# DF-5695 — VERDICT

**Status: reproduced** (algorithm-level invariant break on the exact source,
deterministic interleave harness; deployed-kernel reachability established
by call-graph analysis).
**Impact:** none attacker-observable demonstrated (RNG contract violation:
outputs outside any serialized RC4 evolution under preemption).
**Confidence: likely.**

## What was demonstrated

`./arc4_harness race 1000` (exact verbatim `arc4_randbyte` state machine,
victim preempted at all 20 sub-step boundaries of one `karc4random()` while
a second context runs complete `karc4random()` calls on the same state):

* 49.4% of the time-ordered emitted bytes diverge from the serialized
  reference stream started from the identical state — the joint output
  cannot be produced by any serialization of the two consumers. In a
  correctly serialized implementation (mutex/crit), interleaving only ever
  re-partitions a single valid keystream between consumers; here it does
  not.
* 0 cross-consumer duplicate words in 1000 trials — I explicitly tested
  for the classic "two consumers receive the same 4-byte word" artifact
  and it does not arise in this construction (the preempted byte is always
  computed from a strictly-later state than the preemptor's). The defect's
  observable is chimera values + lost `arc4_numruns` accounting, not value
  reuse.

## Reachability in the deployed kernel (why the `#if 0` premise is false)

* The comment "No one call this function in ISR/ithread"
  (arc4random.c:148) addresses interrupt context only; the race needs only
  *thread* preemption, which LWKT performs: sys/kern/lwkt_thread.c:913-941
  (`lwkt_preempt()` via `lwkt_schedule()`'s `td_preemptable` callback).
* Same-CPU consumer pairs that can interleave:
  - syscall thread `kern_exec.c:1173` / `vm_map.c:4408` / `pf.c:6131` /
    `in_pcb.c:885`  ↔  netisr/TCP thread `pf.c:4459` (inbound scrub,
    via ip_input netisr `ip_input.c:393`), `tcp_syncache.c:1070`,
    `in_pcb.c:414`, `altq_red.c:408`.
* Window: a few instructions per byte, up to `len` bytes in
  `karc4random_buf` (callers pass 16-32B); preemption must land inside and
  the preemptor must call the generator — low per-event probability, but
  a busy server executes these paths continuously (SYN floods literally
  pump `pf.c:4459`).

## Why not higher severity

* All state indices are uint8_t → memory-safe under any interleave.
* Chimera outputs are still unpredictable functions of secret state; no
  bias, duplication, or prediction was demonstrated (duplication
  explicitly ruled out empirically).
* Worst additional effect: interleaved re-entry of `arc4_randomstir()`
  (numruns race) can interleave two KSAs — still entropy-preserving.

Filed Low: correctness of a security primitive + falsified safety premise,
no demonstrated exploitation.

## Fix validation

`fix.diff` adds `crit_enter()/crit_exit()` around the state-machine use in
all three entry points (re-enabling the pair the authors #if 0'd in
`karc4random_buf` at arc4random.c:147-161, adding it to
`karc4random`/`karc4random64` which never had it). A critical section makes
every execution equivalent to a serialization, restoring the invariant
demonstrated broken above. Diff applies clean (`git apply --check`).
Kernel rebuild not performed (Low severity, non-memory-corruption);
semantics of crit_enter/crit_exit (blocks LWKT preemption and interrupts
on the CPU) are the documented DragonFly mechanism, and the guarded region
cannot sleep (`read_random` on the CSPRNG_UNLIMITED path takes only a
spinlock, subr_csprng.c:146,127-168).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.