{
  "finding_id": "DF-5774",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "strtok(optarg, \":\") at init.c:394 returns NULL for a -n argument made entirely of delimiters or empty (-n :, \"-n \"), and init.c:395 feeds it to strtol() unguarded: the vkernel child segfaults during option parsing (ktrace: PSIG SIGSEGV SIG_DFL, zero boot output, monitor exits 0 silently). Same operator-input crash class as DF-1031, distinct site/defect. One-line NULL check fixes it; validated on the rebuilt kernel (clean EX_USAGE exit 0x40, Bad -n option).",
  "exploit_chain": "",
  "evidence": "baseline_run.log + baseline.kdump.txt (PSIG SIGSEGV SIG_DFL; control -n 2 boots); fixed_run.log (exit 0x40, Bad -n option, no signal)",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/init.c:394",
    "sys/platform/vkernel64/platform/init.c:395"
  ],
  "poc_changes": "authored fresh (no seed); run5774.sh wraps the ktrace/kdump evidence and a -n 2 control boot",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 120,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64  (fix validation: rebuild with fix.diff hunk 2)",
  "run_cmd": "ktrace -i -f /tmp/vk5774.ktrace ./kernel.debug -m 512m -n : ; kdump -f /tmp/vk5774.ktrace | grep PSIG",
  "code_hash": "708fdb4072f770e7eb30473bc35d12a1980c17dfd6e87ab5c611a89e1d78be42",
  "notes": "Distinct from DF-1031 (init_disk/-c); this is option-parsing. Monitor masks the crash (WEXITSTATUS of signaled child == 0 -> silent exit 0).",
  "recommended_fix": "if (tok == NULL) usage_err(\"Bad -n option\"); after the strtok at init.c:394",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Baseline: PSIG SIGSEGV, no output. Patched kernel: exit(0x40) with Bad -n option, no signal, control -n 2 unchanged.",
  "fix_evidence": "baseline.kdump.txt vs fixed_run.log"
}