{
  "finding_id": "DF-5729",
  "title": "lwkt_tokref published before initialization: DDB db_dump_td_tokens snapshot walk can deref a stale/NULL tr_tok",
  "verdict": "untested",
  "impact": "none",
  "confidence": "speculative",
  "reproduce": {
    "build": "n/a (source-trace finding)",
    "run": "positive control only: 'ps' in a DDB session walks tokens normally (postfix-run.log of DF-5728)",
    "expected": "window is a few ns wide (lwkt_gettoken: ++td_toks_stop; fence; init); not practically drivable on demand"
  },
  "kernel_refs": [
    "sys/kern/lwkt_token.c:660",
    "sys/kern/lwkt_token.c:663",
    "sys/kern/lwkt_token.c:731",
    "sys/kern/lwkt_token.c:733",
    "sys/kern/lwkt_token.c:797",
    "sys/kern/lwkt_token.c:799",
    "sys/ddb/db_ps.c:193",
    "sys/ddb/db_ps.c:194",
    "sys/ddb/db_ps.c:197",
    "sys/ddb/db_ps.c:149",
    "sys/ddb/db_ps.c:172"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"
  ]
}