{
  "finding_id": "DF-5833",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "The size-precompute races preconditions are reproduced on the guest (20+ times): proc_stop(SCORE)-pre-counted worker LWPs keep completing lwp_create and inserting into the LWP tree throughout generic_elf_coredump, so the DRYRUN sizing pass and the WRITE pass observe different LWP sets (children grow 14-29 per attempt; one run aborted with rv=-1/EINVAL when the WRITE pass exhausted the reservation mid-note-walk, the swallowed-error failure mode). The terminal heap-overflow write (elf_putallnotes error swallowed at imgact_elf.c:1321 -> target_reserve advances off past off_max -> (off_max-off)/sizeof(vn_hdr) size_t-underflow at imgact_elf.c:1653 -> cb_put_fp writes vn_hdr records past the kmallocd header buffer) is proven by line-level analysis but did not demonstrably fire in the rigs attempts: the header-allocation page starvation during the DRYRUN->WRITE window and the p_token endgame race biased the dumper on this configuration, and the children-count variance randomizes the round_page slack. Classified inconclusive: race precondition + reservation-overrun failure reproduced; the unbounded write itself unobserved.",
  "exploit_chain": "",
  "evidence": "run.final.log (per-attempt children growth 14-29 across snapshot/DRYRUN/WRITE/post-dump; parse2 analysis showing WRITE_end_raw consuming the reservation to its final 112 bytes; earlier rv=-1/EINVAL attempt with no image); VERDICT.md (full chain with path:line); fix.diff",
  "kernel_refs": [
    "sys/kern/imgact_elf.c:1012",
    "sys/kern/imgact_elf.c:1023",
    "sys/kern/imgact_elf.c:1321",
    "sys/kern/imgact_elf.c:1422",
    "sys/kern/imgact_elf.c:1653",
    "sys/kern/imgact_elf.c:1656",
    "sys/kern/imgact_elf.c:1113",
    "sys/kern/imgact_elf.c:1268",
    "sys/kern/kern_sig.c:1598",
    "sys/kern/kern_fork.c:848",
    "sys/kern/lwkt_thread.c:641"
  ],
  "poc_changes": "Original analysis had no PoC; the full rig (eater/victim/dripper/controller/parsers) was authored during verification. Multiple iterations fixed: lwp_create stack-top ABI (EFAULT), worker-thread lifetime, objcache drain depth, OOM-killer windows, pre-forked drip driver, checkpoint trigger for prelude-free DRYRUN timing, and per-attempt arithmetic.",
  "attempts": 47,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 9600,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -o victim victim.c -lpthread; cc -O2 -Wall -o eater eater.c; cc -O2 -Wall -o dripper dripper.c; cc -O2 -Wall -o parse_core parse_core.c",
  "run_cmd": "sh controller.sh ckpt2 6",
  "code_hash": "466b64e7acc5910150196a1313493082bbc68812ef943e0ef431ab726750784b",
  "notes": "kern.ckptgroup was set to -1 by root to enable the sys_checkpoint trigger (guest configuration change, documented): it removes the sigexit preludes allocation-park crawl, a rig artifact under artificial memory exhaustion; on a normally-warmed system the sigexit path (fully unprivileged) has a non-parking prelude and the same race. Guest will be reset (with-src) after evidence collection.",
  "recommended_fix": "Propagate elf_putallnotes() failure in __elfN(puthdr) and guard elf_puttextvps vnh_max against off > off_max (see fix.diff)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix not build-validated: the terminal overflow write was not observed on-guest, so no A/B regression exists; the patch removes both enabling defects (error swallowing; underflow-prone bound) by construction.",
  "fix_evidence": "findings/poc/DF-5833/fix.diff"
}