{
  "finding_id": "DF-0861",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "kernel panic; see panic.txt / run.log. On a fixed kernel: exits 0, no panic."
  },
  "kernel_refs": [
    "sys/vfs/hpfs/hpfs_subr.c:274",
    "sys/vfs/hpfs/hpfs_subr.c:276",
    "sys/vfs/hpfs/hpfs_subr.c:282",
    "sys/vfs/hpfs/hpfs_subr.c:292",
    "sys/vfs/hpfs/hpfs_subr.c:297",
    "sys/vfs/hpfs/hpfs_subr.c:230",
    "sys/vfs/hpfs/hpfs_vfsops.c:305"
  ],
  "artifacts": [
    {
      "path": "harness.c",
      "type": "trigger-source",
      "desc": "deterministic loop+bcopy transcription with poisoned allocator; proves 4080-byte OOB write"
    },
    {
      "path": "craft_img.py",
      "type": "trigger-source",
      "desc": "HPFS image crafter: forged sp_cpinum=1 + cpisec s_cpicnt=0x1F"
    },
    {
      "path": "df861.img",
      "type": "disk-image",
      "desc": "crafted 64KB HPFS image (binary) for live mount test"
    },
    {
      "path": "df861-huge.img",
      "type": "disk-image",
      "desc": "variant sp_cpinum=1000 to exercise the fix's EINVAL gate"
    },
    {
      "path": "mount_hpfs_simple.c",
      "type": "trigger-source",
      "desc": "mount(2) helper (RO mount triggers cpinit)"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -O2 -Wall -o harness harness.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "./harness"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "final successful harness build"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "decisive harness run: BUG_CONFIRMED=1, OOB=4080, ATTACKER_CONTROLLED=1"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "Fatal trap 9 in kqueue_register from slab-corruption cascade (live mount run 1)"
    },
    {
      "path": "dmesg.txt",
      "type": "dmesg",
      "desc": "live guest dmesg excerpt"
    },
    {
      "path": "boot.log.baseline",
      "type": "boot-log",
      "desc": "baseline serial log before the panic (clean boot, no panic)"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, cc version, INVARIANTS-in-GENERIC confirmation"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "bound inner loop (&& cpicnt>0), cap s_cpicnt to CPIS_NCPI, validate sp_cpinum (HPFS_SP_CPINUM_MAX=256)"
    },
    {
      "path": "fix_build.log",
      "type": "build-log",
      "desc": "Phase 8 build of patched hpfs.ko module (rc=0)"
    },
    {
      "path": "fix_run.log",
      "type": "run-log",
      "desc": "Phase 8 patched-module validation: clean mount 3 cycles + EINVAL gate for sp_cpinum=1000"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full narrative: mechanism, trigger, impact, fix validation"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "finding summary, build/run, expected vs fixed behaviour"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this artifact catalog"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}