{
  "finding_id": "DF-3124",
  "title": "cd9660 kiconv mount ignores iconv_open() failure — NULL iconv handles panic the kernel on first lookup (convchr(NULL) NULL-deref)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O -o /root/trigger /root/trigger.c -I/usr/src/sys   (in guest, as root)",
    "setup": "vnconfig -c -S 2048 /dev/vn0 /root/poc.iso; kldload libiconv; kldload cd9660_iconv; mkdir -p /mnt/poc",
    "run": "/root/trigger",
    "baseline": "mount_cd9660 /dev/vn0 /mnt/poc && stat /mnt/poc/a && umount /mnt/poc   (no kiconv: clean ENOENT, no panic)",
    "expected": "trigger prints 'mount succeeded with ISOFSMNT_KICONV and failed iconv_open', then stat() panics: 'Fatal trap 12: page fault ... fault virtual address = 0x0 ... Stopped at iconv_convchr+0x27: movq (%rdi),%rsi'"
  },
  "kernel_refs": [
    "sys/vfs/isofs/cd9660/cd9660_vfsops.c:494",
    "sys/vfs/isofs/cd9660/cd9660_vfsops.c:495",
    "sys/vfs/isofs/cd9660/cd9660_vfsops.c:584",
    "sys/vfs/isofs/cd9660/cd9660_util.c:isochar",
    "sys/vfs/isofs/cd9660/cd9660_util.c:sgetrune",
    "sys/vfs/isofs/cd9660/cd9660_lookup.c:237",
    "sys/libiconv/iconv.c:290"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger.c", "poc.iso", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "panic.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}