{
  "finding_id": "DF-2963",
  "verdict": "reproduced",
  "impact": "cross_slice_data_aliasing",
  "confidence": "certain",
  "reproduce": {
    "build": "sh /root/df2963/build.sh  (cc -O -o gen_gpt gen_gpt.c; cc -O -o trigger trigger.c; ./gen_gpt /root/df2963.img)",
    "run": "sh /root/df2963/run.sh   (vnconfig -c vn0 /root/df2963.img; /root/df2963/trigger /dev/vn0; vnconfig -u vn0)",
    "expected": "st_rdev(/dev/vn0s127) == st_rdev(/dev/vn0s0) (0x1e100807) with distinct st_ino; read via vn0s127 returns slice 0/entry 0 data ('ENTRY0ZONE...') instead of entry 127's ('ENTRY127ZONE' at LBA 1000); DIOCGPART on vn0s127 reports slice 0's extent (offset 17408, 30 blocks); 512-byte write via vn0s127 lands on absolute LBA 34 (slice 0's region). On fix.diff-patched kernel: /dev/vn0s127 absent, dmesb 'only 127 slice devices representable, ignoring entry 127'."
  },
  "kernel_refs": [
    "sys/kern/subr_diskgpt.c:175",
    "sys/kern/subr_diskgpt.c:201-204",
    "sys/kern/subr_diskgpt.c:222",
    "sys/kern/subr_disk.c:448-451",
    "sys/sys/diskslice.h:107",
    "sys/sys/diskslice.h:252-253",
    "sys/sys/diskslice.h:327-333",
    "sys/kern/subr_diskslice.c:380-387",
    "sys/vfs/devfs/devfs_core.c:2439-2484",
    "sys/vfs/devfs/devfs_core.c:2571-2578"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "gen_gpt.c", "trigger.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "run.3.log", "run.fixed.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}