{
  "finding_id": "DF-2224",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Oct 20 23:24:18 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/DFV22X  x86_64",
  "code_hash": "c646506a8cbeda4dcb0ade737617a507fac86cf3d381b7df14e25aad5ab10fae",
  "tested_at": "2026-10-20",
  "verdict": "REPRODUCED (mechanics + leak primitive) / LATENT in stock tree / FIX VALIDATED",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh (batch harness kernel DFV22X; verbatim linux_printf.c)",
    "run": "install DFV22X kernel, reboot, sysctl kern.df22x_run=1 (root), read DF2224 lines from dmesg",
    "expected": "BASELINE garbles every conversion (first %d = low-32 of the va_list address; %p prints a kernel stack address 0x9c from the rig witness frame; %s prints the 0x10 gp_offset byte); FIXED prints exact intended strings; canaries INTACT everywhere"
  },
  "kernel_refs": ["sys/dev/drm/linux_printf.c:37", "sys/dev/drm/include/linux/seq_file.h:39", "sys/dev/drm/drm_dp_helper.c:586", "sys/dev/drm/drm_dp_helper.c:662", "sys/dev/drm/i915/i915_gem_gtt.c:1540", "sys/dev/drm/kconfig.h"],
  "artifacts": [
    {"path": "rig_head.c", "type": "rig-source", "desc": "shared batch rig head"},
    {"path": "rig_mid.c", "type": "rig-source", "desc": "verbatim production includes + fixed prototypes"},
    {"path": "rig_tail.c", "type": "rig-source", "desc": "meter + canary-bracketed seq_printf cases, baseline vs fixed with identical variadic args"},
    {"path": "build.sh", "type": "build-script", "desc": "provenance chain + fixed-variant extraction + kernel-compile"},
    {"path": "run.sh", "type": "run-script", "desc": "sysctl trigger + dmesg extraction"},
    {"path": "fix.diff", "type": "suggested-fix", "desc": "one token: ksnprintf -> kvsnprintf (correct va_list forwarding)"},
    {"path": "build.log", "type": "build-log", "desc": "FULL untrimmed nativekernel DFV22X build"},
    {"path": "run.log", "type": "run-log", "desc": "FULL decisive rig output"},
    {"path": "run_section.log", "type": "run-log", "desc": "DF-2224 lines only"},
    {"path": "env.txt", "type": "environment", "desc": "guest env + hashes"},
    {"path": "VERDICT.md", "type": "verdict", "desc": "full narrative incl. ABI derivation, 3-run leak stability, latency analysis"},
    {"path": "README.md", "type": "readme", "desc": "build/run/expected"},
    {"path": "manifest.json", "type": "manifest", "desc": "this file"},
    {"path": "verdict.json", "type": "verdict", "desc": "machine verdict for persist_poc.py"}
  ]
}