# DF-5766 — Permanent Fortuna reseed suppression on the BSP (poisoned ratecheck baseline)

`csprng_get_random()` (sys/kern/subr_csprng.c:134-137) rate-limits reseeds
with `ratecheck(&state->last_reseed, ...)`. The first `csprng_get_random()`
of the system runs inside `rand_initialize()` (SI_BOOT2_POST_SMP) on the
BSP, before the uptime clock is coherent; `ratecheck()`'s first-call path
stores the garbage `getmicrouptime()` value (~1.8e11 s) into
`state->last_reseed`. From then on every delta is negative, `ratecheck()`
returns 0 forever, and **that CPU's CSPRNG never reseeds again — no entropy
harvested after boot is ever mixed in, for the whole uptime**, while
`pool[0]` sits eligible at 15-32 KB. On `ncpus==1` systems this is the only
kernel CSPRNG.

## Reproduce (guest, root, soon after boot)

```
./build.sh                     # cc -O2 -o /tmp/rngtest/csprng_dump csprng_dump.c
./run.sh                       # dump; usched :1 dd 8MiB urandom; dump again
```

Expected (vulnerable kernel):
- `state[0]`: `reseed_cnt=1`, `last_reseed=184467440735.xxxxxx`, `pool0>=96`
  — unchanged by the pinned read.
- other states: `reseed_cnt` increasing, sane small-uptime `last_reseed`.

Patched (fix.diff): after the first read cpu0's `reseed_cnt` grows and
`last_reseed` is sane.

## Files
- `csprng_dump.c` — /dev/kmem state dumper (+ `poll` mode)
- `run.1.log` / `run.2.log` — boot #1 / boot #2 decisive runs (verbatim)
- `build.log` — compile output
- `env.txt` — guest, symbols, DWARF offsets
- `fix.diff`, `fix_build.log`, `fix_run.log` — fix + validation
- `VERDICT.md`, `manifest.json`, `verdict.json`