{
 "finding_id": "DF-2364",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "_chacha20poly1305_update with in_len = 2^32 (a legal complete-block multiple for the size_t API) splits silently: the recording interposition on the verbatim TU shows chacha_encrypt_bytes receiving bytes=0 (uint32_t truncation) while poly1305_update receives 4294967296 (size_t, full) - keystream covers the low 32 bits, MAC covers everything, the AEAD invariant breaks with no error. The KAT control (small lengths, recorders forwarding to the real primitives) matches the real kernel KPI output bit-for-bit, proving the rig drives production code. With the KKASSERT guard the same call is rejected loudly on INVARIANTS kernels (assertion text captured). Latent: every in-tree caller is bounded far below 2^32 (mbuf pkthdr.len is int32).",
 "exploit_chain": "",
 "evidence": "run_fixed_kernel.log + session baseline (TRUNCATION: chacha saw 0, poly saw 4294967296; KAT MATCH), panic_fix.txt (post-fix assertion), fix.diff",
 "kernel_refs": [
  "sys/crypto/chachapoly.c:127",
  "sys/crypto/chachapoly.c:131"
 ],
 "poc_changes": "the recorder forwards to the real primitives below a threshold and only records above it (no 4GiB poly pass); initial RFC vector reference was wrong for the 32-byte payload - replaced by twin comparison against the real kernel KPI",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "kernel-compiled rig (DFBATCH)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"crypto 2364:<kat|trunc>\"",
 "code_hash": "c872cf8f02a063d7e322cc53b4bf4154de47b7e3ebfae04a72e8b297023c5746",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "KKASSERT in_len <= 0xffffffffU in _chacha20poly1305_update (recommend a runtime clamp upstream)"
}