{
  "finding_id": "DF-5810",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "vtruncbuf() snapshots the separately-allocated nc_name pointer under vp->v_spin (vfs_subr.c:531-534), releases the spin, blocks in the re-clean RB_SCAN loop (BUF_TIMELOCK/bwrite), then dereferences the pointer at vfs_subr.c:551 kprintf - a rename/unlink racing the truncations re-clean path can cache_zap the ncp and free nc_name in the window, giving a use-after-free read of freed heap into dmesg. Low severity (narrow race, console-only output); no PoC run per contract skip rule for Low findings.",
  "exploit_chain": "",
  "evidence": "code-path analysis in VERDICT.md; fix.diff compile-validated as part of the guest kernel build used for DF-5807/5811 fix validation",
  "kernel_refs": [
    "sys/kern/vfs_subr.c:531-534",
    "sys/kern/vfs_subr.c:541-554",
    "sys/sys/namecache.h:136"
  ],
  "poc_changes": "n/a - no PoC authored",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "skip-verified Low finding; fix compiled in the patched kernel (strlcpy snapshot under spin, MAXNAMLEN+1 buffer)",
  "recommended_fix": "snapshot the name bytes under v_spin instead of the pointer (fix.diff, applies cleanly, compile-validated)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff compiles (part of the validated kernel build) but no runtime trigger exists for this narrow race",
  "fix_evidence": "fix.diff"
}