{
  "finding_id": "DF-5556",
  "title": "vkernel npxsave() missing FPU security wipe — previous FP owner's XMM registers handed to the next exec'd image (cross-process/cross-exec FP state leak)",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "guest # sh build.sh && sh build_image.sh && cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64   (needs DF-5474 defsym link workaround)",
    "run": "guest # sh /root/run.sh   (boots kernel.debug -m 512m -r /vkroot.img -n 1, runs control + 3x RUNA + prober)",
    "expected": "baseline: X01..X0f lines = 'df555600deadbeef <reg index>' (15/16 markers x3 runs); post-fix: 0 markers"
  },
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/npx.c:248",
    "sys/platform/vkernel64/x86_64/npx.c:145",
    "sys/platform/vkernel64/x86_64/npx.c:187",
    "sys/platform/vkernel64/x86_64/npx.c:222",
    "sys/platform/vkernel64/x86_64/npx.c:154",
    "sys/platform/vkernel64/x86_64/trap.c:1371",
    "sys/platform/vkernel64/include/globaldata.h:66",
    "sys/platform/pc64/x86_64/npx.c:314"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "victim.c", "attacker.c", "prober.c",
    "build.sh", "build_image.sh", "run.sh", "build.log",
    "run.log", "run.fixed.log", "leak_sample.txt", "env.txt",
    "fix.diff", "manifest.hash", "manifest.json", "verdict.json"
  ]
}