{
  "finding_id": "DF-5706",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The DF-5700-class longword over-read of sys/libkern/memcchr.c is real AND live - unlike bcmp.c this file is compiled into every kernel (sys/conf/files:2212) and the shipped guest kernels memcchr (0xffffffff809d5bf0, disassembly matches this C source) is this implementation; its only consumers are the ext2 bitmap scans (ext2_alloc.c:1358/1362/1519/1523). Measured on the pristine, byte-identical source: the first-word align-down load (memcchr.c:83-85) reads up to 7 bytes below begin and the word-walk load (memcchr.c:90-91) up to 7 bytes past begin+n (2,282,570 / 61,553 occurrences over 2.6M differential cases). The over-read is provably benign: every load is a naturally-aligned granule containing >=1 in-bounds byte, 8|4096, so no load can straddle a page (instrumented invariant g_outside_granule==0; 762,160-call both-side PROT_NONE guard sweep with page-edge-critical lengths: zero faults), and mismatches found in over-read bytes are rejected by the done-filter at memcchr.c:114 (10,948 observed activations, all correctly returning NULL) so nothing leaks. DF-5701s truncation shape is NOT shared: n is size_t end-to-end (memcchr.c:60) and all consumer lengths are mount-bounded to [1,bsize] (ext2_vfsops.c:556-572 fpg==bpg==bsize*8; :582-587 ipg<=bsize*8; ext2_mapsearchs bpref normalized by ext2_alloccg:1029-1032). Return semantics exact over 2,608,384 differential cases (0 disagreements). Secondary note: the goto done at :102 is unreachable dead code. Hardening finding only - no exploitable path exists.",
  "exploit_chain": "",
  "evidence": "logs/instr.out (over-read CONFIRMED: max 7B below/past, 0 outside-granule loads, 10948 filter rejections, differential 0 failures); logs/guard.out (RESULT: PASS, 762160 guarded calls); logs/fixed.out + logs/guardfix.out (fix validation: 0 out-of-range loads, 0 differential failures); logs/kernel_liveness.txt (nm + objdump of shipped kernels memcchr); build.log/run.log/run.2.log; memcchr_body.c byte-identical to sys/libkern/memcchr.c:36-117",
  "kernel_refs": [
    "sys/libkern/memcchr.c:83-87",
    "sys/libkern/memcchr.c:90-104",
    "sys/libkern/memcchr.c:108-116",
    "sys/conf/files:2212",
    "sys/vfs/ext2fs/ext2_alloc.c:1358",
    "sys/vfs/ext2fs/ext2_alloc.c:1519",
    "sys/vfs/ext2fs/ext2_vfsops.c:556-587"
  ],
  "poc_changes": "Seed plan (userland differential + guard pages, established rig pattern) required three rig repairs before the authoritative run: (1) guard_harness.c second mprotect call was missing its length argument; (2) instrumented copies needed an explicit LONGPTR_MASK define (the pristine body defines it at :50 but the hand-written instrumented twins did not); (3) drivers needed <stddef.h> for ptrdiff_t on DFly gcc8. The pristine kernel body itself was extracted byte-identical (sed 36,117p; re-diffed) with only the four kernel includes (:30-34) replaced by shim/prelude.h; guest /usr/src source md5-matched the repo.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 210,
  "guest_dirty": 0,
  "build_cmd": "cd findings/poc/DF-5706 && sh ./build.sh   (inside DFly guest; KSRC=/usr/src/sys/libkern/memcchr.c)",
  "run_cmd": "cd findings/poc/DF-5706 && sh ./run.sh    (inside DFly guest)",
  "code_hash": "2d5099c0ddd2c700a03949c050b40276e4703595b98ee9cfeb68493509bd63ab",
  "notes": "Pass-2 checklist answers: (a) over-read ALWAYS same-page (aligned-granule proof + 762k empirical guarded calls + 0 outside-granule instrumented violations); (b) no truncation shape - size_t n end-to-end, consumers bounded [1,bsize] by ext2_vfsops.c:556-572 and :582-587 (which also exclude the ipref%=e2fs_ipg div-by-zero at ext2_alloc.c:1352); (c) return semantics exact, done-filter at :114 is load-bearing (10948 activations, all NULL); (d) consumer census: 4 sites, all ext2 bitmap scans, all in-bounds. Liveness triple-proven: conf/files:2212, memcchr.o + /boot/kernel/kernel nm, objdump of the running symbol. Dead branch at :102 noted (unreachable). Rig ran as unprivileged user maxx; guest left clean (scratch removed, no kernel changes, no reboot).",
  "recommended_fix": "Eliminate the over-read: bytewise head alignment, full-word loop only while (lp+1) <= end, bytewise tail (fix.diff; validated at rig level: zero out-of-range loads, semantics unchanged).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied cleanly (patch -p1, hunk at :74) to a scratch copy of the pristine kernel file inside the rig and validated at rig level: instrumented fixed build shows below-start=0, past-end=0, outside-granule=0 over 2,608,384 differential cases (0 failures); both-side guard sweep passes unchanged. No kernel rebuild performed: the finding is Info/hardening with zero demonstrated impact, so there is no in-kernel behavior to observe; the rig compiles the exact kernel source bytes (md5-matched), matching the validation level used for this family in DF-5700.",
  "fix_evidence": "logs/fixed.out (RESULT: FIX-PASS, 0 out-of-range loads), logs/guardfix.out (RESULT: PASS), logs/scratch/memcchr.c.patched, fix.diff, build.log"
}