{
  "finding_id": "DF-2843",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "vnode_pager_generic_putpages() (sys/vm/vnode_pager.c:776-781) clears the dirty state of all ncount pages and reports VM_PAGER_OK whenever VOP_WRITE returns error==0, even when auio.uio_resid != 0 (short write). The residual is logged (rate-limited) but the unwritten bytes are silently dropped from the pageout pipeline: the page can later be reclaimed and re-fetched from disk, resurrecting stale on-disk content in place of the application's writes, and pageout never retries because rtvals say OK. Not verified on the guest: no filesystem available there (hammer2/ufs/tmpfs/devfs) returns 0 with residual on VOP_WRITE under normal operation, so an honest trigger does not exist on the stock kernel; classified untested rather than fabricating an FS-specific trigger.",
  "exploit_chain": "",
  "evidence": ["README.md: code excerpt with line cites and fix"],
  "kernel_refs": ["sys/vm/vnode_pager.c:771", "sys/vm/vnode_pager.c:776"],
  "poc_changes": "no PoC run; trigger requires a filesystem exhibiting short-but-clean VOP_WRITE",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "write-side sibling of the DF-2663 short-read silent-substitution family; severity Low (integrity, gated on FS behavior)",
  "recommended_fix": "only undirty/report OK when error==0 && auio.uio_resid==0; otherwise treat residual as EIO for the undirty decision"
}