DF-1804 — verification verdict

Mechanism

snpclose at 492-498 under snp_token only: sets snp_blen=0, kfree(snp_buf); then 504 snp_detach takes tp->t_token. snplwrite/snp_in at 159-169 holds tp->t_token and reads/writes snp_buf WITHOUT snp_token. Window: snp_buf freed but tty line discipline still installed -> concurrent write drives snp_in into freed buffer.

Root cause: snp_buf mutated/freed under only one of the two relevant tokens.

Reproduction note (HW/module-gated)

DF-1804 lives in sys/dev/misc/snp/snp.c which is either (a) not compiled into the default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt driver only — loaded via kldload) or (b) gated by absent hardware on this audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID controller, no CardBus bridge). The bug is source-confirmed by tracing the cited path line-by-line; a live trigger would require the corresponding hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.

Fix

Acquire snp_token around the snp_in() call in snplwrite so it serializes with snpclose's free. Matches finding proposal.

Phase 8 — combined fix-kernel build validation

fix.diff was one of 35 standalone git apply-able patches batched into a single make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.

Result: combined kernel build rc=0 with -Werror clean (no warnings).

• Build log: combined_build.log (35666 lines, full untrimmed make output).
• Single-fix kernel artifact: /usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped sha256 eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, built Wed Jul 22 15:42:55 UTC 2026.
• All 35 patches applied cleanly via patch -p1 --forward (no rejects).

Because DF-1804 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.