{
  "finding_id": "DF-2632",
  "title": "hammer2 flusher panics on dense dirent packing: 'insert base overlapping elements' (unprivileged local DoS)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O2 -o gen_names gen_names.c && cc -O2 -o fill2632 fill2632.c && cc -O2 -o denseprobe denseprobe.c && cc -O2 -o naturalprobe naturalprobe.c",
    "run": "sh run_df2632.sh",
    "expected": "stock: panic 'td_critcount is/would-go negative!' (INVARIANTS) / 'insert base ... overlapping elements' with backtrace hammer2_base_insert <- hammer2_chain_rename_obref <- hammer2_chain_indirect_maintenance; fixed kernel: fill proceeds, rate-limited defer notices, files survive remount"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_chain.c:5308-5311",
    "sys/vfs/hammer2/hammer2_chain.c:4065-4231",
    "sys/vfs/hammer2/hammer2_chain.c:3487-3509",
    "sys/vfs/hammer2/hammer2_flush.c:1039-1042",
    "sys/vfs/hammer2/hammer2_subr.c:178-229"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fill2632.c", "denseprobe.c", "naturalprobe.c", "gen_names.c",
    "run_df2632.sh", "run_probe.sh", "run_natural.sh", "validate_fix.sh", "build.sh", "run.sh",
    "stock_run.log", "density_probe.log", "natural_probe.log",
    "serial_panic_stock_standalone.log", "serial_panic_density96.log",
    "serial_panic_invariants.log", "serial_panic_noinv.log",
    "fix_validation.log", "fix_validation_part2.log", "fix_run.log",
    "iteration1_assert.log", "build.log", "fix_build.log", "env.txt",
    "fix.diff", "verdict.json", "manifest.json"
  ]
}