# DF-5474 VERDICT — reproduced (build failure), fix validated by link+boot

**Bottom line:** The stock VKERNEL64 platform **cannot build** on this tree:
`sys/conf/kern.pre.mk:135` adds `-Wl,--build-id=sha1` to ELDFLAGS for every
kernel and `sys/kern/kern_mib.c:101-102` references `__build_id_start` /
`__build_id_end`, which are PROVIDE'd only by the pc64 linker script
(`sys/platform/pc64/conf/ldscript.x86_64:74-77`). The vkernel64 platform
overrides SYSTEM_LD (`sys/platform/vkernel64/conf/Makefile:23-25`) with a
plain `cc -Wl,--export-dynamic -o kernel.debug ... -pthread` link that
neither passes `${ELDFLAGS}` nor uses the platform ldscript
(`sys/platform/vkernel64/conf/ldscript.x86_64` is not referenced by any
link), so the two externs can never resolve:

```
vk_build2.log:
/usr/src/sys/kern/kern_mib.c:111: error: undefined reference to '__build_id_end'
/usr/src/sys/kern/kern_mib.c:111: error: undefined reference to '__build_id_start'
/usr/src/sys/kern/kern_mib.c:132: error: undefined reference to '__build_id_start'
collect2: error: ld returned 1 exit status
*** [kernel.debug] Error code 1
```

`vk_build3.log` proves the platform ldscript is dead: patching the same
`.note.gnu.build-id` PROVIDE block into it changes nothing (same undefined
references), because SYSTEM_LD never passes `-T`.

Impact: build-regression / platform availability (nobody can have built
vkernel64 since the build-id change); `kern.build_id` is a security-relevant
sysctl (build provenance), and vkernel silently has none. Severity Low,
confidence certain.

## Fix validated

`fix.diff`: append
`-Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0` to the
vkernel SYSTEM_LD line. `kern_mib.c`'s sysctl then computes sectionlen 0 and
returns ENOENT gracefully (kern_mib.c:124-127). Validated on the guest:
`make nativekernel KERNCONF=VKERNEL64` with the patched conf/Makefile links
cleanly (vk_fixbuild2.log: `linking kernel.debug` → size line, RC=0), the
resulting vkernel boots to single-user (`vkrun_fixed.log`) and behaves
correctly under the DF-5472/5473 rig. An alternative upstream-shaped fix is
to give vkernel64 a real build-id via its ldscript + `-T`, but that changes
link mode for a userland-executable kernel and was not attempted here.

## Reproduce

```
cd /usr/src && make nativekernel KERNCONF=VKERNEL64   # stock: link error (vk_build2.log)
patch -p1 < fix.diff                                   # defsym in conf/Makefile
make nativekernel KERNCONF=VKERNEL64                   # links + boots
```

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.