acctwatch() ignores VFS_STATFS failure (decides suspend/resume on uninitialized stack statfs) and races vgone(): NULL v_mount dereference panic

Summary

acctwatch() calls (void)VFS_STATFS(vp->v_mount, &sb, proc0.p_ucred) and then tests sb.f_bavail/f_blocks without checking the return value; 'struct statfs sb' is stack-local and uninitialized, so any statfs failure (e.g. NFS accounting file with an unreachable server) drives the suspend/resume decision from stack garbage. Additionally the 'vp->v_type == VBAD' guard does not cover the vgone() window: vclean swaps in deadfs vops and vgone_vxlocked detaches the vnode from its mount (v_mount=NULL) BEFORE setting v_type=VBAD; acctwatch holds acct_lock, not the vnode VX lock, so it can observe v_mount==NULL while v_type is still VREG and pass NULL to vfs_statfs(), which dereferences mp->mnt_op unconditionally — kernel NULL-deref panic. Requires privileged setup (root enabled accounting + NFS statfs failure or umount -f racing the 15s acctwatch callout); genuine reachable defect in the exact scenario the code comments warn about. Not built (Low, privileged-only per contract). Fix: check statfs return + test v_mount explicitly (or set v_type=VBAD before clearing v_mount kernel-wide).

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_acct.c (GLM 5.3).