# DF-2720 VERDICT

**Status: reproduced (check bypass confirmed) — impact: none (no memory
unsafety) — confidence: certain.**

## What was run

t2_* family of crafted ELF64 binaries on the INVARIANTS guest, uid 1001:

- t2_exit77 → rc=77 (harness sanity: entry/exit path correct, DF SYS_exit=1)
- t2_readtext → rc=66 (read own text, nonzero)
- t2_readfile → rc=66 (valid file-backed PT_LOAD part reads real bytes)
- t2_readanon → rc=65 (valid anon bss tail reads zero)
- **t2_wrapfile → rc=139** — PT_LOAD with p_offset=0xFFFFFFFFFFFFF000,
  p_filesz=0x2000: exec succeeded (check bypassed — no "truncated ELF file"),
  the range [0x600000,0x602000) IS mapped file-backed (seen in the core:
  `type=1 flags=6 vaddr=0x600000 filesz=0x2000`), and reading it SIGSEGVs.
- **t2_wrapanon → rc=65** — the wrapped segment's anon tail maps and reads
  zero, proving load_section processed the segment fully.

## Impact assessment

No kernel panic (checked serial log), no leak, no corruption. The
beyond-EOF vnode pindex faults cleanly through vm_fault → SIGSEGV. The
finding stands as a hardening/robustness issue: the truncated-file check is
bypassable and the documented invariant ("fail so vm_map doesn't walk off
the end of the file object", imgact_elf.c:265-270) is violated.

No exploit chain; no fix-validation build performed (impact none).