{
  "finding_id": "DF-2649",
  "verdict": "not_reproduced (code-proven; requires real unreadable media for the final EIO link)",
  "impact": "panic (robustness/DoS on failing media)",
  "reproduce": {
    "build": "sh build.sh (guest base image + host forge variants + guest cc)",
    "run": "sh run.sh; run A mounts craft2649_v1.img and reaches chain_lock->load_data->bread on the forged PFSROOT chain from an unprivileged ioctl (manifests DF-0875's hammer2_get_volume panic on this guest); run B shows the volu_size-inflated variant rejected at mount",
    "expected": "the DF-2649 NULL deref itself (va~0x100 in hammer2_bulkfree_scan) fires only when an in-window read fails - real failing hardware; not guest-materializable (see VERDICT.md)"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_bulkfree.c:143-147",
    "sys/vfs/hammer2/hammer2_bulkfree.c:393-398",
    "sys/vfs/hammer2/hammer2_chain.c:1003-1008",
    "sys/vfs/hammer2/hammer2_ondisk.c:283-290"
  ],
  "artifacts": [
    "forge_2649.py", "h2common.py", "trigger.c", "build.sh", "run.sh",
    "craft2649_v1.img", "craft2649_volusize.img",
    "panic_getvolume.txt", "mount_reject.log",
    "env.txt", "fix.diff", "verdict.json", "manifest.json"
  ]
}