{
  "finding_id": "DF-5806",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "summary": "soreceive() zero-progress `goto restart` (uipc_socket.c:1596-1600) spins forever in kernel mode when MSG_PEEK reads a record that delivers zero bytes; unprivileged, unkillable, permanent guest-wide DoS",
  "reproduce": {
    "build": "cc -O2 -Wall -o peekspin peekspin.c",
    "run": "./peekspin 0 1   (variant 0 = AF_UNIX SOCK_STREAM + SCM_RIGHTS control-only record; variant 1 = SOCK_SEQPACKET zero-length datagram)",
    "expected": "On stock kernel: recv(MSG_PEEK) never returns; the child spins in kernel mode, cannot be killed (never sleeps), and within seconds ALL userland including sshd starves - ssh dies with 'Connection timed out during banner exchange', vm.sh status reports down while qemu still runs; only a VM reset clears it. On fix.diff-patched kernel: recv returns immediately, 12 simultaneous spinners leave the guest fully responsive."
  },
  "kernel_refs": [
    "sys/kern/uipc_socket.c:1596",
    "sys/kern/uipc_socket.c:1340",
    "sys/kern/uipc_socket.c:1409",
    "sys/kern/uipc_socket.c:1446",
    "sys/kern/uipc_socket.c:829",
    "sys/kern/uipc_socket.c:1926",
    "sys/kern/uipc_sockbuf.c:196",
    "sys/kern/uipc_usrreq.c:756",
    "sys/kern/uipc_proto.c:53"
  ],
  "artifacts": [
    "peekspin.c", "build.sh", "run.sh", "build.log", "run.log",
    "env.txt", "VERDICT.md", "fix.diff", "fix-run.log",
    "manifest.json", "verdict.json"
  ],
  "fix_summary": "Never take the zero-progress restart when MSG_PEEK is set (soreceive 1596-1600, mirrored in sorecvtcp 1926-1930); a zero-byte peek returns a short read instead of spinning."
}