{
  "verdict": "not_reproduced",
  "impact": "none",
  "reproduce": {
    "build": "cc -O2 -include unistd.h -o oob_oracle oob_oracle.c",
    "run": "./oob_oracle",
    "expected": "All bind/connect attempts with 2-byte/8-byte sockaddrs return EINVAL on the stock kernel: the handler reads sin_addr/sin6_addr beyond the copied length (code-proven, and the decision is live for in-bounds multicast bytes: 5-byte sockaddr with byte4=224 -> EAFNOSUPPORT) but the recycled-byte oracle (groomed EAFNOSUPPORT flip for namelen<=4) never fires on DF's slab allocator (remote-free z_RChunks topology defeats userland grooming; v6 neighbor byte is structurally sa_len=8)."
  },
  "kernel_refs": [
    "sys/netinet/tcp_usrreq.c:316-321",
    "sys/netinet/tcp_usrreq.c:406-411",
    "sys/netinet/tcp_usrreq.c:597-602",
    "sys/netinet/tcp_usrreq.c:640-656",
    "sys/netinet/tcp_usrreq.c:965-968",
    "sys/kern/uipc_syscalls.c:1513-1532",
    "sys/kern/kern_jail.c:459-480",
    "sys/netinet/in_pcb.c:648",
    "sys/netinet6/in6_pcb.c:129",
    "sys/netinet6/in6_pcb.c:282",
    "sys/kern/kern_slaballoc.c:1491-1547"
  ],
  "artifacts": [
    "oob_oracle.c",
    "probe.c",
    "probe_affinity.c",
    "probe_hammer.c",
    "probe_fleet.c",
    "run.log",
    "probe.log",
    "probe2.log",
    "probe_matrix.log",
    "probe3.log",
    "VERDICT.md",
    "README.md",
    "run.sh",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}