{
 "finding_id": "DF-3069",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not attempted on the guest: demonstrating the memory-exhaustion requires forging on the order of a million CRC-valid, seqno-monotonic REDO_TERM records across the undo FIFO of a crafted image (~1GB of undo for a visible mount-time stall against 4GB RAM) - beyond the crafted-image rig budget for a Low/DoS return. Code-verified: one kmalloc per unique TERM key (hammer_recover.c:1177) plus one per occurrence (:1202-1205), all freed only at stage2 end (:731-738); nothing enforces the documented must-fit-in-memory constraint (:611).",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_recover.c:611",
  "sys/vfs/hammer/hammer_recover.c:1177",
  "sys/vfs/hammer/hammer_recover.c:1202"
 ],
 "poc_changes": "none",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "see README.md",
 "code_hash": null,
 "notes": "fix_status: not_testable (not reproduced)",
 "recommended_fix": "diff: cap total rterm+rte allocations (e.g. 64MB) in hammer_recover_stage2 and fail EIO when exceeded (REDO replay is optional by design).\n"
}