{
  "finding_id": "DF-5732",
  "title": "DDB trap funnel defeats the db_nofault guard: every recoverable DDB memory probe (incl. show registers' disasm of the DDB-writable $rip, db_print.c:68) runs trap_fatal() - spurious crash banner, kernel state disclosure, leaked gd_trap_nesting_level, corrupted session resume",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "severity": "Low",
  "reproduce": {
    "build": "none (DDB console repro)",
    "run": "findings/poc/DF-5732/serial_vm.sh up; ssh root@dfbsd 'sysctl debug.enter_debugger=ddb' & sleep 6; DF5732_SOCK=/tmp/opencode/df-5732-ser.sock python3 findings/poc/DF-5732/drive.py 'set $rip = 0xdead000000000000' 3 'show registers' 6",
    "expected": "register dump, then 'Fatal trap 9: general protection fault while in kernel mode' ... 'kernel: type 9 trap, code=0', then a recovered db> prompt (the quiet recovery the db_nofault guard exists for, delivered only after the full crash dump)"
  },
  "kernel_refs": [
    "sys/ddb/db_print.c:68",
    "sys/ddb/db_print.c:46",
    "sys/platform/pc64/x86_64/db_trace.c:107",
    "sys/ddb/db_variables.c:120",
    "sys/platform/pc64/x86_64/db_interface.c:242",
    "sys/platform/pc64/x86_64/db_interface.c:140",
    "sys/platform/pc64/x86_64/trap.c:414",
    "sys/platform/pc64/x86_64/trap.c:422",
    "sys/ddb/db_examine.c:178"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "drive.py", "serial_vm.sh", "run.sh", "env.txt",
    "run4-decisive-setrip-showregisters.log", "panic.txt", "session0-sweep.log",
    "run1-control-valid-xi.log", "run3-control-held-connection.log",
    "run3-sshpoll.log", "serial-full.log", "fix.diff", "verdict.json",
    "manifest.json", "code_hashes.txt"
  ]
}