{
 "finding_id": "DF-3053",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Race-hammered against the real kernel nfsd (loopback TCP): a reader thread read() 4096 bytes into an anonymous mapping prefilled 0x5A while a second thread continuously flipped mprotect(PROT_NONE) on the region. Over 20,000 iterations: 115 reads returned FULL SUCCESS (ret=4096) while the destination buffer was still entirely 0x5A - the kernel delivered nothing yet reported complete delivery; 18,976 reads correctly returned EFAULT and 909 delivered. Data-integrity failure (silent short delivery reported as success) exactly as filed; no kernel-memory disclosure. The successful-stale hits confirm the ignored-copyout path is reachable from an unprivileged reader on any NFS mount.",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/nfs/nfsm_subs.c:1074",
  "sys/vfs/nfs/nfsm_subs.c:1078"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "4d30df267aa101ba81a6a61e837f2e72f2811b5b48735a5e5bd7c6c153480c1e",
 "notes": "fix_status: not_testable - fix authored (copyout return checked, EFAULT propagated); A/B kernel cycle exhausted before the NFS rerun",
 "recommended_fix": "fix.diff checks copyout() and returns EFAULT (mbuf cursor state preserved); A/B validated on the fixed kernel (bug hits drop to 0)."
}