{
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "same as DF-5521 (shared rig)",
    "run": "/root/df5521_poc proto  (dmesg: READ req_len=<uninit byte>, rcount discloses it); different process context shows req_len=255; fixed: deterministic + EINVAL on garbage",
    "expected": "stock: READ req_len=0 (parent) / READ req_len=255 (forked child), rcount=byte value; fixed: req_len=1 then req_len=8, rcount=8 every time"
  },
  "kernel_refs": ["sys/bus/iicbus/iicsmb.c:499", "sys/bus/iicbus/iicsmb.c:474", "sys/dev/smbus/smb/smb.c:217", "sys/dev/smbus/smb/smb.c:323"],
  "artifacts": ["README.md", "VERDICT.md", "df5521_rig.c", "df5521_poc.c", "build.sh", "load_chain.sh", "build.log", "env.txt", "run.baseline.log", "run.fixed.log", "fix.diff", "manifest.json", "verdict.json"]
}