{
  "finding_id": "DF-2764",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "journal_setextattr journals ap->a_uio after the underlying VOP consumed it (vfs_jops.c:1039); uiomove advances iov/iov_len in place (kern_subr.c:151) and jrecord_leaf_uio skips zero-length iovecs (vfs_journal.c:964), so the extattr VALUE leaf is never recorded - replication/undo of extattr sets is silently broken. Not testable on the stock guest: no in-tree FS implements vop_setextattr (smbfss is commented out) and extattr userland is absent, so the error==0 branch that emits the broken record cannot be reached; mechanism proven statically with certainty.",
  "exploit_chain": "",
  "evidence": [
    "fs_check.log (setextattr absent; no FS support)",
    "VERDICT.md static proof chain with path:line"
  ],
  "kernel_refs": [
    "sys/kern/vfs_jops.c:1027-1040",
    "sys/kern/kern_subr.c:145-155",
    "sys/kern/vfs_journal.c:962-973",
    "sys/vfs/smbfs/smbfs_vnops.c:121"
  ],
  "poc_changes": "n/a - feature absent",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "(none)",
  "run_cmd": "setextattr user myattr myval /tmp/ea_test (userland absent: RC=127)",
  "code_hash": "9a7dfebf51208697aa6af71428081185c72335b5a78dd3f7710a62e401a47376",
  "notes": "not_testable class (target feature absent); latent until an FS implements vop_setextattr; fix.diff authored (uio snapshot pre-op, mirroring journal_write :859-868) but not kernel-validated for this reason",
  "recommended_fix": "copy the uio before vop_journal_operate_ap in journal_setextattr, exactly like journal_write (fix.diff)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix authored from the line-accurate mechanism; cannot be runtime-validated on the stock guest (no FS support)",
  "fix_evidence": [
    "fix.diff"
  ]
}