{
  "finding_id": "DF-5693",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Kernel-only lazy-init race, third instance of the broken-once class: _PROP_ONCE_RUN compiled for the kernel (prop_object_impl.h:302-303) is a cmpset-once with no completion barrier, and prop_bool has NO boot-time consumer (zero references outside libprop), so the cmpset window is live at the first-ever <true/>/<false/> internalize (e.g. a dm ioctl plist) \u2014 attacker-chosen timing on MP. A loser of the cmpset runs the _prop_bool_alloc body (prop_bool.c:132-135) against singletons whose po_type/pb_value may not be stored; if the winner is stalled, later loser reads observe po_type==NULL (guard lies, prop_object_release NULL-deref panic at prop_object.c:1085), a typed object with stale pb_value (prop_bool_true()==false for the TRUE singleton), or a refcount reset that underflows in-flight releases (KKASSERT panic on INVARIANTS). The guest kernel was NOT crashed: the once-flag is one-shot per boot and only ~ns wide, so each attempt costs a reboot (hundreds expected \u2014 infeasible; same classification as DF-5681). The differential rig (guest /usr/src/sys/libprop, md5-identical to the audited tree, userland once swapped for a faithful kernel cmpset-once port) proves it deterministically with a widened window (5/5 per mid-init state: violations, refcount asserts, SIGSEGV) and \u2014 after fixing a getenv self-widening rig artifact \u2014 at REALISTIC init length too: 4/300 anomalies, stable across two 300-process batteries (KVM vCPU preemption; bare-metal rate far lower). Control (stock pthread_once) 5/5 survive; fix emulation (SYSINIT bootstrap) 5/5 survive with the window still widened. Low: one-shot-per-boot ns window, panic-or-lying-bool ceiling, no write primitive.",
  "exploit_chain": "",
  "evidence": "run.log: === 2 VIOLATION[A:po_type=NULL] x5 runs exit=134/139; === 3 VIOLATION[B:value=stale] x5; === 4 release flavor exit=139 x5; === 5 fix runs exit=0 x5; === 6 tally survived=296 violations=1 signals=3 (of 300); run.2.log same 296/1/3; run.first-attempt.log documents the getenv self-widening artifact (bogus 89/300) and why the constructor knob-read replaced it; build.log md5 identity prop_bool.c=1cc7afbc..., prop_object_impl.h=92553511...; VERDICT.md has the full state machine and the pass-2 checklist negatives.",
  "kernel_refs": [
    "sys/libprop/prop_bool.c:40-41",
    "sys/libprop/prop_bool.c:109-136",
    "sys/libprop/prop_bool.c:111-124",
    "sys/libprop/prop_bool.c:132-135",
    "sys/libprop/prop_bool.c:64-74",
    "sys/libprop/prop_object_impl.h:302-303",
    "sys/libprop/prop_object_impl.h:428-430",
    "sys/libprop/prop_object.c:86-93",
    "sys/libprop/prop_object.c:987-994",
    "sys/libprop/prop_object.c:1065-1097",
    "sys/libprop/prop_object.c:647",
    "sys/dev/disk/dm/device-mapper.c"
  ],
  "poc_changes": "Authored fresh (no seed): race_bool.c 8-thread first-use harness with check/release/warmup modes; ksem_object_impl.h = stock header with the userland pthread_once branch swapped for a faithful port of the kernel cmpset-once (volatile int + __sync_bool_compare_and_swap, flag set before f()); ksem_bool.c = stock prop_bool.c plus constructor-read PROP_WIDEN_MS/PROP_WIDEN2_MS usleep knobs inside _prop_bool_init (instrumentation only; an earlier getenv-inside-init draft self-widened the realistic window and was replaced \u2014 see run.first-attempt.log).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "sh /tmp/build.sh  (cc -O2 -fPIC -I. -I/usr/src/sys each .c of two /usr/src/sys/libprop copies; link race_bool, race_bool_ksem with rpath)",
  "run_cmd": "sh /tmp/run.sh  (6-section battery: control x5, ksem stateA x5, stateB x5, release x5, fix-emulation x5, realistic-window 300 spawns)",
  "code_hash": "bf786826c1058a681ba5e53540f30fa192affd934a5ed5f25f13045626457f71",
  "notes": "Pass-2 checklist negatives (clean): (a) internalize tag laxity \u2014 <true attr/>/<true></true> rejected at prop_bool.c:210-212 with *obj left NULL (pre-init at prop_object.c:647); dict continue (prop_dictionary.c:1285-1301) and array continue (prop_array.c:807-811) both handle the NULL child gracefully (whole-parse rejection, no leak/deref); the :217 _PROP_ASSERT is unfalsifiable via the exact-match internalizer table (prop_object.c:596-597,631-638). (b) type guards present on all accessors (prop_bool.c:158,177,190) \u2014 the DF-2229/DF-5682 class does NOT recur here. (c) over-release self-heals (statics never freed, prop_bool.c:64-74); emergency-path first-iteration NULL-parent is DF-5677 (prop_object.c) and bool only reaches it as a leaf with parent!=NULL. (d) externalize bounded (prop_object.c:147-170). Kernel reachability: no in-tree plist schema uses bools (zero prop_dictionary_get_bool callers), dm is the arbitrary-echo conduit but /dev/mapper is not loaded on this guest. Family consistency: DF-2225/DF-5681 same class both Low.",
  "recommended_fix": "Bootstrap the lazy init single-threaded at SI_SUB_PROP via a #ifdef _KERNEL-guarded SYSINIT so the cmpset-once can never race first use (see fix.diff); the macro-level fix (real completion semantics for kernel _PROP_ONCE_RUN) belongs upstream.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Rig-level fix validation: baseline (kernel once-macro semantics) violates 5/5 per mid-init state and SIGSEGVs on the release flavor; fix emulation (once completed before first concurrent use = exactly the SYSINIT(SI_SUB_PROP) bootstrap of fix.diff) survives 5/5 with the window still artificially widened. Single-fix kernel rebuild not performed: no kernel memory-corruption reproduction gates it, and the fixs ordering guarantee (consumers run after SI_SUB_PROP) is the same in-tree guarantee existing proplib SYSINITs rely on. fix.diff additionally #ifdef _KERNEL-guards the SYSINIT so the shared userland libprop build (same file, -D_LIBPROP) keeps compiling.",
  "fix_evidence": "run.log === 5. fix emulation runs 1-5 exit=0 with SURVIVED: both singletons typed, values correct vs === 2/3/4 baseline runs exit=134/139; fix.diff adds the guarded SYSINIT(prop_bool, SI_SUB_PROP, SI_ORDER_ANY) bootstrap to sys/libprop/prop_bool.c."
}