{
 "finding_id": "DF-2360",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "The REAL in-kernel db_disasm on crafted bytes: 0f 01 db dispatches through db_Grp7_11[f_reg()] where db_Grp7_11 has literal NULLs at [3]/[4] - the NULL[3] load faults at address 0x18 (db_disasm+0x1049); 44 0f 01 c0 (REX.R) reads db_Grp7_11[8] past the 6-entry table and db_printf strlen()s the garbage pointer (fault in strlen); 44 8c c0 (REX.R + mov sreg) reads db_seg_reg[8] past the 8-entry table at :1381 - on this kernel layout it returned a mapped pointer and printed corrupt output (mov %al,%ax) instead of faulting, the silent-corruption face of the same bug. With the bounds/NULL guard and the &7 sreg mask all three disassemble or reject without faulting and the control is unchanged. DDB is reached by the console holder or after any panic, so this is a debugger-reliability defect that converts recoverable debug sessions into reboots.",
 "exploit_chain": "",
 "evidence": "panic.txt (fault 0x18 at db_disasm+0x1049; strlen fault; silent mov %al,%ax), run_fixed_kernel.log (??? + no faults + correct %es), rig/dfbatch_dism.c, fix.diff",
 "kernel_refs": [
  "sys/cpu/x86_64/misc/db_disasm.c:908",
  "sys/cpu/x86_64/misc/db_disasm.c:204",
  "sys/cpu/x86_64/misc/db_disasm.c:1381"
 ],
 "poc_changes": "db_disasm takes a third regs argument on this tree (ddb.h); NULL works for these paths",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 420,
 "guest_dirty": 0,
 "build_cmd": "kernel-compiled rig (DFBATCH)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"dism <grp7null|rexgrp7|rexseg|control>\"",
 "code_hash": "7163604684cc2ac9c524cf1e9bb69d25cb8246191cb6a634da5235db52e824bb",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "bounds/NULL-check the Grp7_11 dispatch and mask REX out of the segment table index"
}