{
  "finding_id": "DF-5594",
  "title": "devq lifetime anchored to sim refcount despite queued cam_ed slots (freed with entries queued -> panic guard / latent UAF)",
  "verdict": "untested",
  "impact": "none (trace-only; expected dos)",
  "reproduce": {
    "build": "",
    "run": "",
    "expected": "trace-verified; live corroboration line 'cam_devq_release: WARNING active allocations N active send M!' captured in DF-5592's run.log/panic.txt during a real deregistration"
  },
  "kernel_refs": [
    "sys/bus/cam/cam_sim.c:236-256",
    "sys/bus/cam/cam_queue.c:247-257",
    "sys/bus/cam/cam_xpt.c:4433-4446",
    "sys/bus/cam/cam_xpt.c:5199-5216"
  ],
  "artifacts": ["README.md", "verdict.json", "env.txt", "manifest.json"]
}