# DF-5810 — vtruncbuf() caches nc_name across unlocked blocking work (narrow UAF read)

## What

vtruncbuf() (sys/kern/vfs_subr.c:531-534) snapshots
`TAILQ_FIRST(&vp->v_namecache)->nc_name` under `vp->v_spin`, then
DROPS the spin and runs the re-clean RB_SCAN loop — which sleeps in
BUF_LOCK/bwrite — before `kprintf(... %s, filename)` dereferences the
pointer at vfs_subr.c:551.  `nc_name` is a *separately allocated*
string (sys/sys/namecache.h:136); the namecache entry can be
cache_zap()d (rename/unlink race on the file being truncated) during
the blocking window, leaving `filename` dangling → use-after-free
read of freed heap into the console/dmesg output.

Preconditions: the rarely-taken "re-clean leftover buffers" path
(dirty buffers reappearing after truncation) AND concurrent
rename/unlink of the truncated file — a narrow race with low impact
(dmesg disclosure of freed-heap bytes). Not PoC'd: the trigger needs
a contrived buffer reappearance race; filed as Low with a compile-
validated fix.

## Fix (compile-validated in the guest kernel build; see DF-5807/5811 pack runs)

Snapshot the name bytes under the spin instead of the pointer
(fix.diff). Alternatively hold a namecache reference across the loop.