{
 "finding_id": "DF-2964",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced as root on the stock guest: a GPT header with signature XXNOTGPT (not EFI PART), wrong hdr_crc_table (0xDEADBEEF) but a correct hdr_crc_self was fully parsed as GPT - /dev/vn0s0 was created from entry 0 and dmesg showed the kernel walking all 128 entries (subr_diskgpt.c validates only hdr_size bounds and hdr_crc_self at :112-125; hdr_sig/hdr_revision/hdr_crc_table are never read - rg confirms zero references). Under the crafted-media threat model the attacker controls the table bytes anyway, so this is spec-compliance/robustness hardening; all consumed fields are independently bounds-checked. On the fix kernel the same image is rejected: disk: Wrong GPT signature, no slice devices.",
 "exploit_chain": "",
 "evidence": "run.log baseline: slices created from garbage-signature GPT; fix kernel: disk: Wrong GPT signature + no vn0s0",
 "kernel_refs": [
  "sys/kern/subr_diskgpt.c:112",
  "sys/kern/subr_diskgpt.c:186",
  "sys/sys/gpt.h:36"
 ],
 "poc_changes": "gen_gpt_corrupt.c derived from the DF-2963 rig (same CRC helpers) with corrupted sig + table CRC",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 90,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o gen_gpt_corrupt gen_gpt_corrupt.c",
 "run_cmd": "./gen_gpt_corrupt && vnconfig -c vn0 /tmp/df2964.img; ls /dev/vn0*; dmesg | tail; vnconfig -u vn0",
 "code_hash": "65f912676852b1304e9fb33f1b2fa40f13b4e72b13e9a86ecb4743db7c0da9ba",
 "notes": "Robustness gap observed incidentally during DF-2963 verification",
 "recommended_fix": "Require the GPT_HDR_SIG signature and validate hdr_crc_table over the entry array",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline accepts garbage-signature header; fix kernel requires the EFI PART signature and validates the table CRC."
}