{
 "finding_id": "DF-2825",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced on the stock guest: fcntl(F_SETLK, l_start=10, l_len=-5) returns -1/EINVAL (kern_lockf.c:230-231 rejects negative lengths outright), while POSIX.1-2008 (and FreeBSD/Linux) interpret l_len<0 as the byte range [l_start+l_len, l_start-1] = [5,9]; portable backward-lock applications fail closed on DragonFly. Fail-closed only (no memory safety). On the fix kernel the identical call returns 0 (lock accepted with POSIX semantics). The PoCs F_GETLK cross-check is blind to the callers own lock (F_GETLK ignores locks held by the calling process), so the acceptance rv=0 is the decisive A/B signal.",
 "exploit_chain": "",
 "evidence": "run.log baseline: rv=-1 errno=22; fix kernel: rv=0 errno=0",
 "kernel_refs": [
  "sys/kern/kern_lockf.c:230",
  "sys/kern/kern_lockf.c:229"
 ],
 "poc_changes": "F_GETLK self-check documented as blind to own-process locks",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o lockf_neg lockf_neg.c",
 "run_cmd": "./lockf_neg",
 "code_hash": "ec6c2543e8eacfc1a24530cd73d828fb86e93fd7c5513d6b7368e1915158342b",
 "notes": "Fail-closed deviation; no security impact",
 "recommended_fix": "Convert negative l_len to [start+l_len, start-1] per POSIX instead of EINVAL",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline EINVAL; fix kernel accepts per POSIX [l_start+l_len, l_start-1] semantics."
}