{
  "finding_id": "DF-5720",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced deterministically on the stock snapshot guest: db_command.c:364 accepts a tNUMBER token as a /-modifier but :369 copies db_tok_string, which the lexer fills only for tIDENT tokens (db_lex.c:170-216), so modif[] receives the previously lexed identifier \u2014 deterministically the commands own name. Live serial transcript shows examine/4 silently switching to a mixed hex/pointer/disassembly format walk, print/4 printing an empty line (p has no case in db_print_cmd), and write/4 refused with Unknown size, while letter-modifier controls (x/x, print/x, write/l) behave normally. Impact is none: modif is lexer-bounded (<=119+NUL into modif[120]) and every consumer switches on single characters with bounded defaults, so this is a debugger parser correctness/stale-state bug (console-privileged), not memory unsafety.",
  "exploit_chain": "",
  "evidence": "run.log (aka /tmp/opencode/df-5720-drain.log snapshot): examine/4 db_active -> db_active: 1  0x100000001addb %al,(%rax) + second address header db_global_jmpbuf_valid+0x6: (modif=examine per-char walk); print/4 0x41 -> empty line; write/4 db_active 1 -> Unknown size; controls x/x db_active -> db_active: 1, print/x 0x41 -> 41, write/l db_active 1 -> db_active 1 = 1. VERDICT.md has full delimitation vs DF-5561 and the post-continue cross-file lead with its battery=none control.",
  "kernel_refs": [
    "sys/ddb/db_command.c:361-370",
    "sys/ddb/db_command.c:289",
    "sys/ddb/db_lex.c:170-216",
    "sys/ddb/db_lex.c:225-256",
    "sys/ddb/db_examine.c:55-59",
    "sys/ddb/db_examine.c:78-193",
    "sys/ddb/db_examine.c:204-248",
    "sys/ddb/db_write_cmd.c:47-67"
  ],
  "poc_changes": "Authored directly (no seed pack existed): socket-serial rig adapted from the proven DF-5561 pattern with per-queue pacing; QEMU monitor server=nowait modernized to server=on,wait=off.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (no-op; no compilation required)",
  "run_cmd": "./run.sh",
  "code_hash": "2b4c0b55b77ea5cdb32690c4f4d6c531d1a71e57e344896b4edc9d9e5d9290bc",
  "notes": "Post-continue guest starvation observed (no serial echo / no ssh, vCPUs ~5%) \u2014 reproduced identically with a ZERO-command session (ab_cycle.sh 5 none, exp.A-short-none.drain.log), so it is a property of the debug.enter_debugger/kdb_trap/restart_cpus resume path (sys/ddb/db_sysctl.c:56-76, sys/platform/pc64/x86_64/db_interface.c:160-200), NOT db_command.c; documented as a cross-file lead for the DF-2246/DF-5561 owners. Guest was reset with-src after evidence capture. db_fncall fault-cascade deliberately not re-triggered (owned by DF-5561).",
  "recommended_fix": "In db_commands /-modifier parsing, format db_tok_number into modif for tNUMBER tokens (or reject tNUMBER outright) instead of copying the tIDENT-only db_tok_string buffer.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": null,
  "fix_verdict": "Info-class parser correctness fix; kernel-rebuild validation not warranted (no panic/corruption involved). fix.diff is a minimal, line-accurate unified diff against sys/ddb/db_command.c (never applied to sys/).",
  "fix_evidence": "findings/poc/DF-5720/fix.diff"
}