{
 "finding_id": "DF-3089",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation; no runtime manifestation exists on this platform/compiler (both copies are absorbed by struct padding). NFSKERBKEY_T is u_char[2] (rpcv2.h:133); both nfs_getauth and nfs_savenickauth declare it as a by-value array parameter, so sizeof(NFSKERBKEY_T) inside the function is the pointer size 8: nfs_getauth bcopys 8 bytes out of the 2-byte nmp->nm_key (6-byte in-struct overread, nfs_syscalls.c:1075) and nfs_savenickauth bcopys 8 bytes into the 2-byte nuidp->nu_key at offset ~284 of the 320-byte struct nfsuid (6 bytes into allocator padding, :1208). Fix copies sizeof(member) (2) at both sites; compiled in the F40FIX build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/vfs/nfs/rpcv2.h:133",
  "sys/vfs/nfs/nfs_syscalls.c:1075",
  "sys/vfs/nfs/nfs_syscalls.c:1208"
 ],
 "poc_changes": "n/a - padding-absorbed on this ABI",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": null,
 "notes": "",
 "recommended_fix": "bcopy sizeof(nmp->nm_key)/sizeof(nuidp->nu_key) instead of the decayed parameter type",
 "fix_status": "compile_validated",
 "fix_verdict": "fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)"
}