# DF-2754 - Verification Verdict

**Status:** reproduced
**Impact:** denial_of_service
**Confidence:** certain

## Mechanism
sysctl_kern_stackgap validates only new_val > 0 (power-of-2 and <= 16*PAGE_SIZE); any negative int is accepted verbatim. exec then computes a STATIC gap ALIGN(-stackgap_random) (kern_exec.c:1170-1172), so a large negative value pushes the argv/env destination megabytes away from the stack mapping.

## Verdict
REPRODUCED as root on the stock guest from a single process that restores the sysctl before exiting: kern.stackgap_random accepts -1073741824; execve of /usr/bin/true then fails system-wide (every new image dies - the kernel logged pid 1184 (true) uid 0 exited on signal 11) until the value is restored from the already-running process. One root sysctl write bricks exec for the whole system (no new process can run, including sysctl itself to undo it - recovery would need a reboot or a pre-positioned helper).

## Threat / reachability
Root-only foot-gun / validation gap: a single sysctl permanently denies service; also a hostile-container-config primitive.

## Privilege escalation assessment
n/a (requires root to set; breaks availability, not privilege)

## Fix
Bound the negative (static-gap) form the same way: reject -new_val > 16*PAGE_SIZE.

## Kernel references
- `sys/kern/kern_exec.c:160`
- `sys/kern/kern_exec.c:1670-1674`
- `sys/kern/kern_exec.c:1170`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.