{
  "finding_id": "DF-5655",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "summary": "vkernel64 sys_set_tls_area accepts a non-canonical TLS base; go_user() hands it to the host vmspace_ctl, host wrmsr(MSR_KGSBASE) takes #GP(0) -> HOST kernel panic by an unprivileged in-vkernel user",
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/tls.c:96-102",
    "sys/platform/vkernel64/x86_64/tls.c:142-145",
    "sys/platform/vkernel64/include/thread.h:50",
    "sys/platform/vkernel64/x86_64/trap.c:1407-1408",
    "sys/vm/vm_vmspace.c:293-311",
    "sys/platform/pc64/x86_64/machdep.c:924-927",
    "sys/platform/pc64/x86_64/tls.c:163-172",
    "sys/cpu/x86_64/include/vframe.h:44-47"
  ],
  "reproduce": {
    "build": "cc -static -O -o /tmp/vk_tls_noncanon vk_tls_noncanon.c && cc -static -O -o /tmp/as_nobody as_nobody.c && sh vk_image.sh  (plus VKERNEL64 nativekernel build per env.txt)",
    "run": "sh vk_run.sh baseline 1",
    "expected": "DF5655 uid=65534 marker, then 'Fatal trap 9' and 'Stopped at set_user_TLS+0x94: wrmsr' on the guest console; ssh dead, guest wedged in DDB"
  },
  "artifacts": [
    "vk_tls_noncanon.c", "as_nobody.c", "vk_image.sh", "vk_run.sh",
    "fix.diff", "run.log", "panic.txt", "run.2.log", "run.3.log",
    "run.3.console.log", "build.log", "env.txt", "VERDICT.md",
    "manifest.json", "verdict.json"
  ]
}