{
  "finding_id": "DF-5800",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-3 re-audit of sys/vm/vm_map.c. One certain but impact-free logic defect found: vm_map_delete() sets hole_start=vm_map_max in the no-predecessor sub-branch (vm_map.c:3257-3263), making the trailing vm_map_freehint_hole() update (vm_map.c:3387-3393) an underflowed no-op, so the freehint optimization fails to record bottom-of-map holes. The branch is unreachable from sys_munmap (vm_mmap.c:586 whole-range-mapped check forces the lookup-succeeds branch) and is only exercised by internal whole-map removes on maps being emptied or destroyed, where stale hints cannot mis-allocate (findspace re-validates against the RB tree; vm_map_insert re-validates bounds at vm_map.c:1275-1296). Worst theoretical outcome is a spurious ENOMEM-while-space-free, not constructible from any syscall path. Dynamic pass-3 evidence: three unprivileged stress rigs (stackgrowth-vs-concurrent-mutation 40 rounds + guard-page harness; 9.28M clip/simplify/unclip ops on a 2048-entry fragmented map; 60 fork-COW/wired/shared/NONE-inherit rounds) all completed with the guest up and no panic, corruption, or hang.",
  "exploit_chain": "",
  "evidence": "run.log (all three rigs, guest-live, unprivileged); VERDICT.md sections The defect, precisely and Why no impact is reachable with path:line trace; fix.diff one-liner; env.txt guest configuration",
  "kernel_refs": [
    "sys/vm/vm_map.c:3257",
    "sys/vm/vm_map.c:3262",
    "sys/vm/vm_map.c:3387",
    "sys/vm/vm_map.c:702",
    "sys/vm/vm_mmap.c:586"
  ],
  "poc_changes": "n/a (Info finding; pack carries the pass-3 stress rigs run for the file as a whole: stackstress/fragstress/forkcow built with cc 8.3 on the guest and run as unprivileged user maxx)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 540,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp && sh build.sh   # cc -O -Wall -o {stackstress,fragstress,forkcow} *.c -lpthread",
  "run_cmd": "/tmp/stackstress; /tmp/fragstress; /tmp/forkcow   (as unprivileged user)",
  "code_hash": "09bdcea5beecc0baeabac7b4b75ef70f8037cdde1639bd21934ea6870eef695d",
  "notes": "Pass-3 result for sys/vm/vm_map.c overall: no new memory-safety, privesc, or leak findings. Known findings DF-0940/DF-2672/DF-2673/DF-2674 were excluded and not re-derived. Classes hunted and killed are enumerated in VERDICT.md (vm_map_stack wrap unreachable via sys_mmap MAP_STACK stripping; simplify aux-union loss conservative-only; ONEMAPPING+ref>1 munmap strip defended by vm_map_backing_replicated clearing; set_max=TRUE has no caller; MADV_SETMAP gated behind vm.vkernel_enable=0 verified on guest; IN_TRANSITION merge exclusion via eflags equality; symmetric mlock/munlock wiring accounting; reserve accounting bounded; vm_map_submap NULL clip kernel-internal only; pmap_copy no-op on x86_64).",
  "recommended_fix": "In vm_map_delete()s no-predecessor sub-branch set hole_start = vm_map_min(map) instead of vm_map_max(map) so the freehint is lowered for bottom-of-map holes",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No kernel rebuild performed: Info severity, no reachable impact (hint-table optimization no-op); fix is a mechanical one-liner mirroring the adjacent entry==NULL branch",
  "fix_evidence": "fix.diff"
}