{
  "finding_id": "DF-5677",
  "title": "prop_object_release_emergency dispatches pot_emergency_free on a NULL parent when the first walk iteration breaks (CWE-476; kernel-unreachable, userland malloc-failure edge)",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "userland libprop abort/NULL-deref under allocation failure + retain race; no kernel impact today (M_WAITOK)",
  "reproduce": {
    "build": "sh build.sh  (guest root /tmp/df5677)",
    "run": "sh run.sh",
    "expected": "assert build: 'Assertion failed: (parent) ... line 1048' exit 134; NDEBUG build: SIGSEGV exit 139; fixed rig: 'survived' exit 0"
  },
  "kernel_refs": [
    "sys/libprop/prop_object.c:1005-1052",
    "sys/libprop/prop_object.c:1094-1105",
    "sys/kern/kern_kmalloc.c:706"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df5677_emergency.c", "build.sh", "run.sh",
    "run.log", "fix.diff", "manifest.json", "verdict.json"
  ]
}