{
 "finding_id": "DF-4467",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Software XTS (aes/twofish/serpent in cryptoapi) keeps the running data-unit tweak in the shared session ctx; concurrent dmtc_bio_encdec calls from multiple CPUs interleave reinit/mutation of ctx->tweak, so blocks are enciphered under other data units tweaks. Reproduced: 8 concurrent writers on aes-xts-plain64 dm-crypt -> 1413/1536 verification rounds silently corrupted (all pwrites reported success); single-threaded control 0/512. Silent on-disk ciphertext corruption plus XTS tweak reuse across data units (equality-structure leakage). AESNI paths unaffected.",
 "exploit_chain": "",
 "evidence": "run.log: race run [result] corrupted blocks: 1413 / 512 vs control 0 / 512; VERDICT.md mechanism with cryptoapi.c line refs.",
 "kernel_refs": [
  "sys/crypto/cryptoapi/cryptoapi.c:370",
  "sys/crypto/cryptoapi/cryptoapi.c:412",
  "sys/crypto/cryptoapi/cryptoapi.c:439",
  "sys/dev/disk/dm/crypt/dm_target_crypt.c:958"
 ],
 "poc_changes": "Written fresh: proplib-XML dm control client + disjoint-block concurrent writers + triple verification rounds + control mode; writers own disjoint block ranges so no false positives from userspace write races.",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 420,
 "guest_dirty": 0,
 "build_cmd": "cc -O2 -o xtsrace xtsrace.c -lpthread",
 "run_cmd": "sh run.sh",
 "code_hash": "9d78e46c4b92a258b93a7cd6749a9c1fbc4c8694ece5270495fdc751bef0e981",
 "notes": "QEMU CPU lacks AESNI so the software path is active by default. impact recorded as dos (silent data corruption of stored data); confidentiality angle (tweak reuse) documented in VERDICT.md.",
 "recommended_fix": "Per-call stack tweak buffer in the three software XTS crypt functions; stop using ctx->tweak as running state.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored against sys/crypto/cryptoapi/cryptoapi.c (git apply --check passes): tweak becomes a per-call local in aes/twofish/serpent _xts_crypt. Module rebuild+rerun not performed within this run (Medium, non-memory-safety; change is three mechanical self-contained edits).",
 "fix_evidence": "fix.diff in this pack; baseline race/control logs in run.log."
}