{
  "finding_id": "DF-5595",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardening-class, trace-verified. cam_sim_release() (cam_sim.c:246-255) decrements/frees the sim with a plain non-atomic read-compare-decrement and no lock enforcement or documentation, while the acquisition side xpt_bus_register() uses atomic_add_int (cam_xpt.c:4322) and every sibling finalizer (xpt_release_bus 4979-5008, xpt_release_target 5048-5070, xpt_release_device 5192-5232) uses atomic cmpset loops. Unserialized release pairs lose updates (ref leak: sim+devq never freed; or double kfree + double cam_simq_release). In-tree call sites are sim-lock serialized only by per-driver convention. Same class as DF-5552 (devq), one level up. The concrete rewrite is included and validated inside DF-5592s fix.diff (cam_sim_release becomes the atomic cmpset protocol), which is the recommended fix.",
  "exploit_chain": "",
  "evidence": "README.md (code citations); DF-5592 fix.diff (the validated rewrite of cam_sim_release)",
  "kernel_refs": [
    "sys/bus/cam/cam_sim.c:241-256",
    "sys/bus/cam/cam_xpt.c:4322",
    "sys/bus/cam/cam_xpt.c:4979-5008",
    "sys/bus/cam/cam_xpt.c:5192-5232"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Filed as the sim-object analog of DF-5552; subsumed by DF-5592s fix",
  "recommended_fix": "Atomic cmpset release protocol in cam_sim_release() (as implemented and validated in DF-5592s fix.diff)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not separately validated; the rewrite ships inside DF-5592s validated fix.diff",
  "fix_evidence": "DF-5592/fix.diff; DF-5592/fix_run.log"
}