{
  "finding_id": "DF-2627",
  "verdict": "reproduced",
  "impact_category": "leak",
  "summary": "hammer2_vop_readdir leaks 63 bits of uninitialized kernel stack into the directory cookie (uio_offset -> f_offset committed even on error) when the first xop collect fails; unprivileged lseek() readback verified with 1355 samples, 9 distinct kernel-pointer values; fix validated (1605/1605 samples clean).",
  "reproduce": {
    "build": "sh build.sh  (guest base image + host forge + guest cc of leak_df2627.c)",
    "run": "vnconfig -c vn0 craft2627.img && mount -t hammer2 /dev/vn0@testvol /mnt/h2x && sh run_guest.sh && sh run_guest2.sh",
    "expected": "every sample: rc=-1 errno=33 (EDOM) cookie=0x7fff<kernel KVM pointer> (baseline) vs cookie=0x2 (fixed kernel); control image rc=1008 errno=0 cookie=0x7fffffffffffffff"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_vnops.c:601",
    "sys/vfs/hammer2/hammer2_vnops.c:688-692",
    "sys/vfs/hammer2/hammer2_vnops.c:700",
    "sys/vfs/hammer2/hammer2_vnops.c:745-751",
    "sys/vfs/hammer2/hammer2_vnops.c:758",
    "sys/kern/vfs_syscalls.c:4644-4646",
    "sys/vfs/hammer2/hammer2_chain.c:1070-1072",
    "sys/vfs/hammer2/hammer2_chain.c:2473-2476",
    "sys/vfs/hammer2/hammer2_xops.c:213-242",
    "sys/vfs/hammer2/hammer2_cluster.c:471-477",
    "sys/vfs/hammer2/hammer2_cluster.c:533-536",
    "sys/vfs/hammer2/hammer2.h:1322-1323",
    "sys/vfs/hammer2/hammer2_disk.h:466-467"
  ],
  "fix": {
    "file": "sys/vfs/hammer2/hammer2_vnops.c",
    "description": "Only advance saveoff from bref when error == 0; zero bref at the top (defense-in-depth)",
    "validated": true
  },
  "artifacts": [
    "README.md", "VERDICT.md", "manifest.json", "verdict.json",
    "forge_df2627.py", "mkbase2627.sh", "leak_df2627.c",
    "build.sh", "run_guest.sh", "run_guest2.sh", "fix_validate.sh",
    "base2627.img", "craft2627.img",
    "run.log", "run2.log", "leak_sample.txt", "env.txt",
    "fix_run.log", "fix_run2.log", "fix_build.log", "fix_install.log",
    "fix.diff"
  ],
  "code_hashes": {
    "leak_df2627.c": "38f8d325a32c260d67cfff3e6619c8a62da55661a0714780298545bd87b32d6a",
    "forge_df2627.py": "9c459da273267fd7d1bf383e6ebbc5fe64ecde032a0481890a50985d7ba966ed",
    "base2627.img md5": "35ccafac713bd1529277504cee23d3d7",
    "craft2627.img md5": "b867a4344a6f37f17e678544d919887d"
  }
}