{
 "finding_id": "DF-2764",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "journal_setextattr journals ap->a_uio after the underlying VOP consumed it (vfs_jops.c:1039); uiomove advances iov/iov_len in place (kern_subr.c:151) and jrecord_leaf_uio skips zero-length iovecs (vfs_journal.c:964), so the extattr VALUE leaf is never recorded - replication/undo of extattr sets is silently broken. Not testable on the stock guest: no in-tree FS implements vop_setextattr (smbfs's is commented out) and extattr userland is absent, so the error==0 branch that emits the broken record cannot be reached; mechanism proven statically with certainty.",
 "exploit_chain": "",
 "evidence": [
  "fs_check.log (setextattr absent; no FS support)",
  "VERDICT.md static proof chain with path:line"
 ],
 "kernel_refs": [
  "sys/kern/vfs_jops.c:1027-1040",
  "sys/kern/kern_subr.c:145-155",
  "sys/kern/vfs_journal.c:962-973",
  "sys/vfs/smbfs/smbfs_vnops.c:121"
 ],
 "poc_changes": "n/a - feature absent",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
 "runtime_sec": 10,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "setextattr user myattr myval /tmp/ea_test (userland absent: RC=127)",
 "code_hash": "9a7dfebf51208697aa6af71428081185c72335b5a78dd3f7710a62e401a47376",
 "notes": "not_testable class (target feature absent); latent until an FS implements vop_setextattr; fix.diff authored (uio snapshot pre-op, mirroring journal_write :859-868) but not kernel-validated for this reason",
 "recommended_fix": "copy the uio before vop_journal_operate_ap in journal_setextattr, exactly like journal_write (fix.diff)",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix authored from the line-accurate mechanism; cannot be runtime-validated on the stock guest (no FS support)",
 "fix_evidence": [
  "fix.diff"
 ]
}