{
  "finding_id": "DF-3031",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect certain, impact latent: ext2_readdir reports the allocated cookie count and never corrects it because line 262 does pointer arithmetic (ap->a_ncookies -= ncookies) instead of writing through the pointer. The cookie array is mallocd without M_ZERO, so the unfilled tail is uninitialized kernel heap; todays only consumers (nfs_serv.c:3045/3337) are coincidentally dirent-bounded, so no live disclosure exists in-tree \u2014 filed Low as a VOP-contract violation with latent heap-leak/OOB-read for any consumer that trusts the count. Verification skipped by policy (Low/latent; no runnable local trigger).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3031/VERDICT.md \u2014 static proof with sibling-FS comparison (msdosfs_vnops.c:1738 dereferences)",
    "findings/poc/DF-3031/fix.diff \u2014 one-character fix"
  ],
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_lookup.c:262",
    "sys/vfs/ext2fs/ext2_lookup.c:173",
    "sys/vfs/ext2fs/ext2_vnops.c:2142",
    "sys/vfs/nfs/nfs_serv.c:3120",
    "sys/vfs/nfs/nfs_serv.c:3407"
  ],
  "poc_changes": "n/a \u2014 no PoC seed; static-proof pack only",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Skip sanctioned: Low severity hardening/latent class per Phase V policy (only Critical/High, memcorrupt/privesc, or trivially-runnable local PoCs require guest verification).",
  "recommended_fix": "*ap->a_ncookies -= ncookies; (dereference the pointer; optionally M_ZERO the cookie malloc)"
}