{
  "finding_id": "DF-0243",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "FALSE POSITIVE, independently confirmed. The size_t subtraction at sys/kern/imgact_shell.c:126 does wrap when argv[0] is longer than interpreter tokens + fname, but the wrap is harmless: begin_envv/endp are char* so adding (2^64 - d) computes exactly begin_envv-d / endp-d (the intended post-shrink locations, always in-buffer since begin_envv >= begin_argv+length), and space (int) truncates (size_t)space+offset back to the exact intended space+d (bounded by 2*ARG_MAX, far inside int range). The finding stopped at SIZE_MAX-241 and never evaluated the subsequent pointer adds. On the unpatched kernel (#0 Jul 2 snapshot), 700+ underflow-branch execs -- argv[0] swept 256..262140, argv[0]=262144 at the exact copyinstr bound with offset=15 (max delta d~262129), nonexistent-interpreter #!/a variants, large-env bcopy stress with sentinel verification, and 8x75 parallel execs -- all ran the scripts normally: no panic, no signal, no dmesg warnings, guest stayed up. The claimed kernel panic does not exist; impact none.",
  "exploit_chain": "",
  "evidence": "run.log (decisive baseline, unpatched #0): math_proof 3x ALL MATCH; 6x DF0243_NO_PANIC sweep; 4x DF0243_ENV_OK sentinel_intact; trigger3 phases (a)-(d) all OK ending TRIGGER3_OK: 700 underflow execs, max delta, no crash no signal; zero CHILD_KILLED. fix_run.log (single-fix kernel #1, this runs build): byte-identical to run.log (diff empty). fix.diff applied to guest /usr/src, nativekernel rc=0, booted #1 Mon Oct 12 06:41:45 UTC 2026. Guest reset with-src afterwards (pristine #0 verified).",
  "kernel_refs": [
    "sys/kern/imgact_shell.c:52",
    "sys/kern/imgact_shell.c:117",
    "sys/kern/imgact_shell.c:118",
    "sys/kern/imgact_shell.c:120",
    "sys/kern/imgact_shell.c:123",
    "sys/kern/imgact_shell.c:126",
    "sys/kern/imgact_shell.c:127",
    "sys/kern/imgact_shell.c:128",
    "sys/kern/imgact_shell.c:129",
    "sys/sys/imgact.h:42",
    "sys/sys/imgact.h:46",
    "sys/kern/kern_exec.c:1022",
    "sys/kern/kern_exec.c:1028",
    "sys/kern/kern_exec.c:1061",
    "sys/kern/kern_exec.c:1166",
    "sys/kern/kern_exec.c:1220"
  ],
  "poc_changes": "Added trigger3.c (new): max-delta execs with argv[0]=262144 (the exact ARG_MAX/copyinstr bound) + interp offset=15; nonexistent-interpreter #!/a variant exercising imgact-internal writes alone; large-env + near-max argv[0]; 8x75 parallel hammer. First draft of phase (c) mis-sized argv[0] (262144 + 80 env vars cannot fit ARG_MAX; exec fails EFAULT in exec_copyin_args before imgact) -- fixed by sizing argv0=215024. Re-ran pass-1 trigger/trigger2/math_proof verbatim. No changes needed to pass-1 sources or fix.diff.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1450,
  "guest_dirty": 0,
  "build_cmd": "cd findings/poc/DF-0243 && ./build.sh && cc -O2 -Wall -o trigger3 trigger3.c",
  "run_cmd": "./run.sh && ./trigger3",
  "code_hash": "1ec997a6afe93d17d8025bb64a4f0f5dffd5115b6aa37850c8d351abc7e76ce1",
  "notes": "Verify-mode re-verification of the pass-1 false-positive verdict; concurs and strengthens it with max-delta/parallel/nonexistent-interp coverage the pass lacked. Underflow-branch exec total this run: ~1000 (sweep 6 + trigger2 4 + trigger3 700 + staging). The only residual issue is pedantic: the code forms a transient out-of-object pointer value (strict-reading C UB) and confuses static analyzers -- hardening, not a bug. Guest left pristine (vm.sh reset with-src; #0 kernel, unpatched /usr/src at imgact_shell.c:126 verified).",
  "recommended_fix": "Optional hardening only: rewrite imgact_shell.c:126-129 as an explicit grow/shrink branch (see fix.diff); no security fix required.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 06:41:45 UTC 2026",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "No security fix exists to validate: the claimed bug never manifests (baseline_reproduced=0 -- nothing to reproduce; the finding is a false positive). The defense-in-depth fix.diff was nevertheless fully validated this run: applies cleanly, nativekernel build rc=0 (completed Oct 12 06:44:49 UTC), installkernel rc=0, boots as #1, and the entire suite output is byte-identical to the unpatched kernel (diff run.log fix_run.log empty) -- zero behavioral change by design. fix_status recorded as not_testable because persist_fix.pys schema has no not_applicable value.",
  "fix_evidence": "fix_build.log (BUILD_RC=0, INSTALL_RC=0, kern.version #1 Mon Oct 12 06:41:45 UTC 2026); fix_run.log == run.log (LOGS_IDENTICAL); fix_build.log.pass1 preserves the full 35k-line build transcript of the identical patch."
}