{
  "finding_id": "DF-5819",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "hammer2_vop_nsymlink unconditionally discards the result of hammer2_write_file for the symlink target (hammer2_vnops.c:1847-1849, explicit /* XXX handle error */ error = 0;). The bug is certain in source: on any write failure the VOP returns success and the namecache commits to a symlink whose target is truncated or zero-filled; the call also bypasses the enospace classification and RLIMIT_FSIZE gate that hammer2_vop_write applies because write_file is invoked directly. Runtime trigger requires an I/O error from the bread_kvabio DIRECTDATA-transition read (hammer2_vnops.c:1320) which cannot be injected on the stock virtio guest, so no live reproduction was attempted beyond the code-path trace.",
  "exploit_chain": "",
  "evidence": "README.md code-path trace with exact path:line; no runtime artifact (fault injection unavailable).",
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_vnops.c:1847",
    "sys/vfs/hammer2/hammer2_vnops.c:1320",
    "sys/vfs/hammer2/hammer2_vnops.c:1863"
  ],
  "poc_changes": "no runnable trigger possible without a fault-injecting block device; static verification only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Robustness/error-handling defect (silent partial symlink on IO error); severity Low.",
  "recommended_fix": "Propagate the error: on failure run the unlink-finisher cleanup for nip (as the create-error path does) and return the error instead of error = 0.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: triggering requires a media-read failure inside the embedded-data transition, not injectable on the QEMU virtio disk.",
  "fix_evidence": ""
}