{
  "finding_id": "DF-5675",
  "title": "Recursive proplib externalize vs. iterative internalize: unbounded kernel stack recursion via DM ioctl plist echo (16KB kstack exhausted at ~192 nesting levels)",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "kernel panic (double fault); deterministic local kill for operator/root via 3KB XML",
  "reproduce": {
    "build": "sh build.sh  (guest, root, /tmp/df5675; same-source libprop rig + both harnesses)",
    "run": "sh run.sh",
    "expected": "userland: depth 300 externalize OK / depth 20000 internalize OK then SIGSEGV(139); kernel: depth 64,128 survive; depth 192 -> 'Fatal double fault', page-aligned rsp, panic; patched kernel (fix.diff): 192/2048 -> ENOMEM, 32/60 -> echo OK"
  },
  "kernel_refs": [
    "sys/libprop/prop_object.c:617-659",
    "sys/libprop/prop_object.c:1061-1107",
    "sys/libprop/prop_array.c:174-186",
    "sys/libprop/prop_dictionary.c:455-467",
    "sys/dev/disk/dm/device-mapper.c:267-273"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df5675_dmcrash.c", "df5675_userland.c",
    "build.sh", "run.sh", "fix.diff", "panic.txt", "panic.2.txt",
    "fixtest.console.txt", "build.kernel.log", "run.userland.log",
    "manifest.json", "verdict.json"
  ]
}