{
 "finding_id": "DF-3269",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Reproduced against the kernel source file itself: sys/net/zlib.c compiled without _KERNEL (a configuration its own ifdef ladder supports), driven by an instrumented allocator that 0xAA-fills every allocation (provably uninitialized, matching ng_deflates kmalloc without M_ZERO) and fails the Nth allocation. With the window allocation failing, deflateInit2_ returns Z_MEM_ERROR after 5 allocations, and the error-path deflateEnd returns Z_STREAM_ERROR - because s->status is 0xAAAAAAAA garbage that matches no valid state - with FOUR allocations still live (leaked); a clean init+End leaves zero live. The return value of deflateEnd is decided by uninitialized memory exactly as claimed, and the leak is ~4 allocations per failed init (up to ~256KB at windowBits 15/memLevel 8 for the later allocations). Kernel trigger requires kmem exhaustion inside ng_deflate; the userland harness exercises the identical defect code path in the identical source.",
 "exploit_chain": "",
 "evidence": "run.log (case 1: Z_STREAM_ERROR from garbage status + live=4 LEAKED; case 2 sanity: live=0), zharness.c, zlib_userland.c (verbatim sys/net/zlib.c with MODULE_VERSION ifdefd)",
 "kernel_refs": [
  "sys/net/zlib.c:785-800",
  "sys/net/zlib.c:1108-1127"
 ],
 "poc_changes": "zlib.c compiles userland natively except MODULE_VERSION(zlib,1) which is now ifdeffed _KERNEL in the packed copy; MAX() is defined for the non-kernel build",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O -o zharness zharness.c zlib_userland.c -I.",
 "run_cmd": "guest: ./zharness",
 "code_hash": "8d49b5ef41539df8df2d3f4eb4a69c40c2102ad500719629e166cea18abd4f69",
 "notes": "method note: userland build of sys/net/zlib.c itself (its ifdef ladder supports non-kernel builds); kernel trigger needs kmem exhaustion inside ng_deflate",
 "recommended_fix": "s->status = INIT_STATE immediately after the state allocation; the same harness against the patched file returns Z_OK on the failure path with zero live allocations"
}