{
  "finding_id": "DF-5694",
  "status": "reproduced",
  "verdict": "karc4random64() (sys/libkern/arc4random.c:129-132) assembles its 64-bit word with uncast `arc4_randbyte(d) << 24`; when the 4th byte is >= 0x80 (p=1/2) the int left-shift is UB and wraps to a negative int, whose conversion to uint64_t for the |= sign-extends and pins the upper 32 bits of the output to 0xffffffff. Verified in the RUNNING kernel via KLD sampling (0.4992-0.5005 biased across 2^20-draw reports and a 2M-word stream; biased count == byte3>=0x80 count identically in every run) and via an exact-source userland harness (P=0.499919 over 10M draws). Sole kernel consumer vm_map.c:4408 (mmap ASLR) computes (v & 0x7fff...) % 32GB: measured addend distribution 0.5625 in the top 4GB bucket (uniform 0.125), min-entropy 32.83 vs 35.00 bits; default vm.randomize_mmap=0 disables this consumer, drm get_random_long (i915 GTT) inherits the raw bias. karc4random()/karc4random_buf() are statistically clean (chi2 z in [-1.34,+0.31], 64MB in-kernel each). One-line fix (uint64_t casts) validated: bias 0.000000, buckets 0.125, 35.00-bit entropy.",
  "reproduced": true,
  "impact": "rng_bias_aslr_entropy_loss",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5694/run.log: in-kernel KLD lines top32==0xffffffff: 524342 (0.5000) and k64 words=2097152 ... (0.500496); harness P(top32==0xffffffff) = 0.499919 with vm_map addend buckets bucket[7]: 0.562429 and addend min-entropy ~ 32.83 bits; PATCHED section P(top32==0xffffffff) = 0.000000 ... 35.00 bits. VERDICT.md has full mechanics; env.txt the guest/kernel identity.",
  "kernel_refs": [
    "sys/libkern/arc4random.c:132",
    "sys/libkern/arc4random.c:129",
    "sys/libkern/arc4random.c:119-139",
    "sys/vm/vm_map.c:4408",
    "sys/vm/vm_map.c:4374",
    "sys/dev/drm/include/linux/random.h:49",
    "sys/dev/drm/i915/i915_gem_gtt.c:3986"
  ],
  "poc_changes": "No seed pack existed; authored from scratch: exact-verbatim harness (getrandom-seeded read_random shim), KLD sampler (arc4samp.c) with in-kernel bias counter and stream units, chi-square checker, vm_map-addend simulator, patched-algorithm control, live mmap probes. Fixed my own harness bugs found during bring-up: initial stats mode contaminated by the (real) k64 bias, wrong lag-repeat expectation (p=1/256 not 1/65536), KLD report re-arming per read.",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2100,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o arc4_harness arc4_harness.c -lm ; cd kld && make",
  "run_cmd": "kldload ./kld/arc4samp.ko ; cat /dev/arc4srep ; dd if=/dev/arc4s64 of=/tmp/s64.bin bs=1048576 count=16 ; ./chk /tmp/s64.bin k64 ; ./arc4_harness bias64 10000000",
  "code_hash": "aa5d1abc01a315513d0a8c0b67d8d6e22703b956c5064f1d7b3a92e21c1462d7",
  "notes": "Not memory corruption: no panic/uid0 path; impact is RNG-primitive entropy loss + ASLR degradation behind vm.randomize_mmap=1 + C UB. Statistical negatives (documenting generator health beyond this bug): 2^32-byte Pr[Z==0] z=-0.34, lag1..8 repeats z in [-1.67,+1.18], Mironov-drop first-16K chi2 z=+1.18. Guest reset (with-src) after evidence capture.",
  "recommended_fix": "Cast every shifted arc4_randbyte() to uint64_t in karc4random64() (arc4random.c:129-132); see fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (uint64_t casts on the four low-byte shifts) validated against the exact-source harness compiled by the same guest compiler: baseline bias 0.499919 -> patched 0.000000 over 10M draws, vm_map addend buckets 0.5625/0.0625 -> uniform 0.125, min-entropy 32.83 -> 35.00 bits, chi-square battery unchanged (z=-0.18/-0.13). Kernel rebuild not performed (non-memory-corruption finding); the KLD measurement already proves the deployed kernel exhibits the baseline behavior with the same compiler family.",
  "fix_evidence": "run.log PATCHED algorithm validation section (P=0.000000, buckets 0.1248-0.1252, min-entropy 35.00); fix.diff applies clean via git apply --check."
}