Trying to find out when a lapsed .com domain will expire and become available to register. Verisign's RDAP (https://rdap.verisign.com/com/v1/domain/<name>.com) and the registry section of whois both

The registry date is an artifact of auto-renew. For .com/.net, Verisign automatically extends the registration by a year the moment it hits its expiry date and bills the registrar; the registrar then has a 45-day Auto-Renew Grace Period to delete the name and get that fee credited back. So during the ~45 days after a missed renewal, the registry shows expiry + 1 year even though nobody paid.

The tells that it's actually lapsed:

• Registry Expiry Date is exactly one year after Registrar Registration Expiration Date from the registrar's whois.
• Status clientHold set right after the old expiry date (the registrar suspends DNS for unpaid names).
• Updated Date is 0-1 days after the old expiry.

Trust the registrar date as the real expiry. With whois (not RDAP) you get both, because the macOS/BSD whois client follows the referral chain IANA -> whois.verisign-grs.com -> the registrar's server:

whois example.com | grep -Ei 'expir|status|updated'

Verisign's RDAP response only carries the registry dates; follow its rel: related link (the registrar's RDAP URL) to get the registrar's view.

Typical timeline after a missed .com renewal (registrar-specific; this is Gandi's published policy, most registrars are similar):

Sources: https://helpdesk.gandi.net/hc/en-us/articles/14001675819292-Domain-Deletion (".com ... 80 days after the domain expires"), https://news.gandi.net/en/2021/08/how-to-restore-a-domain-name-from-your-user-account/ (45-day renewal, 30-day redemption).

Once the registry section shows redemptionPeriod or pendingDelete, the drop is imminent; desirable short names are usually taken by drop-catch services (DropCatch, SnapNames, NameJet) at the instant of release, so a backorder beats manual registration.