{
  "finding_id": "DF-3031",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect certain, impact latent: ext2_readdir reports the allocated cookie count and never corrects it because line 262 does pointer arithmetic (ap->a_ncookies -= ncookies) instead of writing through the pointer. The cookie array is malloc'd without M_ZERO, so the unfilled tail is uninitialized kernel heap; today's only consumers (nfs_serv.c:3045/3337) are coincidentally dirent-bounded, so no live disclosure exists in-tree — filed Low as a VOP-contract violation with latent heap-leak/OOB-read for any consumer that trusts the count. Verification skipped by policy (Low/latent; no runnable local trigger).",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-3031/VERDICT.md — static proof with sibling-FS comparison (msdosfs_vnops.c:1738 dereferences)", "findings/poc/DF-3031/fix.diff — one-character fix"],
  "kernel_refs": ["sys/vfs/ext2fs/ext2_lookup.c:262", "sys/vfs/ext2fs/ext2_lookup.c:173", "sys/vfs/ext2fs/ext2_vnops.c:2142", "sys/vfs/nfs/nfs_serv.c:3120", "sys/vfs/nfs/nfs_serv.c:3407"],
  "poc_changes": "n/a — no PoC seed; static-proof pack only",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Skip sanctioned: Low severity hardening/latent class per Phase V policy (only Critical/High, memcorrupt/privesc, or trivially-runnable local PoCs require guest verification).",
  "recommended_fix": "*ap->a_ncookies -= ncookies; (dereference the pointer; optionally M_ZERO the cookie malloc)"
}