{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "finding_id": "DF-5358",
  "title": "pc64 kvm_access_check() residency gate built on pmap_kextract() which validates no paging level: /dev/kmem read at ungrown KVA page-faults the validator (kernel panic); PTE-empty queries return (va & PAGE_MASK) garbage instead of 0",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/vm_machdep.c:1276",
    "sys/platform/pc64/x86_64/vm_machdep.c:1284",
    "sys/platform/pc64/x86_64/vm_machdep.c:1285",
    "sys/platform/pc64/x86_64/pmap.c:1865",
    "sys/platform/pc64/x86_64/pmap.c:1872",
    "sys/platform/pc64/x86_64/pmap.c:1884",
    "sys/kern/kern_memio.c:257",
    "sys/kern/kern_memio.c:266",
    "sys/kern/kern_memio.c:285",
    "sys/vm/vm_kern.c:494",
    "sys/vm/pmap.h:249"
  ],
  "reproduce": {
    "build": "guest root, /root/df5358: printf 'KMOD=\\tpmxtest\\nSRCS=\\tpmxtest.c\\n.include <bsd.kmod.mk>\\n' > Makefile && make && cc -O2 -o pmx_user pmx_user.c",
    "run": "guest root: kldload ./pmxtest.ko ; ./pmx_user 0xfffff80140000000 8   # absent-PDPT KVA probed by the module on this guest",
    "expected": "Stock: Fatal trap 12, Stopped at pmap_kextract.part.23+0x16 (movq (%rax,%rdx,1),%rdx), fault VA = recursive-map PDE-slot address, guest DOWN in DDB; module also prints pmap_kextract(va+0x30)=0x30 for a PT-present/PTE-0 hole. Patched (fix.diff): pread returns -1/EFAULT, guest up; unaligned PTE-0 extract returns 0."
  },
  "artifacts": [
    "pmxtest.c", "pmx_user.c", "Makefile-in-build.sh", "build.sh", "run.sh",
    "build.log", "fix_build.log", "build.tail.log",
    "run.log", "panic.txt", "fix_run.log", "run.fixed.log",
    "env.txt", "fix.diff", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}