{
  "finding_id": "DF-0001",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 17:15:30 UTC 2026     root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_kernel_sha256": "f30fe81d658b01e8fcf2469190aae82f0c5b67961c112da2314f5bece9999902",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "fix_status": "fixed",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "kernel panic; see panic.txt / run.log. On a fixed kernel: exits 0, no panic."
  },
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:4036",
    "sys/kern/vfs_syscalls.c:4038",
    "sys/kern/vfs_syscalls.c:4111",
    "sys/kern/vfs_syscalls.c:4113",
    "sys/sys/systm.h:94",
    "sys/sys/systm.h:117",
    "sys/kern/vfs_quota.c:112",
    "sys/vfs/nfs/nfs_vnops.c:737",
    "sys/vfs/nfs/nfsm_subs.h:109"
  ],
  "artifacts": [
    {
      "path": "estale_trig.c",
      "type": "trigger-source",
      "desc": "THE trigger that fires the panic: open fd -> server-side stale-FH invalidation -> ftruncate -> GETATTR ESTALE -> KASSERT"
    },
    {
      "path": "trunc_panic.c",
      "type": "trigger-source",
      "desc": "original reviewer PoC (path truncate), sharpened to print errnos and populate the target"
    },
    {
      "path": "trunc_only.c",
      "type": "diagnostic",
      "desc": "errno diagnostic proving dead-server GETATTR returns cached attrs (error=0) -> KASSERT not reached (negative evidence)"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "ships sources to guest + cc as unprivileged user maxx"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "full multi-step reproducer: quota reboot + loopback NFS + ESTALE handle invalidation -> panic"
    },
    {
      "path": "run_fix_validate.sh",
      "type": "fix-run-script",
      "desc": "same choreography minus the INVARIANTS-string precondition (used to re-run the trigger on the patched #1 kernel, where the strings are intentionally absent)"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full mechanism walkthrough + Phase-8 fix-validation (baseline panic vs patched clean-error)"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "human-facing build/run/preconditions + file index"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "git-apply-able: KASSERT -> proper error-return + cleanup (vn_unlock+goto done for ftruncate); applies cleanly to sys/kern/vfs_syscalls.c; VALIDATED on a built #1 kernel"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "serial-console panic from prior session: kern_ftruncate(): VOP_GETATTR didn't return 0 at kern_ftruncate+0x152"
    },
    {
      "path": "baseline_panic.txt",
      "type": "panic-signature",
      "desc": "Phase-8 baseline re-confirmation on #0: same panic signature"
    },
    {
      "path": "baseline_run.log",
      "type": "run-log",
      "desc": "Phase-8 baseline run.sh output (full): trigger sequence + panic signature on #0"
    },
    {
      "path": "baseline_boot.log",
      "type": "serial-log",
      "desc": "full untrimmed serial log of the baseline (#0) panicking boot"
    },
    {
      "path": "fix_build.log",
      "type": "build-log",
      "desc": "FULL nativekernel build of the single-fix kernel (35393 lines): vfs_syscalls.o recompiled, kernel.stripped linked, rc=0"
    },
    {
      "path": "fix_run.log",
      "type": "run-log",
      "desc": "Phase-8 patched-#1 PoC re-run (2x determinism): ftruncate returns ESTALE cleanly, guest up, NO panic"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "prior-session decisive confirmation run (fresh vm.sh reset), step-by-step"
    },
    {
      "path": "boot.log.full",
      "type": "serial-log",
      "desc": "prior-session full untrimmed serial log of the panicking boot"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "prior-session final successful build of estale_trig on guest"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, cc, quota default, INVARIANTS check (KASSERT strings in kernel binary)"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this catalog"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}