{
  "finding_id": "DF-5665",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Pass-2 audit of sys/cpu/x86_64/misc/ktr.c (cpu_ktr_caller + FRAMEUP stack unwinder): memory-safe against attacker input by construction. The user-controlled-%rbp route is structurally dead \u2014 FRAMEUPs XOR/~16383 acceptance test (ktr.c:67) always rejects user-space candidates against a genuine kernel-stack baseline (kernel/user address-space split), all writes go to the fixed per-CPU ring slot from ktr_begin_write_entry (kern_ktr.c:511, NULL/panicstr-guarded at :505-508), and every payload size is a compile-time constant (CTASSERT at ktr.h:155). Residual weakness: FRAMEUP accepts non-monotonic, non-aligned, non-contained frame pointers, so a stale kernel %rbp left by a frame-pointer-less assembly stub and landing in the +-16KiB window could make the next frameptr[0]/[1] read fault on unmapped KVA \u2014 panic-only ceiling, no attacker control of the value, debug-only facility (optional ktr; not compiled into the stock guest kernel, live-verified: sysctl debug.ktr -> unknown oid). Filed as Info hardening; PoC waived for Info severity and not exercisable on the guest without a custom options-KTR kernel build. Ring math, allocation, dump/copyout, and ordering checklist items are in-bounds or root-gated; boot-publication ordering already filed as DF-0104 and not re-reported.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5665/VERDICT.md (full per-class kill list with path:line); README.md (mechanism + live guest probes); env.txt (guest uname + sysctl//dev/mem checks); fix.diff (git-apply-checked one-hunk hardening). Decisive lines: sys/cpu/x86_64/misc/ktr.c:66-69 (proximity-only validation), :86-94 (walk + reads), sys/kern/kern_ktr.c:505-511 (entry allocation/guards), :531-532 (sole caller).",
  "kernel_refs": [
    "sys/cpu/x86_64/misc/ktr.c:60",
    "sys/cpu/x86_64/misc/ktr.c:67",
    "sys/cpu/x86_64/misc/ktr.c:78",
    "sys/cpu/x86_64/misc/ktr.c:92",
    "sys/kern/kern_ktr.c:505",
    "sys/kern/kern_ktr.c:511",
    "sys/kern/kern_ktr.c:532",
    "sys/sys/ktr.h:155",
    "sys/platform/pc64/conf/files:110",
    "sys/kern/kern_sysctl.c:1445"
  ],
  "poc_changes": "No PoC run \u2014 Info-severity hardening finding (PoC waived per contract); the audited code is not compiled into the guest kernel (optional ktr), so the path cannot be exercised without a custom kernel build.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "476a25a0b76dcf7d773ffe5ed4e9705bf80802d372293b7a720cbe4a65773a39",
  "notes": "Guest left up and clean. Live introspection performed: debug.ktr OID absent kernel-wide (KTR not compiled), /dev/mem and /dev/kmem root:kmem 0640, sysctl writes to RW ktr knobs gated by SYSCAP_NOSYSCTL_WR (kern_sysctl.c:1445-1448). Negative results for ring index wraparound, per-CPU allocation sizing, DDB dump-path bounds, torn caller-field ordering, entry lifetime/UAF, KTR_VERSION handling \u2014 all detailed in VERDICT.md. DF-0104 (boot publication TSB) pre-existing, not re-reported.",
  "recommended_fix": "Harden FRAMEUP in sys/cpu/x86_64/misc/ktr.c to also require the candidate frame pointer to be strictly above the current frame and 8-byte aligned (genuine x86-64 chains grow upward), preventing a stale/corrupted saved %rbp from walking the chain into unrelated unmapped kernel memory.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git-apply-checked against the unmodified sys/ tree (adds monotonic-up + alignment requirements to FRAMEUP, single hunk). Fix validation build not performed: would require a custom options KTR kernel on the guest to exercise, unwarranted for a speculative panic-only Info hardening note with no demonstrated trigger.",
  "fix_evidence": "findings/poc/DF-5665/fix.diff (git apply --check passed against sys/cpu/x86_64/misc/ktr.c, sha256 476a25a0b76dcf7d773ffe5ed4e9705bf80802d372293b7a720cbe4a65773a39); no fix_build.log/fix_run.log \u2014 no kernel build performed."
}