{
  "finding_id": "DF-2230",
  "title": "Kernel plist integer parsing silently saturates decimal values exceeding INT64_MAX (unsigned fallback is dead code)",
  "file": "sys/libprop/prop_number.c",
  "verdict": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sat Oct 17 09:40:41 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "reproduce": {
    "build": "copy pack to guest /root/df2230; sh /root/df2230/build.sh",
    "run": "sh /root/df2230/run.sh",
    "expected": "kernel lines DF2230|K| show is_unsigned=0 signed=9223372036854775807 for decimal inputs 9223372036854775808 / 10000000000000000000 / 18446744073709551615, while DF2230|U| lines for the same inputs show is_unsigned=1 with the correct unsigned value, and DF2230|UU| lines show signed_rv=0 errno=34 (ERANGE). On the fix.diff-patched kernel the DF2230|K| column matches the DF2230|U| column for all inputs up to UINT64_MAX."
  },
  "kernel_refs": [
    "sys/libprop/prop_number.c:38",
    "sys/libprop/prop_number.c:537-545",
    "sys/libprop/prop_number.c:540",
    "sys/libprop/prop_number.c:583-587",
    "sys/libkern/strtoq.c:96-98",
    "sys/conf/files:2243-2255",
    "sys/libprop/prop_object_impl.h:82-97"
  ],
  "code_hash": "61cb8c3244b17d0f074d2f9e1c80f14929aaeaf9bbf78040a96b9b915c543e1b",
  "code_hash_note": "sha256 of kernel_side.c (decisive kernel rig); userland_unit.c 82e16dba59d6f2c37da84af8e0aa1449f860a12ecb3733dea796b34da5393f76, userland_full.c 36f89f4dc6ba49226bb0911845e83c2f9e7e693bd1cb680f7b52cbff2d42cb81",
  "artifacts": [
    "kernel_side.c",
    "Makefile",
    "userland_full.c",
    "userland_unit.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "fix.diff",
    "fix_build.log",
    "fix_run.log",
    "run.fixed.log",
    "env.txt",
    "VERDICT.md",
    "README.md",
    "manifest.json",
    "verdict.json"
  ]
}