{
  "finding_id": "DF-2827",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "ckpt_thaw_proc() never validates ehdr->e_phnum. With e_phnum == 0, kmalloc(0, M_TEMP, M_WAITOK) returns ZERO_LENGTH_PTR ((void *)-8) and the subsequent 'phdr->p_filesz' load (kern_checkpoint.c:240) reads kernel VA 0x18, producing an unconditional supervisor page fault: 'Fatal trap 12: page fault while in kernel mode, fault virtual address = 0x18 ... Stopped at sys_sys_checkpoint+0x2f0: movq 0x20(%rax),%rax' (0x20 = offsetof(Elf64_Phdr, p_filesz)). Panic reproduces on the stock kernel from a fresh snapshot; requires only the 64-byte ELF header to be well-formed, no file handles or note content. Gate: kern.ckptgroup (wheel by default); non-wheel users get EPERM before parsing. DoS only - the loaded value feeds the nthreads sanity check in elf_getnotes which rejects garbage.",
  "exploit_chain": "",
  "evidence": [
    "panic.txt: Fatal trap 12, fault VA 0x18, instruction movq 0x20(%rax),%rax with rax=(void*)-8",
    "fix_run.log (in ../DF-2826): patched kernel returns clean error, no trap",
    "gen.c: 'zero' mode generates the e_phnum == 0 image"
  ],
  "kernel_refs": [
    "sys/kern/kern_checkpoint.c:232-233",
    "sys/kern/kern_checkpoint.c:240",
    "sys/kern/kern_slaballoc.c:882-891"
  ],
  "poc_changes": "Reuses the DF-2826 generator with phnum_mode=zero (e_phnum=0, no phdr table written); trigger identical to DF-2826's fd3 trigger.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 1,
  "build_cmd": "sh build.sh (guest /root/df2826)",
  "run_cmd": "./gen df2827.ckpt stage2.bin zero && ./trigger_fd3 df2827.ckpt",
  "code_hash": "97b2db55c59c2d7ec05e4893891f1e219b55d43b3e5a2beda7e045e3ddea1920 (trigger_fd3.c); gen.c 65494a03170e0bd568ab2bb20b7b76b68b4f318e572cc2a42ad01140cde57e5e",
  "notes": "Wheel-gated local kernel panic; no memory-safety impact beyond the fault itself. Same-clos fix as DF-2826.",
  "recommended_fix": "Reject e_phnum == 0 (and sanity-bound it) in ckpt_thaw_proc() before the kmalloc - included and validated in ../DF-2826/fix.diff.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Sep  1 20:00:55 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "With the e_phnum==0 rejection in the patched kernel, sys_checkpoint returns a clean error (-1/EINVAL per the trigger) and no Fatal trap occurs; kernel stays up. Baseline panic captured in panic.txt.",
  "fix_evidence": "findings/poc/DF-2827/panic.txt; findings/poc/DF-2826/fix_run.log; findings/poc/DF-2826/fix.diff"
}