DF-5846 — VERDICT

Status: REPRODUCED (unprivileged kernel panic, stock INVARIANTS kernel, fresh run 2026-10-26; 3/3 historical in the DF-2717 pack with crash-dump root-cause). Impact: local DoS (panic) only — no escalation primitive (fixed-offset NULL read).

1. Fresh stock reproduction (this run)

• Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (stock snapshot, INVARIANTS), 6 vCPU QEMU/KVM.
• Trigger: df2717_storm 90 3 0xf as unprivileged maxx (uid 1001) — pthread storm: fchdir swapper between tmpfs /tmp/df2717/a and hammer2 /home/maxx/df2717/b, relative ".." chdir swapper across the mount boundary, volatile mkdir/chdir/rmdir/chdir-away dance on 64 rotating directories, and 3 threads of relative-path open() readers.
• Result (panic-stock.txt): within the 90 s window — Fatal trap 12: page fault, fault virtual address = 0x84, Stopped at nlookup+0x66c: movl 0x84(%rax),%edx, current process = 904 (df5846_storm, uid 1001), CPU3. Signature byte-for-byte identical to the DF-2717-era captures (nlookup+0x66c, VA 0x84, kern_chdir caller).

2. Root cause (source-verified, path:line)

1. rmdir(cwd) defers the namecache zap (NCF_DEFEREDZAP) because the fd-table reference is held (sys/kern/vfs_cache.c). Under chdir churn the deferred zap completes while fd_ncdir still points at the node: it becomes topology-disconnected — nc_parent = NULL, unhashed, unnamed, but alive and referenced. Proven by kgdb on /var/crash/vmcore.0 in the DF-2717 run: cwd ncp had nc_parent=0, nc_head=0, nc_name=0, nc_flag=0x1210, nc_refs=30, path "../../../tmp/df2717/a", element "..".
2. In nlookup()'s ".." handler the NULL-parent case is handled ONLY for the mount-point walk (sys/kern/vfs_nlookup.c:741-756, mnt_ncmounton.ncp == NULL → "broke jail" recovery). The normal parent step sys/kern/vfs_nlookup.c:758 (nctmp.ncp = nctmp.ncp->nc_parent) has no NULL guard, even though the intended generic NULL-parent handling exists further down (:831+).
3. The resulting nctmp.ncp = NULL survives cache_copy() (which is NULL-safe, sys/kern/vfs_cache.c:996-1026) into nch, and nch.ncp->nc_generation & ~3 at sys/kern/vfs_nlookup.c:767 dereferences NULL+0x84 — the observed trap.

Single-threaded rmdir(cwd); ls .. is benign (the fd reference blocks the zap); the multi-actor storm is what completes the deferred zap while walkers keep adopting the disconnected node as their walk base.

3. Fix and A/B validation

fix.diff = the NULL guard (Part B of the DF-2717 pack's validated fix; the FD-spinlock hardening in that pack belongs to DF-2717 and is NOT needed for this crash):

} else {
    nctmp.ncp = nctmp.ncp->nc_parent;
}
+ if (nctmp.ncp == NULL) {
+   kprintf("vfs_nlookup: '..' traverse disconnected: ...");
+   nctmp = nd->nl_rootnch;
+ }

• Validation kernel: tri-fixed build #2: Mon Oct 26 06:04:19 UTC 2026 (vfs_nlookup NULL guard + DF-5847 nd6 fix + DF-5848 m_dup_data fix; the two others are in disjoint subsystems), RC=0 under -Werror.
• A/B (the exact full-mix storm 90/150 3 0xf): stock baseline = 4/4 nlookup NULL-parent panics (3 historical + 1 fresh, all ≤90 s). On the fixed kernel the guard fired 2× then 46× across two runs — every firing is a walk that is an instant panic on stock — with zero nlookup faults. The DF-5846 crash is gone.
• Honest caveat / separate bug: the storm harness has a SECOND kill path — hammer2_xop_start_except+0x25 (NULL+0x81554 read) — that eventually takes down BOTH stock and fixed kernels after the DF-5846 crash would already have fired. Attribution: on the FIXED kernel with mode 0xd (no cross-mount ".." walks) the guard fired 0 times and the hammer2 crash still occurred; on PRISTINE STOCK with mode 0xd (which has no guard at all) the identical crash occurred. The hammer2 panic is therefore pre-existing and independent of this fix — it is a new candidate finding (transcripts: run-fixed3-console.txt, panic-fixedrun-hammer2-incidental.txt, stock-hammer2-attribution-run.txt).
• The '..' traverse disconnected recovery message firing 46× in one run confirms the guard handles the exact stock crash condition at volume without adverse effects (no leak, no wrong behavior).

4. Impact ceiling / privesc assessment

The primitive is a kernel read at a fixed NULL offset (0x84) — a trap, not a corruption. No attacker-controlled value reaches memory; there is no write, no leak, no lifetime hijack. No path to uid=0. Ceiling = reliable unprivileged local DoS, exactly as filed (Medium, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

5. Notes

• The DF-2717 unlocked-read sites are the delivery vehicle that makes walkers adopt the disconnected base quickly, but a correctly-locked reader would copy the same legitimate handle — the missing NULL guard is the root cause and the fix stands alone.
• Guest returned to a clean snapshot after validation.