# DF-2665 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
The vendored LZ4 decompressor is the 2013-era r97 codebase: LZ4_decompress_generic with the pre-hardening overflow accounting, no LZ4_compress_default fast-path bounds API, none of the 13 years of upstream CVE fixes (e.g. the CVE-2014-4610-class read-overrun fixes in r118+).

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Cross-reference item (upstream-owned): version identity confirmed against the r97-era source layout. DragonFly wraps every decompress call with a strict output-size bound (hammer2_lz4.c LZ4_decompress_safe into caller-sized buffers, comp block header caps), so the known r97 decoder overread classes are contained by the wrapper bounds; the real fix is syncing the vendored file to current upstream lz4 (r1.9.x+) - out of scope for a one-off fix.diff, so this pack carries a documented recommendation only, per the contrib/vendored policy.

## Threat / reachability
Vendored-code age: upstream hardening absent; wrapper bounds currently contain the known overread classes.

## Privilege escalation assessment
n/a (hardening)

## Fix
Documented recommendation (no fix.diff): sync sys/vfs/hammer2/hammer2_lz4.c to current upstream LZ4 (upstream-owned history).

## Kernel references
- `sys/vfs/hammer2/hammer2_lz4.c:372`
- `sys/vfs/hammer2/hammer2_lz4.c:517`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)