{
  "finding_id": "DF-5658",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Verified on the guests VKERNEL64 build tree (source MD5-identical): global.s consumes 26 GD_* macros but genassym.c defines only 5, so 21 .set exports silently vanish \u2014 nm on the real-rule-built global.o shows U for all 21 missing macros (incl. the task_log lead GD_CURRENTLDT at global.s:65) with the .globld gd_* aliases absent entirely, assembly exit 0 under -Werror; the exact SYSTEM_LD userland-cc link completes exit 0 with all 21 U GD_* riding into the final vkernel64 binary carrying ZERO relocations, which is precisely why nothing ever fails. 13 of the 21 are restorable (fields exist in struct mdglobaldata); the other 8 (GD_PRV_*) alias fields that do not exist on this platform and are split to DF-5659. fix.diff (13 ASSYM additions + 8 alias deletions) validated: assym.s 44->57 defines, global.o exports 18 gd_* with zero undefined ASSYM macros, relinked final binary 0 U GD_* / 18 exports, every restored value matching an independent-TU checker (gd_currentldt=0x3f14 struct-consistent).",
  "exploit_chain": "",
  "evidence": "run.log + nm_global_pristine.txt (U GD_CURRENTLDT + 20 siblings at object level); final_binary_baseline.txt (21 U GD_*, 0 relocations, link exit 0); assym.pristine.s (44 defines) vs assym.fixed.s (57); fix_run.log + final_binary_fixed.txt (0 U, 18 exports after fix); offset_check.out (44/44 emitted values independently verified + MISSING_* targets); vkbuild.log (full untrimmed build incl. the unrelated __build_id link buster that delimits the tolerance mechanism)",
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/genassym.c:72-121",
    "sys/platform/vkernel64/x86_64/global.s:51-97",
    "sys/platform/vkernel64/x86_64/global.s:65",
    "sys/platform/vkernel64/include/globaldata.h:66-84",
    "sys/platform/vkernel64/conf/Makefile:23-25",
    "sys/conf/kern.post.mk:73-79"
  ],
  "poc_changes": "No seed PoC existed (pass-2 lead). Authored offset_check.c (independent-TU re-evaluation of all 44 ASSYM expressions + CHECK_*/MISSING_* extras) and the build-tree regeneration/probe procedure; had to relax -Werror/-Wnested-externs for the checker harness only (production flags untouched).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/config && config VKKERNEL64 && cd /usr/src/sys/compile/VKERNEL64 && make assym.s global.o",
  "run_cmd": "nm global.o | grep  U GD_ ; cc -g -Wl,--export-dynamic -o /tmp/kernel.dangleproof $(make -V SYSTEM_OBJS) vers.o /tmp/bidstub.o -pthread -Wl,--hash-style=sysv -Wl,-z,max-page-size=0x200000 && nm /tmp/kernel.dangleproof | grep -c  U GD_",
  "code_hash": "6a07ff3758f34594d4a39af5cc5d38d5aa909b9ab8985506ad67ebe615926fa6",
  "notes": "checklist (b) negative-with-evidence: 44/44 emitted values match independent TU. checklist (c): only unmatched macros are the 21 GD_* in global.s (swtch/locore/fork_tramp fully resolve; PCB_CR3/PCB_EXT/MSR_*/PCB_USERLDT uses are #if 0). checklist (d) negative-with-evidence: TD_SAVEFPU=0x628 verified == offsetof(td_mach.mtd_savefpu), DF-5655 chain td_tls==td_savevext==0x630 C-side only, no asm consumer. DF-5597 ioapic twin N/A (no IOAPIC tokens). INCIDENTAL LEAD (task_logd): VKERNEL64 currently fails to link on kern_mib.c __build_id_start/__build_id_end because conf/Makefile SYSTEM_LD override drops -T ldscript (kern.pre.mk:144 provides it; vkernel64/conf/ldscript.x86_64:75 PROVIDEs the symbols) \u2014 the vkernel64 kernel has been unbuildable since the build-id sysctl landed; that failure also proves the link gate only fires on relocation-referenced undefineds.",
  "recommended_fix": "Add the 13 ASSYM(GD_*, offsetof(struct mdglobaldata, ...)) lines to vkernel64 genassym.c and delete the 8 GD_PRV_* aliases from global.s (fix.diff, validated)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline: 21 undefined GD_* symbols in global.o and the final VKERNEL64 binary, only 5 backed gd_* exports, zero build diagnostics. After fix.diff (guest /usr/src copy, same kern.post.mk rules): assym.s 44->57 defines, global.o exports all 18 field-backed gd_* symbols with zero undefined ASSYM macros, final relinked binary has 0 U GD_* and 18 exports, every value matching the independent-TU checker (gd_currentldt=0x3f14). Previously-observed bad behavior gone; link green.",
  "fix_evidence": "fix.diff (git-apply-clean vs pristine sys/), fixbuild.log, fixbuild2.log, fix_run.log, final_binary_fixed.txt, assym.fixed.s vs assym.pristine.s"
}