{
  "finding_id": "DF-2784",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "semundo_adjust() accumulates SEM_UNDO values into the 16-bit signed un_adjval with no SEMAEM enforcement (sysv_sem.c:244). Two +30000 UNDO ops wrap -60000 to +5536; at exit semexit()'s positive branch (sysv_sem.c:1138-1139) skips the clamp-to-0 protection (1133-1137), leaving semval=35536 where POSIX semantics require 0. Deterministic, 2/2 runs, cross-process visible. Distinct from DF-0046 (semval/SEMVMX): this is the undo-accumulator/SEMAEM defect.",
  "exploit_chain": "",
  "evidence": [
    "run.log / run.2.log: 'parent: semval after child exit = 35536' + 'BUG REPRODUCED: un_adjval wrapped to +5536' (2/2)",
    "VERDICT.md: full wrap arithmetic (-60000+65536=5536) and root-cause chain"
  ],
  "kernel_refs": [
    "sys/kern/sysv_sem.c:244",
    "sys/kern/sysv_sem.c:259",
    "sys/kern/sysv_sem.c:1133-1140",
    "sys/kern/sysv_sem.c:91"
  ],
  "poc_changes": "Added ERANGE detection path (child _exit(42), parent recognizes) so the same binary demonstrates both baseline corruption and post-fix rejection.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o adjval_wrap adjval_wrap.c",
  "run_cmd": "./adjval_wrap",
  "code_hash": "a7e089f44961c03ddd11b4d5af55bd95364b15005315721034959e8c0eaed863",
  "notes": "Impact enum 'none': corruption is confined to SysV semaphore values (synchronization logic for semaphore participants), not kernel memory. Severity Low, matching DF-0046 for the sibling SEMVMX defect.",
  "recommended_fix": "Enforce seminfo.semaem on both the accumulate (:244) and create (:259) paths of semundo_adjust, returning ERANGE (validated: op rejected, no corruption).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Tue Sep  1 06:03:53 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel rejects the +30000 UNDO op with ERANGE ('SEMAEM enforcement active, no corruption', rc=0); the 35536 corruption is gone.",
  "fix_evidence": [
    "run.fixed.log: 'parent: child rejected at semop (ERANGE) - SEMAEM enforcement active, no corruption'",
    "fix.diff"
  ]
}