{
  "finding_id": "DF-2720",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The truncated-file check '(off_t)filsz + offset > vp->v_filesize' (imgact_elf.c:274) is computed in unsigned 64-bit arithmetic: p_offset=0xFFFFFFFFFFFFF000 + p_filesz=0x2000 wraps to 0x1000 and passes. Exec succeeds (no 'truncated ELF file'), the segment is mapped file-backed at object pindex 0xFFFFFFFFFFFFF (~2^52 pages past EOF, confirmed present in the process core), the anon tail maps and reads zero, and touching the wrapped file-backed range SIGSEGVs cleanly. No panic, leak, or corruption on the INVARIANTS guest - hardening-grade check bypass only.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2720/run.log — t2_* matrix: wrapfile rc=139, wrapanon rc=65, all controls correct (exit77=77, readtext=66, readfile=66, readanon=65)",
    "findings/poc/DF-2720/core_phdrs.txt — wrapped segment present in core at vaddr=0x600000 filesz=0x2000",
    "VERDICT.md — narrative"
  ],
  "kernel_refs": [
    "sys/kern/imgact_elf.c:274",
    "sys/kern/imgact_elf.c:265"
  ],
  "poc_changes": "First asm harness used Linux syscall numbers (SYS_exit=60) producing SIGSYS noise; rebuilt with DF numbers (SYS_exit=1) and exit-code protocol (65=zero read, 66=nonzero, 139=read fault)",
  "attempts": 12,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "python3 generators (make_wrapseg*.py) + scp to guest + chmod +x",
  "run_cmd": "for t in t2_exit77 t2_readtext t2_readfile t2_readanon t2_wrapfile t2_wrapanon; do sh -c \"/tmp/$t; echo $t rc=$?\"; done",
  "code_hash": "5245e1d0039f182bdfb1f6266014df8a9dca74aa16dc77fd862f20648d5e3d6a",
  "notes": "vm_fault handles the beyond-EOF vnode pindex gracefully (SIGSEGV to the faulting process). Impact ceiling on this guest: none beyond self-DoS.",
  "recommended_fix": "Check for wrap explicitly: if (offset + filsz < offset || offset + filsz > vp->v_filesize || filsz > memsz) -> ENOEXEC",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Impact none; no fix-validation build performed (hardening only).",
  "fix_evidence": []
}