{
  "finding_id": "DF-5245",
  "status": "untested",
  "verdict": "pmap_extract() kernel-VA branch re-tests the PDE (*pt) where it must test the PTE (*ptep) at pmap.c:1739, so a not-present PTE under a valid page directory yields rtval = (va & PAGE_MASK) instead of the documented failure value 0. Certain by inspection. No runtime trigger exists on pc64: no in-tree caller reaches this branch with a kernel VA (busdma uses pmap_kextract; sglist/procfs use the user branch), so impact is latent (any future caller trusting the return, e.g. for DMA sglists, would receive a plausible-looking bogus physical address). Low severity, not executed on the guest.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "README.md in this pack: quoted code pmap.c:1733-1743 showing the duplicated *pt test; caller survey (sys/kern/subr_sglist.c:126, sys/vfs/procfs/procfs_map.c:128) showing the KVA branch is dead on pc64 today",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/pmap.c:1733-1743",
    "sys/kern/subr_sglist.c:126-160",
    "sys/vfs/procfs/procfs_map.c:128"
  ],
  "poc_changes": "none - no runtime PoC (Low severity, dead branch on this platform; contract allows skipping verification for Low/Info)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "notes": "One-line fix included in README.md (test *ptep instead of *pt at line 1739).",
  "recommended_fix": "pmap.c:1739: change if (*pt & pmap->pmap_bits[PG_V_IDX]) to if (*ptep & pmap->pmap_bits[PG_V_IDX]).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not tested - trivial one-line correctness fix; branch has no reachable caller on pc64",
  "fix_evidence": "README.md contains the one-line diff"
}