# DF-5833 PoC — coredump LWP-set race → elf_puttextvp vnh_max underflow → cb_put_fp heap overflow

Unprivileged (uid 1001) rig for the size-precompute race in
`generic_elf_coredump()` (sys/kern/imgact_elf.c).

## Components

| file | role |
|---|---|
| `eater.c`    | pins VM free pages below the vm_page_alloc floor (memory pressure park) |
| `victim.c`   | sleeper threads + worker threads looping lwp_create(2); modes: probe / run (SIGSEGV) / ckpt (sys_checkpoint trigger) |
| `dripper.c`  | pre-forked drip driver: frees memory in controlled bursts into the parked allocators at rig-controlled times |
| `controller.sh` | orchestration: probe (layout measure) → pad tuning → attempt loop |
| `parse_core.c` | core/ckpt image NT_PRSTATUS counter |
| `parse2.c`   | post-note region analyzer (vminfo/vn_count/siginfo/filehdr consistency + reservation-fit arithmetic) |

## Build (on guest)

    cc -O2 -Wall -o eater eater.c
    cc -O2 -Wall -o victim victim.c -lpthread
    cc -O2 -Wall -o dripper dripper.c
    cc -O2 -Wall -o parse_core parse_core.c
    cc -O2 -Wall -o parse2 parse2.c

## Run

    sh controller.sh stage1 5   # benign: successful core with extra NT_PRSTATUS
    sh controller.sh ckpt2 6    # reservation-overrun attempts (root first: sysctl -w kern.ckptgroup=-1)

Each attempt (~20-90 s): eater pins free memory → victim releases
workers whose lwp_create calls park mid-creation → victim triggers the
core dump (SIGSEGV, or sys_checkpoint for the no-prelude path) → the
dumper's DRYRUN sizes the header → dripper feeds pages → parked
lwp_create calls complete and insert LWPs into the tree while the dump
is between its two passes → the WRITE pass needs more note space than
reserved.

## Expected observations (see run.final.log)

- children counts grow across snapshot → DRYRUN → WRITE (LWP insertion
  mid-dump): "race += 14..29" per attempt
- successful images whose WRITE_end_raw consumes the reservation to its
  final bytes (delta absorbed by round_page slack)
- CKPT-RESULT rv=-1 errno=22 with no image when the delta exceeds the
  slack (reservation wall hit mid-note-walk; error swallowed by puthdr)
- (code-certain, not yet observed on-guest) with ≥~7 simultaneous
  in-window inserts: elf_puttextvp's vnh_max size_t-underflows and
  cb_put_fp writes vn_hdr records past the kmalloc'd header buffer.