{
  "finding_id": "DF-2624",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "guest: newfs_hammer2 -L testvol + hammer2 pfs-create /mnt/h2x/poison (build.sh); host: python3 forge_2624.py base2624.img craft2624.img",
    "run": "guest root: vnconfig -c vn0 craft2624.img; mount -o ro -t hammer2 /dev/vn0@testvol /mnt/h2x; hammer2 pfs-list /mnt/h2x",
    "expected": "hammer2_update_pmps pfsallocs EVERY PFS under sroot -> kstrdup walks the NUL-less filename off the end of the 64KB DIO buffer: silent adjacent-heap overread (observed instrumented length 772 = 4 bytes past the buffer) or fatal trap 12 'strlen() <- hammer2_pfsalloc+0x157' when the adjacent page is unmapped; fixed kernel: mount succeeds with a truncation warning"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_vfsops.c:495",
    "sys/vfs/hammer2/hammer2_vfsops.c:465-499",
    "sys/vfs/hammer2/hammer2_vfsops.c:1552-1571",
    "sys/vfs/hammer2/hammer2_disk.h:912-916",
    "sys/vfs/hammer2/hammer2_disk.h:1012"
  ],
  "artifacts": [
    "forge_2624.py", "h2common.py", "run_2624.sh", "run_stock.log",
    "console_excerpts.txt", "fix.diff",
    "instr_build.log", "instr_build2.log", "instr_install.log",
    "fix_build.log", "fix_install.log", "env.txt",
    "README.md", "VERDICT.md", "build.sh", "run.sh", "manifest.json", "verdict.json"
  ]
}