{
 "finding_id": "DF-2244",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "The invariant violation is real and was measured on the stock kernel purely by observation: karc4random_buf charges arc4_numruns once per CALL (arc4random.c:152) while emitting len bytes (:156-157), so a 1 MiB request streams 1 MiB of RC4 keystream under a single key. Timing spikes (a stir costs 25-31k cycles vs 36 for a plain call) show the 16384-run budget firing exactly where modeled (phaseA spike at 16375 = 16384 - 8 probe words - 1 settle), then 5 MiB via karc4random_buf moves the counter by only 5 runs (zero spikes in the next 100 calls; next spike at exactly 12755 = 16385 - 3625 - 5). Impact ceiling is hardening: every in-tree caller passes a small constant length (pf 16, wg 16-32, vtnet/re 5-6 MAC bytes, cryptoapi ctxsize), so no attacker-controlled length exists and no DoS, leak, or privesc is constructible today; the risk is prospective (RC4 bytes-per-key bias beyond the 64 KiB design budget; future large-length callers silently lose the reseed bound). Not memory corruption; closed for privesc. Fix validated by kernel A/B: with fix.diff (chunked generation, chunk/4 runs charged per 64 KiB chunk) the very first karc4random call after 5 MiB reseeds immediately (phaseC spikes {0, 16385}, first-100 spikes 0 -> 1), 1 MiB calls now cost +16 stirs, the normal karc4random budget cycle is unchanged, and the fixed kernel booted normally twice.",
 "exploit_chain": "",
 "evidence": "run.log (stock kernel): arc4runs phaseA spike at 16375, phaseC spikes {12755}, first-100 spikes 0, 5x1MiB buf calls ~7.9M cycles each; run.fix1.log and run.fix2.log (fixed kernel, 2 boots): phaseC spikes {0, 16385}, first-100 spikes 1; VERDICT.md section 2 has the run-arithmetic cross-check proving 5 MiB charged exactly 5 runs",
 "kernel_refs": [
  "sys/libkern/arc4random.c:21",
  "sys/libkern/arc4random.c:152",
  "sys/libkern/arc4random.c:156",
  "sys/net/pf/pf.c:3664",
  "sys/net/wg/wg_cookie.c:231",
  "sys/net/wg/wg_noise.c:304",
  "sys/dev/virtual/virtio/net/if_vtnet.c:885",
  "sys/crypto/cryptoapi/cryptoapi.c:1084"
 ],
 "poc_changes": "Original sketch assumed a runtime KLD could read the per-cpu counters directly (they are file-static; impossible from a module) and that kldload works on this guest (it does not for freshly built modules - kernel-linker GPF). Replaced with a compiled-in kernel experiment (arc4x.c) that proves the accounting purely by rdtsc spike positions, whose arithmetic pins the charged-run count exactly; built via make nativekernel (buildkernel requires absent world tools).",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sat Oct 17 13:48:59 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 5100,
 "guest_dirty": 0,
 "build_cmd": "cp arc4x.c /usr/src/sys/kern/; printf \"kern/arc4x.c\\t\\tstandard\\n\" >> /usr/src/sys/conf/files; cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
 "run_cmd": "reboot; dmesg | grep arc4runs:   (baseline stock); apply fix.diff, rebuild, reboot, dmesg | grep arc4runs:   (fixed)",
 "code_hash": "63f2050c2d85c56f6e0bee9d68cca25e558f63eb7bc0314b99bd249b8db54e1d",
 "notes": "attempts = 1 baseline boot + 2 fixed-kernel boots + 1 kldload attempt that exposed the broken runtime module loader. Spike threshold 20000 cycles / 30x mean; separation is ~800x so detection is unambiguous. Caller audit for attacker-controlled length: none found (all constants). Fixed-kernel phaseB cost increase +8 percent per MiB is the expected price of 16 stirs per MiB. Guest reset with-src after the run; next spawn starts from the clean Jul-2 stock kernel.",
 "recommended_fix": "Charge howmany(chunk,4) runs per at most 64 KiB chunk in karc4random_buf and honor the reseed trigger between chunks (see fix.diff)",
 "fix_status": "validated",
 "fix_notes": "kernel A/B: stock first-100 spikes 0 / phaseC {12755}; fixed first-100 spikes 1 / phaseC {0, 16385}; phaseA unchanged; 2 clean boots of fixed kernel"
}