{
  "finding_id": "DF-3046",
  "title": "TAG_OVERLOAD consumed without length validation: zero-length overload at region end reads one byte past the region",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "on the guest: sh build.sh  (sha256-gates bootp_subr.c to the audited tree, compiles the verbatim source via the harness into the kernel; reboot)",
    "run": "sysctl -w kern.dfrig12=1; sysctl -n kern.dfrig12_status  (also inspect dmesg for the per-subtest console lines)",
    "expected": "baseline: T1a overload=0xa5 == planted byte past region end with badopt=0; T1b len=3 overload=0x02; T1c full-size reply overload=0x03 == guard at bp+sizeof; T1c2 replylen=1458 overload=0xee == tail padding past vend[1221]; T1d/T1e overload tracks planted bp->file[0] (0x5c then 0x77); T1f chained adoption 0x77. Fixed: every planted byte rejected (badopt=1), overload keeps only the legitimate len==1 value."
  },
  "kernel_refs": [
    "sys/vfs/nfs/bootp_subr.c:1283-1287",
    "sys/vfs/nfs/bootp_subr.c:1299-1300",
    "sys/vfs/nfs/bootp_subr.c:1320-1332",
    "sys/vfs/nfs/bootp_subr.c:105"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig12_bootp.c", "build.sh", "run.sh",
    "run.log", "run.fixed.log", "fix_validation.log", "fix.diff",
    "fix_combined.diff", "build.log", "build_fixed.log", "env.txt",
    "manifest.json", "verdict.json"
  ]
}