# DF-2784 VERDICT

**Status: reproduced (deterministic semantic corruption, certain). Fix validated (fixed).**

## Baseline (stock kernel #0)

Two runs, identical (run.log, run.2.log):

```
child : semval before exit = 30000 (undo owed: -60000)
parent: semval after child exit = 35536
expected (POSIX clamp semantics): 0
BUG REPRODUCED: un_adjval wrapped to +5536, positive branch skipped the clamp
```

Root cause chain, all cited:
1. semop `{+30000 SEM_UNDO, +30000 SEM_UNDO}` applies
   `semundo_adjust(…, -30000)` twice (sysv_sem.c:984-985);
2. `sunptr->un_adjval += adjval` at sysv_sem.c:244 accumulates into a
   `short`: −30000 → −60000 wraps to **+5536**.  `seminfo.semaem`
   (16384) is defined (sysv_sem.c:91) but enforced nowhere;
3. at child exit, `semexit()` reads the wrapped value
   (sysv_sem.c:1107), takes the `adjval >= 0` branch (:1138-1139,
   `semval += adjval`) and skips the `semval < -adjval → clamp to 0`
   protection (:1133-1137);
4. final `semval = 30000 + 5536 = 35536` instead of 0 — visible
   cross-process (parent's GETVAL), i.e. attacker-controllable
   corruption of shared-semaphore state for every participant.

Deterministic: 2/2 baseline runs; exact value predicted from the
16-bit wrap arithmetic (−60000 + 65536 = 5536).

Non-overlap with DF-0046: DF-0046 is the missing **SEMVMX** bound on
**semval** in semop/semexit (u_short overflow of the semaphore value).
This finding is the missing **SEMAEM** bound on the **undo
accumulator** `un_adjval` at sysv_sem.c:244/:259 — different variable,
missing check, and failure mode (sign flip defeating the exit clamp).

## Fix validation (patched kernel #1, fix.diff enforces SEMAEM → ERANGE)

```
child : semop rejected with ERANGE (SEMAEM enforced)
parent: child rejected at semop (ERANGE) - SEMAEM enforcement active, no corruption  (rc=0)
```

Bad value gone: op rejected at adjustment time; semop's existing error
path rolls the semaphore values back; exit applies nothing.

## Impact ceiling

Low — corruption is confined to SysV semaphore *values* (logic/sync
corruption for victim applications sharing the semaphore with the
attacker; no kernel memory safety effect).  Matches DF-0046's Low
rating for the sibling defect.