# DF-3057 — evidence pack

**Finding:** dirfs_write clobbers the bread() error and ignores bwrite(): unfilled 16KB blocks (stale data of other files) are persisted to the target file and failures report success

**Verdict: REPRODUCED (deterministic harness). Impact: stale/foreign buffer data persisted into an attacker-readable file (CWE-909) + silent data loss; trigger needs a failing host read (Medium).**

## Reproduce
```
./build.sh
./run.sh     # expect BUG CONFIRMED + FIX VALIDATED; rc=2
```

See VERDICT.md for the full narrative; manifest.json / verdict.json for machine-readable results.