{
 "finding_id": "DF-2888",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation (the wrap needs 2^31 aggregate events - days of sustained load, not demonstrable within a verification session): vcnt (vm_meter.c:245-253) accumulates the u_int per-CPU vmmeter fields into an int count and exports it; vcnt_intr (:259-272) same. Once a per-CPU counter (or the cross-CPU sum) passes 2^31 - reachable in days at ~10k ctx switches/s/CPU - vm.stats.sys.* / vm.stats.vm.* wrap negative/incorrect for systat/top; no in-kernel reader. Correctness/hardening only. Fix (int64_t accumulate, u_int export) compiled in the fix kernel.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: signed-accumulate analysis; fix.diff widens the accumulator",
 "kernel_refs": [
  "sys/vm/vm_meter.c:245",
  "sys/vm/vm_meter.c:259"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "06b80117f332246490cc04dadbedfecdab8e5d34adf37faf9116548beeb127de",
 "notes": "Stats correctness only",
 "recommended_fix": "Accumulate into int64_t and export u_int",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "Widened accumulators compiled and booted; sysctl vm.stats output identical for small values in A/B."
}