{
  "finding_id": "DF-2619",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "guest: newfs_hammer2 base + one 255-char-named file (see build.sh); host: python3 forge_2619.py base2619.img craft2619.img; guest: cc getdents_dump.c statprobe.c",
    "run": "guest root: vnconfig -c vn0 craft2619.img; mount -o ro -t hammer2 /dev/vn0@testvol /mnt/h2x; ./getdents_dump /mnt/h2x; ./statprobe <255-char name>",
    "expected": "getdents returns the dirent name ending with 127 bytes of kernel memory from past the 64KB DIO buffer (mapped-adjacent case), or a fatal trap 12 in memcpy+0x19 / hammer2_vop_readdir+0x5c8 / hammer2_chain_dirent_test+0x89 (unmapped case); stat exercises the dirent_test bcmp OOB; base-image control is clean"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_chain.c:5781-5790",
    "sys/vfs/hammer2/hammer2_vnops.c:723-737",
    "sys/vfs/hammer2/hammer2_chain.c:1100",
    "sys/vfs/hammer2/hammer2_io.c:120-127",
    "sys/vfs/hammer2/hammer2_io.c:555-563",
    "sys/vfs/hammer2/hammer2_xops.c:275-290"
  ],
  "artifacts": [
    "forge_2619.py", "h2common.py", "getdents_dump.c", "statprobe.c",
    "run_2619.sh", "run_2619_instr.sh", "run_stock.log",
    "console_excerpts.txt", "fix.diff", "fix_run.log",
    "instr_build.log", "instr_build2.log", "instr_install.log",
    "fix_build.log", "fix_install.log", "env.txt",
    "README.md", "VERDICT.md", "build.sh", "run.sh", "manifest.json", "verdict.json"
  ]
}