{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -o df3023 trigger.c",
    "run": "as unprivileged user on tmpfs /tmp: ./df3023  (probe pwrite(16384 @ -16384) -> EFAULT; then pwrite(32752 @ -32752) -> kernel panic 'assertion newsize >= 0 failed in tmpfs_reg_resize' at tmpfs_subr.c:990, guest drops to db>)",
    "expected": "baseline: panic, guest down (reproduced twice from clean boots); patched (fix.diff, make nativekernel): both return EINVAL=22, guest stays up, normal I/O regression-clean"
  },
  "kernel_refs": [
    "sys/vfs/tmpfs/tmpfs_vnops.c:666",
    "sys/vfs/tmpfs/tmpfs_vnops.c:713",
    "sys/vfs/tmpfs/tmpfs_vnops.c:760",
    "sys/vfs/tmpfs/tmpfs_vnops.c:559",
    "sys/vfs/tmpfs/tmpfs_subr.c:990",
    "sys/kern/sys_generic.c:360",
    "sys/sys/_uio.h:59"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger.c", "fix.diff", "build.sh", "run.sh",
    "run.log", "run.patched.log", "boot_panic_raw.txt", "panic.txt",
    "fix_build.log", "env.txt", "manifest.json", "verdict.json"
  ]
}