{
  "finding": "DF-2667",
  "title": "Unprivileged kernel NULL-pointer panic via mountctl(2) MOUNTCTL_MOUNTFLAGS with buflen=0 (strlen(NULL) in vfs_flagstostr)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O -o /tmp/df2667 /tmp/mountctl_null.c",
    "run": "/tmp/df2667  (as unprivileged user)",
    "expected": "Fatal trap 12, fault virtual address = 0x0, Stopped at strlen: cmpb $0,(%rdi); guest freezes in DDB"
  },
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:1281",
    "sys/kern/vfs_syscalls.c:1311",
    "sys/kern/vfs_default.c:1316",
    "sys/kern/vfs_subr.c:1996"
  ],
  "artifacts": [
    "mountctl_null.c", "build.sh", "run.sh", "run.log", "panic.txt",
    "env.txt", "fix.diff", "run.patched.log", "fix_validation.log",
    "VERDICT.md", "verdict.json", "manifest.json"
  ]
}