{
  "finding_id": "DF-5824",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Deterministic refcount-discipline bug, reproduced at runtime: inferior() (sys/kern/kern_proc.c:477-481) returns 0 at the pid==0 node without PRELE, stranding one PHOLD on proc0 per call; the unprivileged entry is sys_setpgid on any non-descendant pid (sys/kern/kern_prot.c:372). 10,000,000 setpgid(1,0) calls returned ESRCH 10,000,000 times in 6.5s (~1.54M stranded holds/sec) and 300,000,000 more in 194.7s, growing proc0s p_lock by 310,000,000 (0x1274F0C0) - past PLOCK_MASK (0x0FFFFFFF), i.e. the PLOCK_WAITRES flag bit is now set in proc0s lock word on the guest. No crash results today because proc0 is immortal and nothing PSTALLs/pholdzombs it: the corruption is real but dormant, hence impact=none. Filed Low: unprivileged unbounded growth against a kernel synchronization word is a latent wedge/panic for any future consumer and permanently corrupts proc0s hold accounting.",
  "exploit_chain": "",
  "evidence": "run.log (both bursts: 100% ESRCH = leaking branch executed on every call; arithmetic shows p_lock += 310M crossing 2^28); VERDICT.md (root cause path:line, impact ceiling); fix.diff (one-line PRELE fix)",
  "kernel_refs": [
    "sys/kern/kern_proc.c:477",
    "sys/kern/kern_proc.c:480",
    "sys/kern/kern_proc.c:341",
    "sys/kern/kern_proc.c:263",
    "sys/kern/kern_prot.c:372"
  ],
  "poc_changes": "Authored from scratch (no seed). Target pid 1 chosen for the shortest ancestry walk (init -> proc0, single iteration).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29 14:18:01 UTC 2026 root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 201,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o df5824_leak df5824_leak.c",
  "run_cmd": "./df5824_leak 10000000; ./df5824_leak 300000000",
  "code_hash": "5be07be2604359d6e254f35c06ac8e622289da026fb9d980980768f393d1d4c4",
  "notes": "Guest proc0 carries +310M stranded holds after this verification (dormant flag corruption); guest is reset via vm.sh reset with-src before return. fix.diff is a one-line PRELE(p) on the pid==0 return; not kernel-rebuild-validated because no memory corruption reproduced (impact dormant).",
  "recommended_fix": "Add PRELE(p) before the return(0) in inferior()s pid==0 branch (sys/kern/kern_proc.c:480).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (one line) but not rebuild-validated: the leak has no runtime-observable failure to flip on this guest (dormant corruption only).",
  "fix_evidence": "fix.diff"
}