{
 "finding_id": "DF-2895",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced as root on the stock guest via the kenv(2) syscall: KENV_SET with a name of exactly KENV_MNAMELEN (128) chars returns 0 (success) - the syscalls copyinstr accepts 129 bytes (kern_environment.c:132) but ksetenv rejects namelen 129 > 128 and stores nothing (kern_environment.c:265-266) - and a follow-up KENV_GET returns ENOENT: the privileged caller believes a boot tunable was set at runtime while it was silently dropped (return of ksetenv discarded at :164). Same at the value boundary and with a full dynamic table. Control: a 127-char name round-trips correctly. On the fix kernel the 128-char set returns -1/EINVAL.",
 "exploit_chain": "",
 "evidence": "run.log baseline: SET rv=0 + GET ENOENT; control 127 chars works; fix kernel: SET rv=-1 errno=22",
 "kernel_refs": [
  "sys/kern/kern_environment.c:164",
  "sys/kern/kern_environment.c:265",
  "sys/kern/kern_environment.c:132"
 ],
 "poc_changes": "KENV_* constants and kenv() prototype declared locally (not in stock headers)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o kenv_set kenv_set.c (as root)",
 "run_cmd": "./kenv_set",
 "code_hash": "006b673329ffdc2a10c39f2c2b7de435fbddea1dc0a1597546685d71a34443df",
 "notes": "Privileged-only (SYSCAP_NOKENV_WR); silent configuration drop",
 "recommended_fix": "Propagate ksetenv failure as EINVAL",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline silent drop; fix kernel propagates EINVAL from ksetenv failure."
}