{
  "finding_id": "DF-2316",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh prep.sh && sh build.sh (cd /usr/src && make -j6 nativekernel KERNCONF=PNPH && make installkernel KERNCONF=PNPH); fix A/B: cd /usr/src && patch -p1 < /root/pnp/fix.diff && sh build.sh",
    "run": "sh run.sh (scenarios 9,20,21,22,23x3,24,26); sh run2.sh (scenario 25 -> panic on baseline); capture dfbsd-qemu/boot.log",
    "expected": "baseline: 8/8 truncated-tag attributions PASS (MEM32_RANGE 17 bytes, offsets 0..16); canrd ir_size=0x21595241 from canary bytes past a 512B chunk (3/3); canwr canary 0x00->0x01 (res[5]=1 OOB write); e2e2 ir_size=0x33324644 = 17 canary bytes past a 1024B chunk through the REAL pnp_parse_resources; e2e3 heap residue (0x44504145) into stored isa_config; scenario 25: Fatal trap 12 at res+16, pnp_parse_desc+0x685, panic; fixed kernel: all truncated tags skipped (bogus length lines, nmem=0), scenario 25 no panic, well-formed 27-field vector bit-identical to baseline"
  },
  "kernel_refs": [
    "sys/bus/isa/pnpparse.c:60-340",
    "sys/bus/isa/pnpparse.c:95",
    "sys/bus/isa/pnpparse.c:105",
    "sys/bus/isa/pnpparse.c:123",
    "sys/bus/isa/pnpparse.c:141-167",
    "sys/bus/isa/pnpparse.c:178-198",
    "sys/bus/isa/pnpparse.c:242-266",
    "sys/bus/isa/pnpparse.c:278-299",
    "sys/bus/isa/pnpparse.c:308-326",
    "sys/bus/isa/pnpparse.c:433-543",
    "sys/bus/isa/pnpparse.c:575-601",
    "sys/bus/isa/pnp.c:493-526",
    "sys/bus/isa/pnp.c:536-581",
    "sys/bus/isa/pnp.c:406-480",
    "sys/platform/pc64/x86_64/trap.c:855-878"
  ],
  "artifacts": [
    "pnp_harness.c",
    "pnph.h",
    "pnphctl.c",
    "prep.sh",
    "build.sh",
    "run.sh",
    "run2.sh",
    "fix.diff",
    "build.log",
    "fix_build.log",
    "run.log",
    "fix_run.log",
    "panic.txt",
    "leak_sample.txt",
    "env.txt",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}