{
  "finding_id": "DF-5346",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Hardening-consistency gap, honestly speculative. identify_cpu()s hypervisor feature blacklist (identcpu.c:668-686) exists because Some hypervisors fail to filter out unsupported extended features and masks CR4-activation-requiring extensions under CPUID2_VMM - but only FSGSBASE and SMEP (:675-676). SMAP qualifies under the masks own rule (its activation writes CR4.SMAP in cpu_implement_smap(), machdep.c:344-346, reached from cpu_startup when cpu_stdext_feature & CPUID_STDEXT_SMAP) yet is not masked. On-guest documentation boot (-cpu qemu64,+smap under KVM): Structured Extended Features=0x100000<SMAP> with VMM bit set, blacklist passed it through, CPU Special Features Installed: SMAP, CR4.SMAP accepted, clean boot - proving the pass-through claim; the fault case (hypervisor advertising SMAP but faulting CR4.SMAP writes) panics the kernel during early boot but cannot be constructed with stock QEMU 7.2 (CR4.SMAP is always accepted), so the panic is not reproduced. Impact ceiling: boot-time #GP kernel panic under a buggy/malicious hypervisor - the same class the in-file comment describes; Low severity because no shipping hypervisor is known to trip it today and operators can add the mask via hw.cpu_stdext_disable.",
  "exploit_chain": "",
  "evidence": "boot-kvm-smap.log:35 (Features2=...VMM - hypervisor detected), :38 (Structured Extended Features=0x100000<SMAP> - bit survived the blacklist), :40 (CPU Special Features Installed: SMAP - cpu_implement_smap() ran); VERDICT.md",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/identcpu.c:668",
    "sys/platform/pc64/x86_64/identcpu.c:674",
    "sys/platform/pc64/x86_64/identcpu.c:675",
    "sys/platform/pc64/x86_64/machdep.c:344"
  ],
  "poc_changes": "No seed; authored the +smap documentation boot. Expected outcome on a competent hypervisor is a clean boot - observed as such; the finding documents the missing mask, not a QEMU-reproducible fault.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "build_cmd": "(no compile; QEMU boot trigger)",
  "run_cmd": "qemu-system-x86_64 -enable-kvm -m 2048 -smp 2 -drive file=ovl-smap.qcow2,if=virtio,format=qcow2 -cpu qemu64,+smap,check=off -serial file:smap-boot.log -no-reboot",
  "code_hash": "4e49dd24257a42d0e1f04cea086c785b1cda9600135af2deafdeb346e34220e7",
  "notes": "FreeBSDs identcpu.c carries the same FSGSBASE|SMEP-only mask (divergence note for upstream); the DragonFly rule text at :668-673 plainly covers SMAP. hw.cpu_stdext_disable tunable lets operators add it at the loader prompt.",
  "recommended_fix": "Add CPUID_STDEXT_SMAP to cpu_stdext_disable under CPUID2_VMM (one-line, see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: the faulting-hypervisor precondition (CPUID.7.EBX.SMAP advertised, CR4.SMAP write faults) cannot be built from stock QEMU 7.2; on a competent hypervisor both baseline and patched kernels boot cleanly, so no behavioral delta is observable on this harness.",
  "fix_evidence": "boot-kvm-smap.log (baseline pass-through documented); no fault observable on QEMU/KVM"
}