{
  "schema": "vericull.forensic-dossiers.v1",
  "generated_on": "2026-11-11",
  "native_core": {
    "library": "lib0sec_harness_core.dylib",
    "arch": "arm64-apple-darwin (C++17)",
    "sha256": "4ff6c9581d7d30c9d41390c5a80b2f26d8fb082284a8c2a96fb02f55b6901395",
    "magic_headers": {
      "needle": "0x5a534e44 (ZSND)",
      "verdict": "0x5a535644 (ZSVD)"
    },
    "wilson_z95": 1.959963984540054,
    "slab_multi_boot_min_trials": 3,
    "slab_multi_boot_min_ratio": 0.6
  },
  "router_model": {
    "version": "v2",
    "full_forest_trees": 200,
    "compact_abi_trees": 12,
    "n_features": 55,
    "cv_mean_f1": 0.9617,
    "cv_mean_precision": 0.9604,
    "cv_mean_recall": 0.9631,
    "base_score_logit": 0.5,
    "feature_names": [
      "resp_http_status",
      "resp_sql_error",
      "resp_stack_trace",
      "resp_error_message",
      "resp_payload_exact_reflection",
      "resp_payload_partial_reflection",
      "resp_sensitive_data",
      "resp_flag_pattern",
      "resp_content_type_match",
      "resp_length",
      "resp_waf_signature",
      "resp_redirect",
      "resp_5xx_status",
      "req_sql_syntax",
      "req_xss_payload",
      "req_ssti_syntax",
      "req_path_traversal",
      "req_command_injection",
      "req_encoding_detected",
      "req_http_method",
      "req_auth_header",
      "req_param_count",
      "req_body_length",
      "meta_severity_ordinal",
      "meta_confidence",
      "meta_high_confidence_category",
      "meta_injection_class",
      "meta_access_control_class",
      "meta_has_template_id",
      "meta_has_cwe",
      "meta_has_cve",
      "text_description_length",
      "text_repro_steps",
      "text_impact_statement",
      "text_hedging_language",
      "text_verification_language",
      "text_analysis_length",
      "text_code_blocks",
      "text_evidence_request_nonempty",
      "text_evidence_response_nonempty",
      "text_evidence_analysis_nonempty",
      "cross_payload_category_consistent",
      "cross_severity_confidence_interaction",
      "cross_response_request_length_ratio",
      "cross_evidence_completeness",
      "kernel_crash_type_ordinal",
      "kernel_stack_depth",
      "kernel_has_reproducer",
      "kernel_access_is_write",
      "kernel_access_size",
      "kernel_network_subsystem",
      "kernel_has_alloc_site",
      "kernel_has_free_site",
      "kernel_is_kasan",
      "kernel_subsystem_criticality"
    ],
    "compact_trees": [
      {
        "split_indices": [
          42,
          21,
          25,
          42,
          7,
          0,
          0
        ],
        "split_conditions": [
          2.7750000953674316,
          1.0,
          1.0,
          1.5,
          1.0,
          0.19490480422973633,
          -0.15689119696617126
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.06833098083734512,
          -0.33655568957328796,
          1.6139684915542603,
          -0.5502018928527832,
          0.8761910200119019,
          0.19490480422973633,
          -0.15689119696617126
        ]
      },
      {
        "split_indices": [
          42,
          36,
          43,
          23,
          31,
          0,
          36
        ],
        "split_conditions": [
          1.899999976158142,
          365.0,
          0.4878048896789551,
          2.0,
          686.0,
          -0.10876834392547607,
          374.0
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          0.1009511947631836,
          -0.273500919342041,
          1.3110965490341187,
          -0.7787683606147766,
          0.4036698639392853,
          -0.10876834392547607,
          1.6846846342086792
        ]
      },
      {
        "split_indices": [
          42,
          21,
          31,
          36,
          7,
          35,
          31
        ],
        "split_conditions": [
          1.5,
          1.0,
          1038.0,
          380.0,
          1.0,
          1.0,
          1123.0
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          0.00527973985299468,
          -0.5055065751075745,
          0.819836437702179,
          -0.7531784772872925,
          0.6936741471290588,
          1.1664189100265503,
          -0.7301556468009949
        ]
      },
      {
        "split_indices": [
          23,
          31,
          0,
          36,
          9,
          36,
          36
        ],
        "split_conditions": [
          4.0,
          1038.0,
          0.15446296334266663,
          187.0,
          39.0,
          184.0,
          362.0
        ],
        "left_children": [
          1,
          3,
          -1,
          5,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          -1,
          6,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          0.06365320831537247,
          -0.06800491362810135,
          0.15446296334266663,
          0.06844612210988998,
          -0.9513018131256104,
          1.0893049240112305,
          -0.13846398890018463
        ]
      },
      {
        "split_indices": [
          24,
          31,
          24,
          21,
          31,
          0,
          0
        ],
        "split_conditions": [
          0.925000011920929,
          337.0,
          1.0,
          1.0,
          686.0,
          0.1470225304365158,
          -0.14337651431560516
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.12413415312767029,
          -0.33750489354133606,
          1.1881003379821777,
          -0.8652578592300415,
          -0.0917990580201149,
          0.1470225304365158,
          -0.14337651431560516
        ]
      },
      {
        "split_indices": [
          42,
          36,
          31,
          9,
          31,
          24,
          31
        ],
        "split_conditions": [
          1.5,
          365.0,
          1038.0,
          91.0,
          754.0,
          1.0,
          1123.0
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.03573771193623543,
          -0.42678841948509216,
          0.5648385286331177,
          -0.7630037665367126,
          0.13936753571033478,
          0.8656635284423828,
          -0.6418052911758423
        ]
      },
      {
        "split_indices": [
          24,
          21,
          17,
          36,
          25,
          0,
          0
        ],
        "split_conditions": [
          0.925000011920929,
          1.0,
          1.0,
          153.0,
          1.0,
          0.13381049036979675,
          -0.009484260343015194
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          0.01958192139863968,
          -0.1641528606414795,
          1.2020866870880127,
          -0.31293201446533203,
          0.6951180696487427,
          0.13381049036979675,
          -0.009484260343015194
        ]
      },
      {
        "split_indices": [
          36,
          43,
          36,
          9,
          3,
          23,
          9
        ],
        "split_conditions": [
          193.0,
          1.0639097690582275,
          365.0,
          39.0,
          1.0,
          2.0,
          409.0
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.05639021471142769,
          0.7058917284011841,
          -0.26640909910202026,
          -0.9246375560760498,
          1.160447359085083,
          -0.5873722434043884,
          0.10426236689090729
        ]
      },
      {
        "split_indices": [
          27,
          31,
          36,
          26,
          36,
          23,
          43
        ],
        "split_conditions": [
          1.0,
          809.0,
          395.0,
          1.0,
          714.0,
          2.0,
          3.579831838607788
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          0.02723020128905773,
          0.4081014096736908,
          -0.3991208076477051,
          0.8868275284767151,
          -0.3457082509994507,
          -0.5583707690238953,
          0.5207620859146118
        ]
      },
      {
        "split_indices": [
          42,
          36,
          18,
          9,
          31,
          35,
          9
        ],
        "split_conditions": [
          1.5,
          380.0,
          1.0,
          93.0,
          796.0,
          1.0,
          39.0
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.07015707343816757,
          -0.3655869662761688,
          0.44391268491744995,
          -0.587074875831604,
          0.04200016334652901,
          0.6544668078422546,
          -0.420329749584198
        ]
      },
      {
        "split_indices": [
          24,
          21,
          36,
          36,
          34,
          0,
          0
        ],
        "split_conditions": [
          0.925000011920929,
          1.0,
          187.0,
          153.0,
          1.0,
          0.11765402555465698,
          -0.00614749314263463
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.08280732482671738,
          -0.2225501388311386,
          1.0253130197525024,
          -0.3293199837207794,
          0.4028976857662201,
          0.11765402555465698,
          -0.00614749314263463
        ]
      },
      {
        "split_indices": [
          24,
          43,
          24,
          43,
          43,
          0,
          0
        ],
        "split_conditions": [
          0.925000011920929,
          2.9583332538604736,
          1.0,
          1.1205673217773438,
          3.615384578704834,
          0.11630397289991379,
          -0.11606486886739731
        ],
        "left_children": [
          1,
          3,
          5,
          -1,
          -1,
          -1,
          -1
        ],
        "right_children": [
          2,
          4,
          6,
          -1,
          -1,
          -1,
          -1
        ],
        "base_weights": [
          -0.014579473063349724,
          -0.13923974335193634,
          0.8607034683227539,
          0.07268035411834717,
          -0.5640390515327454,
          0.11630397289991379,
          -0.11606486886739731
        ]
      }
    ]
  },
  "craft_memories": [
    {
      "level": 0,
      "tier": "episodic",
      "prior": 0.0,
      "created_at": 0,
      "token_count": 24,
      "query_overlap": 2,
      "content_hash": "0x000000000000a101"
    },
    {
      "level": 1,
      "tier": "semantic",
      "prior": 0.15,
      "created_at": 1,
      "token_count": 18,
      "query_overlap": 3,
      "content_hash": "0x000000000000a102"
    },
    {
      "level": 2,
      "tier": "analogical",
      "prior": 0.2,
      "created_at": 2,
      "token_count": 20,
      "query_overlap": 2,
      "content_hash": "0x000000000000a103"
    },
    {
      "level": 3,
      "tier": "procedural",
      "prior": 0.25,
      "created_at": 3,
      "token_count": 15,
      "query_overlap": 4,
      "content_hash": "0x000000000000a104"
    },
    {
      "level": 4,
      "tier": "principle",
      "prior": 0.3,
      "created_at": 4,
      "token_count": 15,
      "query_overlap": 5,
      "content_hash": "0x000000000000a105"
    }
  ],
  "bundle_sha256": "6b32e8589c2d3a65ece62772903bcc316e947395fc56dd6b8afdaf0ca36c2834",
  "dossiers": [
    {
      "case_id": "CASE-01-O3-KSMBD-HALLUCINATION",
      "short_id": "CASE-01",
      "tab_label": "ksmbd_smb2.c",
      "file_path": "fs/smb/server/smb2misc.c",
      "vuln_class": "CWE-787 · Hallucinated OOB Sink",
      "title_en": "Hallucinated IOCTL / OOB Sink Refuted in Sub-Millisecond Byte Sweep",
      "title_ko": "환각된 IOCTL·OOB 싱크 심볼의 서브밀리초 바이트 스팬 기각",
      "summary_en": "An LLM scanner cites real helper ksmbd_req_buf_next(work) alongside an invented sink smb2_unchecked_memcpy_oob_sink. Claim #2 fails ZSND byte-needle verification against the file on disk and is deterministically killed without spinning up a VM or second LLM.",
      "summary_ko": "LLM 스캐너가 실제 존재하는 ksmbd_req_buf_next(work) 옆에 존재하지 않는 싱크 심볼 smb2_unchecked_memcpy_oob_sink를 날조해 보고한 사례입니다. 2번 바이트 스팬 청구가 디스크 원문 대조에서 즉시 불일치하여 추가 LLM이나 VM 기동 없이 확정 기각됩니다.",
      "source_snippet": "int ksmbd_smb2_check_message(struct ksmbd_work *work) {\n    struct smb2_hdr *hdr = ksmbd_req_buf_next(work);\n    if (le32_to_cpu(hdr->NextCommand) > work->request_buf_len) return -EINVAL;\n    return 0;\n}\n",
      "source_byte_length": 204,
      "claims": [
        {
          "needle": "ksmbd_req_buf_next(work)",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: packet header fetch helper exists in file",
          "note_ko": "양성 청구: 패킷 헤더 추출 함수가 원문 내 실재함"
        },
        {
          "needle": "smb2_unchecked_memcpy_oob_sink",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: scanner-cited OOB memcpy sink (fabricated by model)",
          "note_ko": "양성 청구: 스캐너가 지목한 OOB 복사 싱크 (모델이 날조한 심볼)"
        }
      ],
      "feature_overrides": {
        "0": 200,
        "23": 1,
        "24": 0.2,
        "34": 3
      },
      "repro_passes": 0,
      "repro_attempts": 5,
      "has_bounded_check": 0,
      "canary_mask": 0,
      "canary_mask_hex": "0x00",
      "tamper_preset": {
        "label_en": "Forge source to plant fake sink",
        "label_ko": "원문에 가짜 싱크 심볼 강제 삽입",
        "mode": "append_source",
        "text": "/* forged: smb2_unchecked_memcpy_oob_sink */\n"
      },
      "verdict_state": 0,
      "verdict_code": "REJECTED_FABRICATED_NEEDLE",
      "router_decision": 0,
      "router_code": "AUTO_REJECT",
      "tp_probability": 0.035,
      "tp_probability_v2_200": 0.7689,
      "router_code_v2_200": "RUN_FREE_LAYERS",
      "layers_to_run_mask_hex": "0x00",
      "highest_ladder_rung": -1,
      "ladder_code": "NONE",
      "structural_claims_total": 2,
      "structural_claims_passed": 1,
      "failed_claim_index": 1,
      "wilson_ci95": [
        0.0,
        0.4345
      ],
      "top_craft_memory_score": 1.63,
      "sweep_digest_hex": "0xd2b5f3790fda8c23",
      "provenance_seal_hash": "0xaf41450d1f6e3efa",
      "record_sha256": "9578d2d16652421c0237d01001b4b488c096cc746c77620b7155344262db9c9d"
    },
    {
      "case_id": "CASE-02-VM-SWITCH-IPV6-NEGATIVE",
      "short_id": "CASE-02",
      "tab_label": "vmswitch_ipv6.c",
      "file_path": "drivers/net/vmswitch/ipv6_ext.c",
      "vuln_class": "CWE-125 · Dominated Bounds Check (#518 Hold)",
      "title_en": "Structurally Grounded Parser Reach Held Under #518 Discipline",
      "title_ko": "전위 길이 검사가 지배하는 파서 도달 사례 (#518 보류 규율)",
      "summary_en": "Both structural needles exist verbatim on disk and KCOV confirms L0 sink PC reachability, but pktLen < sizeof(IPV6_EXTENSION_HEADER) dominates the read across 0/5 trials. Under #518 discipline, Vericull holds the finding for solver synthesis rather than silently dropping or falsely confirming it.",
      "summary_ko": "두 구조적 바이트 청구가 모두 원문에 실재하고 KCOV가 L0 싱크 도달을 확인했으나, 전위 길이 검사가 지배하여 5회 재현 모두 크래시가 발생하지 않았습니다. #518 규율에 따라 성급히 확정하거나 무단 폐기하지 않고 INCONCLUSIVE_HELD로 격리 보류합니다.",
      "source_snippet": "NDIS_STATUS VmsMpNicPktParseIpv6Ext(NET_BUFFER *nb, UINT32 pktLen) {\n    if (pktLen < sizeof(IPV6_EXTENSION_HEADER)) return NDIS_STATUS_INVALID_PACKET;\n    PVOID buf = NdisGetDataBuffer_exref(nb, sizeof(IPV6_EXTENSION_HEADER), localStorage, 1, 0);\n    return buf ? NDIS_STATUS_SUCCESS : NDIS_STATUS_RESOURCES;\n}\n",
      "source_byte_length": 312,
      "claims": [
        {
          "needle": "NdisGetDataBuffer_exref",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: contiguous buffer extraction call exists",
          "note_ko": "양성 청구: 버퍼 추출 호출 심볼이 원문 내 실재함"
        },
        {
          "needle": "pktLen < sizeof(IPV6_EXTENSION_HEADER)",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: dominating header length guard verified",
          "note_ko": "양성 청구: 지배적인 헤더 길이 검사 구문 확인"
        }
      ],
      "feature_overrides": {
        "0": 200,
        "23": 2,
        "24": 0.55,
        "38": 1,
        "39": 1
      },
      "repro_passes": 0,
      "repro_attempts": 5,
      "has_bounded_check": 0,
      "canary_mask": 1,
      "canary_mask_hex": "0x01",
      "tamper_preset": {
        "label_en": "Inject hallucinated offset needle",
        "label_ko": "환각된 바이트 오프셋 청구 주입",
        "mode": "mutate_claim_needle",
        "claim_index": 0,
        "needle": "NdisUncheckedPacketCopy_oob"
      },
      "verdict_state": 1,
      "verdict_code": "INCONCLUSIVE_HELD_518",
      "router_decision": 0,
      "router_code": "AUTO_REJECT",
      "tp_probability": 0.035,
      "tp_probability_v2_200": 0.8318,
      "router_code_v2_200": "RUN_FREE_LAYERS",
      "layers_to_run_mask_hex": "0x00",
      "highest_ladder_rung": 0,
      "ladder_code": "L0_REACH",
      "structural_claims_total": 2,
      "structural_claims_passed": 2,
      "failed_claim_index": -1,
      "wilson_ci95": [
        0.0,
        0.4345
      ],
      "top_craft_memory_score": 1.63,
      "sweep_digest_hex": "0xd2b550790fd9772a",
      "provenance_seal_hash": "0xc11370a4315f00e9",
      "record_sha256": "2945e902527abeebaf11971c1bce8c30d484a650edec091051b10e4290119cb9"
    },
    {
      "case_id": "CASE-03-ENGINE-C-MISSING-LOCK-U1",
      "short_id": "CASE-03",
      "tab_label": "session_lock.c",
      "file_path": "security/keys/session_teardown.c",
      "vuln_class": "CWE-362 / CWE-416 · Non-Crashing Missing Lock",
      "title_en": "Non-Crashing Missing-Lock Invariant Proved via Negative Byte Span",
      "title_ko": "비(非)크래시 락 누락 불변식 위반의 음성 바이트 스팬 증명",
      "summary_en": "Sanitizer fuzzers miss logic and locking flaws that do not immediately fault. Vericull proves kfree(ctx->cred_token) at the top, audit_log_token_use(ctx->cred_token->uid) below, and the strict absence (must_be_absent = 1) of mutex_lock(&ctx->lock) across bytes [50, 175].",
      "summary_ko": "동적 퍼저가 놓치는 비크래시 락 누락·권한 결함을 정적 바이트 구간 불변식으로 입증합니다. 해제 지점과 재참조 지점의 양성 청구 2건, 그리고 바이트 구간 [50, 175] 내 mutex_lock(&ctx->lock) 부재(must_be_absent = 1) 청구가 동시에 충족되어 확정됩니다.",
      "source_snippet": "void session_teardown_unlocked(struct session_ctx *ctx) {\n    kfree(ctx->cred_token);\n    ctx->state = STATE_TEARDOWN_PENDING;\n    audit_log_token_use(ctx->cred_token->uid);\n}\n",
      "source_byte_length": 176,
      "claims": [
        {
          "needle": "kfree(ctx->cred_token);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: credential token freed in teardown",
          "note_ko": "양성 청구: 세션 종료 경로에서 자격 토큰 해제 확인"
        },
        {
          "needle": "audit_log_token_use(ctx->cred_token->uid);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: freed token dereferenced in audit sink",
          "note_ko": "양성 청구: 해제된 토큰의 uid 사후 역참조 확인"
        },
        {
          "needle": "mutex_lock(&ctx->lock)",
          "span_start": 50,
          "span_end": 175,
          "must_be_absent": 1,
          "note_en": "Negative claim (must_be_absent=1): mutex_lock absent in bytes [50, 175]",
          "note_ko": "음성 청구 (must_be_absent=1): 바이트 [50, 175] 구간 내 락 획득 부재 증명"
        }
      ],
      "feature_overrides": {
        "23": 3,
        "24": 0.88,
        "29": 1,
        "32": 1,
        "35": 2,
        "44": 1
      },
      "repro_passes": 0,
      "repro_attempts": 0,
      "has_bounded_check": 1,
      "canary_mask": 0,
      "canary_mask_hex": "0x00",
      "tamper_preset": {
        "label_en": "Patch source with mutex_lock(&ctx->lock)",
        "label_ko": "원문에 mutex_lock(&ctx->lock) 패치 삽입",
        "mode": "insert_lock_in_span"
      },
      "verdict_state": 2,
      "verdict_code": "CONFIRMED_BOUNDED_LOGIC",
      "router_decision": 0,
      "router_code": "AUTO_REJECT",
      "tp_probability": 0.035,
      "tp_probability_v2_200": 0.7973,
      "router_code_v2_200": "RUN_FREE_LAYERS",
      "layers_to_run_mask_hex": "0x00",
      "highest_ladder_rung": -1,
      "ladder_code": "NONE",
      "structural_claims_total": 3,
      "structural_claims_passed": 3,
      "failed_claim_index": -1,
      "wilson_ci95": [
        0.0,
        1.0
      ],
      "top_craft_memory_score": 1.63,
      "sweep_digest_hex": "0x314c15244cce65ca",
      "provenance_seal_hash": "0xd1a42326f03888ea",
      "record_sha256": "f8578d46e95150d86069a38791c3d5bb695f2e0cec670eba6a44838b29d94298"
    },
    {
      "case_id": "CASE-04-SLAB-RANDOMIZATION-WALL-L2",
      "short_id": "CASE-04",
      "tab_label": "slab_kmalloc192.c",
      "file_path": "drivers/char/drv_slot192.c",
      "vuln_class": "CWE-416 · Single-Boot Grooming Fluke Demoted",
      "title_en": "1-of-5 Boot Reclaim Fluke Blocked at SLAB-Randomization Wall (L3 → L2)",
      "title_ko": "5회 부팅 중 1회 우연한 슬랩 재점유를 L3에서 L2로 강등 차단",
      "summary_en": "An exploit agent witnesses L3 heap reclaim once on a lucky boot and claims reliable weaponization. Across 5 fresh SLAB_FREELIST_RANDOM boots, only 1/5 (20% < 60%, Wilson 95% CI [0.0362, 0.6245]) reproduces; Vericull demotes the rung from L3_GROOM to L2_CONTROL.",
      "summary_ko": "공격 에이전트가 단일 부팅에서 우연히 L3 슬랩 재점유에 성공한 뒤 안정적 무기화를 주장한 사례입니다. SLAB_FREELIST_RANDOM 신선 부팅 5회 중 1회(20% < 60%, Wilson 95% 신뢰구간 [0.0362, 0.6245])만 재현되어 L3_GROOM 주장을 기각하고 L2_CONTROL로 강등 고정합니다.",
      "source_snippet": "int ioctl_kmalloc192_uaf_trigger(struct drv_dev *dev, unsigned long arg) {\n    kfree(dev->slot_192);\n    /* SLAB_FREELIST_RANDOM causes 1/5 single-boot reclaim fluke */\n    return dev->slot_192->ops_fn(arg);\n}\n",
      "source_byte_length": 210,
      "claims": [
        {
          "needle": "kfree(dev->slot_192);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: kmalloc-192 object freed",
          "note_ko": "양성 청구: kmalloc-192 슬롯 객체 해제 확인"
        },
        {
          "needle": "dev->slot_192->ops_fn(arg);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: function pointer dereferenced post-free",
          "note_ko": "양성 청구: 해제 직후 함수 포인터 역참조 확인"
        },
        {
          "needle": "dev->slot_192 = NULL;",
          "span_start": 50,
          "span_end": 195,
          "must_be_absent": 1,
          "note_en": "Negative claim: dangling slot pointer never zeroed in [50, 195]",
          "note_ko": "음성 청구: 바이트 [50, 195] 구간 내 포인터 NULL 초기화 부재 확인"
        }
      ],
      "feature_overrides": {
        "23": 4,
        "24": 0.92,
        "45": 4,
        "47": 1,
        "48": 1,
        "51": 1,
        "52": 1,
        "53": 1
      },
      "repro_passes": 1,
      "repro_attempts": 5,
      "has_bounded_check": 0,
      "canary_mask": 15,
      "canary_mask_hex": "0x0f",
      "tamper_preset": {
        "label_en": "Inflate trial log to 4/5 boots (breaks seal)",
        "label_ko": "재현 횟수를 4/5회로 임의 조작 (봉인 불일치 검출)",
        "mode": "inflate_repro_passes",
        "repro_passes": 4
      },
      "verdict_state": 3,
      "verdict_code": "CONFIRMED_POV_REPRODUCED",
      "router_decision": 0,
      "router_code": "AUTO_REJECT",
      "tp_probability": 0.0141,
      "tp_probability_v2_200": 0.856,
      "router_code_v2_200": "AUTO_ACCEPT",
      "layers_to_run_mask_hex": "0x00",
      "highest_ladder_rung": 2,
      "ladder_code": "L2_CONTROL",
      "structural_claims_total": 3,
      "structural_claims_passed": 3,
      "failed_claim_index": -1,
      "wilson_ci95": [
        0.0362,
        0.6245
      ],
      "top_craft_memory_score": 1.63,
      "sweep_digest_hex": "0x314c15244cce65ca",
      "provenance_seal_hash": "0x30841a1e98301215",
      "record_sha256": "3a68c54f56993b3fce66a0003599d695a488e9a917cce9a2c098d210b0c90af1"
    },
    {
      "case_id": "CASE-05-ENGINE-B-L4-ROOT-WEAPONIZATION",
      "short_id": "CASE-05",
      "tab_label": "nf_tables_l4.c",
      "file_path": "net/netfilter/nf_tables_api.c",
      "vuln_class": "CWE-416 · Multi-Boot L4 Root Escalation",
      "title_en": "9-of-10 Fresh KASAN Boots Verified at L4 Root Escalation",
      "title_ko": "신선 KASAN 부팅 10회 중 9회 재현된 L4 권한 상승 확정",
      "summary_en": "All 3 structural claims verify on disk, DROP:uid=N!=0 precedes token-bound canary ROOT emission, and 9/10 fresh KASAN boots reproduce (90% >= 60%, Wilson 95% CI [0.5958, 0.9821], full 200-tree router P(TP) = 0.9488 AUTO_ACCEPT).",
      "summary_ko": "3개 바이트 스팬 청구가 모두 원문과 일치하고, 비특권 강등(DROP:uid=N!=0) 선행 조건과 카나리 ROOT 증명이 신선 KASAN 부팅 10회 중 9회(90% >= 60%, Wilson 95% 신뢰구간 [0.5958, 0.9821], 200-트리 라우터 P(TP) = 0.9488)에서 재현되어 L4 최고 등급으로 봉인됩니다.",
      "source_snippet": "long netfilter_nf_tables_uaf_write(struct nft_ctx *ctx, struct nft_expr *expr) {\n    nft_expr_destroy(ctx, expr);\n    /* kmalloc-192 msg_msg spray + timer_list.function +0x18 overwrite */\n    expr->ops->eval(expr, &ctx->regs);\n    return 0;\n}\n",
      "source_byte_length": 243,
      "claims": [
        {
          "needle": "nft_expr_destroy(ctx, expr);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: expression object destroyed",
          "note_ko": "양성 청구: 표현식 객체 파괴 호출 확인"
        },
        {
          "needle": "expr->ops->eval(expr, &ctx->regs);",
          "span_start": 0,
          "span_end": 0,
          "must_be_absent": 0,
          "note_en": "Positive claim: vtable ops->eval invoked after destroy",
          "note_ko": "양성 청구: 파괴 이후 가상함수 테이블 ops->eval 호출 확인"
        },
        {
          "needle": "refcount_dec_and_test",
          "span_start": 60,
          "span_end": 210,
          "must_be_absent": 1,
          "note_en": "Negative claim: reference-count guard absent across bytes [60, 210]",
          "note_ko": "음성 청구: 바이트 [60, 210] 구간 내 참조계수 검사 부재 증명"
        }
      ],
      "feature_overrides": {
        "23": 4,
        "24": 0.99,
        "45": 5,
        "46": 12,
        "47": 1,
        "48": 1,
        "49": 8,
        "50": 1,
        "51": 1,
        "52": 1,
        "53": 1,
        "54": 1
      },
      "repro_passes": 9,
      "repro_attempts": 10,
      "has_bounded_check": 1,
      "canary_mask": 31,
      "canary_mask_hex": "0x1f",
      "tamper_preset": {
        "label_en": "Corrupt needle #2 symbol (breaks ZSND + ZSVD)",
        "label_ko": "2번 청구 심볼 변조 (ZSND·ZSVD 즉시 차단)",
        "mode": "mutate_claim_needle",
        "claim_index": 1,
        "needle": "expr->ops->hallucinated_eval_sink(expr);"
      },
      "verdict_state": 4,
      "verdict_code": "CONFIRMED_ROOT_ESCALATION",
      "router_decision": 0,
      "router_code": "AUTO_REJECT",
      "tp_probability": 0.0911,
      "tp_probability_v2_200": 0.9488,
      "router_code_v2_200": "AUTO_ACCEPT",
      "layers_to_run_mask_hex": "0x00",
      "highest_ladder_rung": 4,
      "ladder_code": "L4_ESCALATE",
      "structural_claims_total": 3,
      "structural_claims_passed": 3,
      "failed_claim_index": -1,
      "wilson_ci95": [
        0.5958,
        0.9821
      ],
      "top_craft_memory_score": 1.63,
      "sweep_digest_hex": "0x314c15244cce65ca",
      "provenance_seal_hash": "0x18961f37a8862fe1",
      "record_sha256": "baa91c21981ef4135077ff3ef15267d23acc16cce8dc8db9033d2a8e13057799"
    }
  ]
}