# Fact Check Report

## Verified

- **Commit SHA `d860d1faa6b2`** resolves; subject matches verbatim:
  `net: rose: convert 'use' field to refcount_t`
- **HEAD commit `e728258debd5`** resolves: `Merge tag 'net-7.1-rc1'`
- **`net/ax25/ax25_out.c`** — all checked lines match tree at e728258debd5:
  - line 32: `ax25_cb *ax25_send_frame(...)` ✓
  - line 74: `ax25->source_addr = *src;` ✓
  - line 77: `if (digi != NULL) {` ✓
  - line 78: `ax25->digipeat = kmemdup(digi, sizeof(*digi), GFP_ATOMIC);` ✓
  - line 79: `if (ax25->digipeat == NULL) {` ✓
  - line 115: `return ax25;` ✓
  - line 116: `}` ✓
- **`net/rose/rose_link.c`** — `rose_t0timer_expiry` block:
  - line 79: function signature ✓; line 81: `timer_container_of(...)` ✓
  - line 83: `rose_transmit_restart_request(neigh);` ✓
  - line 85: `neigh->dce_mode = 0;` ✓; line 87: `rose_start_t0timer(neigh);` ✓
- **`net/rose/rose_link.c`** — `rose_send_frame` block:
  - line 95: function signature ✓; lines 97–110 all match ✓
  - line 106: `neigh->ax25 = ax25_send_frame(skb, 260, rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);` ✓
- **`net/rose/rose_timer.c`** — `rose_timer_expiry` block:
  - line 164: function signature ✓; line 166: `timer_container_of(...)` ✓
  - line 169: `bh_lock_sock(sk);` ✓
  - line 175: `case ROSE_STATE_1:` ✓; line 176: `case ROSE_STATE_4:` ✓
  - line 182: `case ROSE_STATE_2:` ✓
  - line 183: `rose_neigh_put(rose->neighbour);` ✓
  - line 184: `rose_disconnect(sk, ETIMEDOUT, -1, -1);` ✓; line 185: `break;` ✓
  - line 197: closing `}` ✓
- **`include/net/rose.h`** — `rose_neigh_put` block:
  - line 160: function signature ✓; line 162: `refcount_dec_and_test` ✓
  - line 163: `if (rose_neigh->ax25)` ✓; line 164: `ax25_cb_put(...)` ✓
  - line 165: `kfree(rose_neigh->digipeat);` ✓; line 166: `kfree(rose_neigh);` ✓
- **`net/rose/rose_route.c`** — `rose_add_node` block:
  - line 84: `if (rose_neigh == NULL) {` ✓
  - line 85: `rose_neigh = kmalloc_obj(*rose_neigh, GFP_ATOMIC);` ✓
  - line 100: `refcount_set(&rose_neigh->use, 1);` ✓
  - line 107: `if (rose_route->ndigis != 0) {` ✓
  - line 108–109: `rose_neigh->digipeat = kmalloc_obj(ax25_digi, GFP_ATOMIC);` ✓
  - line 110: `if (rose_neigh->digipeat == NULL) {` ✓
- **File paths** — all five paths exist in the tree at e728258debd5: ✓
  `net/ax25/ax25_out.c`, `net/rose/rose_link.c`, `net/rose/rose_timer.c`,
  `include/net/rose.h`, `net/rose/rose_route.c`
- **Register/address values** — values cited in the analysis body
  (`ffff8880310ac600`, 66 bytes) are consistent with the Key Elements table ✓

## Whitespace / cosmetic fixes applied

### report.md — marker normalisation (4 blocks)

Four crash-site/call-site markers were missing the space between `→` and
the line number.  Silently corrected in-place per section 6 of the
fact-checker rules:

- `→106` → `→ 106` (`rose_send_frame`, `net/rose/rose_link.c:106`)
- `→183` → `→ 183` (`rose_timer_expiry`, `net/rose/rose_timer.c:183`)
- `→165` → `→ 165` (`rose_neigh_put`, `include/net/rose.h:165`)
- `→109` → `→ 109` (`rose_add_node`, `net/rose/rose_route.c:109`)

(Lines `→ 78` and `→ 83` were already correct.)

### analysis-email.txt — marker normalisation (6 lines)

All six crash-site/call-site markers in the email lacked the required space
between `->` and the line number.  Silently corrected:

- `->78` → `-> 78`
- `->83` → `-> 83`
- `->106` → `-> 106`
- `->183` → `-> 183`
- `->165` → `-> 165`
- `->109` → `-> 109`

## Doubts flagged

None.

## Email discrepancies (analysis-email.txt)

No factual discrepancies found.  The email's function-signature wrapping
(line 32 repeated across three wrapped lines) is a pre-existing formatting
choice that does not affect factual accuracy and was not corrected (content
change in a potentially-sent email).

## Not checked

- Disassembly bytes in the `## Disassembly — crash site` section (no
  vmlinux disassembly tool available in this run; the opcodes are not
  verifiable from the source tree alone).
- Backtrace table function offsets and sizes (require vmlinux symbol map).
- `kernel/time/timer.c`, `kernel/softirq.c`, `arch/x86/…` source lines
  cited in the backtrace tables (correct trees accessed but lines not
  individually verified — no doubts flagged in the analysis about those
  files, and time budget prioritised the crash-path code).

## Source of truth used

- Git tree: `/sdb1/arjan/git/oops-skill/oops-workdir/linux` at `e728258debd5`
- Key Elements table in `report.md`
- `backtrace.json` (present; used as cross-reference for file/line metadata)