{
  "finding_id": "DF-5773",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "init.c installs the monitors SIGTERM forwarder handle_term AFTER fork() (init.c:206-218), so every child forked by a LATER monitor iteration -- i.e. every vkernel boot after a cpu_reset()/EX_VKERNEL_REBOOT reboot cycle -- inherits handle_term with childpid == 0, turning init.c:505s kill(childpid, sig) into kill(0, SIGTERM): a signal to the ENTIRE process group. Because the handler runs with SIGTERM self-masked, its own kill(0) leaves a fresh TERM pending on itself that is delivered the instant the handler returns: a self-re-arming, unstoppable signal storm that freezes the reforked vkernel in its early-boot window (until shutdown.cs SI_BOOT2_PROC0 initshutdown would replace the handler) and TERMs every bystander in the launching pgrp (rc script, supervisor, pipeline). The mechanism was reproduced on the guest with a byte-faithful extraction of init.c:204-230/500-506 (storm_demo.c): 85 runner TERM deliveries in ~3s, bystander killed by the splash, demo pair wedged against a second TERM; with the one-line guard the storm and splash vanish (0 hits, bystander alive). The full in-vkernel trigger is traced line-by-line and rigged (run5773.sh + reboot2.c) but is currently gated ONE bug upstream: the stock vkernels reboot path NULL-derefs in naccess (fault VA 0x58, post-sync, kern_shutdown boot() cleanup) before reaching cpu_reset, so no reforked child exists on this snapshot to storm. Same-uid (or root) signaling is the only prerequisite on the attacker side, and vkernel reboot cycles are routine operation.",
  "exploit_chain": "attacker with same uid as vkernel (or root) -> vkernel completes one guest reboot (kern_reboot -> cpu_reset exit 32 -> monitor refork; stock-gated by the sibling naccess bug today) -> child #2 inherits handle_term with childpid==0 -> single kill -TERM during the next boots pre-SI_BOOT2_PROC0 window -> kill(0, SIGTERM) -> process-group splash (launching script/supervisor TERMed) + self-re-arming storm -> vkernel permanently wedged, TERM-immune, ~100% CPU; only kill -9 recovers",
  "evidence": "baseline_storm.obs (85x RUNNER_GOT_SIGTERM, BYSTANDER_DEAD_BY_SPLASH, DEMO_STILL_ALIVE_AFTER_SECOND_TERM_storm_wedged); fixed_storm.obs (0 hits, BYSTANDER_ALIVE after the guard); VERDICT.md (full trace, sibling-gate analysis); run5773.sh/reboot2.c (in-vkernel rig); fixed_vk5773.obs (fixed kernel, TERM burst: SLEEPER_ALIVE, no splash)",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/init.c:204",
    "sys/platform/vkernel64/platform/init.c:217",
    "sys/platform/vkernel64/platform/init.c:218",
    "sys/platform/vkernel64/platform/init.c:228",
    "sys/platform/vkernel64/platform/init.c:505",
    "sys/platform/vkernel64/platform/init.c:1474",
    "sys/platform/vkernel64/platform/shutdown.c:82"
  ],
  "poc_changes": "PoC authored fresh this run (no seed): storm_demo.c extracts init.cs exact monitor/child structure; run5773.sh adapts the DF-5661 fifo rig (root-mount answer must be written at t=0; guest reboot(8) wedges, so reboot2.c invokes reboot(2) directly; exec 3>fifo must happen only after the vkernel holds the read end -- fifo deadlock otherwise)",
  "attempts": 7,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64   # + DF-5474 build-id defsym workaround in platform/vkernel64/conf/Makefile; cc -O -o storm_demo storm_demo.c",
  "run_cmd": "sh run_storm_demo.sh 3   # and: sh run5773.sh 0.03 with /bin/reboot2 injected in /vkroot.img",
  "code_hash": "73eb56a1ff2d1d6b79d1f39d0f7c5f5cc3be27f7e936eb0585d4b8d6361b7a19",
  "notes": "In-vkernel trigger gated by a THIRD shutdown-family bug observed live this run: kern_reboot from process context NULL-derefs in naccess (IP 0x55d143/0x55d163, fault VA 0x58, current process sh) after disks sync -- blocks cpu_reset/refork on stock; DF-5661s fix.diff moves but does not remove it. First-boot children have SIG_DFL for SIGTERM (sigaction runs post-fork), so TERM during boot #1 is a silent death (verified live, 0.15s delay run) -- only reforked children storm. Guest reset (with-src) performed after verification.",
  "recommended_fix": "Guard handle_term: if (childpid > 0) kill(childpid, sig); -- only the monitor forwards",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Baseline harness: storm (85 runner hits) + bystander killed + TERM-proof wedge. Patched harness (guard): 0 hits, bystander alive, normal lifecycle. Patched vkernel (rebuilt): TERM burst produces no splash and no storm (SLEEPER_ALIVE, no RUNNER_GOT_SIGTERM); the reboot path still wedges in naccess, which is a different files defect and correctly unaffected.",
  "fix_evidence": "baseline_storm.obs vs fixed_storm.obs; fixed_vk5773.obs; fix.diff hunk 1"
}