{
  "finding_id": "DF-5727",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "watch addr[,size] - the syntax documented in ddb(4) - silently drops the size: db_command.c:386-396 parses ,size into the count parameter, db_watch.c:198-201 ignores count and re-parses at end-of-line (FALSE) so size defaults to 4 unconditionally; live-proven watch ticks,8 shows Size 4 while the undocumented watch ticks 8 shows Size 8. Mis-sized tripwire on a root-gated console -> Low; compounds DF-5721s inert software watchpoints with a distinct argument-handling root cause; no memory unsafety.",
  "exploit_chain": "",
  "evidence": "baseline-up.serial.log / session1-smp.serial.log: watch ticks,8 -> show watches prints Size 4; watch ticks 8 -> Size 8. fix_run.log (patched): watch ticks,8 -> Size 8; watch ticks -> Size 4 (default preserved).",
  "kernel_refs": [
    "sys/ddb/db_watch.c:192",
    "sys/ddb/db_watch.c:198",
    "sys/ddb/db_command.c:386",
    "share/man/man4/ddb.4:495"
  ],
  "poc_changes": "No seed PoC; uses the DF-5725 packs serial rig.",
  "attempts": 2,
  "runtime_sec": 120,
  "build_cmd": "(fix kernel) cd /usr/src && patch -p1 -N < /tmp/combined.diff && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel",
  "run_cmd": "./enter_ddb.sh; DF5725_SOCK=/tmp/opencode/df-5725-ser-up.sock ./drive_ddb.py watch ticks,8 2 show watches 3 dwatch ticks 2 watch ticks 8 2 show watches 3 dwatch ticks 2",
  "notes": "db_watchpoint_cmd is registered with CS_MORE (db_command.c:112) which is what leaves the token stream at EOL for the doomed re-parse. Fix keeps the legacy space form and the 4 default.",
  "recommended_fix": "Honor the parser-provided count in db_watchpoint_cmd() (comma syntax) while keeping the legacy space form and 4-byte default (fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Stock kernel: comma size silently dropped (Size 4 for ,8). Patched kernel: watch ticks,8 -> Size 8, watch ticks -> Size 4. Documented syntax now honored.",
  "fix_evidence": "findings/poc/DF-5727/fix.diff; fix_run.log (Size 8 for comma syntax on patched kernel); baseline-up.serial.log (Size 4 on stock)",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 (baseline); patched fix kernel #1: Sat Oct 10 18:42:38 UTC 2026",
  "guest_dirty": 0,
  "code_hash": "4af3526ae154b6eda9c58a47a4765ec20f5f92789a42d1c221faabf9f498c9ea",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Sat Oct 10 18:42:38 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC"
}