KVM virtual-TLB artifact. The fix remains the correct hardening for the three source-level legs.",
  "fix_evidence": "fixrun1.log (fixed kernel, 185 hits); compare run.base.log (stock kernel); fix.diff (git apply --check verified against pristine sys/)"
}