{
  "finding_id": "DF-5837",
  "status": "untested",
  "verdict": "Code defect confirmed by line-accurate static analysis: cluster_wbuild() installs the pbuf KVA window with pmap_qenter_noinval (sys/kern/vfs_cluster.c:1691-1693) BEFORE the b_bufsize>b_kvasize guard (1694-1698), inverting the safe ordering used by cluster_rbuild (1094-1100), and neither build function calls bkvareset() after qentering although both set B_KVABIO (940, 1551) and initpbuf never resets b_cpumask (sys/vm/vm_pager.c:382-395). Latent impact: any future component-accounting slip of the DF-2725 class turns into an actual out-of-bounds PTE install into the adjacent pbufs contiguous KVA window (arena at sys/vm/vm_pager.c:239-242) before the panic fires; the stale cpumask becomes live for any CPU-touching window consumer. Not executed on the guest: unreachable without a second kernel bug - wbuilds exact per-component page guard (1606-1616, actual xio_npages), getblk forcing B_VMIO on all buffers (sys/kern/vfs_bio.c:2810,2974), vmaxiosize clamped to MAXPHYS (sys/kern/vfs_subr.c:1519-1531) and xio_pages[] sized btoc(MAXPHYS)=32 (sys/sys/xio.h:66) close every reachable path; the default disk strategy chain only derives physical addresses via TLB-immune page-table walks (sys/dev/disk/nvme/nvme.c:390, sys/platform/pc64/x86_64/pmap.c:1873-1887). Defense-in-depth fix authored (check-before-map + bkvareset).",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5837/VERDICT.md (full path:line analysis); findings/poc/DF-5837/fix.diff (hoisted guard + bkvareset at both qenter sites); key lines sys/kern/vfs_cluster.c:1691-1698 vs 1094-1100, sys/kern/vfs_cluster.c:1606-1616 (i>0-only guard), sys/kern/vfs_cluster.c:940+1551 (B_KVABIO), sys/vm/vm_pager.c:239-242+299-301+382-395, sys/kern/vfs_bio.c:3216+3838+3994 (qenter/bkvareset pairing), sys/platform/pc64/x86_64/pmap.c:2164-2166 (qenter_noinval semantics)",
  "kernel_refs": [
    "sys/kern/vfs_cluster.c:1691",
    "sys/kern/vfs_cluster.c:1694",
    "sys/kern/vfs_cluster.c:1606",
    "sys/kern/vfs_cluster.c:940",
    "sys/kern/vfs_cluster.c:1551",
    "sys/kern/vfs_cluster.c:1094",
    "sys/kern/vfs_cluster.c:1098",
    "sys/vm/vm_pager.c:382",
    "sys/kern/vfs_bio.c:3994",
    "sys/platform/pc64/x86_64/pmap.c:2164"
  ],
  "poc_changes": "no PoC built - latent defect not reachable by any local program on a default-config guest without a second kernel bug; verification intentionally skipped per contract for Low hardening findings",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Cross-file observation for the orchestrator (NOT part of this finding): sys/dev/disk/md/md.c:254-333 bcopy/bzeros through bp->b_data with no bkvasync(), violating the KVABIO contract that subr_disk.c:1218/nvme_disk.c:220/virtio_blk.c:520 document; combined with a filesystem on md(4) and repeated clustered file I/O pinned to one CPU, that is a plausible stale-TLB wrong-page copy. Recommend spawning an audit of sys/dev/disk/md/md.c.",
  "recommended_fix": "Hoist the b_bufsize>b_kvasize panic above pmap_qenter_noinval in cluster_wbuild (mirror cluster_rbuild) and call bkvareset(bp) after both qenter sites so the pbuf window re-enters the KVABIO cpumask protocol.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (guard hoist + bkvareset x2); not built on the guest because the guarded condition is unreachable on a stock kernel - no observable behavior changes to measure (fix_status not_testable).",
  "fix_evidence": "findings/poc/DF-5837/fix.diff"
}