{
  "finding_id": "DF-2932",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "REPRODUCED. Wall-clock component proven end-to-end as unprivileged uid 1001 (run.log, run.determinism.log: decoded v1 timestamp equals host wall clock to the second, 3/3 runs, version nibble 1). MAC component proven at the helper level on the same guest (module.tap.log): for arpcom-first tap0, if_getanyethermac() returns the interface's exact MAC, which uuid_node() copies into the UUID node field with only the multicast bit ORed (kern_uuid.c:90) — any observer clears that bit and recovers the hardware address; end-to-end via the syscall requires the first IFT_ETHER driver to be arpcom-first (all classic PCI NICs), which this vtnet-only guest lacks (its branch is DF-2931). RFC 4122 sec 6 names this exact MAC exposure; uuidgen(2) is unprivileged and jail-visible (no priv_check/prison check at kern_uuid.c:160), and the MAC/timestamp persist into on-media artifacts (hammer2 PFS ids, disklabel64 stor_uuid).",
  "exploit_chain": "",
  "evidence": [
    "run.log — uid 1001, 4× v1 UUIDs, 'v1 timestamp decoded' == 'host wall clock'",
    "run.determinism.log — timestamp tracks wall clock across 3 runs",
    "module.tap.log — conforming tap0: if_getanyethermac returns exact MAC 00:bd:e8:3f:01:00 (the 6 bytes uuid_node places in the node field)",
    "VERDICT.md — full narrative and impact ceiling"
  ],
  "kernel_refs": [
    "sys/kern/kern_uuid.c:86",
    "sys/kern/kern_uuid.c:90",
    "sys/kern/kern_uuid.c:99",
    "sys/kern/kern_uuid.c:142",
    "sys/kern/kern_uuid.c:160",
    "sys/net/if.c:3033",
    "sys/vfs/hammer2/hammer2_ioctl.c:902",
    "sys/kern/subr_disklabel64.c:472"
  ],
  "poc_changes": "No orchestrator seed (new pass-2 finding); trigger shared with DF-2931 (same uuidleak.c), which decodes the RFC4122 v1 timestamp to demonstrate the wall-clock disclosure.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/uuidleak /tmp/uuidleak.c",
  "run_cmd": "/tmp/uuidleak (as uid 1001)",
  "code_hash": "3da1904abf6ab697031ccb4a7b40e69c4f2100f0f04147c98d6434ee2032bd72",
  "notes": "Privacy/info-disclosure class — no write primitive, no uid=0 route (objective (2): manifests, ceiling = hardware identity + generation-time metadata persisted in UUID artifacts; jail-reachable). MAC end-to-end needs an arpcom-first first NIC (physical boxes); demonstrated at helper level on this guest since its only ether is vtnet (see DF-2931 for that branch).",
  "recommended_fix": "uuid_node(): always use read_random() for the node id (RFC 4122-conformant random node) instead of embedding the host MAC.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (random node ids in uuid_node) and verified git-apply-clean against sys/kern/kern_uuid.c; kernel rebuild validation skipped per contract (leak-class, rebuild mandated only for memory corruption) to keep the guest clean.",
  "fix_evidence": "findings/poc/DF-2932/fix.diff (git apply --check: clean)"
}