{
  "finding_id": "DF-5825",
  "title": "kdmsg_state_msgrx() REPLY-direction injection removes state from wrong RB tree (peer UAF)",
  "file": "sys/kern/kern_dmsg.c",
  "lines": [
    810,
    986,
    1080,
    1083
  ],
  "verdict_pending_note": "manifest finalized after fix validation; see verdict.json",
  "reproduce": {
    "build": "cc -O -o /root/escalate /root/escalate.c && cc -O -o /root/oracle /root/oracle_inject.c && cc -O -D_KERNEL_STRUCTURES -I/usr/src/sys -o /root/probe_state /root/probe_state.c",
    "run": "kldload xdisk; /root/oracle   # pure-peer panic at kern_dmsg.c:1082\n/root/escalate             # UAF root + fake rbnode -> fatal trap 9 in kdmsg_state_tree_RB_FIND at 0x4242424242424242",
    "expected": "panic: assertion \"msg->any.head.cmd & DMSGF_REPLY\" failed in kdmsg_state_msgrx at kern_dmsg.c:1082  |  Fatal trap 9: general protection fault ... Stopped at kdmsg_state_tree_RB_FIND+0x2a: cmpq 0x58(%rax),%rdx"
  },
  "kernel_refs": [
    "sys/kern/kern_dmsg.c:807",
    "sys/kern/kern_dmsg.c:810",
    "sys/kern/kern_dmsg.c:971",
    "sys/kern/kern_dmsg.c:986",
    "sys/kern/kern_dmsg.c:1075",
    "sys/kern/kern_dmsg.c:1080",
    "sys/kern/kern_dmsg.c:1083",
    "sys/kern/kern_dmsg.c:1263",
    "sys/kern/kern_dmsg.c:1754",
    "sys/sys/tree.h:585",
    "sys/sys/tree.h:651"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger_dmsg_uaf.c",
    "oracle_inject.c",
    "introspect.c",
    "escalate.c",
    "probe_state.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "panic.txt",
    "panic.oracle.txt",
    "fix_runs.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}