================================================================================
DF-0220 — end-to-end re-verification (2026-10-12, VERIFY mode)
================================================================================
Guest kernel: 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (unpatched;
source identical to workspace sys/, md5 c115d52f222269d185da27510e0beb89,
last relevant commit 2026-06-27).

Sequence and results:

 1. Source re-trace (current tree)                            -> unchanged
    since the 2026-07 runs; all line cites re-verified
    (subr_csprng.c:84-85,134-149,151-166,176-238,272-273;
     kern_nrandom.c:485-560,562,688-719,726-746,748-788;
     kern_memio.c:319,352; kern_time.c:1140-1159;
     platform/pc64/x86_64/machdep.c:2777 early rand_initialize call).

 2. Manufactured-window characterization (current guest, root, /dev/kmem):
    a. ctx offset proof: sigma "expand 32-byte k" at state+40..55 of a
       healthy state                                      -> kmem_window_decisive.log
    b. force state[2] to (reseed_cnt=0, key=0, ctx=0, pool0.bytes=0,
       last_reseed={0,0}); IN-PROCESS read of 4x32 B with
       rand_mode=csprng, pinned usched :4 (mask=cpu2):
       blk1 = 0x00*32, then deterministic chain, 5/5 byte-identical trials
                                                          -> kmem_window_decisive.log
    c. per-read live ctx dumps (sigma/key/ctr after each read) match the
       offline model EXACTLY (chain_model.py: 4/4 blocks + 4/4 keys)  ->
                                                          kmem_window_chain.log
    d. default mixed mode: same forced state, output = NON-zero (IBAA mask)
    e. self-heal: pool[0] refills to >=96 B within ~3 s (rand_thread feeds);
       the next read reseeds (reseed_cnt 0 -> 1, sane last_reseed) and
       output returns to normal random bytes            -> decisive log [F]
    f. pinning pitfalls documented: usched :N is a CPU MASK (:3={cpu0,cpu1});
       separate-process force->read loses the window to a background
       consumer within ~0.2 s (first two experiment logs, VERDICT.md).

 3. Cross-boot empirical refutation (unprivileged):
    3x vm.sh reset with-src; boot_probe.sh at earliest ssh (uptime 17-18 s):
      - /dev/urandom, getrandom(2), kern.random: 64 B each, pairwise differ
        59-60/64 bytes across all 3 boots; never all-zero   -> boot{1,2,3}_probe.txt
      - zero_scan (uid 1001): 736 blocks/interface/boot in first 15 s;
        0 all-zero blocks (6624 total)                     -> boot{1,2,3}_probe.txt
      - per-CPU state dump at earliest ssh: every state reseed_cnt>=1,
        key=NONZERO; BSP frozen at reseed_cnt=1 with garbage
        last_reseed=184467440735.6xxxxx (the rand_initialize-time
        getmicrouptime artifact, = DF-5766's root cause)   -> boot{1,2,3}_probe.txt

 4. fix.diff validation (defense-in-depth fix; no reproduced bug to contrast):
      - patch -p1 --dry-run on /usr/src                  -> Hunk #1 @138, clean
      - apply + compile with EXACT kernel CFLAGS from
        /usr/obj/usr/src/sys/X86_64_GENERIC (make -V CFLAGS):
        pristine  object: dac9843d2e31a470a402d48cb179e25d  ORIG_OBJ_OK
        patched   object: 64df3fc09488f15ff407593dbc7416f7  PATCHED_OBJ_OK
        (zero warnings)                                   -> fix_apply_compile.log
      - tree restored and verified pristine (md5 c115d52f...)
      - full patched-kernel boot: NOT APPLICABLE -- the patched kernel would
        behave identically to the unpatched one (reseed_cnt>0 before any
        userspace read in both cases; the only behavioral delta is for a
        condition unreachable from userspace).

 5. Guest left healthy: all states reseed_cnt>=1, rand_mode=mixed, /usr/src
    pristine, no panic, guest up.                           -> final_state.log

================================================================================
RESULT
================================================================================
NOT REPRODUCED (unprivileged/real-world observability: NONE on this kernel).
The emit path itself is REAL and fully deterministic -- demonstrated live via
a root-manufactured state: /dev/urandom would return literal 0x00 bytes and
then a keystream reproducible offline (chain_model.py matches the live kernel
4/4 blocks + 4/4 keys, 5/5 trials byte-identical).  But the precondition
(reseed_cnt==0 AND pool[0]<96 at an UNLIMITED read) cannot occur for any
userspace reader: rand_initialize pre-feeds every state's pool[0] with ~15 KB
before that state's first possible read, and the reseed attempt precedes the
emit loop.  Cross-boot outputs differ on all interfaces (3 boots x 3 pairs),
zero all-zero blocks in 6624 early-boot samples, every state keyed at the
earliest userland moment.  DF-0220 stays NOT REPRODUCED with the mechanism
now proven end-to-end; the boot-time entropy-quality concern for the BSP's
single frozen key is DF-5766's finding, not this one.