{
  "finding_id": "DF-3216",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "host: python3 craft.py <dir>  (imgA64.img bsize=4096, imgB8.img bsize=1024, dev64.img); scp images + trigger.c/vntool.c/build.sh/run.sh to guest:/root; guest: sh /root/build.sh",
    "run": "guest as root: sh /root/run.sh  (panic variant: skip the decoy block in craft.py or simply ls the mount after reload)",
    "expected": "stock kernel: 'panic: ext2_dirbad: /mnt/e2: bad dir ino 2 at offset 0: mangled entry' on the first post-reload lookup. With decoy image + instrumented module: post-reload reads return zero content, and the write phase logs 'DF3216[WRITE-OOB]: bap[997] <- 1351 at b_data+3988 (buffer size 1024)' style 4-byte OOB heap writes; post-run image forensics show the victim file's indirect block with 0/256 entries and orphaned 0xAA blocks. With fix.diff: correct markers, no OOB prints, consistent on-disk mapping."
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_bmap.c:126",
    "sys/vfs/ext2fs/ext2_bmap.c:255",
    "sys/vfs/ext2fs/ext2_bmap.c:354",
    "sys/vfs/ext2fs/ext2_balloc.c:267",
    "sys/vfs/ext2fs/ext2_vfsops.c:821",
    "sys/vfs/ext2fs/ext2_vfsops.c:991"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "craft.py", "trigger.c", "vntool.c",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "fix_run.log",
    "panic.txt", "env.txt", "instrument.diff", "fix.diff",
    "verdict.json", "manifest.json"
  ]
}