{
  "finding_id": "DF-3248",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1 (in-guest rebuild with fix.diff, per VERDICT.md 'Fix validation')",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff bounds the dirent walk (freeoff validation per bread; every dirent fully inside [20,freeoff) with reclen >= offsetof(de_name)+de_namelen and reclen <= freeoff-dep_offset before any field dereference; DE_END test restructured post-sanity; DE_DOWNLSN bounds-checked; dive depth capped at 64). Identical PoC fails EINVAL at the first insane advance; in-bounds lookups still work. Note: fix_build.log/fix_run.log referenced in README.md were not copied into the pack (reviewer rate-limited); validation outcome per VERDICT.md.",
  "fix_evidence": ["findings/poc/DF-3248/fix.diff", "findings/poc/DF-3248/VERDICT.md#Fix-validation"]
}