# DF-2406 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** likely

## Mechanism
rdrand_rng_harvest performs no NIST SP 800-90B health tests (repetition count / adaptive proportion) on the harvested RDRAND stream before mixing it into the kernel pool.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain absence. Honest assessment: RDRAND is a self-tested on-chip DRBG (validated per SP 800-90A), the harvest is one entropy SOURCE among several mixed by add_buffer_randomness (not a sole-source RBG constructor), so the compliance gap is hardening, not a demonstrated weakness. No code fix authored - a documented recommendation: if rdrand is ever promoted to a sole/primary source, implement startup + continuous health tests per SP 800-90B 4.4 at the harvest site.

## Threat / reachability
Latent code defect; see VERDICT.md.

## Privilege escalation assessment
n/a (hardening)

## Fix
Documented recommendation (no fix.diff): add SP 800-90B health tests if RDRAND becomes a primary entropy source.

## Kernel references
- `sys/dev/crypto/rdrand/rdrand.c:169`
- `sys/dev/crypto/rdrand/rdrand.c:171`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)