{
 "finding_id": "DF-2965",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced on the stock guest: sbrk(4096) + copying a 5-byte ret-42 thunk into the page + calling it printed 42 - the brk heap is genuinely executable (sys_sbrk vm_unix.c:141 and sys_obreak :227 pass VM_PROT_ALL as BOTH prot and max_protection; on amd64 the pmap honors VM_PROT_EXECUTE). A/B nuance: with the fix (prot=VM_PROT_RW, max_protection kept VM_PROT_ALL as a compat escape hatch) the brk vm_map entry now reports rw- (/proc/self/map: 0x402000-0x406000 rw- NCOW NNC none), but CALLING heap code still succeeds on this guest - a control mmap(PROT_READ|PROT_WRITE) is equally executable here, i.e. this QEMU vCPU configuration does not enforce NX for user pages despite machdep.pmap_nx_enable=1 and CPUID NX. The kernel-side mapping change is real and verified; hardware enforcement of the dropped EXEC bit cannot be demonstrated on this platform configuration. Filed as defense-in-depth (historical BSD behavior; adds nothing beyond mmap RWX which any process can request), so impact stays none.",
 "exploit_chain": "",
 "evidence": "run.log baseline: ret=42 (heap exec); fix kernel: /proc/self/map brk entry rw- (was rwx) + NX-platform control (plain RW mmap also executable)",
 "kernel_refs": [
  "sys/vm/vm_unix.c:141",
  "sys/vm/vm_unix.c:227",
  "sys/sys/vm.h:87"
 ],
 "poc_changes": "added /proc/self/map protection dump and an RW-mmap exec control to separate map-level from plevel enforcement",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o brk_exec brk_exec.c",
 "run_cmd": "./brk_exec",
 "code_hash": "fb9dc839101925541bf382dcdd55384eaa4b1c87cc2a890e3aee07cbc2b7c9c1",
 "notes": "Full W^X would also drop EXEC from max_protection and from the ELF data segment",
 "recommended_fix": "Map brk VM_PROT_RW (optionally keep max VM_PROT_ALL as compat escape hatch)",
 "fix_status": "partial",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "vm_map-level fix verified (brk entry rw-); execution still succeeds because NX is not enforced by this vCPU configuration for ANY mapping (control experiment) - the max_protection=ALL escape hatch additionally permits mprotect back to X by design."
}