# DF-5775 — VERDICT

**Status: reproduced (stock kernel, deterministic). Fix validated on a
rebuilt kernel.**
**Impact: arbitrary-file truncate/overwrite (content replaced with the
pid) with the vkernel launcher's privileges — in the common
root-launched deployment, root file destruction via a symlinked pidfile
path. Severity Low (config-injection precondition), certain.**

`writepid()` (init.c:1381-1404) opens the operator-supplied `-p` path
with `O_RDWR|O_CREAT|O_EXLOCK|O_NONBLOCK` and no `O_NOFOLLOW`
(init.c:1390), then `ftruncate(fd, 0)` (init.c:1400) and writes the pid
(init.c:1401). A symlink at the pidfile path is followed: the TARGET is
truncated and overwritten. Live proof on the guest (baseline_run.log):

```
before: target=DF5775-MARKER-SECRET-ORIGINAL-CONTENT-MUST-SURVIVE
after:  target=[14255]
RESULT: target CLOBBERED via symlink (vulnerable)
```

with the vkernel itself dying immediately afterwards ("System memory
size must be specified with -m") — demonstrating that writepid runs
BEFORE any memory/disk setup (init.c:442-444), so the clobber needs no
bootable configuration at all.

Fixed kernel (`fix.diff` hunk 3: `O_NOFOLLOW`): open fails with ELOOP
("Failed to create pidfile: Too many links"), the vkernel exits, and
the marker target is intact (fixed_run.log).

Reachability: `-p` is operator input; the security-relevant scenario is
a privileged launcher consuming a pidfile path from lower-trust
configuration (the same confused-deputy class as any root-run daemon
with a configurable pidfile). No memory-safety primitive; hence Low.

Artifacts: run5775.sh, baseline_run.log, fixed_run.log, fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.