{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "summary": "Silent data substitution on ZLIB-invalid but checksum-valid compressed blocks reproduced deterministically on the stock kernel; the LZ4 sibling additionally exhibited an attacker-length OOB kernel write (Fatal trap 12, machine halted)",
  "reproduce": {
    "build": "./build.sh (guest /root/df2655; cc h2zsub.c + kernel icrc32.c + xxhash.c)",
    "run": "./mkimage.sh && ./run_stock_ab.sh && ./run_lz4.sh small && ./run_lz4.sh big",
    "expected": "A: pristine md5 876569bd...; B/B2/B3: read(2) exit 0 with first 64KB all zeros (md5 b1e63222...) + 'HAMMER2 ZLIB: Fatal error during decompression.' in dmesg; lz4 small: same substitution + silent 9-byte OOB write; lz4 big: Fatal trap 12 at memset+0xf0, guest halted at db>"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_strategy.c:257-261",
    "sys/vfs/hammer2/hammer2_strategy.c:262-270",
    "sys/vfs/hammer2/hammer2_strategy.c:206-220",
    "sys/vfs/hammer2/hammer2_strategy.c:215-216",
    "sys/vfs/hammer2/hammer2_chain.c:5380-5428",
    "sys/vfs/hammer2/hammer2_lz4.c:515-517"
  ],
  "artifacts": [
    "h2zsub.c", "build.sh", "mkimage.sh", "run_stock_ab.sh", "run_lz4.sh",
    "dump.pristine.log", "dump.patched-zlib.log", "dump.patched-lz4.log",
    "patch.zlib.log", "patch.lz4.log", "patch.lz4.small.log",
    "run.a.pristine.log", "run.b.patched.log", "lz4small-run.log",
    "panic.txt", "panic.lz4-small.txt",
    "fixrun1.log", "fixrun2.log", "k1build.log", "k1install.log",
    "mkfs.log", "mkimage.log", "fix.diff", "env.txt", "VERDICT.md",
    "README.md", "manifest.json", "verdict.json"
  ]
}