{
  "finding_id": "DF-5712",
  "status": "reproduced",
  "verdict": "The kernels index()/rindex() (the backend of every in-kernel strchr/strrchr via sys/sys/libkern.h:164-174) compare the sign-extended string byte against the untruncated int search argument at sys/libkern/index.c:46 and sys/libkern/rindex.c:47, where ISO C requires converting the argument to char first. For any ch outside [-128,127] the kernel scans never match while libc truncates and matches the corresponding byte: the userland differential harness (kernel sources compiled verbatim in the DragonFly guest, ch in [-300,300] over a high-bit corpus) shows 116 divergences from libc (58 index + 58 rindex), identical across 3 runs, dropping to 0 with the one-character ((char)ch) fix. No memory unsafety: both scans are byte-at-a-time and halt exactly at the NUL \u2014 guard-page-proven, ch==0 tail semantics match libc exactly. No in-tree caller passes a high-bit search byte (census in VERDICT.md), so the defect is latent: a parser ported from userland that searches for a delimiter >= 0x80 would silently treat every occurrence as absent (field-separation confusion shape).",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5712/run.log: DIFF baseline: index 58 mismatches, rindex 58 mismatches + BASELINE_TOTAL_MISMATCHES=116 + samples str=\"\" ch=-256 kernel=-1 libc=0; CH0_SEMANTICS: OK; GUARDPAGE_RESULT: byte-exact, halts at NUL (0 unexpected faults); PATCHED_TOTAL_MISMATCHES=0. Identical in run.2.log/run.3.log. build.log proves the guest /usr/src sources are sha256-identical to the audited tree and the compiled bodies are byte-identical (BODY-IDENTICAL lines).",
  "kernel_refs": [
    "sys/libkern/index.c:46",
    "sys/libkern/rindex.c:47",
    "sys/sys/libkern.h:164",
    "sys/sys/libkern.h:170"
  ],
  "poc_changes": "Harness authored fresh (no seed). (1) kernel #include <sys/param.h> substituted with <stddef.h> for the userland build (bodies untouched, cmp-proven); (2) corpus literal \"a\\x80b\\x80c\" split into adjacent literals after a gcc hex-escape warning; (3) guest transfer via b64decode (guest lacks base64(1)).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": false,
  "build_cmd": "cd /tmp/df5712 && sh build.sh   (cc 8.3; compiles /usr/src/sys/libkern/index.c and rindex.c verbatim, renamed via -Dindex=k_index/-Drindex=k_rindex, plus sed-patched (char)ch copies)",
  "run_cmd": "cd /tmp/df5712 && sh run.sh   (./diffharness)",
  "code_hash": "93687a39c4253051c1edf5ea32f8f4172ed52dfbb4459ba141372604e92c2f1e",
  "notes": "Guard-page part also documents the NUL-termination contract: a buffer with no zero byte abutting a PROT_NONE page faults at the guard \u2014 reachable in-kernel only through a consumer bug; consumer census (VERDICT.md) found none. nata ata-disk.c:511 model[40] device-trust wart noted, out of scope for this finding. Guest not dirtied: only /tmp/df5712 created; no panic, no kernel state change, no reset needed.",
  "recommended_fix": "Cast the search argument to char before comparing in both primitives: if (*u.p == (char)ch) in sys/libkern/index.c and sys/libkern/rindex.c (see fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "The one-character-per-file fix was validated inside the same harness: build.sh sed-applies exactly if (*u.p == ch) -> if (*u.p == (char)ch) to the verbatim kernel sources (diff shown in build.log) and compiles the patched bodies alongside; the differential vs libc drops from 116 mismatches to 0 (PATCHED_TOTAL_MISMATCHES=0, 3/3 runs). The cast reproduces libc semantics on both signednesses of char. A full kernel rebuild adds nothing for this stateless pure function beyond the demonstrated object-level equivalence, so none was performed; fix.diff is authored against the read-only sys/ tree and was never applied there.",
  "fix_evidence": "findings/poc/DF-5712/run.log: DIFF patched: index 0 mismatches, rindex 0 mismatches / PATCHED_TOTAL_MISMATCHES=0; build.log: the 44c44/45c45-style diff hunks showing only the cast changed; fix.diff: git-apply-able unified diff for both files."
}