{
  "finding_id": "DF-3397",
  "status": "build_failed",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent type/width bug (certain from source): rx-ring init writes a 4-byte int into the const uint16_t nr_buf_size field (netmap.h:225), clobbering the adjacent uint16_t flags (netmap.h:226) with the high half of NETMAP_BDG_BUF_SIZE; the tx-ring path at :945 uses the correct uint16_t store. Benign with default 2KB pools (high half 0), changes rx-ring semantics with >=64KB buf pools. PoC impossible: module does not compile on this tree.",
  "exploit_chain": "",
  "evidence": [
    "VERDICT.md — the 4-byte vs 2-byte store asymmetry (:974 vs :945) and the adjacent-field layout (netmap.h:225-226)",
    "netmap_build.log — module build failure on this tree"
  ],
  "kernel_refs": ["sys/net/netmap/netmap_mem2.c:974", "sys/net/netmap/netmap_mem2.c:945", "sys/net/netmap/netmap.h:225"],
  "poc_changes": "No executable PoC possible; analysis-only.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src/sys/net/netmap && make",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Found during pass-2 line-diff of the tx vs rx init blocks.",
  "recommended_fix": "Use *(uint16_t *)(uintptr_t)&ring->nr_buf_size in the rx path, matching :945.",
  "fix_status": "build_blocked",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored; cannot be built/validated because the netmap module does not compile on this tree.",
  "fix_evidence": "fix.diff"
}