# DF-2770 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Mechanically reproduced on the stock guest with a pty pair in TIOCPKT mode: after TIOCEXT (EXTPROC on) a slave tcsetattr queues the TIOCPKT_IOCTL packet (tty_pty.c:1248); the master full-buffer read returns 0x40 + 44 termios bytes (sanity phase). A second event read into [1 valid byte][1 PROT_NONE byte] returned rv=1 with errno=0: ureadc delivered the 0x40 control byte, then uiomove(termios,1) hit EFAULT which the code discards (tty_pty.c:721-722), consumed pt_send (tty_pty.c:724) and reported success - the control event and the termios snapshot are silently lost and the short read is EOF-indistinguishable, exactly as filed. On the fix kernel the same faulting read returns -1/EFAULT (retryable).

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)