# DF-2812 VERDICT — reproduced (defined local symbol fails to resolve: "link_elf: symbol s undefined")

**Status: reproduced.** Stock guest kernel
`DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC`.

## Evidence

Control module (STB_GLOBAL "s", one R_X86_64_64 reloc against it):
```
$ kldload /tmp/globalsym.ko; echo GLOBALSYM_RC=$?
GLOBALSYM_RC=0
 $ kldstat | tail -1
 4    1 0xfffff80116944000     1000 globalsym.ko
$ kldunload /tmp/globalsym.ko; echo UNLOAD_RC=0
```
(run.log) — the generator produces fully valid ET_EXEC KLD modules for
link_elf_load_file, so the failure below is attributable solely to the
bind byte.

Test module (byte-identical except st_info: STB_LOCAL "s"):
```
$ kldload /tmp/localsym.ko; echo LOCALSYM_RC=$?
kldload: an error occurred while loading module /tmp/localsym.ko. ...
LOCALSYM_RC=1
console: link_elf: symbol s undefined
```
(run.log) — the symbol is *defined in the module itself*
(st_shndx=1, st_value=0x80) yet resolution fails.

## Root cause
sys/kern/link_elf.c:1003-1008 — the STB_LOCAL branch of elf_lookup()
returns the resolved kernel address as the function's int return value
(the errno channel) and never writes the out-parameter:

```c
	return ((Elf_Addr) ef->address + sym->st_value);   /* :1007 */
```

The contract (sys/sys/linker.h:327 `typedef int elf_lookup_fn(...,
Elf_Addr *)`, consumer sys/cpu/x86_64/misc/elf_machdep.c:123-125) is
"nonzero return = failure; address via *result". The truncated heap
pointer is nonzero, so elf_reloc_internal reports failure → relocate_file
(sys/kern/link_elf.c:718-722) prints "symbol s undefined" and the load
aborts. If the truncated value happened to be 0, elf_machdep.c:125 would
instead compute `val = addr + addend` from an uninitialized stack `addr`
and store it into the module image (uninitialized-stack-value write into
kernel memory that the module then executes).

This is a half-converted fossil of the old `Elf_Addr elf_lookup(...)`
API; the global branch at :1022 was converted correctly, and
link_elf_obj.c's elf_obj_lookup (:1149-1150) shows the correct form
(`*result = ...; return (0);`).

## Impact
Root-gated (kldload). Primary observable: ET_EXEC KLD modules with
STB_LOCAL relocations cannot load at all (functional bug present since the
elf_machdep conversion), with a latent uninitialized-stack-value write on
the measure-zero path. Low severity; security interest is the uninit
write and the fact that the failure message itself routes through
symbol_name() (the DF-0062 unbounded-st_name surface).

## Fix validation
fix.diff converts :1007 to `*result = (Elf_Addr) ef->address +
sym->st_value; return (0);`. Patched kernel: `kldload /tmp/localsym.ko`
returns RC=0 (loads, relocates the local symbol correctly, unloads) —
run_fix.log.