{
  "finding_id": "DF-5594",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Trace-verified only. cam_devqs refcount counts sims alone (cam_devq_reference called only from cam_sim_alloc, cam_sim.c:185); devices are queued into devq->alloc_queue/send_queue without references, and cam_sim_release() (cam_sim.c:247-250) destroys the devq at last-sim-ref even though xpt_bus_deregister() explicitly proceeds after 5 drain retries with qinfo entries still queued (cam_xpt.c:4439-4446). The code contradicts its own comment (cam_sim.c:236-240). Downstream: devices keep pinfo.index pointing into freed arrays -> panic(Removing device while still queued for ccbs) at cam_xpt.c:5199-5205 (local DoS), plus freed devq arrays holding live cam_ed pointers (latent UAF surface, currently unwalked post-retarget because dead_sim.devq==NULL). Live corroboration: the DF-5592 rigs real deregistration flow printed cam_devq_release: WARNING active allocations 8 active send 8! (release with active I/O -- the DF-5552 class firing through cam_sim.cs release ordering). Not dynamically PoCd: needs a device stuck queued-for-ccbs at detach (DF-5550s corruption state or frozen alloc queue).",
  "exploit_chain": "",
  "evidence": "README.md (full path:line trace); DF-5592 panic.txt/run.log (captured cam_devq_release: WARNING active allocations 8 active send 8! during a real deregistration)",
  "kernel_refs": [
    "sys/bus/cam/cam_sim.c:236-256",
    "sys/bus/cam/cam_sim.c:183-185",
    "sys/bus/cam/cam_queue.c:247-257",
    "sys/bus/cam/cam_xpt.c:4433-4446",
    "sys/bus/cam/cam_xpt.c:5199-5216"
  ],
  "poc_changes": "no standalone PoC built (trace-only); the DF-5592 rigs deregistration flow supplied the live warning-line corroboration",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Sibling provenance for DF-5552s non-atomic/warn-and-free class, now with the exact cam_sim.c release-ordering root cause; realistic producers are detach-under-load, frozen alloc queues, and the DF-5550 drvq corruption state",
  "recommended_fix": "Have devices hold a devq reference while their alloc/send qinfo entries are queued (drop in xpt_release_devices guarded branch), or make cam_devq_release refuse the final free while alloc_queue.entries/send_queue.entries are non-zero, mirroring xpt_release_devices guard instead of a kprintf",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not validated (no dynamic repro in this run)",
  "fix_evidence": ""
}