{
  "finding_id": "DF-5784",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "guest: newfs_hammer2 + one file f1 -> base.img; host: python3 forge_df5784.py base.img craftA.img craftB.img (+ craftC.img keybits=0 control); scp to /root/poc/df5784/",
    "run": "guest root: sh /root/poc/df5784/run_df5784.sh  (control mount, then crafted craftB mount + ./leakloop /mnt/h2x 1000000)",
    "expected": "stock kernel: control completes (delta 0); crafted readdir never completes -- leakloop R2, kill -9 EPERM, umount hangs, vfs.hammer2.chain_allocs creeps up; craftC control (no wrap) benign (CRAFTC_DELTA=0). patched kernel (fix.diff): crafted completes with CRAFTED_DELTA=0, umount OK."
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_chain.c:108-117",
    "sys/vfs/hammer2/hammer2_chain.c:1955-1969",
    "sys/vfs/hammer2/hammer2_chain.c:2606-2617",
    "sys/vfs/hammer2/hammer2_chain.c:2748-2749",
    "sys/vfs/hammer2/hammer2_chain.c:4975-4986",
    "sys/vfs/hammer2/hammer2_admin.c:1000-1019"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "forge_df5784.py", "leakloop.c",
    "build.sh", "run_df5784.sh",
    "base.img", "craftA.img", "craftB.img", "craftC.img",
    "run.log", "run_wedge_transcript.txt", "run_control_craftC.log",
    "run_fix.log", "build.log", "fix_build.log",
    "fix.diff", "env.txt", "code_hashes.txt", "manifest.json", "verdict.json"
  ]
}