{
  "finding_id": "DF-5705",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not PoC-verified (Low/hardening): the mechanics are source-certain but the manifestation requires orchestrated kernel memory pressure against a >=17-deep proplib dictionary free (global keysym lockmgr held across the M_WAITOK growth allocation at prop_stack.c:50 via prop_object.c:1077-1094 -> prop_dictionary.c:380) or a >=17-deep equals walk (per-object mtx chain held across the push at prop_object.c:1174). Impact ceiling is a memory-pressure-bounded global stall of all proplib dictionary operations (soft DoS, no hard deadlock: pageout takes no proplib locks) plus the undocumented sleepable-context requirement imposed on prop_object_release/prop_object_equals callers. Second, source-certain observation: DragonFly kmalloc(M_WAITOK) without M_NULLOK never returns NULL (kern_slaballoc.c:873-877 panics on limit, :1723-1724 panics on map exhaustion), so prop_stack.c:52-53 is kernel-dead code and the push-failure -> emergency-release machinery (prop_array.c:129-132, prop_dictionary.c:380-383) cannot fire from stack growth in-kernel \u2014 corroborating DF-5677s kernel-unreachable reachability note. Left untested deliberately: Low-severity hardening finding, honest manifestation requires an artificial pressure rig whose value would not change the classification.",
  "exploit_chain": "",
  "evidence": "README.md (full path:line analysis); no run artifacts (untested by design)",
  "kernel_refs": [
    "sys/libprop/prop_stack.c:49-53",
    "sys/libprop/prop_object_impl.h:260-263",
    "sys/libprop/prop_object.c:1077-1094",
    "sys/libprop/prop_object.c:1174",
    "sys/libprop/prop_dictionary.c:380-383",
    "sys/libprop/prop_dictionary.c:397-409",
    "sys/libprop/prop_array.c:129-132",
    "sys/libprop/prop_array.c:240-243",
    "sys/kern/kern_slaballoc.c:873-877",
    "sys/kern/kern_slaballoc.c:1723-1724"
  ],
  "poc_changes": "No PoC authored (hardening finding; PoC skipped per contract for Low severity).",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 checklist item (a) (kmalloc sizes / M_WAITOK handling). Growth allocation size itself is a fixed sizeof(*eelem) (5 pointers, 40 bytes) \u2014 no depth-supplied arithmetic feeds any size. Do NOT fix by adding M_NULLOK before DF-5677s emergency-path fix lands: a NULL there routes into the buggy emergency mode.",
  "recommended_fix": "Grow the walk stack outside lock-held regions (pre-reserve push headroom before taking pot_lock in the release walk; same for the equals walk) and document prop_object_release/prop_object_equals as sleepable-context-only; keep M_WAITOK (never M_NULLOK) until the emergency path is fixed.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "No fix validation performed (finding untested; the hardening direction is multi-site, not a validated one-liner).",
  "fix_evidence": ""
}