{
  "finding_id": "DF-5462",
  "status": "not_reproduced",
  "verdict": "The lockless cam_extend race is proven in code (ptopen/ptclose/ptstrategy/ptioctl read ptperiphs with no lock vs ptctors cam_extend_set kmalloc/bcopy/kfree growth with the sim lock dropped) but did not manifest in ~5 guest boots / ~90+ growth windows / >150M racing opens; the ~1-2 instruction window puts the per-window hit probability at ~0.1-0.3%, consistent with zero observed hits. Run #2 left an unexplained wedge (3 racer children stuck, system-wide exec hang) consistent with a hit landing in cam_periph_lock, but without a stack it is not provable and is not claimed. Root-gated on every path.",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "exploit_chain": "",
  "evidence": "VERDICT.md (interleaving analysis + attempt table); ptsim.c (rig); race5462.c (racer); run.sh; panic.camq-lead.txt (independent camq_remove NULL-deref lead captured mid-experiment); env.txt",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_pt.c:153",
    "sys/bus/cam/scsi/scsi_pt.c:189",
    "sys/bus/cam/scsi/scsi_pt.c:219",
    "sys/bus/cam/scsi/scsi_pt.c:311",
    "sys/bus/cam/scsi/scsi_pt.c:632",
    "sys/bus/cam/cam_extend.c:26",
    "sys/bus/cam/cam_extend.c:54",
    "sys/bus/cam/cam_extend.c:81",
    "sys/bus/cam/cam_periph.c:319"
  ],
  "poc_changes": "PoC authored from scratch for this finding (no seed): fake CAM SIM exposing T_PROCESSOR targets (ptsim.c) because T_PROCESSOR devices do not exist on the guest; batched 8-unit growth choreography after single-scan mass attach tripped an unrelated camq_remove panic; heap-stamper threads to make freed-array reuse visible; racer with shared-memory stats and console heartbeat. Required building a custom guest kernel (EVILPT = X86_64_GENERIC + device pt) because device pt is not in GENERIC.",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Mon Oct  5 22:30:30 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/EVILPT  x86_64",
  "runtime_sec": 3300,
  "guest_dirty": 1,
  "build_cmd": "in guest: cd /root/poc/DF-5462 && ./build.sh  (KMOD=ptsim + cc race5462.c); kernel: cd /usr/src && make -j6 nativekernel KERNCONF=EVILPT",
  "run_cmd": "in guest as root: cd /root/poc/DF-5462 && STAMPBYTE=65 MAXT=512 BATCHPAUSE=1 ./run.sh",
  "code_hash": "0e2ded60ca2036c55a6125fb08118efc006747b54702be53fa3e42e94261af42",
  "notes": "Fix (cam_extend_lk leaf lock serializing set/get/release) built, installed and growth-smoke-tested clean on the guest (23.1M racing opens under the lock, zero anomalies), but a behavioral A/B was impossible since the baseline never reproduced. Independent lead captured: deterministic camq_remove+0x35 NULL-deref write panic under ~100-160-target attach churn (queue hole/double-remove class, xpt scheduler queue) - see panic.camq-lead.txt. Guest reset performed at end of run.",
  "recommended_fix": "Serialize cam_extend_set/get/release with a leaf lockmgr lock (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Baseline race never reproduced in budget, so no behavioral A/B was possible; the fix kernel built cleanly, booted, attached 64 pt devices through 7 locked growth events under 23.1M racing opens with zero anomalies or deadlocks.",
  "fix_evidence": "fix_build.log (full clean nativekernel build); VERDICT.md fix-validation section; patched smoke run inline in run summary"
}