# DF-5798 VERDICT — NOT REPRODUCED (speculative race, code-level case documented)

## Bottom line
The race was exercised hard on the guest (6 rounds x (8x400
self-reexecing processes on the mount + respawning busy-holder +
10x `umount -f`), >100k execs, 60 force-unmount attempts, ~4.5 min)
and did **not** manifest: no panic, no refcount divergence observed,
guest stayed up (dmesg shows only the namecache layer's own
"nlookup: warning umount race avoided" defusing, 243x — machinery that
protects nlookup paths but NOT p_textnch). The code-level race remains:
the unsynchronized compare-then-drop in `unmount_allproc_cb()`
(vfs_syscalls.c:777-778) against exec's drop-then-copy
(kern_exec.c:549-552) has an interleave that steals a reference from the
newly installed handle. The window (callback's compare→drop gap must
contain exec's full swap) is on the order of tens of nanoseconds against
millisecond process lifetimes — likely why it did not trigger.

## Why it is still reported (speculative)
- `unmount_allproc_cb` mutates `p->p_textnch` with no `p_token`; every
  other mutation site in the kernel (kern_exec.c:549, kern_exit.c:498,
  kern_shutdown.c:599, kern_fork.c:541) is serialized by p_token. The
  asymmetry is unambiguous in the source.
- The bad interleave is concrete: T1 reads `p->p_textnch.mount == mp`
  (old handle) → T2 (exec) `cache_drop` (zeroes) + `cache_copy`
  (installs new handle, takes refs) → T1 `cache_drop(&p->p_textnch)`
  drops the NEW handle's refs and zeroes it → the new ncp/mount refs
  are one too low → premature free of a namecache entry still reachable
  from the topology/vp → UAF on next touch (exec/exit/resolve).
- `dounmount()`'s retry loop (vfs_syscalls.c:888-963) re-runs the
  callback every iteration (up to 50 per attempt) whenever the mount
  stays busy, multiplying exposure per `umount -f`.
- Trigger privilege: root by default; unprivileged if
  `vfs.usermount=1` (mount owner can force-umount their own mount —
  sys_unmount vfs_syscalls.c:648-665).

## Evidence
- `run.log` — stress trace: STRESS-DONE, mount cleaned up, no panic.
- `dmesg.txt` — 243x "nlookup: warning umount race avoided" (proves
  heavy umount racing occurred; that warning path is nlookup-specific).
- `reexec.c`, `stress.sh` — the rig.

## Fix validation
Not performed (nothing reproduced to validate against). fix.diff is the
one-line-token fix: take p_token around the p_textnch drop and re-check
the condition under the token.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.