{
  "finding_id": "DF-3122",
  "verdict": "reproduced (panic, crafted image; OOB read source-certain, runtime-silent)",
  "impact": "panic",
  "reproduce": {
    "build": "host: ./craft.sh ; guest: cc -O2 -o /root/vntool vntool.c",
    "run": "guest root: /root/vntool attach 0 /root/a1.img && mount -t ext2fs /dev/vn0 /mnt/e2 && chmod 777 /mnt/e2/d ; guest maxx: stat /mnt/e2/d/zzqq01",
    "expected": "stock kernel: panic 'ext2_dirbad: : bad dir ino 12 at offset 7168: mangled entry' (ext2_search_dirblock <- ext2_htree_lookup). patched kernel: clean ENOENT, guest up. a2.img stage: silent ENOENT both kernels (OOB probe)."
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_htree.c:142-152",
    "sys/vfs/ext2fs/ext2_htree.c:127-129",
    "sys/vfs/ext2fs/ext2_htree.c:136-140",
    "sys/vfs/ext2fs/ext2_htree.c:381-415"
  ],
  "artifacts": ["README.md", "VERDICT.md", "craft.sh", "trigger.sh", "run.sh", "build.sh", "vntool.c", "build_a.py", "run.log", "run2.log", "run3.log", "panic.txt", "bootlog.full.txt", "fix.diff", "build.log.gz", "fix_run1.log", "fix_run2.log", "fix_valid.log", "env.txt", "notes-df3085.md", "verdict.json", "manifest.json"]
}