{
  "finding_id": "DF-2792",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sys_ioprio_get()'s PRIO_PGRP scan (kern_resource.c:366-368) gates members on p->p_nice while assigning p->p_ionice; the PROCESS/USER paths compare p_ionice. Deterministic unprivileged PoC: pgrp members with ionice {1,2,8} and nice {0,5,1} yields ioprio_get(PRIO_PGRP)=2 while ioprio_get(PRIO_USER)=8, and the call can even return ESRCH with live members when no member's nice exceeds the running high. Pure correctness defect in a query API (wrong I/O-priority hint to userland); no memory safety, disclosure, or privilege impact. Reproduced identically on stock kernel #0 and the DF-2791-patched kernel #1.",
  "exploit_chain": "",
  "evidence": [
    "run.log / run.2.log: 'ioprio_get(PRIO_PGRP, 965) = 2 (correct max = 8)' with USER path returning 8"
  ],
  "kernel_refs": [
    "sys/kern/kern_resource.c:366",
    "sys/kern/kern_resource.c:368",
    "sys/kern/kern_resource.c:408"
  ],
  "poc_changes": "Dropped local ioprio_set/ioprio_get wrappers (DF libc already declares them in sys/resource.h), added signal.h; syscall numbers 520/521 from syscalls.master.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o ioprio_pgrp ioprio_pgrp.c",
  "run_cmd": "./ioprio_pgrp",
  "code_hash": "b82da74631f4bdaee7089f1a454d51d2efb2c8e790c80acd2345507794665257",
  "notes": "ESRCH variant (all members nice <= running high) also reachable per source, not separately demoed.",
  "recommended_fix": "Compare p->p_ionice instead of p->p_nice in the ioprio_get PRIO_PGRP member scan (fix.diff).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line field fix authored (fix.diff); dedicated kernel rebuild not performed for a Low correctness finding — behavior validated by inspection against the correct PROCESS/USER paths in the same function.",
  "fix_evidence": ["fix.diff"]
}