{
  "finding_id": "DF-5343",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect is certain at code level; mapping corruption proven on the audited guest with verbatim logic. mptable_lapic_pass2_callback() synthesizes fake logical CPUs with proc.cpu_flags = ent->cpu_flags (mptable.c:702) and advances arg->cpu unconditionally (mptable.c:705-709). The BSP entry is mandatory in every table, is necessarily EN|BP, and the fixup engages precisely on under-reporting tables (cpu_count==1 single-BSP case, mptable.c:433-435, or spaced ids), so its fake entries carry the BP bit, take processor_entry()s BSP branch (mptable.c:565-568) and call lapic_set_cpuid(0, fake_apic_id) \u2014 cpu_id_to_apic_id[0] is clobbered to bsp_id+logical_cpus-1, the fake never registers in its slot, and the burned slot later reads apic id 0 from BSS. Reproducer scenario 1 (table = {BSP id0}, lcpus_max=2): cpu0->apic1, slot1 unregistered, naps=1 -> start_all_aps SIPIs CPUID_TO_APICID(1)=0 (the BSP itself) -> smp_startup_mask never completes -> BOOT HANG (mp_machdep.c:595); all IPIs to cpu0 are mis-addressed thereafter. Scenario 2 (ids {0,2}, naps=3) shows the same clobber plus a skipped slot. Scenario 3 with force_enable=1 (fakes get EN only) produces the correct 0/1/2/3 mapping \u2014 proving both the intent of the ternary and the fix. Engages on ANY mptable (non-ACPI) HT system whose fixup activates with default tunables; end-to-end kernel manifestation UNTESTED (needs crafted/legacy firmware table on HT hardware; the standard guest boots via ACPI MADT).",
  "exploit_chain": "",
  "evidence": "run.log \u2014 scenario 1: cpu->apic: [0]=1 [1]=0 ... cpu1->apic0(== BSP id, phantom: never starts) -> BOOT HANG; scenario 2: [0]=1 [1]=0 [2]=2 [3]=3; scenario 3 (force_enable): [0]=0 [1]=1 [2]=2 [3]=3 (correct).",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/mptable.c:700",
    "sys/platform/pc64/x86_64/mptable.c:702",
    "sys/platform/pc64/x86_64/mptable.c:705",
    "sys/platform/pc64/x86_64/mptable.c:707",
    "sys/platform/pc64/x86_64/mptable.c:708",
    "sys/platform/pc64/x86_64/mptable.c:565",
    "sys/platform/pc64/x86_64/mptable.c:566",
    "sys/platform/pc64/x86_64/mp_machdep.c:482",
    "sys/platform/pc64/x86_64/mp_machdep.c:595",
    "sys/platform/pc64/apic/lapic.c:1213"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch. Reproducer copies the cited mptable.c logic verbatim (u_int/u_char semantics preserved); KKASSERT is modeled as a kernel-panic path (setjmp-resumable in the harness), and pmap_mapdev/MMIO access is elided where userland cannot express it (clearly marked in the source header).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "guest: cc -O2 -Wall -Wextra -o /tmp/htfix_bp_flag_inherit /tmp/htfix_bp_flag_inherit.c",
  "run_cmd": "guest: /tmp/htfix_bp_flag_inherit",
  "code_hash": "8df0fbc95c24548c1c1f66e65b9c7a49a757be0c0e61ed0442186d3003499b10",
  "notes": "Boot-time, malicious-firmware/loader threat class (same bar as accepted DF-1034/DF-5326). Kernel-boot manifestation not armable on the standard QEMU/SeaBIOS guest (no MP-table/SMAP injection, no unprivileged in-guest path) \u2014 verification is the guest-executed verbatim-logic reproducer per the DF-5326 precedent. Guest left clean (only /tmp scratch).",
  "recommended_fix": "clear PROCENTRY_FLAG_BP on synthetic entries and gate arg->cpu++ on registration (mptable.c:702-709)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff is authored against the read-only sys/ tree and passes git apply --check, but could not be kernel-build-validated: the bugs kernel manifestation cannot be armed on this guest (needs injected firmware tables), so there is no baseline to compare a patched kernel against.",
  "fix_evidence": "findings/poc/DF-5343/fix.diff (git apply --check passes); reasoning in VERDICT.md"
}