# DF-5823 VERDICT

**status: not_reproduced** (runtime) / race statically **certain** /
impact: none observed / confidence: likely

## Mechanism (path:line)

* Filters run under only `prg->proc_token` shared:
  sys/kern/kern_proc.c:1710-1711 (`lwkt_gettoken_shared`, `LIST_FOREACH`).
* KERN_PROC_PGRP re-reads `p->p_pgrp` twice with no lock:
  kern_proc.c:1736-1738.
* KERN_PROC_TTY walks `p_pgrp->pg_session->s_ttyp->t_dev`:
  kern_proc.c:1741-1747.  `p_session` is `#define p_session
  p_pgrp->pg_session` (sys/sys/proc.h:344) so the `p->p_session == NULL`
  check at 1743 is dead code — the NULL-ness it pretends to guard is one
  hop deeper.
* The pgrp pointer is mutated by `enterpgrp()` (kern_proc.c:814-826) and
  `leavepgrp()` (kern_proc.c:859-872) under `p->p_token`+`pg_token`, and
  the last `pgrel()` frees the pgrp (kern_proc.c:656-690) while the member
  proc remains scannable on allproc.  The mover's manual `pgref()`
  (kern_proc.c:815, 860) protects only its own window, not a scanner that
  already loaded the pointer.
* Zombies keep `p_pgrp` until reap (`leavepgrp` at kern_exit.c:1271 runs
  after `proc_remove_zombie`), and list removal is serialized against the
  scan by the bucket token — so the *freed-pgrp* variant (member moves
  pgrps while on-list) is the reachable race; a NULL `p_pgrp` is not
  reachable for on-list procs.

## What was run

`./df5823_churn 180` as unprivileged `maxx` on the audit guest: 24 churn
workers, each forking grandchildren that `setpgid(0,0)` (fresh pgrp, sole
member, on-list) then `setsid()` (leaves that pgrp as last member → pgrel
frees it mid-scan); half the workers additionally acquire a controlling
tty (posix_openpt + auto-TIOCSCTTY) so the `s_ttyp` hop of KERN_PROC_TTY
is raced.  Scanner polled `kern.proc.pgrp.1` and `kern.proc.tty.0`
continuously: 17,090,388 iterations (~94,942/s), load average 22.

## Why no panic (honest impact ceiling)

Every object in the raced chain (`struct pgrp`, `struct session`, `struct
tty`) lives in a dedicated kmalloc zone whose backing memory is never
unmapped; freed chunks retain (or get same-type) contents, so the stale
reads degrade to wrong `pg_id`/`t_dev` comparisons instead of faults.  A
page-faulting wild hop requires a freed chunk field to alias a
non-resident pointer — possible only through same-zone reuse patterns
that keep producing valid objects.  Consequence class: incorrect filter
results (cosmetic), theoretical panic (not demonstrated in 17M polls).

## Reproduce

```
cc -O2 -o df5823_churn df5823_churn.c
./df5823_churn 180
# guest stays up, rig prints "scanner iterations: NNNN (~95k/s)"
# a kernel panic during the run would upgrade this finding
```

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.