{
  "finding_id": "DF-3553",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /usr/src/sys/netgraph7/netgraph && make && (cd ../socket && make) && (cd ../tee && make) && cc -O2 -DNG7 -o /root/poc/tee_cycle7 /root/poc/tee_cycle.c",
    "run": "kldload /usr/src/sys/netgraph7/netgraph/netgraph.ko /usr/src/sys/netgraph7/socket/ng_socket.ko /usr/src/sys/netgraph7/tee/ng_tee.ko (full paths); /root/poc/tee_cycle7 (root)",
    "expected": "panic: assertion \"ref < &td->td_toks_end\" failed in lwkt_gettoken_shared at sys/kern/lwkt_token.c:732; DDB trace = ng_apply_item x31 recursive; guest dead in DDB"
  },
  "kernel_refs": [
    "sys/netgraph7/tee/ng_tee.c:293",
    "sys/netgraph7/tee/ng_tee.c:169",
    "sys/netgraph7/netgraph/ng_base.c:1961",
    "sys/netgraph7/netgraph/ng_base.c:1998",
    "sys/kern/lwkt_token.c:732"
  ],
  "fix_diff": "fix.diff",
  "fix_evidence": "fix1_cycle.log: patched core (el_hops/NG_HOPS_MAX=16, -Werror clean rebuild) -> STEP sendto ok, RESULT no-panic survived 30s, RUN_RC=0, guest healthy; stock -> panic (console_full.txt)",
  "artifacts": [
    "README.md", "VERDICT.md", "tee_cycle.c", "build.sh", "run.sh",
    "run.log", "panic.txt", "console_full.txt", "ddb_trace.txt",
    "fix.diff", "fix_build.log", "fix1_cycle.log", "env.txt",
    "manifest.json", "verdict.json"
  ]
}