{
  "finding_id": "DF-3031",
  "verdict": "untested",
  "impact": "none",
  "summary": "ext2_readdir (ext2_lookup.c:262, dispatched from ext2_vnops.c:2142) fails to dereference a_ncookies when subtracting the unfilled remainder, so the caller keeps the allocated (not used) cookie count; the malloc'd (non-M_ZERO) cookie tail is uninitialized heap — a VOP-contract violation with latent kernel-heap disclosure to any consumer that trusts the count (in-tree NFS consumers are coincidentally dirent-bounded).",
  "evidence": ["findings/poc/DF-3031/VERDICT.md", "findings/poc/DF-3031/fix.diff", "sys/vfs/ext2fs/ext2_lookup.c:262", "sys/vfs/msdosfs/msdosfs_vnops.c:1738"],
  "reproduce": {
    "build": "n/a — static proof (see VERDICT.md); verification skipped by policy for Low/latent findings",
    "run": "n/a",
    "expected": "n/a"
  },
  "kernel_refs": ["sys/vfs/ext2fs/ext2_lookup.c:173", "sys/vfs/ext2fs/ext2_lookup.c:262", "sys/vfs/ext2fs/ext2_vnops.c:2142", "sys/vfs/nfs/nfs_serv.c:3120", "sys/vfs/nfs/nfs_serv.c:3407"],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"],
  "notes": "One-character fix (*ap->a_ncookies -= ncookies). In-tree nfsrv loops pair cookies with dirents bounded by cpos < cend (nfs_serv.c:3066-3067,3101-3102), so no live OOB today; the ncookies==0 stale-cookie retry branch becomes unreachable for ext2 and any future consumer reading cookies[0..ncookies) would disclose uninitialized kernel heap over NFS."
}