{
 "finding_id": "DF-2754",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "REPRODUCED as root on the stock guest from a single process that restores the sysctl before exiting: kern.stackgap_random accepts -1073741824; execve of /usr/bin/true then fails system-wide (every new image dies - the kernel logged pid 1184 (true) uid 0 exited on signal 11) until the value is restored from the already-running process. One root sysctl write bricks exec for the whole system (no new process can run, including sysctl itself to undo it - recovery would need a reboot or a pre-positioned helper).",
 "exploit_chain": "no escalation path: root-only sysctl; impact is system-wide exec denial (recovery needs a reboot or a pre-positioned process)",
 "evidence": "run.log: exec ok before; sysctl accepts -1073741824; exec fails system-wide after (kernel logged pid 1184 (true) uid 0 exited on signal 11); exec ok again after restore",
 "kernel_refs": [
  "sys/kern/kern_exec.c:160",
  "sys/kern/kern_exec.c:1670-1674",
  "sys/kern/kern_exec.c:1170"
 ],
 "poc_changes": "/bin/true does not exist on DragonFly (first run compared ENOENT against ENOENT); switched to /usr/bin/true and the before/after/restore contrast became decisive. The PoC restores the sysctl from the same process before exiting so the guest is never bricked.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "cc -o stackgap_neg stackgap_neg.c",
 "run_cmd": "as root: ./stackgap_neg  (self-restoring; safe to run)",
 "code_hash": "82dae124715f3709cfb386d89f4269a7d3a1532f6b053dc09bb12c67ea6837c3",
 "notes": "",
 "recommended_fix": "Bound the negative (static-gap) form the same way: reject -new_val > 16*PAGE_SIZE.",
 "fix_status": "not_testable",
 "fix_kernel_uname": null,
 "fix_baseline_reproduced": null,
 "fix_patched_reproduced": null,
 "fix_verdict": "fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier",
 "fix_evidence": "batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)"
}