# DF-2674 VERDICT — REPRODUCED (W^X weakening), fix validated

## Question

Are stack regions created by downward stack growth executable?

## Root cause (path:line)

`vm_map_growstack()` inserts the growth with hardcoded protections
(**sys/vm/vm_map.c:4246-4251**):

```c
rv = vm_map_insert(map, &count, NULL, NULL, 0, NULL,
                   addr, stack_entry->ba.start,
                   VM_MAPTYPE_NORMAL,
                   VM_SUBSYS_STACK, VM_PROT_ALL, VM_PROT_ALL, 0);
```

`VM_PROT_ALL` = READ|WRITE|**EXECUTE** becomes the *current* protection of
the grown chunk.  The main stack is created by exec with
`prot = VM_PROT_READ|VM_PROT_WRITE` (sys/kern/kern_exec.c:991-995), so
growth silently makes the newly usable stack executable.

## Reproduction (unprivileged, /proc/self/map)

run.log (stable across 3 runs):

```
---- before growth ----
0x00007fffffde0000-0x00007fffffdfe000 rw-      <- original stack
---- after growth (fault 1 page below) ----
0x00007fffffdc0000-0x00007fffffde0000 rwx      <- grown chunk: RWX
0x00007fffffde0000-0x00007fffffdfe000 rw-
```

The other `r-x` region in the log is the program text, unrelated.

Impact: silent executable-stack introduction on growth — weakens
non-exec-stack hardening for stack-overflow exploitation.  Rated Low
(the stack's max_protection already includes EXEC, so a process could ask
for it via mprotect; the defect is the kernel granting X unprompted).

## Fix validation

`fix.diff` passes `stack_entry->protection` / `stack_entry->max_protection`
to the insert.  On the patched kernel the grown region is `rw-`
(see fix run in run.log).