{
  "finding_id": "DF-5592",
  "title": "cam_sim freed while pending in the camisr completion softint (UAF: write + function-pointer dispatch from freed object)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh   (in guest /root/df5592; builds ptsim3/ptsim3.ko)",
    "run": "kldload ./ptsim3/ptsim3.ko; sleep 2; sysctl debug.ptsim3.go=1   # =2 panic, =4 fix-check",
    "expected": "mode 1: '*** UAF CONFIRMED: kernel ran a completion callback out of a cam_sim chunk that cam_sim_free() had already kfree()'d ***'; mode 2: [Stopped at camisr_runqueue+0x53] DDB/fatal trap; mode 4 on fixed kernel: chunk refcount reads 1 after cam_sim_free (pin held), marker fires with sim valid"
  },
  "kernel_refs": [
    "sys/bus/cam/cam_sim.c:241-256",
    "sys/bus/cam/cam_xpt.c:4891-4926",
    "sys/bus/cam/cam_xpt.c:7389-7407",
    "sys/bus/cam/cam_xpt.c:7506",
    "sys/dev/disk/ahci/ahci_cam.c:210-227"
  ],
  "artifacts": [
    "ptsim3.c", "build.sh", "run.sh", "build.log", "run.log",
    "panic.txt", "fix.diff", "fix_build.log", "fix_run.log",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json", "env.txt"
  ]
}