{
  "finding_id": "DF-2837",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sysctl_handle_sb_max (uipc_socket2.c:686-704) maintains the u_long sb_max with sizeof(int) SYSCTL_IN/SYSCTL_OUT transfers. Demonstrated as root: an 8-byte sysctl write of 0x100001000 returns success and stores only the low half (sb_max=0x1000); a write of 0x100080000 stores 0x80000 - magnitude silently wrong by 4 GiB with rc=0. The high 32 bits of sb_max are provably always zero (this handler is the only writer), so no out-of-bounds sb_max is reachable; impact is silent corruption of a root-settable limit plus a truncated read side. Hardening finding: reproduced exactly as derived, no security impact.",
  "exploit_chain": "",
  "evidence": [
    "run.log: 'write #1 ... -> sysctl returned 0 (ok)' then 'sb_max = 4096 (0x1000) <-- low 32 bits kept, high half silently dropped'",
    "run.log: 'write #2 ... sb_max = 524288 (0x80000) <-- became 0x80000, magnitude wrong by 4 GiB'"
  ],
  "kernel_refs": [
    "sys/kern/uipc_socket2.c:686-704",
    "sys/kern/uipc_socket2.c:75-77"
  ],
  "poc_changes": "Seed written fresh; no changes needed after the first run.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o sbmax sbmax.c",
  "run_cmd": "/tmp/sbmax (as root; restores previous value)",
  "code_hash": "edc19e40abf61d7502f6a7b686facf570e9790b327158201fb14f657f79fa145",
  "notes": "Root-only writer, no unprivileged attack surface; value restored after the run. sb_max_adj recompute path itself uses 64-bit math and is fine.",
  "recommended_fix": "Round-trip the sysctl value through an explicit int temporary in sysctl_handle_sb_max so the stored, validated and reported values agree (see fix.diff).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info-severity finding; no behavioral kernel validation performed - for well-formed int-width sysctl use the patched behavior is identical by construction. The fix.diff was applied to the guest's /usr/src copy after the DF-2836/DF-2838 validation runs and compile-checked with the kernel's own preprocessor flags in the kernel objdir (cc -fsyntax-only ... rc=0).",
  "fix_evidence": [
    "findings/poc/DF-2837/fix.diff"
  ]
}