# DF-5708 VERDICT — reproduced (mechanism; impact: none at demonstration privilege)

**Bottom line.** The absorbing-fixed-point behavior of the shared MINSTD
state is real and was demonstrated live on the guest kernel: writing 0
(the exact effect of `skrandom(0)`) or 0xFFFFFFFE (= 2*(2^31-1), both
producible by `skrandom(karc4random())` at oce attach, p = 3/2^32 per
attach) pins `randseed` at 0x7fffffff permanently; every subsequent
`krandom()` returns the constant 0x7fffffff. The demonstration used
root's /dev/mem to place the state (equivalent to the skrandom call the
oce driver makes in-kernel); no unprivileged trigger exists on this guest
(no oce hardware), so the security impact ceiling on default configs is
the probabilistic oce path plus foreign-kmodule/legacy misuse. Classified
Low severity, impact "none" at demonstration privilege.

## Proof detail

- fixedpoint.log: three-arm experiment (0 / 2m / control) with the
  loadav-driven draw stream as the consumer; stuck states observed across
  multiple 8s windows; control evolves normally (8 draws / 8 s = 1/s,
  consistent with rate.log's 1.23/s six-CPU measurement).
- Arithmetic: for x ∈ {0, m, 2m}: hi/lo split yields
  t = 16807*lo - 2836*hi = 0 exactly (0: 0-0; m: 16807*2836-2836*16807;
  2m: 16807*5672-2836*33614 = 95329304... = 0), `t<=0` fixup → m, and
  state m maps to itself. Verified by hand and live.
- Cross-checks that all 2^32 single-word seeds are otherwise safe:
  for x < 2^32, |t_before| < 2^31 so the single += m always lands in
  [1, m] — only the three multiples of m degenerate; wide seeds ≥ ~2^38
  can transiently return out-of-range values (negative sign-extended),
  documented as a robustness note (no current caller).

## Fix validation

Not rebuilt (not a memory-corruption class finding; fix validation not
mandated). fix.diff folds seeds into the valid domain in skrandom() and
defensively re-seeds krandom(); the patch is compile-trivial and the
math is exercised by the same demonstration (any x≡0 mod m maps to a
valid state under `seed % 0x7ffffffe + 1`).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.