# DF-2935 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation (the deviation is deny-only on every reachable path, so there is no userland-visible demonstration): vop_helper_access selects cr_ruid/cr_rgid (REAL ids) whenever a_flags lacks AT_EACCESS (vfs_helper.c:88-94) - correct for access(2)/faccessat(2) - but the bare 3-arg VOP_ACCESS macro (vfsops.h:1040-1041) also passes flags=0, so kernel-internal authorization callers get REAL-ID checks while the primary open(2) gate naccess_lva uses EFFECTIVE ids (vfs_nlookup.c:1854-1874); on all reachable internal paths the deviation is spurious EACCES only (sys_fhopen euid-0-gated, fp_vpopen kernel-only, tmpfs/ext2 checks behind nlookup's effective-ID gate). Latent hazard: any new internal VOP_ACCESS caller or gate-reorder turns real-ID matching into an authorization GRANT for setuid contexts. Fix (7 internal call sites switched to VOP_EACCESS) compiled in the fix kernel.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)