# DF-5810 — VERDICT

**Status: untested (Low-severity race; no PoC run — skip per contract
for Low findings).**

Code-level proof of the protocol violation:
- pointer captured under spin: sys/kern/vfs_subr.c:531-534
- spin released: :534
- blocking re-clean loop with sleeps: :541-554 (BUF_TIMELOCK/bwrite)
- dereference: :551 kprintf("%s", filename)
- nc_name is separately allocated and freed with its ncp:
  sys/sys/namecache.h:136, cache_zap() frees the ncp+name without
  consulting vp->v_spin holders after they release it.

The fix.diff (strlcpy into a 256-byte local under the spin) compiled
as part of the patched guest kernel built for DF-5807/5811 validation
(the same vfs_subr.c object), but no runtime trigger was attempted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.