{
  "finding_id": "DF-5711",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Consumer-census finding from the sys/libkern/strncpy.c pass-2 audit: netmap_vale.c:331-332 clamps namelen to IFNAMSIZ (not IFNAMSIZ-1) and netmap_vale.c:352 then strncpys exactly 16 non-NUL bytes into char bdg_basename[IFNAMSIZ] (netmap_vale.c:198) -- the array is left unterminated. Reproduced on the DF 6.5 guest with the kernels own strncpy: no NUL within [0,16), strlen runs to 47 through the adjacent canary. Impact none today: the only in-tree readers are ND()/D() debug prints and ND is a no-op in release (netmap_kern.h:80-81); bridge matching uses bdg_namelen+strncmp, not the stored NUL. Filed as Info hardening.",
  "exploit_chain": "",
  "evidence": "run.log: bdg_basename has NUL within [0,16)? -> NO (index -1) and strlen(...): 47; fix.diff applies clean to guest /usr/src (Hunk #1 succeeded at 350).",
  "kernel_refs": [
    "sys/net/netmap/netmap_vale.c:331",
    "sys/net/netmap/netmap_vale.c:352",
    "sys/net/netmap/netmap_vale.c:198",
    "sys/net/netmap/netmap_kern.h:80"
  ],
  "poc_changes": "Harness written fresh (rig shared with DF-5710; kernel strncpy compiled unmodified from /usr/src).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-5710/build.sh (shared rig)",
  "run_cmd": "./harness_netmap_clamp",
  "code_hash": "df73d1a65ead4bd9585d1fe17d0d9f7d75cf1d65c91ca391a38c9cff11842bd8",
  "notes": "Hardening class per the audit contract: no live consumer in release builds, so no kernel-build fix validation performed; fix.diff semantics-preserving (clamp untouched to keep strncmp matching identical).",
  "recommended_fix": "netmap_vale.c:352: set b->bdg_basename[IFNAMSIZ-1] = \\0 after the strncpy (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info/hardening finding: no kernel build/boot validation performed (nothing manifests in release builds). fix.diff applies cleanly and forces NUL termination without altering the bdg_namelen/strncmp matching semantics.",
  "fix_evidence": "patch -C -p1 --dry-run on guest /usr/src: Hunk #1 succeeded at 350 (output captured in findings/poc/DF-5710/fix_run.log)."
}