0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-SNKTC4BP.js

@@ -0,0 +1,1422 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  homeStateDir
+} from "./chunk-KKGE5RQE.js";
+
+// packages/core/dist/triage/kernel-vm-runner.js
+import { execFileSync, spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { constants as fsConstants, copyFileSync, mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync, realpathSync, statSync, chmodSync } from "node:fs";
+
+// packages/core/dist/triage/bug-attribution.js
+function normalizeModuleName(ref) {
+  const base = ref.replace(/^["']|["']$/g, "").split("/").pop() ?? ref;
+  return base.replace(/\.ko(\.(gz|xz|zst))?$/i, "").replace(/-/g, "_");
+}
+function detectOutOfBandModuleLoad(scanText, targetModules) {
+  const allowed = new Set(targetModules.map(normalizeModuleName));
+  const allowedList = [...allowed];
+  const re = /\binsmod\b\s+["']?([\w./+-]+)["']?|(?:^|[;\n]|&&|\|\||\||[$#]\s+|\b(?:system|popen)\s*\(\s*["'])\s*modprobe\b\s+["']?([\w./+-]+)["']?|\b(?:__NR_|SYS_|sys_)?(finit_module|init_module)\b/g;
+  for (let m = re.exec(scanText); m; m = re.exec(scanText)) {
+    if (m[3]) {
+      return { denied: true, method: m[3], offendingModule: m[3], allowed: allowedList };
+    }
+    const cmd = m[1] ? "insmod" : "modprobe";
+    const token = m[1] ?? m[2];
+    if (cmd === "insmod" && !/\.ko(\.(gz|xz|zst))?$/i.test(token) && !token.includes("/"))
+      continue;
+    if (!allowed.has(normalizeModuleName(token))) {
+      return { denied: true, method: cmd, offendingModule: token, allowed: allowedList };
+    }
+  }
+  return { denied: false, allowed: allowedList };
+}
+function scanHardcodedKernelAddresses(exploitSource, runOutput, opts) {
+  const addresses = [
+    ...new Set((exploitSource.match(/0x[0-9a-fA-F]{8,16}/g) ?? []).filter((lit) => {
+      const hex = lit.slice(2);
+      return hex.length >= 12 && /^ffff/i.test(hex);
+    }))
+  ];
+  const flagged = addresses.length > 0;
+  const leakProvenance = /\bARB-READ\b|\bLEAK[:=]/i.test(runOutput) || /leak(?:ed|ing)?\b[^\n]*0x[0-9a-fA-F]{8,}/i.test(runOutput);
+  const refuse = flagged && !leakProvenance && opts.kaslrOn;
+  return {
+    flagged,
+    addresses,
+    leakProvenance,
+    verdict: refuse ? "refuse" : "allow",
+    reason: !flagged ? "no hardcoded kernel-address literal in exploit source" : leakProvenance ? "hardcoded kernel address is backed by a runtime leak marker" : refuse ? "KASLR-on claim with a hardcoded kernel address and no leak provenance \u2014 root not credited" : "hardcoded kernel address present but nokaslr climb \u2014 flagged, allowed"
+  };
+}
+function assertBugAttribution(input) {
+  const scanText = `${input.exploitSource}
+${input.runOutput}`;
+  const modLoad = detectOutOfBandModuleLoad(scanText, input.targetModules);
+  if (modLoad.denied) {
+    throw new Error(`bug-attribution guard: out-of-band kernel module load (${modLoad.method} ${modLoad.offendingModule ?? ""}) is not the sanctioned target module [${modLoad.allowed.join(", ") || "none"}] \u2014 a privilege credited off an attacker-supplied module is rejected`);
+  }
+  const addr = scanHardcodedKernelAddresses(input.exploitSource, input.runOutput, { kaslrOn: input.kaslrOn });
+  if (addr.verdict === "refuse") {
+    throw new Error(`bug-attribution guard: hardcoded kernel address without leak provenance under KASLR-on (${addr.addresses.join(", ")}) \u2014 root not credited`);
+  }
+}
+
+// packages/core/dist/triage/kernel-vm-runner.js
+var ATTESTATION_KEYS = ["schema", "nonce", "reproducer_sha256", "expected_kernel_release", "observed_kernel_release", "boot_id", "kernel_image_sha256", "kernel_config_sha256", "ruid", "euid", "suid", "rgid", "egid", "sgid", "groups", "cap_inh", "cap_prm", "cap_eff", "cap_amb", "securebits", "userns_max", "initial_userns", "no_new_privs"];
+var RELEASE_RE = /^[A-Za-z0-9._+~-]{1,128}$/;
+function parseKernelExecutionAttestation(raw) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line)
+      continue;
+    const match = /^([a-z0-9_]+)=([^\r\n]*)$/.exec(line);
+    if (!match || fields.has(match[1]))
+      throw new Error("malformed or duplicate kernel execution attestation field");
+    fields.set(match[1], match[2]);
+  }
+  if (fields.size !== ATTESTATION_KEYS.length || ATTESTATION_KEYS.some((key) => !fields.has(key)))
+    throw new Error("kernel execution attestation has missing or unknown fields");
+  const dec = (key) => {
+    const value = fields.get(key);
+    if (!/^(0|[1-9][0-9]{0,9})$/.test(value))
+      throw new Error(`invalid attestation ${key}`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed > 4294967295)
+      throw new Error(`invalid attestation ${key}`);
+    return parsed;
+  };
+  const nonce = fields.get("nonce"), reproducerSha256 = fields.get("reproducer_sha256");
+  const expectedKernelRelease2 = fields.get("expected_kernel_release"), observedKernelRelease = fields.get("observed_kernel_release");
+  const bootId = fields.get("boot_id"), kernelImageSha256 = fields.get("kernel_image_sha256"), kernelConfigSha256 = fields.get("kernel_config_sha256");
+  const caps = ["cap_inh", "cap_prm", "cap_eff", "cap_amb"].map((key) => fields.get(key));
+  if (fields.get("schema") !== "2" || !/^[a-f0-9]{32}$/.test(nonce) || !/^[a-f0-9]{64}$/.test(reproducerSha256) || !RELEASE_RE.test(expectedKernelRelease2) || !RELEASE_RE.test(observedKernelRelease) || !/^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(bootId) || !/^[a-f0-9]{64}$/.test(kernelImageSha256) || !/^[a-f0-9]{64}$/.test(kernelConfigSha256) || caps.some((cap) => !/^[a-f0-9]{16}$/.test(cap)))
+    throw new Error("invalid kernel execution attestation binding, provenance, or capability field");
+  const groups = fields.get("groups");
+  if (groups !== "" && !/^(0|[1-9][0-9]{0,9})(,(0|[1-9][0-9]{0,9}))*$/.test(groups))
+    throw new Error("invalid attestation groups");
+  const nnp = dec("no_new_privs");
+  if (nnp !== 0 && nnp !== 1)
+    throw new Error("invalid attestation no_new_privs");
+  const initial = dec("initial_userns");
+  if (initial !== 0 && initial !== 1)
+    throw new Error("invalid attestation initial_userns");
+  const receipt = { schemaVersion: 2, nonce, reproducerSha256, expectedKernelRelease: expectedKernelRelease2, observedKernelRelease, bootId, kernelImageSha256, kernelConfigSha256, realUid: dec("ruid"), effectiveUid: dec("euid"), savedUid: dec("suid"), realGid: dec("rgid"), effectiveGid: dec("egid"), savedGid: dec("sgid"), supplementaryGroups: groups ? groups.split(",").map(Number) : [], inheritableCapabilities: caps[0], permittedCapabilities: caps[1], effectiveCapabilities: caps[2], ambientCapabilities: caps[3], secureBits: dec("securebits"), userNamespaceMax: dec("userns_max"), initialUserNamespace: initial === 1, noNewPrivileges: nnp === 1 };
+  if (raw !== serializeKernelExecutionAttestation(receipt))
+    throw new Error("kernel execution attestation is not canonical");
+  return receipt;
+}
+function bindKernelExecutionAttestation(receipt, expected) {
+  if (expected.dropUid === void 0 !== (expected.dropGid === void 0))
+    throw new Error("kernel execution identity requires UID and GID together");
+  if (receipt.nonce !== expected.nonce || receipt.reproducerSha256 !== expected.reproducerSha256 || receipt.expectedKernelRelease !== expected.expectedKernelRelease || receipt.observedKernelRelease !== expected.expectedKernelRelease || receipt.kernelImageSha256 !== expected.kernelImageSha256 || receipt.kernelConfigSha256 !== expected.kernelConfigSha256)
+    throw new Error("kernel execution attestation binding or runtime kernel identity mismatch");
+  if (expected.dropUid !== void 0 && (receipt.realUid !== expected.dropUid || receipt.effectiveUid !== expected.dropUid || receipt.savedUid !== expected.dropUid || receipt.supplementaryGroups.length !== 0 || [receipt.inheritableCapabilities, receipt.permittedCapabilities, receipt.effectiveCapabilities, receipt.ambientCapabilities].some((cap) => cap !== "0000000000000000") || !receipt.noNewPrivileges || receipt.userNamespaceMax !== 0 || !receipt.initialUserNamespace))
+    throw new Error("kernel execution attestation did not prove requested UID/capability boundary");
+  if (expected.dropGid !== void 0 && (receipt.realGid !== expected.dropGid || receipt.effectiveGid !== expected.dropGid || receipt.savedGid !== expected.dropGid))
+    throw new Error("kernel execution attestation did not prove requested GID boundary");
+}
+function renderKernelExecutionLauncherSource() {
+  return String.raw`#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+static int num(const char *s,unsigned *v){char *e=0;unsigned long n=strtoul(s,&e,10);if(!s[0]||*e||n>0xffffffffUL)return -1;*v=(unsigned)n;return 0;}
+static int writezero(void){int f=open("/proc/sys/user/max_user_namespaces",O_WRONLY);if(f<0)return -1;if(write(f,"0\n",2)!=2){close(f);return -1;}return close(f);}
+int main(int argc,char **argv){
+ if(argc<11)return 125; unsigned uid=0,gid=0; int du=strcmp(argv[7],"-")!=0,dg=strcmp(argv[8],"-")!=0; if(du!=dg)return 125;
+ if((du&&num(argv[7],&uid))||(dg&&num(argv[8],&gid)))return 125;
+ int receipt=open(argv[1],O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW,0400); if(receipt<0)return 126;int initns=open("/proc/1/ns/user",O_RDONLY|O_CLOEXEC);
+ if(du&&writezero())return 126;
+ int p[2]; if(pipe2(p,O_CLOEXEC))return 126; pid_t child=fork(); if(child<0)return 126;
+ if(child){close(receipt);if(initns>=0)close(initns);close(p[1]);char x;ssize_t n=read(p[0],&x,1);close(p[0]);if(n!=0){waitpid(child,0,0);return 127;}int m=open(argv[9],O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW,0400);if(m<0){kill(child,SIGKILL);waitpid(child,0,0);return 126;}write(m,"1\n",2);close(m);int st;if(waitpid(child,&st,0)<0)return 126;if(WIFEXITED(st))return WEXITSTATUS(st);return 128+WTERMSIG(st);}
+ close(p[0]); if(dg&&(setgroups(0,NULL)||setresgid(gid,gid,gid)))return 126;if(du&&setresuid(uid,uid,uid))return 126;if(du&&prctl(PR_SET_NO_NEW_PRIVS,1,0,0,0))return 126;
+ uid_t r,e,s;gid_t gr,ge,gs;if(getresuid(&r,&e,&s)||getresgid(&gr,&ge,&gs))return 126;gid_t gl[64];int ng=getgroups(64,gl);if(ng<0)return 126;
+ FILE *st=fopen("/proc/self/status","r");char line[256],ci[17]="",cp[17]="",ce[17]="",ca[17]="";int nnp=-1;if(!st)return 126;while(fgets(line,sizeof line,st)){sscanf(line,"CapInh: %16[0-9a-fA-F]",ci);sscanf(line,"CapPrm: %16[0-9a-fA-F]",cp);sscanf(line,"CapEff: %16[0-9a-fA-F]",ce);sscanf(line,"CapAmb: %16[0-9a-fA-F]",ca);sscanf(line,"NoNewPrivs: %d",&nnp);}fclose(st);
+ char *caps[]={ci,cp,ce,ca};for(int i=0;i<4;i++){if(strlen(caps[i])!=16)return 126;for(char *q=caps[i];*q;q++)if(*q>='A'&&*q<='F')*q+=32;}
+ struct stat ns,ns1;int initial=initns>=0&&!stat("/proc/self/ns/user",&ns)&&!fstat(initns,&ns1)&&ns.st_dev==ns1.st_dev&&ns.st_ino==ns1.st_ino;if(initns>=0)close(initns);FILE *um=fopen("/proc/sys/user/max_user_namespaces","r");unsigned umax;if(!um||fscanf(um,"%u",&umax)!=1)return 126;fclose(um);int sb=prctl(PR_GET_SECUREBITS);if(sb<0||nnp<0)return 126;
+ char rel[129],boot[37];FILE *ur=fopen("/proc/sys/kernel/osrelease","r"),*bi=fopen("/proc/sys/kernel/random/boot_id","r");if(!ur||!bi||!fgets(rel,sizeof rel,ur)||!fgets(boot,sizeof boot,bi))return 126;fclose(ur);fclose(bi);rel[strcspn(rel,"\r\n")]=0;boot[strcspn(boot,"\r\n")]=0;
+ FILE *o=fdopen(receipt,"w");if(!o)return 126;fprintf(o,"schema=2\nnonce=%s\nreproducer_sha256=%s\nexpected_kernel_release=%s\nobserved_kernel_release=%s\nboot_id=%s\nkernel_image_sha256=%s\nkernel_config_sha256=%s\nruid=%u\neuid=%u\nsuid=%u\nrgid=%u\negid=%u\nsgid=%u\ngroups=",argv[2],argv[3],argv[4],rel,boot,argv[5],argv[6],r,e,s,gr,ge,gs);for(int i=0;i<ng;i++)fprintf(o,"%s%u",i?",":"",gl[i]);fprintf(o,"\ncap_inh=%s\ncap_prm=%s\ncap_eff=%s\ncap_amb=%s\nsecurebits=%d\nuserns_max=%u\ninitial_userns=%d\nno_new_privs=%d\n",ci,cp,ce,ca,sb,umax,initial,nnp);if(fclose(o))return 126;
+ execvp(argv[10],&argv[10]);char bad='x';write(p[1],&bad,1);return 127;
+}`;
+}
+var RECOGNIZED_CONFIG_PROFILES = ["kasan", "kcsan", "plain"];
+function buildFlagsForProfile(profile) {
+  if (profile === "kasan") {
+    return [
+      "--enable CONFIG_KASAN",
+      "--set-str CONFIG_KASAN_MODE generic",
+      "--enable CONFIG_KASAN_GENERIC",
+      "--enable CONFIG_KASAN_INLINE",
+      "--enable CONFIG_KASAN_STACK",
+      "--enable CONFIG_KASAN_VMALLOC",
+      "--enable CONFIG_UBSAN",
+      "--enable CONFIG_UBSAN_BOUNDS",
+      "--enable CONFIG_UBSAN_SHIFT"
+    ];
+  }
+  if (profile === "plain") {
+    return ["--disable CONFIG_KASAN", "--disable CONFIG_KCSAN", "--enable CONFIG_DEBUG_INFO"];
+  }
+  if (profile === "kcsan") {
+    return [
+      "--enable CONFIG_KCSAN",
+      "--enable CONFIG_KCSAN_EARLY_ENABLE",
+      "--set-val CONFIG_KCSAN_REPORT_ONCE_IN_MS 0",
+      "--enable CONFIG_KCSAN_INTERRUPT_WATCHER",
+      "--enable CONFIG_PREEMPT",
+      "--disable CONFIG_KASAN",
+      "--enable CONFIG_DEBUG_INFO",
+      "--enable CONFIG_DEBUG_KERNEL"
+    ];
+  }
+  throw new Error(`unrecognized kernel config profile: ${profile} (known: ${RECOGNIZED_CONFIG_PROFILES.join(", ")})`);
+}
+function kcsanConfigSupported(kernelConfigText) {
+  return /^CONFIG_KCSAN=y\s*$/m.test(kernelConfigText);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function inferDiskFormat(diskImage) {
+  return diskImage.endsWith(".qcow2") || diskImage.endsWith(".qcow") ? "qcow2" : "raw";
+}
+function defaultKernelCacheDir() {
+  return process.env["0SEC_KERNEL_BUILD_CACHE"]?.trim() || join(homeStateDir(), "kernel-cache");
+}
+function kernelTreeFingerprint(kernelTree) {
+  try {
+    const described = execFileSync("git", ["describe", "--tags", "--always", "--dirty"], {
+      cwd: kernelTree,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (described)
+      return described;
+  } catch {
+  }
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: kernelTree,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    const stat = statSync(kernelTree);
+    return `${realpathSync(kernelTree)}:${Math.trunc(stat.mtimeMs)}`;
+  }
+}
+function sanitizeForPath(value) {
+  return value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 64) || "rev";
+}
+function configNameHash(configProfile) {
+  return createHash("sha256").update(configProfile).digest("hex").slice(0, 12);
+}
+function sha256File(path) {
+  if (!path || !existsSync(path))
+    throw new Error(`kernel provenance artifact not found: ${path || "<unset>"}`);
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+function expectedKernelRelease(kernelTree, explicit, requireExplicit = false) {
+  const fromEnv = explicit?.trim() || process.env["0SEC_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
+  if (fromEnv) {
+    if (!RELEASE_RE.test(fromEnv))
+      throw new Error("invalid expected kernel release");
+    return fromEnv;
+  }
+  if (requireExplicit)
+    throw new Error("env-provided kernel artifacts require an explicit expected kernel release");
+  try {
+    const release2 = execFileSync("make", ["-s", "kernelrelease"], { cwd: kernelTree, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (RELEASE_RE.test(release2))
+      return release2;
+  } catch {
+  }
+  const makefile = readFileSync(join(kernelTree, "Makefile"), "utf8");
+  const part = (name) => new RegExp(`^${name}\\s*=\\s*([^\\s#]+)`, "m").exec(makefile)?.[1];
+  const version = part("VERSION"), patch = part("PATCHLEVEL"), sub = part("SUBLEVEL") ?? "0", extra = part("EXTRAVERSION") ?? "";
+  const release = version && patch ? `${version}.${patch}.${sub}${extra}` : "";
+  if (!RELEASE_RE.test(release))
+    throw new Error("cannot determine expected kernel release; set 0SEC_KERNEL_QEMU_EXPECTED_RELEASE");
+  return release;
+}
+function kernelBuildCacheKey(kernelTree, configProfile) {
+  const fingerprint = kernelTreeFingerprint(kernelTree);
+  const revPart = fingerprint.includes(":") ? createHash("sha256").update(fingerprint).digest("hex").slice(0, 16) : sanitizeForPath(fingerprint);
+  return `${revPart}-${configNameHash(configProfile)}`;
+}
+function artifactsExist(outDir) {
+  return existsSync(join(outDir, "bzImage")) && existsSync(join(outDir, "rootfs.img")) && existsSync(join(outDir, "kernel.config"));
+}
+function defaultBuildRunner(input) {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const script = [
+    join(here, "kernel-vm", "build-from-tree.sh"),
+    join(process.cwd(), "packages/core/src/triage/kernel-vm/build-from-tree.sh"),
+    join(process.cwd(), "src/triage/kernel-vm/build-from-tree.sh")
+  ].find((candidate) => existsSync(candidate));
+  if (!script) {
+    throw new Error("kernel build script not found; set 0SEC_KERNEL_QEMU_KERNEL/0SEC_KERNEL_QEMU_DISK to prebuilt artifacts or run from a source checkout");
+  }
+  execFileSync("bash", [script, input.kernelTree, input.outDir, input.configProfile], {
+    stdio: "inherit"
+  });
+}
+function prepareKernelVmArtifacts(opts) {
+  const configProfile = opts.configProfile ?? "kasan";
+  const log = opts.logger ?? ((line) => console.log(line));
+  const envKernel = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
+  const envDisk = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  if (!opts.force && envKernel && envDisk && existsSync(envKernel) && existsSync(envDisk)) {
+    log(`[kernel-cache] env-override: using 0SEC_KERNEL_QEMU_KERNEL/DISK (skipping build)`);
+    return {
+      kernelImage: envKernel,
+      diskImage: envDisk,
+      kernelConfig: process.env["0SEC_KERNEL_QEMU_CONFIG"]?.trim() || "",
+      cacheKey: "env",
+      cacheDir: "",
+      cacheStatus: "env",
+      configProfile
+    };
+  }
+  const kernelTree = realpathSync(resolve(opts.kernelTree));
+  const cacheRoot = resolve(opts.cacheDir ?? defaultKernelCacheDir());
+  const cacheKey = kernelBuildCacheKey(kernelTree, configProfile);
+  const outDir = join(cacheRoot, cacheKey);
+  mkdirSync(outDir, { recursive: true });
+  if (!opts.force && artifactsExist(outDir)) {
+    log(`[kernel-cache] hit: ${outDir} (config=${configProfile})`);
+    warnIfKcsanUnsupported(configProfile, join(outDir, "kernel.config"), log);
+    return {
+      kernelImage: join(outDir, "bzImage"),
+      diskImage: join(outDir, "rootfs.img"),
+      kernelConfig: join(outDir, "kernel.config"),
+      cacheKey,
+      cacheDir: outDir,
+      cacheStatus: "hit",
+      configProfile
+    };
+  }
+  log(`[kernel-cache] miss: building into ${outDir} (config=${configProfile})`);
+  const runner = opts.buildRunner ?? defaultBuildRunner;
+  runner({ kernelTree, outDir, configProfile });
+  if (!artifactsExist(outDir)) {
+    throw new Error(`kernel build did not produce bzImage/rootfs.img/kernel.config in ${outDir}`);
+  }
+  warnIfKcsanUnsupported(configProfile, join(outDir, "kernel.config"), log);
+  return {
+    kernelImage: join(outDir, "bzImage"),
+    diskImage: join(outDir, "rootfs.img"),
+    kernelConfig: join(outDir, "kernel.config"),
+    cacheKey,
+    cacheDir: outDir,
+    cacheStatus: "miss",
+    configProfile
+  };
+}
+function warnIfKcsanUnsupported(configProfile, kernelConfigPath, log) {
+  if (configProfile !== "kcsan")
+    return;
+  let text = "";
+  try {
+    text = readFileSync(kernelConfigPath, "utf-8");
+  } catch {
+    log(`[kcsan-gate] WARN: could not read ${kernelConfigPath} to verify CONFIG_KCSAN \u2014 race lane may be blind`);
+    return;
+  }
+  if (!kcsanConfigSupported(text)) {
+    log(`[kcsan-gate] WARN: CONFIG_KCSAN not enabled in ${kernelConfigPath} \u2014 data races will NOT be observed (fail-soft)`);
+  }
+}
+function loadKernelVmConfigFromEnv() {
+  const kernelImage = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
+  const diskImage = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  const missing = [
+    !kernelImage ? "0SEC_KERNEL_QEMU_KERNEL" : "",
+    !diskImage ? "0SEC_KERNEL_QEMU_DISK" : ""
+  ].filter(Boolean);
+  if (missing.length > 0) {
+    throw new Error(`kernel VM runner is enabled but missing required env vars: ${missing.join(", ")}`);
+  }
+  const resolvedKernelImage = kernelImage;
+  const resolvedDiskImage = diskImage;
+  const kaslr = /^(1|true|on|yes)$/i.test(process.env["0SEC_KERNEL_QEMU_KASLR"]?.trim() ?? "");
+  const explicitAppend = process.env["0SEC_KERNEL_QEMU_APPEND"]?.trim();
+  const kernelAppend = explicitAppend || buildKernelAppend(kaslr);
+  const widenSymbol = process.env["0SEC_KERNEL_QEMU_WIDEN_SYMBOL"]?.trim() || void 0;
+  const widenOffsetRaw = process.env["0SEC_KERNEL_QEMU_WIDEN_OFFSET"]?.trim();
+  const widenDelayRaw = process.env["0SEC_KERNEL_QEMU_WIDEN_DELAY_MS"]?.trim();
+  const weaponizeInitramfs = /^(1|true|on|yes)$/i.test(process.env["0SEC_KERNEL_QEMU_INITRAMFS"]?.trim() ?? "") || /^(1|true|on|yes)$/i.test(process.env.USE_KERNEL_WEAPONIZE?.trim() ?? "");
+  const initramfsModules = (process.env["0SEC_KERNEL_QEMU_INITRAMFS_MODULES"]?.trim() || "").split(/[:,\s]+/).map((m) => m.trim()).filter(Boolean);
+  const busyboxPath = process.env["0SEC_KERNEL_QEMU_BUSYBOX"]?.trim() || void 0;
+  return {
+    qemuBinary: process.env["0SEC_KERNEL_QEMU_BINARY"]?.trim() || "qemu-system-x86_64",
+    kernelImage: resolvedKernelImage,
+    diskImage: resolvedDiskImage,
+    diskFormat: process.env["0SEC_KERNEL_QEMU_DISK_FORMAT"]?.trim() || inferDiskFormat(resolvedDiskImage),
+    bootTimeoutSec: parseInt(process.env["0SEC_KERNEL_QEMU_BOOT_TIMEOUT_SEC"]?.trim() || "120", 10),
+    memoryMb: parseInt(process.env["0SEC_KERNEL_QEMU_MEMORY_MB"]?.trim() || "2048", 10),
+    smp: parseInt(process.env["0SEC_KERNEL_QEMU_SMP"]?.trim() || "2", 10),
+    kernelAppend,
+    qemuAccel: process.env["0SEC_KERNEL_QEMU_ACCEL"]?.trim() || void 0,
+    initrdPath: process.env["0SEC_KERNEL_QEMU_INITRD"]?.trim() || void 0,
+    timeoutSec: parseInt(process.env["0SEC_KERNEL_QEMU_TIMEOUT_SEC"]?.trim() || "60", 10),
+    shareTag: process.env["0SEC_KERNEL_QEMU_SHARE_TAG"]?.trim() || "osecshare",
+    artifactDir: process.env["0SEC_KERNEL_QEMU_ARTIFACT_DIR"]?.trim() || void 0,
+    kaslr,
+    ...widenSymbol ? { widenSymbol } : {},
+    ...widenOffsetRaw && Number.isFinite(parseInt(widenOffsetRaw, 16)) ? { widenOffset: parseInt(widenOffsetRaw, 16) } : {},
+    ...widenDelayRaw && Number.isFinite(parseInt(widenDelayRaw, 10)) ? { widenDelayMs: parseInt(widenDelayRaw, 10) } : {},
+    ...process.env["0SEC_KERNEL_QEMU_GUEST_BUILD_DIR"]?.trim() ? { guestKernelBuildDir: process.env["0SEC_KERNEL_QEMU_GUEST_BUILD_DIR"].trim() } : {},
+    weaponizeInitramfs,
+    ...initramfsModules.length > 0 ? { initramfsModules } : {},
+    ...busyboxPath ? { busyboxPath } : {}
+  };
+}
+function buildKernelAppend(kaslr) {
+  const base = "console=ttyS0 root=/dev/vda rw";
+  const tail = "panic=-1 init=/sbin/0sec-init";
+  return `${base} ${kaslr ? "kaslr" : "nokaslr"} ${tail}`;
+}
+function renderRaceWidenModuleSource(symbol, offset, delayMs) {
+  const off = `0x${offset.toString(16)}`;
+  return [
+    "// 0sec race-widening kprobe: inject mdelay() at the faulting PC to widen",
+    "// the UAF/race window. Best-effort; harmless if the probe fails to register.",
+    "#include <linux/module.h>",
+    "#include <linux/kernel.h>",
+    "#include <linux/kprobes.h>",
+    "#include <linux/delay.h>",
+    "",
+    'MODULE_LICENSE("GPL");',
+    "",
+    `static unsigned long widen_delay_ms = ${delayMs};`,
+    "module_param(widen_delay_ms, ulong, 0644);",
+    "",
+    "static struct kprobe kp = {",
+    `    .symbol_name = "${symbol}",`,
+    `    .offset = ${off},`,
+    "};",
+    "",
+    "static int handler_pre(struct kprobe *p, struct pt_regs *regs) {",
+    "    mdelay(widen_delay_ms);",
+    "    return 0;",
+    "}",
+    "",
+    "static int __init widen_init(void) {",
+    "    kp.pre_handler = handler_pre;",
+    `    pr_info("0sec-widen: probing ${symbol}+${off} delay=%lums\\n", widen_delay_ms);`,
+    "    return register_kprobe(&kp);",
+    "}",
+    "",
+    "static void __exit widen_exit(void) { unregister_kprobe(&kp); }",
+    "",
+    "module_init(widen_init);",
+    "module_exit(widen_exit);"
+  ].join("\n");
+}
+var RACE_HARNESS_BASE_HEADERS = [
+  "#include <stdio.h>",
+  "#include <stdlib.h>",
+  "#include <string.h>",
+  "#include <unistd.h>",
+  "#include <pthread.h>",
+  "#include <sched.h>",
+  "#include <time.h>",
+  "#include <fcntl.h>",
+  "#include <sys/types.h>"
+];
+function renderRealIpiRaceHarness(spec) {
+  const maxIters = Number.isFinite(spec.maxIters) ? Math.max(1, Math.trunc(spec.maxIters)) : 2e5;
+  const seconds = Number.isFinite(spec.seconds) ? Math.max(1, Math.trunc(spec.seconds)) : 40;
+  const cpuA = 0;
+  const cpuB = spec.sameCpu ? 0 : 1;
+  const seen = /* @__PURE__ */ new Set();
+  const headerLines = [];
+  const push = (h) => {
+    const t = h.trim();
+    if (!t || seen.has(t))
+      return;
+    seen.add(t);
+    headerLines.push(t);
+  };
+  push("#define _GNU_SOURCE");
+  for (const h of RACE_HARNESS_BASE_HEADERS)
+    push(h);
+  for (const h of spec.headers ?? []) {
+    push(h);
+  }
+  const setupC = spec.setupC?.trim() ? spec.setupC : "/* no widening tactics composed */";
+  return [
+    ...headerLines,
+    "",
+    "static volatile int g_stop = 0;",
+    "",
+    "static void osec_pin_cpu(int cpu) {",
+    "  cpu_set_t set;",
+    "  CPU_ZERO(&set);",
+    "  CPU_SET(cpu, &set);",
+    "  sched_setaffinity(0, sizeof(set), &set);",
+    "}",
+    "",
+    "static long osec_env_long(const char *name, long dflt) {",
+    "  const char *v = getenv(name);",
+    "  if (!v || !*v) return dflt;",
+    "  char *end = NULL;",
+    "  long n = strtol(v, &end, 10);",
+    "  return (end && *end == '\\0' && n > 0) ? n : dflt;",
+    "}",
+    "",
+    `static void *osec_racer_a(void *arg) {`,
+    "  (void)arg;",
+    `  osec_pin_cpu(${cpuA});`,
+    "  while (!g_stop) {",
+    `    ${spec.raceOpA}`,
+    "  }",
+    "  return NULL;",
+    "}",
+    "",
+    `static void *osec_racer_b(void *arg) {`,
+    "  (void)arg;",
+    `  osec_pin_cpu(${cpuB});`,
+    "  while (!g_stop) {",
+    `    ${spec.raceOpB}`,
+    "  }",
+    "  return NULL;",
+    "}",
+    "",
+    "int main(void) {",
+    `  long retries = osec_env_long("0SEC_RACE_RETRIES", ${maxIters});`,
+    `  long seconds = osec_env_long("0SEC_RACE_SECONDS", ${seconds});`,
+    "  time_t deadline = time(NULL) + seconds;",
+    "",
+    "  /* Arm the widening tactics ONCE (freeze/register + IPI bursts). */",
+    setupC,
+    "",
+    "  /* Bad Epoll non-crashing retry loop: re-race until the sanitizer fires.",
+    "     The harness itself never touches freed memory \u2014 the kernel splat on the",
+    "     serial console is the only terminator; here we just exhaust the budget. */",
+    "  for (long iter = 0; iter < retries && time(NULL) < deadline; iter++) {",
+    "    g_stop = 0;",
+    "    pthread_t ta, tb;",
+    "    if (pthread_create(&ta, NULL, osec_racer_a, NULL) != 0) break;",
+    "    if (pthread_create(&tb, NULL, osec_racer_b, NULL) != 0) { g_stop = 1; pthread_join(ta, NULL); break; }",
+    "    usleep(200);",
+    "    g_stop = 1;",
+    "    pthread_join(ta, NULL);",
+    "    pthread_join(tb, NULL);",
+    '    if ((iter & 0x3ff) == 0) { printf("0SEC-RACE iter=%ld\\n", iter); fflush(stdout); }',
+    "  }",
+    '  printf("0SEC-RACE done (budget exhausted, no splat)\\n");',
+    "  fflush(stdout);",
+    "  return 0;",
+    "}"
+  ].join("\n");
+}
+function buildQemuCommand(config, serialLogPath, sharedDir) {
+  const args = [
+    "-m",
+    String(config.memoryMb),
+    "-smp",
+    String(config.smp),
+    "-kernel",
+    config.kernelImage,
+    "-drive",
+    `file=${config.diskImage},format=${config.diskFormat},if=virtio`,
+    "-append",
+    config.kernelAppend,
+    "-virtfs",
+    `local,path=${sharedDir},mount_tag=${config.shareTag},security_model=none,id=hostshare`,
+    "-nographic",
+    "-monitor",
+    "none",
+    "-serial",
+    `file:${serialLogPath}`,
+    "-no-reboot",
+    // Every verification boot must start from the same immutable rootfs state.
+    // QEMU writes guest disk changes to a temporary overlay and discards them
+    // when the VM exits; this is the disk-state half of the N-boot contract.
+    "-snapshot"
+  ];
+  if (config.qemuAccel) {
+    args.push("-accel", config.qemuAccel);
+  }
+  if (config.initrdPath) {
+    args.push("-initrd", config.initrdPath);
+  }
+  return { command: config.qemuBinary, args };
+}
+function buildInitramfsKernelAppend(kaslr) {
+  return [
+    "console=ttyS0",
+    "earlyprintk=serial",
+    "rdinit=/init",
+    "kasan_multi_shot=1",
+    kaslr ? "kaslr" : "nokaslr",
+    "panic=-1"
+  ].join(" ");
+}
+function renderInitramfsInitScript(moduleNames, raceEnv, timeoutSec) {
+  const raceEnvEntries = Object.entries(raceEnv).filter(([key]) => /^0SEC_RACE_[A-Z0-9_]+$/.test(key));
+  const envAssignments = raceEnvEntries.map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ");
+  const exploitCommand = [
+    envAssignments ? `/bin/busybox env ${envAssignments}` : "",
+    `/bin/busybox timeout ${timeoutSec} /exploit > /tmp/run.log 2>&1`
+  ].filter(Boolean).join(" ");
+  const insmods = moduleNames.map((m) => `insmod /lib/modules/${m} 2>&1 && echo "insmod ${m} ok" || echo "insmod ${m} rc=$?"`).join("\n");
+  return [
+    "#!/bin/busybox sh",
+    "/bin/busybox mkdir -p /proc /sys /dev /tmp /lib/modules",
+    "/bin/busybox mount -t proc none /proc",
+    "/bin/busybox mount -t sysfs none /sys",
+    "/bin/busybox mount -t devtmpfs none /dev 2>/dev/null",
+    "/bin/busybox --install -s /bin 2>/dev/null",
+    'echo "=== 0SEC-INITRAMFS weaponize lane up ==="',
+    "cat /proc/version",
+    insmods,
+    'echo "=== 0SEC-INITRAMFS run (env: ' + raceEnvEntries.map(([key]) => key).join(",") + ') ==="',
+    // CRITICAL: the engine's emitted exploit prints a RECLAIM marker on EVERY
+    // spray-loop iteration (thousands/sec). Streaming that to the slow 8250 UART
+    // wedges the CPU in io_serial_in and STARVES the race (NMI watchdog fires,
+    // KASAN never gets a window). So redirect the exploit's stdout/stderr to a
+    // tmpfs file (fast, no UART blocking) during the race, then `cat` it to the
+    // serial console AFTER the race completes — the oracle reads the full serial
+    // stream either way, and the KASAN splats (kernel printk, a separate path)
+    // still interleave live. `timeout` caps a hung flood; busybox `timeout` takes
+    // the seconds as a POSITIONAL arg (`timeout SECS PROG`), NOT GNU `-t SECS`.
+    `${exploitCommand} || echo "0SEC-INITRAMFS exploit exit=$?" >> /tmp/run.log`,
+    'echo "=== 0SEC-INITRAMFS exploit output (batched off the UART hot path) ==="',
+    "cat /tmp/run.log",
+    'echo "=== 0SEC-INITRAMFS post-run ==="',
+    "sync",
+    "cat /tmp/pwned 2>/dev/null && echo 0SEC-INITRAMFS-PWNED-FILE-PRESENT",
+    'echo "=== 0SEC-INITRAMFS done; powering off ==="',
+    "/bin/busybox poweroff -f"
+  ].join("\n");
+}
+function buildWeaponizeInitramfs(config, exploitC, workDir, raceEnv) {
+  const rootDir = join(workDir, "initramfs-root");
+  mkdirSync(join(rootDir, "bin"), { recursive: true });
+  mkdirSync(join(rootDir, "lib", "modules"), { recursive: true });
+  for (const sub of ["proc", "sys", "dev", "tmp"]) {
+    mkdirSync(join(rootDir, sub), { recursive: true });
+  }
+  const busybox = config.busyboxPath || (() => {
+    try {
+      return execFileSync("sh", ["-c", "command -v busybox"], { encoding: "utf8" }).trim();
+    } catch {
+      return "";
+    }
+  })();
+  if (!busybox || !existsSync(busybox)) {
+    throw new Error("weaponize-initramfs lane: no busybox found (set 0SEC_KERNEL_QEMU_BUSYBOX to a STATIC busybox)");
+  }
+  execFileSync("cp", [busybox, join(rootDir, "bin", "busybox")]);
+  chmodSync(join(rootDir, "bin", "busybox"), 493);
+  const srcPath = join(workDir, "exploit.c");
+  writeFileSync(srcPath, exploitC, "utf-8");
+  const binPath = join(rootDir, "exploit");
+  const compileLog = join(workDir, "compile.log");
+  try {
+    execFileSync("gcc", ["-O0", "-g", "-static", "-o", binPath, srcPath, "-lpthread"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  } catch (err) {
+    const msg = err instanceof Error && "stderr" in err ? String(err.stderr) : String(err);
+    writeFileSync(compileLog, msg, "utf-8");
+    throw new Error(`weaponize-initramfs lane: static exploit compile failed:
+${msg.slice(0, 1500)}`);
+  }
+  chmodSync(binPath, 493);
+  const moduleNames = [];
+  for (const koPath of config.initramfsModules ?? []) {
+    if (!existsSync(koPath)) {
+      throw new Error(`weaponize-initramfs lane: module not found: ${koPath}`);
+    }
+    const name = koPath.split("/").pop();
+    execFileSync("cp", [koPath, join(rootDir, "lib", "modules", name)]);
+    moduleNames.push(name);
+  }
+  const initPath = join(rootDir, "init");
+  writeFileSync(initPath, renderInitramfsInitScript(moduleNames, raceEnv, config.timeoutSec), "utf-8");
+  chmodSync(initPath, 493);
+  const cpioPath = join(workDir, "initramfs.cpio.gz");
+  execFileSync("sh", ["-c", `cd ${shellQuote(rootDir)} && find . -print0 | cpio --null -o --format=newc 2>/dev/null | gzip -9 > ${shellQuote(cpioPath)}`]);
+  if (!existsSync(cpioPath) || statSync(cpioPath).size === 0) {
+    throw new Error("weaponize-initramfs lane: cpio packing produced an empty initramfs");
+  }
+  return cpioPath;
+}
+function buildInitramfsQemuCommand(config, serialLogPath, initramfsPath, kernelAppend) {
+  const args = [
+    "-m",
+    String(config.memoryMb),
+    "-smp",
+    String(config.smp),
+    "-kernel",
+    config.kernelImage,
+    "-initrd",
+    initramfsPath,
+    "-append",
+    kernelAppend,
+    "-nographic",
+    "-monitor",
+    "none",
+    "-serial",
+    `file:${serialLogPath}`,
+    "-no-reboot"
+  ];
+  if (config.qemuAccel) {
+    args.push("-accel", config.qemuAccel);
+  }
+  return { command: config.qemuBinary, args };
+}
+function collectRaceEnv() {
+  const out = {};
+  for (const key of [
+    "0SEC_RACE_FLOOD_THREADS",
+    "0SEC_RACE_SPRAY_THREADS",
+    "0SEC_RACE_PARK_US",
+    "0SEC_RACE_SECONDS",
+    "0SEC_RACE_SAME_CPU"
+  ]) {
+    const v = process.env[key]?.trim();
+    if (v)
+      out[key] = v;
+  }
+  return out;
+}
+async function sleep(ms) {
+  await new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function stopVm(proc) {
+  if (proc.exitCode !== null || proc.killed)
+    return;
+  proc.kill("SIGTERM");
+  const deadline = Date.now() + 1e4;
+  while (proc.exitCode === null && Date.now() < deadline) {
+    await sleep(250);
+  }
+  if (proc.exitCode === null) {
+    proc.kill("SIGKILL");
+  }
+}
+function renderGuestRunnerScript(config, language, request) {
+  const uid = request.dropUid === void 0 ? "-" : String(request.dropUid);
+  const gid = request.dropGid === void 0 ? "-" : String(request.dropGid);
+  const launcherArgs = `"$WORK_DIR/attest-launcher" "$SHARE_DIR/execution-attestation.txt" ${shellQuote(request.nonce)} ${shellQuote(request.reproducerSha256)} ${shellQuote(request.expectedKernelRelease)} ${shellQuote(request.kernelImageSha256)} ${shellQuote(request.kernelConfigSha256)} ${shellQuote(uid)} ${shellQuote(gid)} "$SHARE_DIR/exec-started.ok"`;
+  if (language === "syz") {
+    return [
+      "#!/bin/sh",
+      "set -eu",
+      "SHARE_DIR=/mnt/0sec",
+      "WORK_DIR=/tmp/0sec-run",
+      'mkdir -p "$WORK_DIR"',
+      "compiled=0",
+      "executed=0",
+      "exit_code=0",
+      "timed_out=0",
+      'cp "$SHARE_DIR/repro.syz" "$WORK_DIR/repro.syz"',
+      'if command -v syz-execprog >/dev/null 2>&1 && /usr/bin/gcc -O2 -o "$WORK_DIR/attest-launcher" "$SHARE_DIR/attest-launcher.c" >>"$SHARE_DIR/compile.log" 2>&1; then',
+      "  compiled=1",
+      '  : > "$SHARE_DIR/compile.log"',
+      "else",
+      `  printf '%s\\n' 'syz-execprog not found in guest' > "$SHARE_DIR/compile.log"`,
+      "  exit_code=127",
+      "fi",
+      'if [ "$compiled" = "1" ]; then',
+      "  dmesg -C 2>/dev/null || true",
+      // KCOV coverage collection (AIxCC T1): ask syz-execprog to collect coverage
+      // and dump the per-call PC set to coverage_prog* shards on the share.
+      // `-cover=1` enables KCOV; `-coverfile` is the shard prefix. Both flags are no-ops
+      // (or rejected) on a non-KCOV kernel / older syz-execprog — fail-soft so a
+      // run without coverage still records its crash result.
+      `  if timeout ${shellQuote(String(config.timeoutSec))}s ${launcherArgs} syz-execprog -cover=1 -coverfile="$SHARE_DIR/coverage" "$WORK_DIR/repro.syz" >"$SHARE_DIR/run.log" 2>&1; then`,
+      "    executed=1",
+      "    exit_code=0",
+      "  else",
+      "    exit_code=$?",
+      '    if [ "$exit_code" = "124" ]; then',
+      "      timed_out=1",
+      "    else",
+      "      executed=1",
+      "    fi",
+      "  fi",
+      '  [ -f "$SHARE_DIR/exec-started.ok" ] || executed=0',
+      "  # Consolidate coverage: syz-execprog -coverfile writes the PC set to",
+      "  # per-program/per-call shards named `coverage_prog<N>.<call>` (e.g.",
+      "  # `coverage_prog0.0`), and may also leave a bare `coverage` / `coverage.N`.",
+      "  # Concatenate every shard into coverage.log for the host to parse; PCs are",
+      "  # deduped downstream by parseCoveragePcs (fail-soft if none landed).",
+      '  cat "$SHARE_DIR/coverage" "$SHARE_DIR/coverage."* "$SHARE_DIR/coverage_prog"* > "$SHARE_DIR/coverage.log" 2>/dev/null || true',
+      "else",
+      '  : > "$SHARE_DIR/run.log"',
+      "fi",
+      'dmesg 2>/dev/null > "$SHARE_DIR/dmesg.log" || true',
+      `printf '%s\\n' "$compiled" > "$SHARE_DIR/compiled.ok"`,
+      `printf '%s\\n' "$executed" > "$SHARE_DIR/executed.ok"`,
+      `printf '%s\\n' "$exit_code" > "$SHARE_DIR/exit_code"`,
+      `printf '%s\\n' "$timed_out" > "$SHARE_DIR/timed_out"`,
+      "sync"
+    ].join("\n");
+  }
+  const widenLines = config.widenSymbol !== void 0 && config.widenOffset !== void 0 && config.widenDelayMs !== void 0 && config.guestKernelBuildDir ? [
+    "# \u2500\u2500 Race-widening (best-effort, fail-soft) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    `KBUILD_DIR=${shellQuote(config.guestKernelBuildDir)}`,
+    "widened=0",
+    'if [ -d "$KBUILD_DIR" ] && command -v make >/dev/null 2>&1; then',
+    '  cp "$SHARE_DIR/osec_widen.c" "$WORK_DIR/osec_widen.c" 2>/dev/null || true',
+    '  printf "obj-m += osec_widen.o\\n" > "$WORK_DIR/Makefile"',
+    '  if make -C "$KBUILD_DIR" M="$WORK_DIR" modules >"$SHARE_DIR/widen.log" 2>&1 \\',
+    '     && insmod "$WORK_DIR/osec_widen.ko" >>"$SHARE_DIR/widen.log" 2>&1; then',
+    "    widened=1",
+    '    printf "%s\\n" "0sec-widen: insmod ok" >> "$SHARE_DIR/widen.log"',
+    "  else",
+    '    printf "%s\\n" "0sec-widen: build/insmod failed \u2014 running WITHOUT widening" >> "$SHARE_DIR/widen.log"',
+    "  fi",
+    "else",
+    '  printf "%s\\n" "0sec-widen: no kernel build tree in guest \u2014 running WITHOUT widening" > "$SHARE_DIR/widen.log"',
+    "fi",
+    'printf "%s\\n" "$widened" > "$SHARE_DIR/widened.ok"'
+  ] : [];
+  return [
+    "#!/bin/sh",
+    "set -eu",
+    "# uid-drop exec contract: this runner executes the reproducer as the guest",
+    "# init (uid 0). A weaponization exploit drops to an unprivileged uid itself",
+    "# (setuid(65534)) BEFORE firing its root tail, then re-checks getuid()==0",
+    "# after \u2014 so the captured output carries an ordered DROP(uid!=0)\u2192ROOT(uid=0)",
+    "# witness the oracle uses to confirm a genuine escalation. We must therefore",
+    "# run it directly (as root), NOT via su/sudo to a lower uid.",
+    "SHARE_DIR=/mnt/0sec",
+    "WORK_DIR=/tmp/0sec-run",
+    'mkdir -p "$WORK_DIR"',
+    "compiled=0",
+    "executed=0",
+    "exit_code=0",
+    "timed_out=0",
+    'cp "$SHARE_DIR/repro.c" "$WORK_DIR/repro.c"',
+    ...widenLines,
+    `if /usr/bin/gcc -B/usr/bin/ -O0 -g -o "$WORK_DIR/repro" "$WORK_DIR/repro.c" -lpthread >"$SHARE_DIR/compile.log" 2>&1 && /usr/bin/gcc -O2 -o "$WORK_DIR/attest-launcher" "$SHARE_DIR/attest-launcher.c" >>"$SHARE_DIR/compile.log" 2>&1; then`,
+    "  compiled=1",
+    "else",
+    "  exit_code=$?",
+    "fi",
+    'if [ "$compiled" = "1" ]; then',
+    "  dmesg -C 2>/dev/null || true",
+    `  if timeout ${shellQuote(String(config.timeoutSec))}s ${launcherArgs} "$WORK_DIR/repro" >"$SHARE_DIR/run.log" 2>&1; then`,
+    "    executed=1",
+    "    exit_code=0",
+    "  else",
+    "    exit_code=$?",
+    '    if [ "$exit_code" = "124" ]; then',
+    "      timed_out=1",
+    "    else",
+    "      executed=1",
+    "    fi",
+    "  fi",
+    '  [ -f "$SHARE_DIR/exec-started.ok" ] || executed=0',
+    "else",
+    '  : > "$SHARE_DIR/run.log"',
+    "fi",
+    'dmesg 2>/dev/null > "$SHARE_DIR/dmesg.log" || true',
+    `printf '%s\\n' "$compiled" > "$SHARE_DIR/compiled.ok"`,
+    `printf '%s\\n' "$executed" > "$SHARE_DIR/executed.ok"`,
+    `printf '%s\\n' "$exit_code" > "$SHARE_DIR/exit_code"`,
+    `printf '%s\\n' "$timed_out" > "$SHARE_DIR/timed_out"`,
+    "sync"
+  ].join("\n");
+}
+async function waitForVmResult(config, proc, hostTmpDir, bootLogPath) {
+  const totalBudgetSec = config.bootTimeoutSec + config.timeoutSec + 60;
+  const deadline = Date.now() + totalBudgetSec * 1e3;
+  const compiledMarker = join(hostTmpDir, "compiled.ok");
+  while (Date.now() < deadline) {
+    if (existsSync(compiledMarker)) {
+      return;
+    }
+    if (proc.exitCode !== null) {
+      const bootLog2 = existsSync(bootLogPath) ? readFileSync(bootLogPath, "utf-8").slice(-4e3) : "";
+      throw new Error(`kernel VM exited before producing results (exit=${proc.exitCode}).
+${bootLog2}`);
+    }
+    await sleep(2e3);
+  }
+  const bootLog = existsSync(bootLogPath) ? readFileSync(bootLogPath, "utf-8").slice(-4e3) : "";
+  throw new Error(`timed out waiting for kernel VM results in shared dir ${hostTmpDir} after ${totalBudgetSec}s.
+${bootLog}`);
+}
+function parseCoveragePcs(raw) {
+  const pcs = /* @__PURE__ */ new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    const token = line.trim().split(/\s+/)[0];
+    if (!token)
+      continue;
+    let value;
+    try {
+      value = token.startsWith("0x") || token.startsWith("0X") ? BigInt(token) : /^[0-9]+$/.test(token) ? BigInt(token) : -1n;
+    } catch {
+      continue;
+    }
+    if (value > 0n)
+      pcs.add(`0x${value.toString(16)}`);
+  }
+  return [...pcs].sort((a, b) => {
+    const av = BigInt(a);
+    const bv = BigInt(b);
+    return av < bv ? -1 : av > bv ? 1 : 0;
+  });
+}
+async function waitForInitramfsVm(config, proc, serialLogPath) {
+  const totalBudgetSec = config.bootTimeoutSec + config.timeoutSec + 60;
+  const deadline = Date.now() + totalBudgetSec * 1e3;
+  while (Date.now() < deadline) {
+    if (proc.exitCode !== null)
+      return { poweredOff: true };
+    if (existsSync(serialLogPath)) {
+      const tail = readFileSync(serialLogPath, "utf-8").slice(-2e3);
+      if (tail.includes("0SEC-INITRAMFS done"))
+        return { poweredOff: true };
+    }
+    await sleep(1e3);
+  }
+  return { poweredOff: false };
+}
+async function runWeaponizeInitramfs(config, exploitC) {
+  const hostTmpDir = config.artifactDir ? (() => {
+    mkdirSync(config.artifactDir, { recursive: true });
+    return mkdtempSync(join(config.artifactDir, "0sec-initramfs-"));
+  })() : mkdtempSync(join(tmpdir(), "0sec-initramfs-"));
+  const serialLogPath = join(hostTmpDir, "serial.log");
+  const raceEnv = collectRaceEnv();
+  let initramfsPath;
+  try {
+    initramfsPath = buildWeaponizeInitramfs(config, exploitC, hostTmpDir, raceEnv);
+  } catch (err) {
+    if (!config.artifactDir)
+      rmSync(hostTmpDir, { recursive: true, force: true });
+    return {
+      compiled: false,
+      executed: false,
+      output: err instanceof Error ? err.message : String(err),
+      dmesg: "",
+      exitCode: -1,
+      timedOut: false
+    };
+  }
+  const kernelAppend = buildInitramfsKernelAppend(config.kaslr ?? false);
+  const { command, args } = buildInitramfsQemuCommand(config, serialLogPath, initramfsPath, kernelAppend);
+  const vmProc = spawn(command, args, { stdio: "ignore" });
+  try {
+    const { poweredOff } = await waitForInitramfsVm(config, vmProc, serialLogPath);
+    const serial = existsSync(serialLogPath) ? readFileSync(serialLogPath, "utf-8") : "";
+    const executed = serial.includes("0SEC-INITRAMFS run");
+    const timedOut = !poweredOff;
+    if (executed) {
+      assertBugAttribution({
+        exploitSource: exploitC,
+        runOutput: serial,
+        targetModules: (config.initramfsModules ?? []).map((p) => p.split("/").pop() ?? p),
+        kaslrOn: config.kaslr ?? false
+      });
+    }
+    return {
+      compiled: true,
+      executed,
+      output: serial,
+      dmesg: serial,
+      exitCode: executed ? 0 : 1,
+      timedOut
+    };
+  } finally {
+    await stopVm(vmProc);
+    if (!config.artifactDir) {
+      rmSync(hostTmpDir, { recursive: true, force: true });
+    }
+  }
+}
+async function runReproducerInKernelVm(report) {
+  if (!report.reproducer) {
+    return {
+      compiled: false,
+      executed: false,
+      output: "",
+      dmesg: "",
+      exitCode: -1,
+      timedOut: false
+    };
+  }
+  const config = loadKernelVmConfigFromEnv();
+  if (config.weaponizeInitramfs && (report.reproducerLanguage ?? "c") === "c") {
+    return runWeaponizeInitramfs(config, report.reproducer);
+  }
+  const hostTmpDir = config.artifactDir ? (() => {
+    mkdirSync(config.artifactDir, { recursive: true });
+    return mkdtempSync(join(config.artifactDir, "0sec-kvm-"));
+  })() : mkdtempSync(join(tmpdir(), "0sec-kvm-"));
+  const language = report.reproducerLanguage ?? "c";
+  const request = report.executionAttestationRequest ?? (() => {
+    const release = process.env["0SEC_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
+    if (!release || !RELEASE_RE.test(release))
+      throw new Error("direct kernel VM execution requires 0SEC_KERNEL_QEMU_EXPECTED_RELEASE");
+    return {
+      nonce: randomBytes(16).toString("hex"),
+      reproducerSha256: createHash("sha256").update(report.reproducer).digest("hex"),
+      expectedKernelRelease: release,
+      kernelImageSha256: sha256File(config.kernelImage),
+      kernelConfigSha256: sha256File(process.env["0SEC_KERNEL_QEMU_CONFIG"]?.trim() || "")
+    };
+  })();
+  const sourcePath = join(hostTmpDir, language === "syz" ? "repro.syz" : "repro.c");
+  const runnerScriptPath = join(hostTmpDir, "runner.sh");
+  const serialLogPath = join(hostTmpDir, "serial.log");
+  writeFileSync(sourcePath, report.reproducer, "utf-8");
+  writeFileSync(runnerScriptPath, renderGuestRunnerScript(config, language, request), "utf-8");
+  writeFileSync(join(hostTmpDir, "attest-launcher.c"), renderKernelExecutionLauncherSource(), "utf-8");
+  if (config.widenSymbol !== void 0 && config.widenOffset !== void 0 && config.widenDelayMs !== void 0) {
+    writeFileSync(join(hostTmpDir, "osec_widen.c"), renderRaceWidenModuleSource(config.widenSymbol, config.widenOffset, config.widenDelayMs), "utf-8");
+  }
+  const { command, args } = buildQemuCommand(config, serialLogPath, hostTmpDir);
+  const vmProc = spawn(command, args, {
+    stdio: "ignore"
+  });
+  try {
+    await waitForVmResult(config, vmProc, hostTmpDir, serialLogPath);
+    const compiled = readFileSync(join(hostTmpDir, "compiled.ok"), "utf-8").trim() === "1";
+    const executed = existsSync(join(hostTmpDir, "executed.ok")) ? readFileSync(join(hostTmpDir, "executed.ok"), "utf-8").trim() === "1" : false;
+    const exitCode = existsSync(join(hostTmpDir, "exit_code")) ? parseInt(readFileSync(join(hostTmpDir, "exit_code"), "utf-8").trim(), 10) : 1;
+    const timedOut = existsSync(join(hostTmpDir, "timed_out")) ? readFileSync(join(hostTmpDir, "timed_out"), "utf-8").trim() === "1" : false;
+    const compileLog = existsSync(join(hostTmpDir, "compile.log")) ? readFileSync(join(hostTmpDir, "compile.log"), "utf-8").trim() : "";
+    const runLog = existsSync(join(hostTmpDir, "run.log")) ? readFileSync(join(hostTmpDir, "run.log"), "utf-8").trim() : "";
+    const dmesg = existsSync(join(hostTmpDir, "dmesg.log")) ? readFileSync(join(hostTmpDir, "dmesg.log"), "utf-8").trim() : "";
+    const coveragePcs = existsSync(join(hostTmpDir, "coverage.log")) ? parseCoveragePcs(readFileSync(join(hostTmpDir, "coverage.log"), "utf-8")) : void 0;
+    const executionAttestationPath = join(hostTmpDir, "execution-attestation.txt");
+    let executionAttestation;
+    if (existsSync(executionAttestationPath)) {
+      executionAttestation = parseKernelExecutionAttestation(readFileSync(executionAttestationPath, "utf-8"));
+      bindKernelExecutionAttestation(executionAttestation, request);
+    }
+    if (executed) {
+      assertBugAttribution({
+        exploitSource: report.reproducer,
+        runOutput: runLog,
+        targetModules: (config.initramfsModules ?? []).map((p) => p.split("/").pop() ?? p),
+        kaslrOn: config.kaslr ?? false
+      });
+    }
+    return {
+      compiled,
+      executed,
+      output: compiled ? runLog : compileLog,
+      dmesg,
+      exitCode: Number.isFinite(exitCode) ? exitCode : 1,
+      timedOut,
+      ...coveragePcs && coveragePcs.length > 0 ? { coveragePcs } : {},
+      ...executionAttestation ? { executionAttestation, executionAttestationPath } : {}
+    };
+  } finally {
+    await stopVm(vmProc);
+    if (!config.artifactDir) {
+      rmSync(hostTmpDir, { recursive: true, force: true });
+    }
+  }
+}
+var KERNEL_CRASH_SIGNATURES = [
+  // KCSAN data-race — the race class KASAN is structurally blind to. Matched
+  // first so a widened data-race under the `kcsan` build profile is recognized
+  // (closes the loop with kcsan-race.ts's parser + patch-to-poc.ts's
+  // "KCSAN: data-race" expected signature).
+  { pattern: /BUG:\s*KCSAN:\s*data-race|KCSAN:\s*data-race/i, signature: "kcsan-data-race" },
+  { pattern: /KASAN:\s+slab-use-after-free|KASAN.*use-after-free/i, signature: "kasan-uaf" },
+  { pattern: /KASAN:\s+slab-out-of-bounds|KASAN.*out-of-bounds/i, signature: "kasan-oob" },
+  { pattern: /KASAN.*double-free/i, signature: "kasan-double-free" },
+  { pattern: /KASAN.*invalid-free/i, signature: "kasan-invalid-free" },
+  { pattern: /KASAN.*stack-out-of-bounds/i, signature: "kasan-stack-oob" },
+  { pattern: /UBSAN.*shift/i, signature: "ubsan-shift" },
+  { pattern: /UBSAN.*overflow/i, signature: "ubsan-overflow" },
+  { pattern: /UBSAN.*(out-of-bounds|index)/i, signature: "ubsan-bounds" },
+  { pattern: /UBSAN/i, signature: "ubsan" },
+  { pattern: /NULL pointer dereference|kernel NULL pointer/i, signature: "null-deref" },
+  { pattern: /general protection fault/i, signature: "general-protection" }
+];
+function detectKernelSignature(dmesg) {
+  for (const { pattern, signature } of KERNEL_CRASH_SIGNATURES) {
+    if (pattern.test(dmesg))
+      return signature;
+  }
+  return void 0;
+}
+function defaultDmesgOutPath() {
+  const ns = process.hrtime.bigint().toString();
+  const random = Math.random().toString(36).slice(2, 10);
+  return join(tmpdir(), `0sec-verify-${ns}-${random}.dmesg`);
+}
+function writeProofFileReadOnly(path, content) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content, "utf-8");
+  try {
+    chmodSync(path, 292);
+  } catch {
+  }
+}
+async function verifyKernelFinding(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const dmesgOutPath = opts.dmesgOutPath ?? defaultDmesgOutPath();
+  if (!opts.syzProgramPath && !opts.reproducerPath) {
+    throw new Error("verifyKernelFinding requires either syzProgramPath or reproducerPath");
+  }
+  if (opts.syzProgramPath && opts.reproducerPath) {
+    throw new Error("verifyKernelFinding: pass only one of syzProgramPath or reproducerPath");
+  }
+  const reproPath = opts.syzProgramPath ?? opts.reproducerPath;
+  const reproducerLanguage = opts.syzProgramPath ? "syz" : "c";
+  if (!existsSync(reproPath)) {
+    throw new Error(`reproducer not found: ${reproPath}`);
+  }
+  if (opts.executionIdentity && (!Number.isSafeInteger(opts.executionIdentity.uid) || opts.executionIdentity.uid <= 0 || opts.executionIdentity.uid > 4294967295 || !Number.isSafeInteger(opts.executionIdentity.gid) || opts.executionIdentity.gid <= 0 || opts.executionIdentity.gid > 4294967295)) {
+    throw new Error("executionIdentity requires positive uint32 uid/gid values");
+  }
+  const reproducerBytes = readFileSync(reproPath);
+  const nonce = randomBytes(16).toString("hex");
+  const reproducerSha256 = createHash("sha256").update(reproducerBytes).digest("hex");
+  let artifacts;
+  try {
+    artifacts = prepareKernelVmArtifacts({
+      kernelTree: opts.kernelTree,
+      configProfile: opts.kernelConfig ?? "kasan",
+      cacheDir: opts.cacheDir,
+      force: opts.forceBuild,
+      logger: log,
+      buildRunner: opts.buildRunner
+    });
+  } catch (err) {
+    writeProofFileReadOnly(dmesgOutPath, `[build_failed] ${err instanceof Error ? err.message : String(err)}
+`);
+    return {
+      status: "build_failed",
+      dmesg_path: dmesgOutPath,
+      build_cache_hit: false
+    };
+  }
+  const build_cache_hit = artifacts.cacheStatus === "hit" || artifacts.cacheStatus === "env";
+  mkdirSync(dirname(dmesgOutPath), { recursive: true });
+  const launchDir = mkdtempSync(join(dirname(dmesgOutPath), ".0sec-kernel-launch-"));
+  const stagedKernelImage = join(launchDir, "kernel.image");
+  const stagedKernelConfig = join(launchDir, "kernel.config");
+  let attestationRequest;
+  try {
+    copyFileSync(artifacts.kernelImage, stagedKernelImage, fsConstants.COPYFILE_FICLONE);
+    copyFileSync(artifacts.kernelConfig, stagedKernelConfig, fsConstants.COPYFILE_FICLONE);
+    chmodSync(stagedKernelImage, 292);
+    chmodSync(stagedKernelConfig, 292);
+    attestationRequest = {
+      nonce,
+      reproducerSha256,
+      expectedKernelRelease: expectedKernelRelease(opts.kernelTree, opts.expectedKernelRelease, artifacts.cacheStatus === "env"),
+      kernelImageSha256: sha256File(stagedKernelImage),
+      kernelConfigSha256: sha256File(stagedKernelConfig),
+      ...opts.executionIdentity ? { dropUid: opts.executionIdentity.uid, dropGid: opts.executionIdentity.gid } : {}
+    };
+  } catch (err) {
+    rmSync(launchDir, { recursive: true, force: true });
+    writeProofFileReadOnly(dmesgOutPath, `[build_failed] ${err instanceof Error ? err.message : String(err)}
+`);
+    return { status: "build_failed", dmesg_path: dmesgOutPath, build_cache_hit };
+  }
+  const previousEnv = {
+    qemu: process.env["0SEC_KERNEL_QEMU"],
+    kernel: process.env["0SEC_KERNEL_QEMU_KERNEL"],
+    disk: process.env["0SEC_KERNEL_QEMU_DISK"],
+    cfg: process.env["0SEC_KERNEL_QEMU_CONFIG"],
+    cacheKey: process.env["0SEC_KERNEL_QEMU_CACHEKEY"]
+  };
+  process.env["0SEC_KERNEL_QEMU"] = "1";
+  process.env["0SEC_KERNEL_QEMU_KERNEL"] = stagedKernelImage;
+  process.env["0SEC_KERNEL_QEMU_DISK"] = artifacts.diskImage;
+  if (artifacts.kernelConfig) {
+    process.env["0SEC_KERNEL_QEMU_CONFIG"] = stagedKernelConfig;
+  }
+  if (artifacts.cacheKey) {
+    process.env["0SEC_KERNEL_QEMU_CACHEKEY"] = artifacts.cacheKey;
+  }
+  let runResult;
+  try {
+    const report = {
+      raw: "",
+      crashType: "unknown",
+      faultingFunction: "unknown",
+      stackFrames: [],
+      reproducer: reproducerBytes.toString("utf-8"),
+      reproducerLanguage,
+      executionAttestationRequest: attestationRequest
+    };
+    const runner = opts.vmRunner ?? runReproducerInKernelVm;
+    runResult = await runner(report);
+    if (sha256File(stagedKernelImage) !== attestationRequest.kernelImageSha256 || sha256File(stagedKernelConfig) !== attestationRequest.kernelConfigSha256) {
+      throw new Error("staged kernel image or config changed during execution");
+    }
+  } catch (err) {
+    writeProofFileReadOnly(dmesgOutPath, `[run_failed] ${err instanceof Error ? err.message : String(err)}
+`);
+    return {
+      status: "run_failed",
+      dmesg_path: dmesgOutPath,
+      build_cache_hit
+    };
+  } finally {
+    process.env["0SEC_KERNEL_QEMU"] = previousEnv.qemu;
+    process.env["0SEC_KERNEL_QEMU_KERNEL"] = previousEnv.kernel;
+    process.env["0SEC_KERNEL_QEMU_DISK"] = previousEnv.disk;
+    process.env["0SEC_KERNEL_QEMU_CONFIG"] = previousEnv.cfg;
+    process.env["0SEC_KERNEL_QEMU_CACHEKEY"] = previousEnv.cacheKey;
+    rmSync(launchDir, { recursive: true, force: true });
+  }
+  const dmesgContent = runResult.dmesg || runResult.output || "";
+  writeProofFileReadOnly(dmesgOutPath, dmesgContent);
+  const dmesgSha256 = createHash("sha256").update(dmesgContent).digest("hex");
+  const cov = runResult.coveragePcs && runResult.coveragePcs.length > 0 ? { coveragePcs: runResult.coveragePcs } : {};
+  let attestationFields = {};
+  if (runResult.executionAttestation) {
+    try {
+      bindKernelExecutionAttestation(runResult.executionAttestation, attestationRequest);
+      const attestationPath = `${dmesgOutPath}.execution-attestation`;
+      const raw = runResult.executionAttestationPath && existsSync(runResult.executionAttestationPath) ? readFileSync(runResult.executionAttestationPath, "utf-8") : serializeKernelExecutionAttestation(runResult.executionAttestation);
+      const parsedRaw = parseKernelExecutionAttestation(raw);
+      bindKernelExecutionAttestation(parsedRaw, attestationRequest);
+      if (serializeKernelExecutionAttestation(parsedRaw) !== serializeKernelExecutionAttestation(runResult.executionAttestation))
+        throw new Error("kernel execution attestation object/raw mismatch");
+      writeProofFileReadOnly(attestationPath, raw);
+      attestationFields = { executionAttestation: parsedRaw, executionAttestationPath: attestationPath, executionAttestationSha256: createHash("sha256").update(raw).digest("hex") };
+    } catch {
+      return { status: "run_failed", dmesg_path: dmesgOutPath, build_cache_hit, ...cov, dmesgSha256 };
+    }
+  } else if (opts.executionIdentity || !opts.vmRunner) {
+    return { status: "run_failed", dmesg_path: dmesgOutPath, build_cache_hit, ...cov, dmesgSha256 };
+  }
+  if (!runResult.compiled || !runResult.executed) {
+    return {
+      status: "run_failed",
+      dmesg_path: dmesgOutPath,
+      build_cache_hit,
+      ...cov,
+      dmesgSha256,
+      ...attestationFields
+    };
+  }
+  if (opts.expectedSignature) {
+    const haystack = dmesgContent.toLowerCase();
+    const needle = opts.expectedSignature.toLowerCase();
+    if (haystack.includes(needle)) {
+      return {
+        status: "reproduced",
+        signature: opts.expectedSignature,
+        dmesg_path: dmesgOutPath,
+        build_cache_hit,
+        ...cov,
+        dmesgSha256,
+        ...attestationFields,
+        ...opts.executionIdentity ? { executionIdentity: opts.executionIdentity } : {}
+      };
+    }
+    const detected2 = detectKernelSignature(dmesgContent);
+    if (detected2) {
+      return {
+        status: "run_failed",
+        signature: detected2,
+        dmesg_path: dmesgOutPath,
+        build_cache_hit,
+        ...cov,
+        dmesgSha256,
+        ...attestationFields
+      };
+    }
+    return {
+      status: "no_signal",
+      dmesg_path: dmesgOutPath,
+      build_cache_hit,
+      ...cov,
+      dmesgSha256,
+      ...attestationFields
+    };
+  }
+  const detected = detectKernelSignature(dmesgContent);
+  if (detected) {
+    return {
+      status: "reproduced",
+      signature: detected,
+      dmesg_path: dmesgOutPath,
+      build_cache_hit,
+      ...cov,
+      dmesgSha256,
+      ...attestationFields
+    };
+  }
+  return {
+    status: "no_signal",
+    dmesg_path: dmesgOutPath,
+    build_cache_hit,
+    ...cov,
+    dmesgSha256,
+    ...attestationFields
+  };
+}
+function serializeKernelExecutionAttestation(r) {
+  return `schema=2
+nonce=${r.nonce}
+reproducer_sha256=${r.reproducerSha256}
+expected_kernel_release=${r.expectedKernelRelease}
+observed_kernel_release=${r.observedKernelRelease}
+boot_id=${r.bootId}
+kernel_image_sha256=${r.kernelImageSha256}
+kernel_config_sha256=${r.kernelConfigSha256}
+ruid=${r.realUid}
+euid=${r.effectiveUid}
+suid=${r.savedUid}
+rgid=${r.realGid}
+egid=${r.effectiveGid}
+sgid=${r.savedGid}
+groups=${r.supplementaryGroups.join(",")}
+cap_inh=${r.inheritableCapabilities}
+cap_prm=${r.permittedCapabilities}
+cap_eff=${r.effectiveCapabilities}
+cap_amb=${r.ambientCapabilities}
+securebits=${r.secureBits}
+userns_max=${r.userNamespaceMax}
+initial_userns=${r.initialUserNamespace ? 1 : 0}
+no_new_privs=${r.noNewPrivileges ? 1 : 0}
+`;
+}
+async function verifyAcrossBoots(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const bootTotal = Math.max(1, opts.boots ?? 3);
+  const minHits = Math.max(1, Math.min(opts.minHits ?? 2, bootTotal));
+  const { boots: _boots, minHits: _minHits, dmesgOutPath, ...baseOpts } = opts;
+  const bootStatuses = [];
+  const bootResults = [];
+  let bootHits = 0;
+  let firstReproduced;
+  let lastResult;
+  for (let i = 0; i < bootTotal; i++) {
+    const perBootDmesg = dmesgOutPath ? i === 0 ? dmesgOutPath : `${dmesgOutPath}.boot-${i + 1}` : void 0;
+    const result = await verifyKernelFinding({
+      ...baseOpts,
+      ...perBootDmesg ? { dmesgOutPath: perBootDmesg } : {}
+    });
+    lastResult = result;
+    bootResults.push(result);
+    bootStatuses.push(result.status);
+    if (result.status === "reproduced") {
+      bootHits++;
+      if (!firstReproduced)
+        firstReproduced = result;
+    }
+    log(`[nboot] boot ${i + 1}/${bootTotal}: ${result.status} (hits=${bootHits}/${minHits} required)`);
+    if (bootHits + (bootTotal - i - 1) < minHits && bootHits < minHits) {
+      log(`[nboot] threshold ${minHits} unreachable \u2014 stopping early`);
+      break;
+    }
+  }
+  let nbootStable = bootHits >= minHits;
+  const winning = firstReproduced ?? lastResult;
+  let aggregateStatus = nbootStable ? "reproduced" : pickWorstStatus(bootStatuses);
+  let manifest = {};
+  const reproduced = bootResults.filter((boot) => boot.status === "reproduced");
+  const provenanceRequired = opts.executionIdentity !== void 0 || opts.vmRunner === void 0;
+  if (nbootStable && provenanceRequired) {
+    const attestations = reproduced.map((boot) => boot.executionAttestation);
+    const first = attestations[0];
+    const complete = reproduced.length >= minHits && first !== void 0 && reproduced.every((boot) => {
+      const receipt = boot.executionAttestation;
+      const identityMatches = !opts.executionIdentity || boot.executionIdentity?.uid === opts.executionIdentity.uid && boot.executionIdentity?.gid === opts.executionIdentity.gid;
+      return receipt?.schemaVersion === 2 && boot.executionAttestationPath && boot.executionAttestationSha256 && boot.dmesgSha256 && identityMatches && receipt.expectedKernelRelease === first.expectedKernelRelease && receipt.observedKernelRelease === first.observedKernelRelease && receipt.kernelImageSha256 === first.kernelImageSha256 && receipt.kernelConfigSha256 === first.kernelConfigSha256;
+    });
+    const bootIds = new Set(attestations.flatMap((receipt) => receipt ? [receipt.bootId] : []));
+    if (!complete || bootIds.size !== reproduced.length) {
+      nbootStable = false;
+      aggregateStatus = "run_failed";
+    }
+  }
+  if (nbootStable && provenanceRequired) {
+    const path = `${dmesgOutPath ?? winning.dmesg_path}.execution-attestations.manifest`;
+    const first = reproduced[0].executionAttestation;
+    const content = JSON.stringify({
+      schemaVersion: 2,
+      expectedKernelRelease: first.expectedKernelRelease,
+      observedKernelRelease: first.observedKernelRelease,
+      kernelImageSha256: first.kernelImageSha256,
+      kernelConfigSha256: first.kernelConfigSha256,
+      ...opts.executionIdentity ? { executionIdentity: opts.executionIdentity } : {},
+      boots: reproduced.map((boot, index) => ({ index: index + 1, bootId: boot.executionAttestation.bootId, receiptSha256: boot.executionAttestationSha256, receiptPath: boot.executionAttestationPath, dmesgSha256: boot.dmesgSha256, dmesgPath: boot.dmesg_path }))
+    }, null, 2) + "\n";
+    writeProofFileReadOnly(path, content);
+    manifest = { executionAttestationManifestPath: path, executionAttestationManifestSha256: createHash("sha256").update(content).digest("hex") };
+  }
+  return {
+    status: aggregateStatus,
+    ...winning.signature ? { signature: winning.signature } : {},
+    dmesg_path: winning.dmesg_path,
+    build_cache_hit: winning.build_cache_hit,
+    bootHits,
+    bootTotal,
+    nbootStable,
+    bootStatuses,
+    bootResults,
+    ...manifest,
+    ...winning.executionIdentity ? { executionIdentity: winning.executionIdentity } : {},
+    ...winning.executionAttestation ? { executionAttestation: winning.executionAttestation, executionAttestationPath: winning.executionAttestationPath, executionAttestationSha256: winning.executionAttestationSha256 } : {}
+  };
+}
+var STATUS_PRECEDENCE = [
+  "build_failed",
+  "run_failed",
+  "no_signal",
+  "reproduced"
+];
+function pickWorstStatus(statuses) {
+  for (const candidate of STATUS_PRECEDENCE) {
+    if (statuses.includes(candidate))
+      return candidate;
+  }
+  return "no_signal";
+}
+
+export {
+  detectOutOfBandModuleLoad,
+  scanHardcodedKernelAddresses,
+  assertBugAttribution,
+  parseKernelExecutionAttestation,
+  bindKernelExecutionAttestation,
+  renderKernelExecutionLauncherSource,
+  RECOGNIZED_CONFIG_PROFILES,
+  buildFlagsForProfile,
+  kcsanConfigSupported,
+  prepareKernelVmArtifacts,
+  loadKernelVmConfigFromEnv,
+  buildKernelAppend,
+  renderRaceWidenModuleSource,
+  renderRealIpiRaceHarness,
+  buildQemuCommand,
+  buildInitramfsKernelAppend,
+  renderInitramfsInitScript,
+  buildWeaponizeInitramfs,
+  buildInitramfsQemuCommand,
+  collectRaceEnv,
+  parseCoveragePcs,
+  runReproducerInKernelVm,
+  defaultDmesgOutPath,
+  writeProofFileReadOnly,
+  verifyKernelFinding,
+  verifyAcrossBoots
+};