{
  "finding_id": "DF-5019",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Deterministic kernel panic reproduced: ioctl(TBRIDGE_GETRESULT) with no prior TBRIDGE_LOADTEST drives the test kthread into tbridge_test_done() where KKASSERT(tbridge_testcase != NULL) (sys/dev/misc/tbridge/tbridge.c:196) fails on any INVARIANTS kernel \u2014 stock X86_64_GENERIC ships INVARIANTS and dfregress kernels build tbridge in; verified on a DragonFly 6.5-DEVELOPMENT guest with device tbridge compiled in (panic + DDB wedge, ssh dead). On the stock kernel with tbridge kldloaded as a module there is no panic: out-of-tree kmods compile without INVARIANTS, the KKASSERT is a no-op and the walk degrades to ENOTSUP (errno 45). Root-gated throughout (/dev/tbridge is 0600 root:wheel and the driver is opt-in), so impact is a root-triggerable panic of a debug driver, not privilege escalation. fix.diff (EINVAL guard at the top of TBRIDGE_GETRESULT) validated on the guest: baseline panics, patched kernel returns EINVAL and survives.",
  "exploit_chain": "kldload/built-in tbridge + testcase kmod registering tb_run -> open /dev/tbridge (root only) -> ioctl(TBRIDGE_GETRESULT) with no LOADTEST -> kthread runs tb_run -> tbridge_test_done -> KKASSERT(tbridge_testcase != NULL) fails -> panic. No uid=0 path: 0600 device, opt-in driver.",
  "evidence": "panic.txt (exact assertion + DDB), run.log (baseline narrative), run.kmod.log (kmod path -> ENOTSUP), build.log/build.fix.log (kernel builds), env.txt (uname, /dev/tbridge perms, INVARIANTS), VERDICT.md, poc.c, mytcase.c, build.sh, run.sh, fix.diff",
  "kernel_refs": [
    "sys/dev/misc/tbridge/tbridge.c:265",
    "sys/dev/misc/tbridge/tbridge.c:196",
    "sys/dev/misc/tbridge/tbridge.c:202",
    "sys/sys/tbridge.h:33",
    "sys/conf/files:2122",
    "sys/config/X86_64_GENERIC:56"
  ],
  "poc_changes": "Seed had no runnable PoC. Authored: mytcase.c (out-of-tree testcase kmod; needed #include <sys/kernel.h> because sys/tbridge.h is not self-contained for SYSINIT), poc.c (raw ioctl trigger), build.sh/run.sh; plus the two-mode reproduction (kmod vs in-kernel) to bound exposure honestly.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0/1: custom DF5019 (X86_64_GENERIC + device tbridge) x86_64 (baseline #0 Sat Sep 26 03:54, patched #1 04:10 UTC 2026)",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (guest) + make -j6 nativekernel KERNCONF=DF5019 for the in-kernel variant",
  "run_cmd": "sh run.sh (guest, as root): kldload tbridge/mytcase; ./poc",
  "code_hash": "cb371f13f4bc594a51cef705aeab449954a800cc012b07f801d60a66402ae1f3",
  "notes": "run.kmod.log documents the no-INVARIANTS kmod degradation (ENOTSUP, no panic). Distinct from known DF-2048 (tbridge_curtest NULL, tbridge.c:266). sys/tbridge.h non-self-contained header noted (build trap).",
  "recommended_fix": "Reject TBRIDGE_GETRESULT with EINVAL when tbridge_testcase == NULL (no LOADTEST issued); see fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff applied to guest /usr/src, kernel rebuilt (nativekernel) and rebooted; identical PoC returns EINVAL (errno 22) with the kernel alive \u2014 panic gone. fix_patched_reproduced=false is the desired outcome (bug behavior does NOT reproduce on the patched kernel).",
  "fix_evidence": "VERDICT.md (Fix validation section), build.fix.log, panic.txt (baseline) vs run.log narrative (patched run: GETRESULT returned -1, errno=22)"
}