{
  "finding_id": "DF-5676",
  "title": "MATCH() preamble memcmp reads past the NUL sentinel in _prop_object_internalize_context_alloc (bounded OOB read; userland crash reproduced)",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "userland SIGSEGV on same-source libprop; kernel page-contained read on current bcmp codegen (no fault/leak) — latent kernel UB",
  "reproduce": {
    "build": "sh build.sh  (guest root /tmp/df5676)",
    "run": "sh run.sh",
    "expected": "baseline probe SIGSEGV (139) on guard page; fixed rig (fix.diff) runs all probes clean (0)"
  },
  "kernel_refs": [
    "sys/libprop/prop_object.c:733-761",
    "sys/libprop/prop_object.c:391-393",
    "sys/libkern/bcmp.c:57-110"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df5676_guard.c", "build.sh", "run.sh",
    "run.log", "fix.diff", "manifest.json", "verdict.json"
  ]
}