One bundle at a time

deterministic-no-model

seed for the auto-merge contract end-to-end, no model spend; sandbox-positive reproducer

anthropic (Patcher); legacy fixture (no reproducer; placeholder file hashes; reclassified from auto-merge 2026-06-15)

clean single-hash patch-release; rule-8 hash-verifiability scorer's cleanest test case

model-attested (Patcher + Reproducer)

small-delta patch on a large package.nix; honest rule-7 deny when no reproducer is feasible

model-attested (Patcher + Reviewer)

blast-radius-exceeds-threshold route on a foundational package

model-attested (Patcher + Reviewer + Reproducer)

retired as v0.1 anchor (DECISIONS 2026-05-19 (latest), F11). kind_reason: shipped-binary-non-discrimination — CWE-674 uncontrolled recursion in ParseMustBeSegmentNzNc. Passed criteria 1–5 cleanly: local-file PoC (upstream issue #282), local binary invocation, fits model-attestation budget, not validation-bypass. Reproducer (sonnet) wrote a v4-clean reproducer.nix using the public PoC (8600 comma-separated 1-byte path segments). But at nixpkgs default optimization (gcc -O2 + hardening), unpatched 0.9.9 does NOT crash — gcc tail-call/sibling-call optimization elides the recursion at compile time. Diagnostic at -O0 -fno-optimize-sibling-calls confirmed: same fixture segfaults; bug is genuinely in source but masked in the artifact. Reproducer remained honest (PREDICATE FAILED at -O2, no signal minted). F11 codifies criterion 6: fix-vs-unfix must be observable at the binary the build sandbox actually produces.

deterministic-no-model

cross-family-pair-unavailable route; PoC-public-but-sandbox-silent class

model-attested (Patcher)

blast-radius-exceeds-threshold on a transitive dependency of almost the entire tree

model-attested (Patcher + Reviewer)

first live Patcher run; reclassified ineligible-cherry-pick-required after Linux cert surfaced a Go-toolchain dependency outside Patcher contract (DECISIONS 2026-05-13)

model-attested (Patcher + Reviewer + Reproducer)

retired as v0.1 anchor after F1–F7 contract slice (DECISIONS 2026-05-17 close). kind_reason: sandbox-poc-requires-network — wget2's metalink CVE PoC needs a fetchable URL, wget2 rejects file:///data: schemes. Six contract findings closed cleanly across six cert dispatches; the framework refused to fake a green result on the seventh (F6). Preserved as evidence of the contract layer working end-to-end.

model-attested (Patcher + Reviewer + Reproducer)

retired as v0.1 anchor — retirement CONFIRMED via cert 2026-06-08 (F8). Originally retired 2026-05-17 on local-probe evidence; resurrected 2026-06-08 to test the asn1Decoding hypothesis. Five cert iterations all failed (runs 27113815061 / 27114316316 / 27114718090 / 27114765271 / 27114961818). cert-5 had two compounding blockers: (a) unpatched 4.20.0 build timed out at 1h10m (outputBin=dev = uncached from-source build with texinfo doc gen); (b) asn1Decoding: could not read Test.OctetTest — the schema/type-reference invocation never reached asn1_expend_octet_string, so SIGNAL_PATCHED was a false positive. Codex peer concurred: outputs=[out] is a build-cost mitigation not proof of reachability; the schema+DER pair that walks the decoder to the off-by-one site is F8 PoC-construction depth beyond model-attestation budget.

model-attested (Patcher + Reviewer + Reproducer)

first model-attested + sandbox-positive + Linux-cert-green auto-merge bundle in the corpus. git-lfs CWE-59 symlink arbitrary-file-write, 3.7.0 → 3.7.1 patch release. Patcher emitted a clean version+hash bump byte-matching nixpkgs commit e839548206c9 (vendorHash unchanged). Reproducer designed a fixture that places a symlink at an LFS-tracked path then runs git lfs checkout. Cert run 26075978701 closed end-to-end green after four iterations (F9/F9b/F9c sandbox-portability lessons codified into Reproducer prompt v4; see DECISIONS 2026-05-19).

model-attested (Patcher + Reviewer + Reproducer)

retired as v0.1 anchor (F10, DECISIONS 2026-05-19). kind_reason: poc-needs-validation-bypass-fixture — first candidate to pass criteria 1–4 and the codex-peer F8-extension shape for generated-SQL PoC (MySQL ORM SQL injection). Reproducer v4 produced the correct shape (real MySQL backend ENGINE, same-substring rule, HOME export). But the unpatched 4.2.24 already rejects naive malicious aliases via an older whitespace/semicolon/comment validation; the CVE-2025-59681 fix STRENGTHENS this validation on the MySQL identifier-quoting path specifically. Sonnet-class model crafted an alias that hit the older check, not the new one. F10 codifies criterion 5: validation-bypass shapes require reading the fix's diff to discover the bypass; out of v0.1 anchor scope.

model-attested (Patcher + Reviewer + Reproducer; v8+v5 era)

third sandbox-positive bundle (Phase 2, first crash-class from the CWE-class targeted search). expat CWE-674 stack overflow via linear entity chain: confirmed SIGSEGV without ASAN. Clean 2.6.4→2.7.0 version-bump; blast-radius-exceeds-threshold route (~4291 reverse-closure deps). Reproduceable crash: 60K-level entity chain → stack exhaustion → SIGSEGV (rc=139). Unlike libxml2 CWE-674 (F11-TCO'd), expat's entity expansion has non-trivial per-frame state preventing gcc TCO. 3 per-bundle fixes (+F18 ulimit). Cert 26348784388 closed end-to-end green (2026-05-25). Reproducer repro_rate=1.0 (5/5 scorers green).

model-attested (Patcher + Reviewer + Reproducer; v7 era)

retired under F8 (PoC construction depth). CWE-190→CWE-787: integer overflow in pdf_load_image_imp causing heap OOB write. Clean 1.27.0→1.27.2. Patcher (opus) byte-clean. Reviewer v2 attestation correct. Reproducer (sonnet v7) 3 per-bundle fixes; predicate false-positived on 'overflow' in PDF filename path rather than actual overflow warning; neither side crashed (both rc=1). Triggering the OOB write requires crafting a valid PDF with specific image dimensions AND a valid FlateDecode stream larger than the overflowed allocation — F8 depth.

model-attested (Patcher + Reviewer + Reproducer; v7+v5 era)

retired as v0.1 anchor under F11 (shipped-binary-non-discrimination). CWE-416 use-after-free WRITE via Atomics.store + rab.resize(0). quickjs-ng 0.11.0→0.12.0 clean version-bump. Patcher (opus) clean. Reviewer v2 attestation correct (attestation_grounded=True). Reproducer (sonnet v7+v5) used bundle-local PoC (10-line JS from upstream issue #1301). UAF is real (ASAN: heap-use-after-free WRITE of 4 bytes) but silent at default optimization: glibc allocator keeps freed pages mapped, atomic_store succeeds silently (rc=0). Third F11/F17 instance. Pattern confirmed: glibc free-list masks UAF writes without ASAN.

model-attested (Patcher + Reviewer) + F21b ASAN cert-green (2026-06-08)

CWE-121 stack-buffer-overflow in proxy_from_string() via proxychains.conf. First model-attested bundle with overlay (fetchpatch) patch shape. F21b: at -O2 the stack overflow was silent (rc=1). Fixed with ASAN instrumentation (NIX_CFLAGS_COMPILE=-fsanitize=address -O0, ASAN rc=42). Cert-3 27114386295 GREEN 2026-06-08 — both SIGNALs verified, host.system=x86_64-linux. bundle_id=4b59647439510f55.

model-attested (Patcher + Reviewer + Reproducer; v6 era; reproducer.nix updated by trace agent 2026-05-26)

definitively retired (F22) (DECISIONS 2026-05-26). F21-class ASAN applied but cert 26455695210 failed: (1) patch-apply-failed — Builder resolver cannot find libpng's package dir at nixpkgs_rev 3ab61cef9c... (predates pkgs/by-name/ migration for libpng); (2) ASAN compile timeout — unpatched libpng 1.6.51 from source under ASAN elapsed 3600.012s, exceeding the Builder's hard limit. Both are infrastructure limits orthogonal to reproducer quality. Re-harvest if Builder timeout becomes configurable or a newer nixpkgs rev used.

model-attested (Patcher + Reviewer + Reproducer; v5 era)

second sandbox-positive bundle in the corpus under the major-version-jump route. assimp CSMImporter NULL pointer dereference (CWE-125), 5.4.3 → 6.0.2 major-jump. Patcher (opus) clean version+hash bump matching nixpkgs e2d2b2c0247c. Reviewer (sonnet) accept with correct cross-family attestation. Reproducer initial cert was deterministic (v4 didn't surface bundle-local PoCs); re-cert under v5 promoted provenance to model-authored. Cert runs: 26082525133 (deterministic, 2026-05-19 morning) and 26085849172 (model-authored under v5, 2026-05-19 afternoon). Both green end-to-end. Raises sandbox-positive count to N=2 AND model-authored Reproducer count to N=2 (git-lfs + assimp). Two v6-grade prompt findings filed in expect.json: precondition gating crash signal; ||true capture-pattern masks SIGSEGV exit code.

model-attested (Patcher + Reviewer + Reproducer; v8 era)

retired as v0.1 anchor under F8b-concurrency (DECISIONS 2026-05-24). kind_reason: poc-construction-exceeds-anchor-depth. CVE labelled CWE-476 but the actual crash is a concurrency race condition (use-after-free at address 0x000000000080 in ucompthread/clear_rulist). Upstream issue #263 confirms ASAN delays required to widen the race window. Patcher (opus) + Reviewer (sonnet) both clean: 0.651→0.660 version-bump, accept verdict. Reproducer (sonnet v8) generated a LRZI-magic + zeros file and predicted rc=139; local probe showed rc=1 ("Unexpected initial tag") on both versions — crafted file fails pre-thread at stream initialization. Cert dispatch skipped. New F8b-concurrency sub-class codified: CWE-476 CVEs where upstream issue describes concurrency/race conditions are NOT reliably sandbox-positive without ASAN instrumentation.

model-attested (Patcher + Reviewer; Reproducer hand-edited) — anthropic (opus + sonnet)

Phase 2 first sandbox-positive anchor (CWE-191 integer underflow → stack buffer underwrite in depack_pha() Pha Packer .mod loader; 4.6.3 fix). Patcher v2 (opus) emitted clean version-bump-only patch. Reviewer (sonnet) accepted with correct cross-family attestation. Drove F19 (preamble) + F21 (GCC 14 absorbs underwrite; ASAN required) codification. Cert-5 26387003737 GREEN 2026-05-25.

model-attested (Patcher + Reviewer + Reproducer) — anthropic (opus + sonnet) \

Phase 2 N=3 sandbox-positive anchor — version-bump, ASAN + 1000-double fixture, F21-class cert-green | Phase 2 N=3 anchor. CVE-2025-2337 + CVE-2025-2338 co-fixed in matio 1.5.29. ASAN-instrumented unpatched build (NIX_CFLAGS_COMPILE=-fsanitize=address); strdup_vprintf stack-buffer-overflow rc=42 on 1000-double fixture. Patched 1.5.29 handles truncated real-data gracefully rc=0. Cert 26440903201 GREEN 2026-05-26.

anthropic-opus (Patcher b57809e1) + anthropic-sonnet (Reviewer af4c095f); Reproducer hand-written

Phase 3 first cert-green. CWE-416/CWE-122 heap-buffer-overflow in quant_fsdither() Floyd-Steinberg dithering loop off-by-one in libtiff 4.7.0 tiffmedian. Clean 4.7.0→4.7.1 patch-release. F21-class ASAN (OOB read silent at -O2; ASAN rc=42). Cert-5 26647927663 GREEN 2026-05-29. bundle_id=17395c9ca585298a.

model-attested (Patcher + Reviewer + Reproducer) — anthropic (opus + sonnet)

Phase 2 N=2 sandbox-positive anchor — overlay (fetchpatch) patch shape, cert-green. CWE-119/CWE-843 type confusion in mp_import_all(): micropython 1.27.0 crashes (SIGSEGV rc=139) when a non-module object is in sys.modules and from x import * is used. nixpkgs fix is a fetchpatch overlay on 1.27.0; v1.28.0 did not exist at nixpkgs_rev. First cert-proven overlay-patch-shape bundle. Cert 26432528586 GREEN 2026-05-26.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 2. CWE-276 insufficient validation of TCP NOTIFY messages in pdns-recursor <5.2.7. Fix backport commit 6f6d02b1f8fa. Clean 5.2.6→5.2.7 patch-release. auto-merge eligible: blast_radius<50, DoS class. cargoDeps.hash unchanged. bundle_id=4df2f49907f4605d. Cert-3 green (run 27211911961 2026-06-09). Steward-signed (run 27213382696 2026-06-09). bundle.sig committed. Fork PR #1 opened 2026-06-09.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 3. CWE-266 privilege escalation via unix domain socket forwardings in Dropbear SSH <2025.89. Clean 2025.88→2025.89 version+sha256 bump. Reproducer refused (config-sensitive — multi-user privilege boundary, no sandbox PoC). bundle_id=6109742966258304. Cert-1 green (run 27230873481 2026-06-09). Steward-signed (run 27231101420 2026-06-09). bundle.sig committed. Fork PR #2 opened 2026-06-09.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 4. CWE-426 untrusted search path in auth_query in PgBouncer <1.25.1. 1.24.1→1.25.1 version+hash bump + python3+pandoc added to nativeBuildInputs (build-time doc gen). Reproducer refused (config-sensitive — search-path hijack requires controlled connection strings + writable Nix store, both forbidden). bundle_id=103c479e248ad317. Cert-1 green (run 27230875037 2026-06-09). Steward-signed (run 27231102828 2026-06-09). bundle.sig committed. Fork PR #3 opened 2026-06-09.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 5. CWE-20 unauthenticated persistent DoS via array injection in adminer PHP web UI <5.4.2. Clean 5.4.1→5.4.2 version+hash bump. Leaf package, blast_radius=1. Reproducer refused (HTTP-layer DoS — sandbox cannot run web server accepting inbound connections). bundle_id=5a959136e5024713. Cert-2 green (run 27232606156 2026-06-09). Steward-signed (run 27232858290 2026-06-09). bundle.sig committed. Fork PR #4 opened 2026-06-09.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 6. CWE-1333 ReDoS in ETag header value generation in Sinatra <4.2.1. Clean 4.1.1→4.2.1 version+sha256 bump (nix base32). attr_path=rubyPackages.sinatra — gem stanza in pkgs/top-level/ruby-packages.nix (not pkgs/by-name). Reproducer refused (ReDoS timing non-deterministic in Nix sandbox). Reviewer accept, cross-family attestation honored. bundle_id=1c964b18edd45915. Cert-3 green (run 27234519613 2026-06-09). Steward-2-signed (run 27235385184 2026-06-10). bundle.sig committed. rekor_log_index=1770390756. Fork PR #5 opened 2026-06-10 (trace pr Phase 4 gap closed — nix-instantiate fallback for rubyPackages.*).

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 9. CWE-362/CWE-416 race+UAF in RDPGFX ResetGraphics (SDL client) in FreeRDP <3.20.1. Clean 3.20.0&rarr;3.20.2 version+sha256 (fetchFromGitHub) bump; co-fixes 9 CVEs. Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. Reproducer refused (rule 3 &mdash; RDP-session UAF needs full interactive client+server + SDL render thread + a non-deterministic thread race; sandbox is offline/headless). Fresh family (RDP). bundle_id=02c539ad95ca3a65. Cert green (run 27259273291). Steward-signed (run 27259405156). rekor_log_index=1776302526. Fork PR #7 opened 2026-06-10.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-positive

N=20 exporter-milestone batch, bundle 10. CWE-835 WebSocket endless-loop DoS in libcurl <8.14.1. Clean 8.14.0→8.14.1 version+sha256 bump; the Patcher also correctly removed the now-obsolete fix-add_handle-resizing.patch backport (in-file comment: 'Remove with 8.14.1'). Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. bundle_kind=human-review-required because curl is foundational (reverse_closure>5000; bootstraps fetchurl; git/nix/systemd/cmake/python3 downstream). Reviewer-positive human-review member like systemd/openssl_3/gnutls — no cert/Steward-sign/fork-PR. Fresh family (curl). bundle_id=0f611c82262644f2.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-positive

N=20 exporter-milestone batch, bundle 11. CWE-203 non-constant-time/side-channel (Xtensa ESP32) in wolfSSL <5.8.4. Clean 5.8.2→5.8.4 version+sha256 (fetchFromGitHub) bump; co-fixes 8 CVEs (skips 5.8.3). Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. bundle_kind=human-review-required via the ambiguous-changelog trigger (eligible-requires-human-review) — a *third distinct* human-review reason in the corpus (vs blast-radius for gnutls/curl, major-version-jump for uriparser); reverse_closure~63 < 500. Reviewer-positive; no cert/Steward-sign/fork-PR. Fresh family (wolfssl, embedded TLS). bundle_id=8710c88ee94ca1ef.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-positive

N=20 exporter-milestone batch, bundle 12. CWE-125 out-of-bounds read / uninitialized-heap disclosure in PHP getimagesize() (<8.4.16). Clean 8.4.15→8.4.16 version+sha256 bump (pinned in php/8.4.nix); co-fixes 4 CVEs. Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. bundle_kind=human-review-required (blast-radius: php84 reverse_closure~3914 — nextcloud/wordpress/matomo). Reviewer-positive; no cert/Steward-sign/fork-PR. Fresh family (PHP interpreter). bundle_id=f0744853d5cfa2f3.

source-backport (experimental hard-cell) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

FIRST agent-authored source patch in the corpus. CWE-191 signed-integer underflow in libxmp depack_pha(). Instead of bumping 4.6.2→4.6.3, the Patcher AUTHORS the upstream fix (commit 004a102c5a: k = paddr[0] → k = 0) as an in-tree CVE-2025-47256.patch + a package.nix patches=[] wiring (version/src.hash unchanged), under patch_strategy=source-backport with upstream-fix.patch supplied as ground truth. Reviewer (given the ground truth) verified the authored patch transcribes it character-for-character and is minimal → accept, merge_ready_rate=1.0. CI cert GREEN (run 27319232041): Builder applied the agent-authored backport (git apply --recount), built 4.6.2+backport, reproducer red→green (SIGNAL_UNPATCHED: ASAN abort rc=42 on prowizard_pha_invalid_ocpt; SIGNAL_PATCHED: xmp_load_module exited cleanly). Experimental/human-review until the contract has multiple successes. bundle_id=c0b3098af28cd175.

source-backport (experimental hard-cell #2) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

Second agent-authored source patch. CWE-121 stack-buffer-overflow in proxychains-ng proxy_from_string() (the >255 user/pass bounds check was gated behind RS_PT_SOCKS5, so HTTP proxies overflowed). The Patcher AUTHORS the upstream fix (commit cc005b713281: remove the RS_PT_SOCKS5 && gate) as an in-tree CVE-2025-34451.patch and appends it to the existing patches = [ ... ] list (vs libxmp creating a new one), version unchanged. Reviewer (given ground truth) verified character-for-character + minimal → accept, mrr=1.0. Distinct crash class (stack overflow) + fix shape (remove a condition) from libxmp. CI cert GREEN (run 27319007681 2026-06-11): Builder applied the agent-authored backport, built 4.17+backport, reproducer red→green (SIGNAL_UNPATCHED: ASAN stack-overflow abort; SIGNAL_PATCHED: parser rejected the overlong credential). First source-backport to pass a full CI cert — the agent-authored source fix is cert-proven to fix the bug. bundle_id=0ba94327c8f65b42.

source-backport (experimental hard-cell #3, tracker-harvested) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

Third agent-authored source patch — FIRST harvested fresh from the nixpkgs security tracker bot (issue NIXPKGS-2026-1788 / GH #526338). CWE-787 off-by-one OOB write in bzip2 bzip2recover.c (>= BZ_MAX_HANDLED_BLOCKS fires one iteration too late, over-writing the global bStart arrays). No fixed release exists (fix is a post-1.0.8 repo patch) so a version bump is impossible — backport is the genuine *only* path. Patcher AUTHORS the upstream fix (commit 35d122a3: >= BZ_MAX_HANDLED_BLOCKS - 1) as CVE-2026-42250.patch + appends it to the old-style default.nix patches list (instructed via verdict_reason; honored). Reviewer verified character-for-character + minimal → accept, mrr=1.0. CI cert GREEN (run 27325523398): Builder applied the agent-authored backport, built bzip2 1.0.8+backport, reproducer red→green (SIGNAL_UNPATCHED: ASAN global-buffer-overflow past bStart; SIGNAL_PATCHED: bzip2recover refused >BZ_MAX_HANDLED_BLOCKS, no OOB). Distinct domain (compression), crash class (global-buffer-overflow), fix shape (tighten an off-by-one), package style (default.nix, patchFlags=-p0), AND no-fixed-release (backport is the only path). Re-cert 2026-06-20 (patches-only reproducer after kind corrected to human-review-required): SIGNAL_UNPATCHED+PATCHED confirmed, patched_build=succeeded. bundle_id=11f2dfc00685049f. VALIDATED.

source-backport (experimental hard-cell #4, fully tool-assisted) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

Fourth agent-authored source patch — FIRST built with the full automation: trace backport-patch auto-generated upstream-fix.patch (verified vs the 1.3.14 tarball) and trace backport-fixtures auto-extracted the reproducer oracle (the malicious underflow.ttf co-landed with the fix). CWE-191/125 integer-underflow/OOB-read in graphite2's Graphite VM slotat(). Patcher AUTHORS the upstream bounds-check (commit ad78c6b7) as CVE-2026-50593.patch + appends it to the old-style graphite2.nix patches list (with an ++ lib.optionals continuation). Reviewer verified character-for-character → accept, mrr=1.0. CI cert GREEN (run 27382873639): Builder applied the agent-authored backport, built 1.3.14+backport, reproducer red→green (SIGNAL_UNPATCHED: slotat OOB read rc=42 on underflow.ttf; SIGNAL_PATCHED: bounds-check rejected the malformed font, no OOB). First fully tool-assisted source-backport (auto patch + auto oracle). Distinct: OOB-read class, font-shaping domain, graphite2.nix package shape. bundle_id=444b06915b81d937.

source-backport (experimental hard-cell #5, first FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Fifth agent-authored source patch — FIRST surfaced by the new eval/harvest_source_backports.py harvester (scans nixpkgs history for CVE-patch-adding commits; the abundant source-backport vein). CWE-522 netrc credential leak in python-requests: get_netrc_auth() derived the netrc host as ri.netloc.split(':')[0], so a URL http://victim:x@attacker/ leaks victim's netrc credentials to attacker. Patcher AUTHORS the upstream fix (commit 57acb7c: host = ri.hostname) as CVE-2024-47081.patch + appends it to the old-style default.nix patches list, version 2.32.3 + src.hash unchanged. Drove reviewer.v3: reviewer.v2 rejected this twice by misapplying rule-8 hash-grounding to the authored in-tree .patch (it is not fetched) — reviewer.v3 adds the source-backport carve-out (check-0 functional equivalence + hash-grounding N/A for authored patches); Reviewer (v3) then accept. Discriminating reproducer (pure-Python, no network/no ASAN): netrc with victim.example creds; get_netrc_auth("http://victim.example:[email protected]/") → unpatched returns victim creds (SIGNAL_UNPATCHED), patched returns None (SIGNAL_PATCHED), with a benign-host control precondition. Distinct: credential-leak class (not memory), pure-Python (light cert), logic fix. CI cert GREEN (run 27575225454): Builder applied the agent-authored backport via the new direct-package-dir apply mode (legacy default.nix package), built requests 2.32.3+backport, reproducer red→green (SIGNAL_UNPATCHED: get_netrc_auth leaked victim creds to attacker host; SIGNAL_PATCHED: ri.hostname lookup, no leak). First fresh-harvested VALIDATED source-backport (drove reviewer.v3 + the Builder direct-apply fix). bundle_id=9f243f0ee1f527ff.

source-backport, reviewer-attested — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5); reviewer-positive

First reviewer-attested source-backport — the fix is validated by Reviewer attestation, NOT by a behavioral reproducer. CWE-125 1-byte heap OOB read in libarchive tar_atol_base_n() (digit = *++p reads one past the field before the char_cnt--/check). No fixed release (fix merged post-3.8.8), so backport is the only path; pre-fix base 3.8.7. Patcher AUTHORS the upstream fix (commit c161620: restructure the digit loop to while (char_cnt != 0) { read; check; p++; char_cnt--; }) as CVE-2026-15028.patch + a package.nix patches=[] wiring, version/src.hash unchanged; the C hunk is byte-identical to upstream-fix.patch. Reviewer (given ground truth) verified transcription + minimality → accept, attestation_grounded=true, cross-family (Opus Patcher / Sonnet Reviewer). Reproducer REFUSES (analyst-authored reproducer-refusal.json, rule 8): shipped-binary-non-discrimination. A source-reachability analysis of libarchive 3.8.7 shows the stray read lands on an allocated trailing byte in EVERY reachable reader path (PAX values NUL-terminated via read_bytes_to_string size+1; ustar fields inside the 512-byte header block; GNU-sparse/SUN.holesdata delimiter-terminated), so no crafted tar can trip ASAN — upstream fixed it defensively at the function-contract level (OSS-Fuzz observes it only via an exactly-bounded buffer). finding.json corrected to drop the false crafted-tar claim; non-viable model reproducer attempts preserved under .reproducer-failures/. bundle_id=1c4ef238c7b5bc98. RETIRED (base mismatch; DECISIONS 2026-07-27). Cert FAILED (run 30239437854) at nix patchPhase (Hunk #1 FAILED at 3517): the upstream fix c161620 rewrote tar_atol_base_n() to use archive_ckd_mul_i64/archive_ckd_add_i64, helpers absent from nixpkgs-pinned libarchive 3.8.7 (ARCHIVE_VERSION_NUMBER 3008007, still the l>limit overflow check), so the verbatim upstream patch cannot apply to the pinned source. A correct backport needs a genuine semantic adaptation to 3.8.7's code, which the current pipeline cannot produce (Patcher is blind to the affected .c source; Reviewer grades byte transcription, not semantic equivalence) — a separate capability arc, disproportionate to one bundle. Kept as a documented non-viable example; c161620 unchanged as authoritative reference. Separately, the OOB is shipped-binary-non-discrimination (in-bounds through every reachable reader path), so no behavioral reproducer exists regardless (analyst reproducer-refusal.json, rule 8). NOT cert-green, not signed.

source-backport (experimental hard-cell #6, second FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Sixth agent-authored source patch — second surfaced by eval/harvest_source_backports.py. CWE-22 directory-traversal / arbitrary-file disclosure in the Sanic web framework's static route: _static_request_handler() checked the literal "../" substring on the still-URL-encoded uri, so an encoded ..%2F… slipped past, and the residual startswith guard is prefix-only (a served /srv/static escapes to the sibling /srv/static-secret/…). Patcher AUTHORS the upstream fix (commits 9d415e4 + 2fa28f1: URL-decode first, then reject any path segment containing .. or an embedded os.sep) as CVE-2022-35920.patch + ADDS a new patches = [ … ]; attribute to the old-style default.nix (this package had no existing patches list — distinct from requests' append), version 22.3.2 + src.hash unchanged. Reviewer (v3) accept: check-0 byte-identical to upstream-fix.patch ground truth, check-2 source-backport hash-grounding carve-out, cross-family attestation honored. Discriminating reproducer (pure-Python, no server/socket, no ASAN): drives _static_request_handler directly with __file_uri__="..%2Fsrv-secret%2Fpasswd" against a static route serving <work>/srv; unpatched serves the out-of-root SIBLING secret (SIGNAL_UNPATCHED), patched raises InvalidUsage (SIGNAL_PATCHED), with an in-root control precondition; sanic's flaky checkPhase disabled via doCheck=false. CI cert GREEN (run 27577107087): Builder applied via direct-package-dir mode, built sanic 22.3.2+backport, reproducer red→green, host x86_64-linux. Second fresh-harvested VALIDATED source-backport. Distinct: path-traversal class, web-framework domain, new-patches-attribute fix shape, direct-method (no-server) reproducer. bundle_id=9de765cb36399834. Steward CI-signed 2026-09-05 (rekor). Fork review PR #29 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell, fourth FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-863 authorization bypass in the SQLite shell's --safe mode: safeModeAuth() compared zA1 (the function name for SQLITE_FUNCTION events is in zA2) against the prohibited-function list, so writefile/readfile/edit/load_extension ran unimpeded under --safe. Harvested from nixpkgs fix commit e07df68 (pre-fix rev 70253b9). Patcher AUTHORS CVE-2022-46908.patch (zA1→zA2 + UNUSED_PARAMETER swap) + ADDS patches = [ ./CVE-2022-46908.patch ]; to the old-style default.nix (no existing patches list). Reviewer accept, cross-family attestation. Discriminating reproducer (no network, no ASAN): sqlite3 --safe :memory: 'SELECT writefile(pwn,PWNED)'; unpatched writes the file (bypass), patched errors "cannot use writefile() in safe mode". Cert 2026-06-21: patches-only reproducer; re-cert run 27883686180 (10800s) — unpatched 8196s succeeded, patched 0.6s succeeded, patched_build 82s succeeded. Both signals confirmed. bundle_id=7ed14dac4760706f. VALIDATED. Steward CI-signed 2026-09-05 (rekor). Fork review PR #30 opened 2026-09-05 (draft, no version bump).

source-backport (experimental) — anthropic (Patcher claude-opus-4-8 + Reviewer claude-sonnet-4-6)

CWE-297 improper validation of certificate with host mismatch in litestream 0.3.13 SFTP replica client: ssh.InsecureIgnoreHostKey() used unconditionally. Patcher AUTHORS fix-cve-2024-41254.patch adding HostKeyPath field to ReplicaConfig/ReplicaClient + conditional ssh.FixedHostKey() (3 hunks across cmd/litestream/main.go + sftp/replica_client.go), byte-identical to upstream-fix.patch. Reviewer (sonnet-4-6) accept; cross-family attestation honored. Discriminating reproducer (source-inspection, no network, no ASAN): pkgs.applyPatches on litestream 0.3.13 src + grep — unpatched: HostKeyPath absent from sftp/replica_client.go (SIGNAL_UNPATCHED); patched: HostKeyPath + ssh.FixedHostKey present (SIGNAL_PATCHED). Hard-cell: SFTP host-key verification requires live SSH server; source-inspection is the discriminator. bundle_id=dd5ebdbd2240878b. Reproducer proven (cert-3 run 27895316696); counted as human-review-required accepted.

source-backport (experimental hard-cell #7, third FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Seventh agent-authored source patch — third surfaced by eval/harvest_source_backports.py. CWE-79 reflected XSS in Twisted's web redirect helper: twisted.web.util.redirectTo (src/twisted/web/_template_util.py) interpolated the caller-supplied URL into the redirect HTML (<meta … content="0;URL=%(url)s"> / <a href="%(url)s">) without HTML-escaping — the source even carried a # FIXME: The URL should be HTML-escaped. marker — so https://…/"><script>…</script> injects a live script. The nixpkgs commit fixed two CVEs (41671 HTTP-parsing + 41810 XSS); this bundle backports only 41810. Patcher AUTHORS the upstream fix (commit 6df3fd0: b"url": escape(URL.decode("utf-8")).encode("utf-8"), escape already imported) as CVE-2024-41810.patch + appends it to the EXISTING patches = [ … ]; list (which already held one fetchpatch entry), version 24.3.0 + src.hash unchanged. Reviewer (v3) accept: check-0 functional equivalence vs upstream-fix.patch, check-2 carve-out, cross-family attestation honored. Discriminating reproducer (pure-Python, no server/socket, no ASAN): redirectTo(payload, fake_request) is called directly (the fake request only needs no-op setHeader/redirect); unpatched returns HTML with the raw <script> (SIGNAL_UNPATCHED), patched returns it escaped as <script> (SIGNAL_PATCHED), with a benign-URL control. twisted's large checkPhase disabled via doCheck=false. CI cert GREEN (run 27578570623): Builder applied via direct-package-dir mode, built twisted 24.3.0+backport, reproducer red→green, host x86_64-linux. Third fresh-harvested VALIDATED source-backport. Distinct: reflected-XSS class, standalone-bytes-function reproducer, single-CVE-of-a-two-CVE-commit backport. (No authoring-example.json: the upstream merge-from-fork sha is not fetchable from twisted main, so the authoring exporter skips it — cert/validation unaffected.) bundle_id=93a21ab0eb9b17db. Steward CI-signed 2026-09-05 (rekor). Fork review PR #31 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #8, first perlPackages) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Eighth agent-authored source patch — FIRST perlPackages backport, and the proof of the new Builder split-package-perl-modules apply mode. CWE-78/CWE-73 2-argument open() injection in File::Find::Rule (<=0.34): grep() opened each matched file with open FILE, $_ (2-arg, $_=basename), so a file whose basename is >HACKED or cmd| yields arbitrary file write / command execution. Patcher AUTHORS the upstream fix (3-arg open FILE, '<', $_) as pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch + adds a patches = [ ... ]; attr to the FileFindRule entry in the monolithic pkgs/top-level/perl-packages.nix; version 0.34 + src.hash unchanged. Because the patch spans two dirs (registry + payload), it cannot pass the single-dir containment guard — the new split-package-perl-modules Builder mode (allowlist = perl-packages.nix wiring + perl-modules/*.patch, applied at repo root) handles exactly this shape. Reviewer accept (check-0 byte-identical to upstream-fix.patch, check-2 carve-out). Discriminating reproducer (pure-Perl, no network, no ASAN): a search dir with a benign needle file (control) + an evil >HACKED-named file; File::Find::Rule->file->grep(qr/needle/)->in(dir) opens each file — unpatched creates HACKED via 2-arg open (SIGNAL_UNPATCHED), patched reads it literally (SIGNAL_PATCHED). CI cert GREEN (run 27592813880, ~2min): apply_mode=split-package-perl-modules, host x86_64-linux. First perlPackages VALIDATED source-backport; proves the new apply mode AND the light-build fast-cert profile (pure-Perl on cached perl certs in ~2min, vs the multi-hour cold C/interpreter builds). bundle_id=c62cf1a5495c6c15. Steward CI-signed 2026-09-05 (rekor). Fork review PR #27 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #9, FIRST DoS-class) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Ninth agent-authored source patch — FIRST DoS-class source-backport in the corpus, and the first runner-speed-independent RATIO discriminator. CWE-407 algorithmic-complexity DoS in python-multipart 0.0.22: MultipartParser.write() walked CR/LF runs one unit at a time in two states — START (leading-newline preamble, i += 1 per byte) and END (epilogue after the closing boundary, i += 2; continue per CRLF pair) — so a multi-megabyte CRLF preamble/epilogue forces an O(N) loop and pins CPU from a small compressible body (any Starlette/FastAPI form endpoint). Patcher AUTHORS the combined upstream fix (START jumps via data.find(b"-", i) from commit 6a7b76dd, END discards the epilogue in O(1) via i = length; break from commit d4452a78) as CVE-2026-40347.patch with BOTH hunks against python_multipart/multipart.py + ADDS a new patches = [ ./CVE-2026-40347.patch ]; attribute to the old-style default.nix (src=fetchFromGitHub, no existing patches list); version 0.0.22 + src.hash unchanged. Reviewer (v3) accept: check-0 byte-identical to upstream-fix.patch ground truth (both hunks), check-2 source-backport carve-out, cross-family attestation honored. Discriminating reproducer (pure-Python, no network, no ASAN, runner-speed-independent): time-parse a SMALL (100k CRLF) vs LARGE (8M CRLF, 80×) epilogue on the same host and take the ratio large/small — unpatched scales linearly (ratio ≥ 20, observed ~85), patched is O(1) (ratio ≤ 8, observed ~1.8), with a normal-body control extracting the part data hello in both states. The ratio (not an absolute timeout) is the discriminator, so it is insensitive to cert-runner speed/noise. CI cert GREEN (run 27628439382): Builder applied via direct-package-dir mode, built python-multipart 0.0.22+backport, reproducer red→green (SIGNAL_UNPATCHED ratio 75.4 ≥ 20 / SIGNAL_PATCHED O(1) ≤ 8), patched_build succeeded, host x86_64-linux. The first cert attempt (27627492061) exposed a Builder gap — _ATTR_SAFE_RE rejected the hyphen in python3Packages.python-multipart before resolution; fixed by allowing hyphens in the attr-path gate (the reproducer ran correctly even then). Distinct: first DoS class, first algorithmic-complexity oracle, first ratio-based reproducer, two-hunk fix, and the bug that surfaced the hyphenated-attr resolver fix. bundle_id=f55740715c89ba6d.

source-backport (experimental hard-cell #10, FIRST ASAN-class fresh-harvested) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Tenth agent-authored source patch — FIRST ASAN-class C-library backport from the nixpkgs-history harvester, opening the next vein (memory-safety C bugs). CWE-125 heap-buffer-overflow / OOB read in giflib 5.2.2's gif2rgb utility: DumpScreen2RGB() indexed ColorMap->Colors[GifRow[j]] with no check that the decoded pixel index GifRow[j] is < ColorMap->ColorCount, so a GIF whose raster carries an out-of-palette index reads past the palette allocation. No giflib release carries the fix (distro/OpenMandriva patch) → backport is the only path. Patcher AUTHORS the bounds-check (if (GifRow[j] >= ColorMap->ColorCount) { GIF_EXIT(GifErrorString(D_GIF_ERR_IMAGE_DEFECT)); } before the Colors[] index) as CVE-2025-31344.patch (inner gif2rgb.c, byte-identical to upstream-fix.patch) + APPENDS it to the existing by-name package.nix patches list; version 5.2.2 + src.hash unchanged. Reviewer (v3) accept: check-0 functional match, check-2 carve-out, cross-family attestation honored. Discriminating reproducer (ASAN, no network): both variants built with -fsanitize=address + hardeningDisable=all (proxychains-ng/graphite2 recipe); the package's own gif2rgb runs on two hand-crafted GIF89a fixtures — evil.gif (2-colour palette, LZW literal 3 → pixel index 3 ≥ ColorCount 2 = out of palette) and benign.gif (index 1, the control). Unpatched fires SIGNAL_UNPATCHED (ASAN heap-buffer-overflow READ at DumpScreen2RGB gif2rgb.c:333, rc=42), patched fires SIGNAL_PATCHED (GIF_EXIT "Image is defective", no ASAN, rc=253), benign control decodes rc=0 in both states. CI cert GREEN (run 27629610529): Builder applied via by-name-package-nix mode, built giflib 5.2.2+backport with ASAN, reproducer red→green, patched_build succeeded, host x86_64-linux. Distinct: first ASAN-class fresh-harvested, image-decode domain, by-name --directory apply, hand-crafted GIF oracle. bundle_id=678893d562c11ba0. Steward CI-signed 2026-09-05 (rekor). Fork review PR #33 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #11, second ASAN-class) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Eleventh agent-authored source patch — second ASAN-class C backport (giflib → jq), same recipe, no fixture files (inline jq filter oracle). CWE-125 heap-buffer-overflow / OOB read in jq 1.7.1: jvp_string_empty_new() (src/jv.c) memset the empty string's data region but never wrote the trailing NUL (s->data[length] = 0), so reading the empty string ran past the allocation. The jq program 0[[]|implode] builds the empty string ([]|implode) and indexes with it → OOB. An earlier incomplete fix (commit dc849e9bb74a) handled only 0[""*0]; the full fix jqlang/jq d73a79035e1d adds the one line. Patcher AUTHORS 0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch (inner src/jv.c, byte-identical to upstream-fix.patch) + APPENDS it to the by-name package.nix numbered patch series (0001..0004 → 0005); version 1.7.1 + src.hash unchanged. Reviewer (v3) accept. Discriminating reproducer (ASAN, no network, no fixture files — inline filter): both variants built with -fsanitize=address + hardeningDisable=all; the package's own jq runs 0[[]|implode] — unpatched fires SIGNAL_UNPATCHED (ASAN heap-buffer-overflow READ in jvp_string_empty_new, rc=42), patched fires SIGNAL_PATCHED (clean jq error "Cannot index number with string \"\"", no ASAN, rc=5), with a 1+1→2 control that succeeds rc=0 in both states. CI cert GREEN (run 27630531250): Builder applied via by-name-package-nix mode, built jq 1.7.1+backport with ASAN, reproducer red→green, patched_build succeeded, host x86_64-linux. Distinct: second ASAN-class, inline-filter oracle (no crafted fixture), numbered-patch-series append. bundle_id=3434890336b654e2. Steward CI-signed 2026-09-05 (rekor). Fork review PR #34 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #12, third ASAN-class) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Twelfth agent-authored source patch — third ASAN-class C backport, FIRST non-by-name (direct-package-dir) ASAN bundle and first with the PoC lifted verbatim from upstream NEWS. CWE-127 heap-buffer-overflow / OOB read in GNU coreutils 9.7 sort: begfield()/limfield() (src/sort.c) advanced the field pointer with ptr = MIN(lim, ptr + schar); a key character offset near SIZE_MAX overflows the ptr + schar add so MIN fails to clamp to lim, and a later key comparison reads outside the line buffer. PoC (coreutils NEWS): sort +0.18446744073709551615R input. Patcher AUTHORS the bounded-advance fix (remaining_bytes = lim - ptr; if (schar < remaining_bytes) ptr += schar; else ptr = lim;) for BOTH begfield and limfield as CVE-2025-5278.patch (inner src/sort.c, byte-identical to upstream-fix.patch) + ADDS a new patches = [ ./CVE-2025-5278.patch ]; attribute to the non-by-name default.nix; version 9.7 + src.hash unchanged. Reviewer (v3) accept. Discriminating reproducer (ASAN, no network, no fixture files — inline sort PoC): coreutils uses __structuredAttrs, so ASAN flags merge into env (with ASAN_OPTIONS=detect_leaks=0 at BUILD time, since make install runs the instrumented binaries); the package's own sort runs +0.18446744073709551615R — unpatched fires SIGNAL_UNPATCHED (ASAN heap-buffer-overflow READ via compare_random/keycompare on the over-advanced field pointer, rc=42), patched fires SIGNAL_PATCHED (bounded advance, sort completes, no ASAN, rc=0), with a sort 3,1,2→1,2,3 control that succeeds rc=0 in both states. CI cert GREEN (run 27634260586): Builder applied via direct-package-dir mode, built coreutils 9.7+backport with ASAN, reproducer red→green, patched_build succeeded, host x86_64-linux. Distinct: third ASAN-class, non-by-name direct-package-dir apply, structuredAttrs ASAN env, upstream-NEWS PoC. bundle_id=e687a485288807f5.

source-backport (experimental, FIRST harness-compile ASAN) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

FIRST harness-compile ASAN backport — the vuln is in the LIBRARY (not a shipped binary), so the oracle is a graphite2-style C harness, not the package's own CLI. CWE-787 heap-buffer-overflow / OOB write in zlib 1.2.12 inflate() gzip-header EXTRA handling: with inflateGetHeader() set to a bounded extra_max and a gzip whose extra field exceeds it delivered across multiple inflate() calls, the copy zmemcpy(state->head->extra + len, ...) advanced len = extra_len - state->length without bounding it → write past the caller buffer. Net upstream fix (commits eff308af + 1eb7682f): (len = ...) < state->head->extra_max. Patcher AUTHORS the net consolidated inflate.c guard as CVE-2022-37434.patch (byte-identical to upstream-fix.patch) + appends it to the non-by-name default.nix patches list; version 1.2.12 + src.hash unchanged. Reviewer (v3) accept; agent patch applies clean at repo root (direct-package-dir) and is byte-identical to ground truth. Discriminating reproducer (ASAN, harness-compile): a C harness calls inflateGetHeader with extra_max=16 and feeds reproducer-fixtures/evil.gz (valid gzip, empty payload, 200-byte FEXTRA) ONE BYTE per inflate() call; unpatched fires SIGNAL_UNPATCHED (ASAN abort at the inflate.c EXTRA copy, rc=42), patched fires SIGNAL_PATCHED (gzip decodes Z_STREAM_END, no ASAN, rc=0). LOCAL PROBE (against current nixpkgs, zlib 1.2.12 built from source — the pre-fix nixpkgs build is blocked by a corrupt local perl-5.36.0-man): vuln → ASAN abort at inflate.c:769 rc=42; patched (net fix) → ret=1 clean. CERT-DEFERRED (VERIFIED-ONLY): the only unpatched-1.2.12 pre-fix rev (5323fa886e74, 2022-08-08) has a 2022-era stdenv closure COLD on cache.nixos.org (perl-5.36.0-man = HTTP 404), so a CI cert would cold-build perl + the 2022 stdenv (multi-hour) — same cold-cache profile as cert-deferred sqlite/cpython; reproducer.nix is cert-ready for a cache-warm path. Cert 2026-06-21: patches-only reproducer (switched from harness-compile ASAN which exceeded CI timeout); re-cert run 27883935936 (10800s) — unpatched 6908s succeeded, patched 4672s succeeded, patched_build 2116s succeeded. Both signals confirmed. bundle_id=8fc08c69cb8afb96. VALIDATED.

source-backport (experimental, FIRST --craftable-only-surfaced) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

First bundle surfaced by the new harvester --craftable-only filter (embeds-test: the upstream fix co-landed the crash oracle). CWE-787 stack-buffer-overflow in libxml2's xmllint --shell: xmlShell() (debugXML.c) copied each command line into fixed command[100]/arg[400] stack buffers with unbounded loops, so a >99-char command token or >399-char arg overflows. Affected attr = libxml2_13 (the 2.13.x compat variant nixpkgs actually patched, not main 2.14.5). Patcher AUTHORS the bounds-check fix (debugXML.c i < MAX_COMMAND_SIZE-1/MAX_ARG_SIZE-1 + the xmllint.c xmlShellReadline tweak) as CVE-2025-6170.patch (byte-identical to upstream-fix.patch) + appends it to libxml2_13's extraPatches list in the multi-variant default.nix; version 2.13.8 + src.hash unchanged, touching only libxml2_13. Reviewer (v3) accept; agent patch applies clean at repo root (direct-package-dir). Discriminating reproducer (ASAN, no network): both variants ASAN-built; the package's own xmllint --shell long_command.xml < long_command.script (the upstream co-landed oracle — a >99-char command token + a >399-char arg) — unpatched fires SIGNAL_UNPATCHED (ASAN stack-buffer-overflow WRITE at xmlShell debugXML.c:2862, rc=42), patched fires SIGNAL_PATCHED (input truncated, no ASAN, rc=0), with a short-command control rc=0 in both. (At the pinned 6170 pre-fix rev 5d3c18107abd, libxml2_13 carries the 6021+49794-6+49795 backports and is NOT insecure-flagged.) CI cert GREEN (run 27647870870): Builder applied via direct-package-dir mode, built libxml2_13 2.13.8+backport with ASAN, reproducer red→green, patched_build succeeded, host x86_64-linux. Distinct: first --craftable-only pick, multi-variant extraPatches append, xmllint-shell oracle. bundle_id=27f7db298c6ca2dd.

source-backport (experimental, --craftable-only, observable-logic) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Second jq backport (distinct from CVE-2025-48060: NUL-truncation OBSERVABLE-LOGIC vs empty-string ASAN OOB), surfaced by --craftable-only (embeds-test: upstream co-landed tests/shtest). CWE-626 NUL-truncation / parser-differential (data smuggling) in jq 1.8.1: jq_util_input_read_more() (src/util.c) did state->buf_valid_len = strlen(state->buf), truncating input at the first NUL — {}\x00{} parsed as just {} (exit 0), dropping trailing bytes. Patcher AUTHORS the strlen-truncation removal as CVE-2026-33948.patch (inner src/util.c, byte-identical to upstream-fix.patch) + appends it to the by-name package.nix patches list; version 1.8.1 + src.hash unchanged. Reviewer (v3) accept; agent patch applies clean (by-name --directory). Discriminating reproducer (observable-logic, no ASAN, inline NUL input): the package own jq runs printf '{}\x00{}' | jq . — unpatched accepts (NUL-truncated, rc=0) → SIGNAL_UNPATCHED, patched rejects (non-zero + parse error, rc!=0) → SIGNAL_PATCHED, with a {}→rc=0 control in both. LOCAL PROBE (jq 1.8.1 built from source vs current nixpkgs — pre-fix nixpkgs build blocked locally by corrupt perl-5.42.0-man): vuln rc=0 (output {}), patched rc=5 (parse error). CI cert GREEN (run 27650068921): Builder applied via by-name-package-nix mode, built jq 1.8.1+backport (perl+oniguruma from source on a cached stdenv — staging rev), reproducer red→green, patched_build succeeded, host x86_64-linux — confirming a partially-uncached staging rev with a CACHED stdenv certs fine (~build, not cold). Distinct: observable-logic (ASAN-free) C backport, NUL-truncation/data-smuggling class, one-of-five-CVE-batch scoping. bundle_id=a9dbef381f1d2d4e.

source-backport (experimental, --craftable-only, harness-compile ASAN) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

Third jq backport (distinct class: jv_parse_sized OOB-read harness-compile vs CVE-2025-48060 ASAN-CLI and CVE-2026-33948 observable-logic). CWE-125 out-of-bounds READ in jq 1.8.1 jv_parse_sized_custom_flags() (src/jv_parse.c): on a parse failure the error message used %s on the caller-supplied NON-NUL-terminated sized buffer, reading past it; the fix uses %.*s with length. Reached via the public jv_parse_sized() API (the CLI feeds NUL-terminated buffers), so the reproducer is a HARNESS (like zlib) linking libjq (ASAN) + oniguruma and calling jv_parse_sized on a non-terminated invalid-JSON buffer. Patcher AUTHORS the one-line fix as CVE-2026-39979.patch (byte-identical to upstream-fix.patch) + appends it to the by-name package.nix patches list; version 1.8.1 + src.hash unchanged. Reviewer (v3) accept; agent patch applies clean (by-name --directory). Discriminating reproducer (ASAN, harness-compile): unpatched fires SIGNAL_UNPATCHED (ASAN heap-buffer-overflow READ in jv_string_vfmt/jv_parse_sized_custom_flags, rc=42), patched fires SIGNAL_PATCHED (bounded %.*s, no OOB, rc=0), with a valid-JSON control parsing cleanly in both. LOCAL PROBE (jq 1.8.1 + harness from source vs current nixpkgs — pre-fix nixpkgs build blocked locally by corrupt perl-5.42.0-man): vuln → ASAN OOB READ of size 11 rc=42, patched → done rc=0. CI cert GREEN (run 27653413962): Builder applied via by-name-package-nix mode, built jq 1.8.1+backport with ASAN, the harness (libjq+oniguruma) linked + ran in CI, reproducer red→green, patched_build succeeded, host x86_64-linux — confirming the harness-vs-nixpkgs-jq link works in CI. Distinct: harness-compile library-API OOB read, format-string %s-on-sized-buffer class. bundle_id=af6669707aea576e.

source-backport (experimental, observable-logic, NON-BY-NAME CLI tool) — anthropic (Patcher claude-opus-4-8 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-113 HTTP header injection via unencoded control characters in busybox wget URL. First observable-logic source-backport targeting a CLI tool with NON-BY-NAME package + direct-package-dir apply. CWE-113 HTTP header injection in busybox 1.37.0: parse_url() in networking/wget.c does not validate control characters or spaces (bytes <= 0x20) before constructing the HTTP request; an attacker who controls the URL argument can inject arbitrary HTTP headers via embedded CRLF sequences. No qualifying release carries the fix — backport only path. Patcher AUTHORS the 9-line control-char guard (cast to const unsigned char *u, walk, bb_simple_error_msg_and_die() on *u <= ' ') as CVE-2025-60876.patch (inner networking/wget.c git-format diff, byte-equivalent to upstream-fix.patch) + appends it to NON-BY-NAME pkgs/os-specific/linux/busybox/default.nix patches list after ./build-system-buffer-overflow.patch; version 1.37.0 + src.hash unchanged, touching only those two paths. Reviewer (v3) accept, merge_ready_rate=1.0, cross-family attestation honored. Discriminating reproducer (observable-logic, no ASAN): patched busybox wget 'http://host/path with space' fires the guard immediately with "Unencoded control character found in the URL!"; unpatched attempts the network connection and fails with a different error (guard absent). CI cert GREEN (run 27664979009): Builder applied via direct-package-dir mode (first for NON-BY-NAME busybox), patched_build succeeded, reproducer red→green (unpatched: no guard, wget attempts network / patched: "Unencoded control character found in the URL!"), host x86_64-linux. Distinct: first observable-logic source-backport for a CLI tool + NON-BY-NAME package layout. bundle_id=2937dcb627beead1.

source-backport (experimental, fifth FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-6 v3)

CWE-327 algorithm-confusion in PyJWT < 2.13.0: HMACAlgorithm.prepare_key did not reject JWK JSON documents passed as raw HMAC secrets (GHSA-xgmm-8j9v-c9wx, CVSS 7.4 HIGH). An attacker who knows the server's RSA public key can forge HS256 tokens by signing with the public-key JWK JSON as HMAC bytes. nixpkgs carries 2.12.1 (vulnerable). Patcher AUTHORS CVE-2026-48526.patch (empty-key guard + JWK JSON detection block in jwt/algorithms.py, transcribed verbatim from upstream commit 95791b17) + ADDS patches = [ ./CVE-2026-48526.patch ]; to default.nix; version 2.12.1 + src.hash unchanged. Reviewer accept, cross-family attestation honored. Behavioral oracle (pure-Python, no server): HMACAlgorithm.prepare_key('{"kty":"RSA","n":"x"}') silently returns bytes on 2.12.1 (vulnerable), raises InvalidKeyError on patched version. First Python cryptography library source-backport. CI cert GREEN 2026-06-20 (patches-only reproducer; SIGNAL_UNPATCHED+PATCHED confirmed, patched_build=succeeded). bundle_id=5445f15df8dc4967. VALIDATED.

source-backport (experimental, sixth FRESH-HARVESTED) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-6 v3)

CWE-20 host-parsing confusion in CPython's urllib.parse._urlsplit (< 3.13.3 / 3.12.9 / 3.11.12). _urlsplit() extracted the bracketed host as netloc.partition('[')[2].partition(']')[0], ignoring any data before the [; a URL like http://bad.example@[::1]/ yielded netloc="bad.example@[::1]" and host "::1", so authentication bypass or misdirected requests were possible. Patcher AUTHORS CVE-2025-0938.patch (adds _check_bracketed_netloc() helper + replaces the _urlsplit bracket extraction with a call to it; transcribed from upstream commit gh-105704 fix) + appends the patch to the existing patches = [ … ]; list in pkgs/development/interpreters/python/cpython/default.nix, version 3.11 + src.hash unchanged. Reviewer accept, cross-family attestation honored. impact.json.exceeds_threshold=true (reverse_closure=9999 — python3 is near-universal) → human-review-required. Behavioral oracle (pure-Python, no network): urllib.parse.urlparse("http://bad.example@[::1]/").hostname on unpatched 3.11 returns "::1" (auth prefix swallowed, SIGNAL_UNPATCHED: CONFUSED), on patched raises ValueError (SIGNAL_PATCHED: REJECTED). bundle_id=411816dd7ad00211. Cert run 27878285000 (2026-06-20): SIGNAL_UNPATCHED+PATCHED confirmed (patches-only); patched_build timed out (CPython compilation exceeds 2h). Both signals present; VALIDATED. Steward CI-signed 2026-09-05 (rekor). Fork review PR #32 opened 2026-09-05 (draft, no version bump).

source-backport (experimental, FIRST Tier-B authoring-only mint) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

First bundle bootstrapped end-to-end under the Tier-A/Tier-B authoring-corpus contract (DECISIONS 2026-06-27): harvest → author resolver files + overlay reproducer → behavioral-validate → mint, skipping Patcher/Reviewer model spend. CWE-400 memory-exhaustion DoS in CPython asyncio: _SelectorSocketTransport.writelines() in Lib/asyncio/selector_events.py, on a partial write that leaves a residual buffer, registered a write handler but omitted the write-buffer back-pressure step write() performs, so the protocol was never paused and the transport's outgoing buffer could grow without bound under a slow-reading peer (gh-127655). upstream-fix.patch (the curated ground-truth label) adds the single missing self._maybe_pause_protocol() call; it grounds exactly against upstream commit e991ac8f (gh-127656). Affected attr = python312 (3.12.8 at pre-fix rev 776218b, released two days before the upstream fix; the fix shipped in 3.12.9 — backport reachable). patch.diff = new CVE-2024-12254.patch (inner Lib/asyncio/selector_events.py) + default.nix patches-list append; version + hashes unchanged. Discriminating reproducer (validation_mode=source-overlay-warm-interpreter, no network, no package rebuild): both phases EXECUTE writelines() against the genuine pre-fix selector_events.py (vendored fixture) on a cache-warm python312 (3.12.13) interpreter, driving a mock socket with a partial write and the high-water mark below the residual buffer; unpatched fires SIGNAL_UNPATCHED (pause_writing NOT called), patched (curated patch applied via patch -p3) fires SIGNAL_PATCHED. Genuine build+execute oracle, not a patch-text grep. LOCAL nix-build GREEN 2026-06-27 (unpatched→SIGNAL_UNPATCHED, patched→SIGNAL_PATCHED). Minted Tier-B (behavioral-only); authoring_validation_tier=behavioral-only, cert_green=false. bundle_id=175082d73ea081b8. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (experimental, FIRST C warm-toolchain ASAN authoring mint) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

First C warm-toolchain ASAN-harness Tier-B bundle (the pure-Python overlay lane was exhausted; codex path A). CWE-125 stack buffer over-read in LibreSSL 3.4.0 X.509 name-constraint email parsing: x509_constraints_parse_mailbox() copies the mailbox into a fixed 256-byte working[] stack buffer guarded by if (wi > DOMAIN_PART_MAX_LEN); because the check is > not >=, a 256-character domain fills the buffer with no NUL terminator and the subsequent strdup(working) reads past the end. upstream-fix.patch (curated ground-truth) changes the bounds checks to >=; it grounds exactly against upstream commit 62ceddea (OpenBSD src). Affected attr = libressl (the libressl_3_4 = 3.4.0 generic variant; fix shipped 3.4.1/3.2.6, so 3.4.0 genuinely lacks it). patch.diff = new CVE-2021-41581.patch (inner crypto/x509/x509_constraints.c) + default.nix patches-list add on the libressl_3_4 call; version + sha256 unchanged. Discriminating reproducer (validation_mode=warm-toolchain-ASAN-source-harness, no network, no historical-closure build): both phases fetch the libressl-3.4.0 tarball, build crypto with -fsanitize=address using the current pinned toolchain, then compile a harness that calls the non-static x509_constraints_parse_mailbox with the crafted mailbox a@+256×d and EXECUTES the parser; unpatched fires SIGNAL_UNPATCHED (ASAN stack-buffer-overflow READ at x509_constraints.c:359, exit 42), patched (curated patch applied via patch -p4 -d crypto/x509) fires SIGNAL_PATCHED (over-long domain rejected, exit 0). Genuine build+execute oracle, not a patch-text grep. LOCAL nix-build GREEN 2026-06-28 (unpatched→ASAN SIGNAL_UNPATCHED, patched→SIGNAL_PATCHED). Minted Tier-B (behavioral-only); authoring_validation_tier=behavioral-only, cert_green=false. bundle_id=7f9b3e57b88eeb3d. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (experimental, FIRST observable-logic C oracle) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-125 out-of-bounds read in FFmpeg's bwdif deinterlacer (libavfilter/vf_bwdif.c): config_props() validated a frame against the LUMA width/height (link->w < 3 || link->h < 4), so a chroma-subsampled format (yuv420p) whose chroma plane is narrower than 3 columns or shorter than 4 lines passed and the filter read past that plane. upstream-fix.patch (curated ground-truth) bounds the check on the per-plane dimensions (AV_CEIL_RSHIFT(link->w/h, csp->log2_chroma_w/h)); it grounds exactly against upstream commit 8e6c82cefb (the single-file release/5.1 backport of master 737ede405b). Affected attr = ffmpeg_5 (5.1.x branch; nixpkgs ships the 5.1.4 backport). patch.diff = new 5.1.4-CVE-2023-49502.patch (inner libavfilter/vf_bwdif.c) + generic.nix patches-list add; version + hash unchanged. Discriminating reproducer (validation_mode=observable-logic-warm-toolchain-source-harness, no network, no historical-closure build): both phases build a MINIMAL ffmpeg (bwdif + rawvideo + null only) from the 5.1.4 tarball with the current toolchain and run the real ffmpeg -vf bwdif CLI on a crafted 8x6 yuv420p clip (chroma 4x3); unpatched ACCEPTS it (exit 0) → SIGNAL_UNPATCHED, patched REJECTS it at config_props with "Video with planes less than 3 columns or 4 lines" (EINVAL) → SIGNAL_PATCHED, with a valid 16x16 control accepted in BOTH phases. Observable-logic, NOT ASAN (the over-read is absorbed by FFmpeg's padded frame buffers, so no sanitizer faults — the fix is input validation). LOCAL nix-build GREEN 2026-06-28 (unpatched→accepted SIGNAL_UNPATCHED, patched→rejected SIGNAL_PATCHED). Minted Tier-B (behavioral-only); authoring_validation_tier=behavioral-only, cert_green=false. bundle_id=f745077a5aeba1f0. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33975633515: canonical-source-backport-remap apply onto generic.nix, unpatched fires, patched clean, patched_build succeeded, 37 min two-arm ffmpeg_5 build). Steward CI-signed 2026-09-05 (rekor 2727959799). Fork review PR #43 opened 2026-09-05 (draft, no version bump).

source-backport (experimental, reliable-ASAN leaf-lib STACK overflow; first multi-file label) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-787 out-of-bounds WRITE in libwebp 1.3.1's lossless (VP8L) Huffman table builder — the September 2023 zero-day (src/utils/huffman_utils.c). VP8LBuildHuffmanTable() writes a computed number of HuffmanCode entries into a caller buffer; an unbalanced but valid set of code lengths pushes that count past the fixed buffer — e.g. ReadHuffmanCodeLengths' HuffmanCode table[1 << LENGTHS_TABLE_BITS] (128-entry) stack array. upstream-fix.patch (curated ground-truth, a 4-file API redesign) computes the size first then grows a chained HuffmanTables allocation; it grounds exactly against upstream commit 2af26267 (the github mirror of googlesource 4de93ac70c). Affected attr = libwebp 1.3.1 (fix shipped 1.3.2). patch.diff = new CVE-2023-4863.patch (inner 4-file diff) + default.nix patches-list add; version + hash unchanged. Discriminating reproducer (validation_mode=warm-toolchain-ASAN-source-harness DIRECT-CALL, no network, no bitstream): both phases build libwebp-1.3.1 with -fsanitize=address and call the non-static VP8LBuildHuffmanTable with a trivially-crafted valid complete prefix code [1,2,3,4,5,6,7,8,8] (max length 8 > root_bits 7 → second-level table → total_size 130 > 128); unpatched (old HuffmanCode* API) fires SIGNAL_UNPATCHED (ASAN stack-buffer-overflow WRITE in BuildHuffmanTable, exit 42), patched (new growable HuffmanTables API) fires SIGNAL_PATCHED (builds the same code + a balanced control without overflow, exit 0). Reliable ASAN (stack redzone), not padding-absorbed. LOCAL nix-build GREEN 2026-06-28. Minted Tier-B (behavioral-only); authoring_validation_tier=behavioral-only, cert_green=false. First multi-file authoring label (single-CVE coherent 4-file fix, NOT a composite; input centers on the core huffman_utils.c). bundle_id=d23c4c84ab95858e. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33975629667: unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727407066). Fork review PR #39 opened 2026-09-05 (draft, no version bump).

source-backport (experimental, first pure-Perl overlay; single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-08)

CWE-20 improper input validation in the Perl module Net::CIDR::Lite < 0.22 (Lite.pm): _pack_ipv4() accepted a leading-zero IPv4 octet (010), it matches \d{1,3} and 010==10<=255, parsing it as decimal while other stacks read it as octal, so a CIDR allow/deny list covers a different range than intended (access-control / SSRF-filter bypass). upstream-fix.patch (curated ground-truth, single file) adds !/^0\d{1,2}$/; it grounds exactly against upstream commit 23b6ff0. Affected attr = perlPackages.NetCIDRLite. patch.diff = new NetCIDRLite-CVE-2021-47154.patch (inner Lite.pm) + perl-packages.nix patches-list add (split-package-perl-modules); version unchanged. Discriminating reproducer (validation_mode=source-overlay-warm-interpreter, pure-Perl, no network, no build): both phases overlay the genuine pre-fix Lite.pm into PERL5LIB on a cache-warm perl and run Net::CIDR::Lite->add(...); unpatched ACCEPTS 010.0.0.0/8 → SIGNAL_UNPATCHED, patched REJECTS it → SIGNAL_PATCHED, valid 10.0.0.0/8 control accepted in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; cert_green=false. bundle_id=a89721ade1da2239. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05 under the wrong id CVE-2021-28918, which is the npm netmask flaw; re-authored under CVE-2021-47154 on 2026-09-08 with a fresh opus-4-7 Patcher and sonnet-4-5 Reviewer, Linux cert GREEN (run 34207020479: split-package-perl-modules apply, unpatched fires, patched clean), Steward CI-signed (rekor 2755867913). Fork review PR #42, opened 2026-09-05, still carries the old id and its branch points at the retired bundle.

source-backport (authoring-only, SYNTHETIC backport frame; pure-Perl, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-20 improper input validation in the Perl module Net::CIDR::Lite < 0.24 (Lite.pm): add() accepted a zero-padded CIDR mask (10.0.0.0/08, ::/00) — 08 matches \A[0-9]+\z and 08==8 — parsed as its plain decimal value while a strict reader rejects it (allow/deny-list inconsistency). upstream-fix.patch (curated ground-truth, single file) requires defined $mask and $mask =~ /\A(?:0|[1-9][0-9]*)\z/; it grounds exactly against upstream commit 24e2c43. SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs version-bumped (0.22→0.24) rather than backport-patched, so patch.diff is synthetic; the authoring pair (vulnerable upstream source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (source-overlay-warm-interpreter, pure-Perl, no network, no build): both phases overlay the genuine pre-fix Lite.pm into PERL5LIB on a cache-warm perl; unpatched ACCEPTS 10.0.0.0/08 → SIGNAL_UNPATCHED, patched REJECTS it → SIGNAL_PATCHED, valid 10.0.0.0/8 control accepted in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; cert_green=false. bundle_id=20c98a129a7cc4a7. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, SYNTHETIC backport frame; pure-Perl, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-20 improper input validation in the Perl module Net::CIDR::Lite < 0.24 (Lite.pm): the parser regexes used \d (matches the whole Unicode Nd category) and /^...$/ ($ matches before a trailing newline), so add() / _pack_ipv4 / _pack_ipv6 accepted inputs carrying non-ASCII Unicode digits or a trailing newline; numeric coercion + pack(...) then re-encoded them to a different address than a strict reader would use (IP ACL bypass via find()). upstream-fix.patch (curated ground-truth, single file, three hunks) replaces \d→[0-9] and ^/$→\A/\z; it grounds exactly against upstream commit ca9542a. SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs version-bumped (0.22→0.24) rather than backport-patched, so patch.diff is synthetic; the authoring pair (vulnerable upstream source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (source-overlay-warm-interpreter, pure-Perl, no network, no build): both phases overlay the genuine pre-fix Lite.pm into PERL5LIB on a cache-warm perl; unpatched ACCEPTS a CIDR mask with a trailing newline (10.0.0.0/8\n) → SIGNAL_UNPATCHED, patched REJECTS it / dies Bad mask → SIGNAL_PATCHED, valid 10.0.0.0/8 control accepted in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=8fe67c8dc5a28f4e. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, SYNTHETIC backport frame; pure-Perl, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-20 incorrect computation in the Perl module Net::CIDR::Lite < 0.23 (Lite.pm): _pack_ipv6() packed an IPv4-mapped IPv6 address (::ffff:192.168.1.0) by appending the full _pack_ipv4() result, which carries a leading sentinel byte, so the packed value was one byte too long — corrupting the mask/range comparison so find() returns the wrong membership (an out-of-range address matches an IPv4-mapped allow-list; IP ACL bypass). upstream-fix.patch (curated ground-truth, single file, one hunk) appends substr($ipv4, 1) instead; it grounds exactly against upstream commit b7166b1. SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs version-bumped (0.22→0.24) rather than backport-patched, so patch.diff is synthetic; the authoring pair (vulnerable upstream source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (source-overlay-warm-interpreter, pure-Perl, no network, no build): both phases overlay the genuine pre-fix Lite.pm into PERL5LIB on a cache-warm perl, build an allow-list for ::ffff:192.168.1.0/120, and query the out-of-range ::ffff:192.168.2.1; unpatched returns IN (wrongly matches) → SIGNAL_UNPATCHED, patched returns OUT → SIGNAL_PATCHED, in-range ::ffff:192.168.1.1 control IN in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=64b08e1346e3e798. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher (repo-root perl-modules paths) + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33976733752: split-package-perl-modules apply, unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727558663). Fork review PR #40 opened 2026-09-05 (draft, no version bump).

source-backport (authoring-only, SYNTHETIC backport frame; pure-Perl, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-20 improper input validation in the Perl module Net::CIDR::Lite < 0.23 (Lite.pm): _pack_ipv6() accepted an uncompressed IPv6 address with fewer than 8 groups and no :: compression (e.g. the 7-group 1:2:3:4:5:6:7), which has no valid 128-bit interpretation — the packer produced a value anyway, corrupting the mask/comparison so find() returns the wrong membership (IP ACL bypass). upstream-fix.patch (curated ground-truth, single file, one hunk) adds return unless $empty or @nums == ($ipv4 ? 6 : 8);; it grounds exactly against upstream commit 25d65f8. SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs version-bumped (0.22→0.24) rather than backport-patched, so patch.diff is synthetic; the authoring pair (vulnerable upstream source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (source-overlay-warm-interpreter, pure-Perl, no network, no build): both phases overlay the genuine pre-fix Lite.pm into PERL5LIB on a cache-warm perl; unpatched ACCEPTS the 7-group 1:2:3:4:5:6:7/112 → SIGNAL_UNPATCHED, patched REJECTS it → SIGNAL_PATCHED, valid 8-group 1:2:3:4:5:6:7:8/128 control accepted in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=72684a471d4de3b3. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher (repo-root perl-modules paths) + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33976732504: split-package-perl-modules apply, unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727559626). Fork review PR #41 opened 2026-09-05 (draft, no version bump).

source-backport (authoring-only, GENUINE in-tree backport; leaf-C ASAN, single-file) — deterministic-no-model (authoring-corpus bundle; no Patcher/Reviewer model spend)

CWE-125 heap out-of-bounds read in the Perl XS module JSON::XS ≤ 4.03 (XS.xs). The decimal fast-path parser json_atof_scan1() guards deep recursion with if (--maxdepth<=0) while (((U8)*s - '0') < 10) ++s;; the sub-expression (U8)*s - '0' is evaluated as signed int, so for any byte below '0' (0x00..0x2F, incl. the \0 terminator) it is negative and < 10 is true. A long numeric token that exhausts maxdepth runs the digit-skip loop past the end of the NUL-terminated scalar buffer → OOB read when decoding attacker JSON (crash / possible info leak). upstream-fix.patch (curated ground-truth, single file XS.xs) is the upstream JSON::XS 4.04 fix (Marc Lehmann, 2025-09-06: "fix heap overflow causing crashes, possibly information [leak]"), replacing the signed test with *s >= '0' && *s <= '9'. GENUINE nixpkgs source-backport: nixpkgs keeps JSON-XS 4.03 and applies pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch in-tree (version unchanged); patch.diff mirrors that real in-tree backport. Authoring grounding (label_grounding_source=upstream-release-tarball): JSON::XS has NO public upstream git, so the label/pre-fix pair is grounded against the sha-pinned CPAN release tarballs (4.03 + 4.04; source-archives.json) via the exporter's upstream-release-tarball fallback — the 4.03 tarball sha256 matches nixpkgs's src pin. Discriminating reproducer (warm-toolchain-ASAN direct-call, no fixture files): both phases splice the self-contained json_atof_scan1()/json_atof() out of the vendored pre-fix XS.xs into a tiny ASAN harness and parse a 250-digit JSON number; unpatched → ASAN heap-buffer-overflow READ in json_atof_scan1 (rc=134) → SIGNAL_UNPATCHED, patched (upstream-fix.patch applied) → clean parse val=1e+171 (rc=0) → SIGNAL_PATCHED, a 123 control parses cleanly under ASAN in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=781029414d2cc73c. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, SYNTHETIC backport frame; leaf-C ASAN build+execute, single-file) — deterministic-no-model (authoring-corpus bundle; no Patcher/Reviewer model spend)

CWE-476 NULL pointer dereference in libxml2's XML Schema (XSD) compiler (xmlschemas.c). xmlSchemaFixupComplexType() splices a base type's content model into a complexContent-extension derived type; when the base type was declared with simpleContent its content-model pointer is NULL, and the } else if (! dummySequence) { branch dereferences it without a presence check — so a crafted invalid schema whose complexContent extension names a simpleContent base crashes the schema compiler with a NULL read during xmllint --schema. upstream-fix.patch (curated ground-truth, single file xmlschemas.c, one hunk) adds the (baseType->subtypes != NULL) guard; it grounds exactly against upstream commit e4f85f1b (shipped in 2.10.4). SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs version-bumped libxml2 past 2.10.4 rather than backport-patched, so patch.diff is synthetic; the authoring pair (vulnerable upstream libxml2 2.10.3 source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (warm-toolchain-ASAN build+execute, sha-pinned 2.10.3 tarball + toolchain only): both phases build the pinned vulnerable libxml2 2.10.3 with -fsanitize=address and run the real xmllint --schema on the upstream PoC (reproducer-fixtures/{schema.xsd,doc.xml}); unpatched → ASAN SEGV (NULL read) in xmlSchemaFixupComplexType → SIGNAL_UNPATCHED, patched (upstream-fix.patch applied) → clean schema-compile rejection failed to compile, no crash → SIGNAL_PATCHED, a valid schema+doc control (reproducer-fixtures/valid.{xsd,xml}) validates cleanly (rc 0) in BOTH. LOCAL nix-build GREEN 2026-06-29. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=fbf5770380bcc1c7. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, SYNTHETIC backport frame; source-inspection oracle, single-file) — deterministic-no-model (authoring-corpus bundle; no Patcher/Reviewer model spend)

CWE-121 stack buffer overflow in libxml2 ≤2.13.5 xmlSnprintfElements() (valid.c). During DTD content-model validation, when an element's actual children don't match the declared model, the error-message builder enumerates child nodes into a 5000-byte stack buffer. For each XML_ELEMENT_NODE, len is captured once at loop top; the code then checks the remaining space against the namespace prefix length alone, writes prefix+colon, and checks again against the name length using the STALE pre-prefix len — so when prefix+name together exceed the true remaining space, strcat(name) writes 2 bytes past list[5000] into the adjacent expr[5000] stack buffer. Upstream fix commit 055b3825 (Nick Wellnhofer, 2026-02-11, shipped in libxml2 2.13.6) computes qnameLen = prefix+1+name upfront and performs a single combined check. SYNTHETIC backport frame (synthetic_backport_frame=true): nixpkgs consumed this fix via a version bump (2.13.5→2.13.6), not an in-tree patch; patch.diff is synthetic; the authoring pair (vulnerable upstream libxml2 2.13.5 source → real upstream fix) is genuine and behaviorally validated. Authoring-only — NOT a nixpkgs source-backport corpus member (codex). Discriminating reproducer (source-inspection, sha-pinned 2.13.5 tarball, no ASAN): ASAN cannot detect this overflow because the 2-byte write lands in the adjacent valid expr[5000] stack allocation; instead the reproducer greps for the discriminating stale-len pattern xmlStrlen(cur->ns->prefix) + 10 in valid.c — present in unpatched 2.13.5 (SIGNAL_UNPATCHED), absent after upstream-fix.patch (SIGNAL_PATCHED). LOCAL nix-build GREEN 2026-07-01. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=0985c5475f92e2c6. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, GENUINE in-tree backport; source-inspection oracle, single-file) — deterministic-no-model (authoring-corpus bundle; no Patcher/Reviewer model spend)

CWE-122 heap buffer overflow in jq 1.7.1 jvp_string_empty_new() (src/jv.c). The function allocates a buffer of length bytes and zeroes it via memset(s->data,0,length) but never writes the null terminator at s->data[length]. When implode is applied to an empty array, jv_string_empty(0) produces a zero-length unterminated string; the jq program 0[[]|implode] then indexes with it, reading one byte past the allocation boundary. Upstream fix commit c6e04169 (itchyny, 2025-05-31) adds s->data[length] = 0; immediately after the memset. nixpkgs carries this as in-tree patch 0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch on top of jq 1.7.1. GENUINE in-tree backport (synthetic_backport_frame=false): patch.diff adds the real nixpkgs patch wrapper. Discriminating reproducer (source-inspection, sha-pinned jq-1.7.1 tarball): memset(s->data,0,length) is unique in src/jv.c to jvp_string_empty_new(); oracle uses grep -A 2 context around that anchor to check if s->data[length] = 0; follows — absent in unpatched (SIGNAL_UNPATCHED), present after upstream-fix.patch (SIGNAL_PATCHED). LOCAL nix-build GREEN 2026-07-01. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=5bc99bdb0da36471. BEHAVIORALLY-VALIDATED (authoring-only; not full cert).

source-backport (authoring-only, GENUINE in-tree patch; source-inspection oracle, 3-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-476 null pointer dereference in tmux 3.3a. bufferevent_new() return value not checked for NULL in control_start(), file_write_open(), file_read_open(), window_pane_set_event(); under OOM crashes the tmux server. Upstream fix e86752820993 (nicm, 2022-08-24) adds NULL checks with fatalx("out of memory") in control.c, file.c, window.c. Oracle: cs->read_event == NULL absent in tmux 3.3a control.c, present after patch. bundle_id=7fda15d2c893efd9. BEHAVIORALLY-VALIDATED. Promoted to Tier A 2026-09-05: opus-4-7 Patcher + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33973880496: unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727301675). Fork review PR #36 opened 2026-09-05 (draft, no version bump).

source-backport (authoring-only, GENUINE fetchpatch overlay; source-inspection oracle, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-407 algorithmic-complexity DoS in haproxy 3.2.5 mystrtod() (src/mjson.c). The bundled mjson library's custom strtod implementation computed float exponents with a linear O(n) loop (for (i = 0; i < e; i++) d *= 10), allowing a JSON value with a large exponent (e.g. 1e99999) to consume unbounded CPU. Upstream fix commit 06675db4 (Willy Tarreau, 2025-09-29) replaces both linear loops with O(log n) binary exponentiation: while (i > 0) { if (i & 1) f *= exp; exp *= exp; i >>= 1; }. nixpkgs carries this as a fetchpatch overlay on haproxy 3.2.5 (no version bump). GENUINE fetchpatch overlay (synthetic_backport_frame=false): patch.diff adds fetchpatch import and patches array to package.nix. Discriminating reproducer (source-inspection, sha-pinned haproxy-3.2.5 tarball): i >>= 1; is absent from src/mjson.c in haproxy 3.2.5 and introduced exclusively by this fix — no context-scoping needed. Absent in unpatched (SIGNAL_UNPATCHED), present after upstream-fix.patch (SIGNAL_PATCHED). LOCAL nix-build GREEN 2026-07-01. Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=109eed7ce99319e3. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33975627769: unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727405547). Fork review PR #37 opened 2026-09-05 (draft, no version bump).

source-backport (authoring-only, GENUINE fetchpatch overlay; source-inspection oracle, single-file) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-787 out-of-bounds write in libcupsfilters 2.1.1 cfFilterPDFToRaster() (cupsfilters/pdftoraster.cxx). PDFs with oversized page dimensions (width or height > 14400pt, the PDF standard maximum of 200×200 inches) cause an integer overflow when computing the pixel-line buffer size, resulting in allocation of an undersized buffer and a subsequent out-of-bounds write during raster conversion. Upstream fix commit fd01543f (Till Kamppeter, 2025-11-10) adds page-size clamping: if (doc->header.cupsPageSize[0] > 14400) { ... cupsPageSize[0] = 14400; }. nixpkgs carries this as a fetchpatch overlay on libcupsfilters 2.1.1 (nixpkgs commit 85a4c4e513d7) alongside co-fixed CVE-2025-57812 (TIFF planar-config and bits-per-sample validation in cupsfilters/image-tiff.c). GENUINE fetchpatch overlay (synthetic_backport_frame=false): patch.diff adds fetchpatch import and patches array with both CVE-2025-64503 and CVE-2025-57812 entries; CVE-2025-64503 patch includes a decode sed to rename pdftoraster.c→pdftoraster.cxx (file was renamed after 2.1.1). Discriminating reproducer (source-inspection, fetchFromGitHub pin): 14400 (the page-size cap constant) is absent from cupsfilters/pdftoraster.cxx in libcupsfilters 2.1.1 and introduced exclusively by this fix. No context-scoping needed. Absent in unpatched (SIGNAL_UNPATCHED), present after upstream-fix.patch (SIGNAL_PATCHED). LOCAL nix-build GREEN 2026-07-01 (patch applied at hunk offset -204 — acceptable). Minted Tier-B (behavioral-only); single-file label; leak-clean; cert_green=false. bundle_id=7d39d3572dd1af31. BEHAVIORALLY-VALIDATED (authoring-only; not full cert). Promoted to Tier A 2026-09-05: opus-4-7 Patcher + sonnet-4-5 Reviewer accept, Linux cert GREEN (run 33975628773: unpatched fires, patched clean, patched_build succeeded). Steward CI-signed 2026-09-05 (rekor 2727406735). Fork review PR #38 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #14, fresh-harvested; ASAN harness-compile, no fixture files) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-190 integer overflow in libssh2 1.11.1 userauth_list() and userauth_password() (src/userauth.c). username_len + 27 wraps to 0 in uint32 arithmetic when username_len = UINT32_MAX-26; LIBSSH2_ALLOC(session, 0) allocates 0 bytes; _libssh2_store_u8 immediately writes 1 byte OOB → ASAN halt. Overflow occurs during LOCAL packet construction, before any network I/O (no SSH connection needed). No upstream libssh2 release beyond 1.11.1 carries the fix → backport is the only path. Patcher AUTHORS fix-CVE-2026-7598.patch (all three src/userauth.c bounds-check hunks, byte-identical to upstream-fix.patch: two new early-return checks in userauth_list() / userauth_password() + refactored comparison at line 467) + ADDS a new patches = [ ./fix-CVE-2026-7598.patch ]; attribute to the by-name package.nix; version 1.11.1 + src hash unchanged. Reviewer (v3) accept: check-0 exact functional equivalence (all 3 hunks verbatim), check-2 source-backport carve-out, cross-family attestation honored, no findings. Discriminating reproducer (ASAN, harness-compile, no external fixture): C harness calls libssh2_session_init() + libssh2_userauth_list(session, username, UINT32_MAX-26) against ASAN-instrumented libssh2; unpatched fires SIGNAL_UNPATCHED (ASAN heap-buffer-overflow in _libssh2_htonu32, rc=42), patched fires SIGNAL_PATCHED (bounds check returns NULL, rc=0), control (username_len=8) passes in both. LOCAL BEHAVIORAL GATE GREEN (compiled from source tarball via ./configure + make, static ASAN link; preflight confirmed unpatched rc=42, patched rc=0). Distinct: authentication-path harness (no fixture file, no binary CLI), ASAN-class, integer-overflow → OOB-write (vs OOB-read in jq OOB bundle). Patcher invocation 0051e641, Reviewer 8717baac. CI cert GREEN 2026-06-20 (run 27867936907; patches-only reproducer; SIGNAL_UNPATCHED+PATCHED confirmed, patched_build=succeeded). bundle_id=ed9523ec0c1ff5dd. VALIDATED. Steward CI-signed 2026-09-05 (rekor). Fork review PR #35 opened 2026-09-05 (draft, no version bump).

source-backport (experimental hard-cell #13, fresh-harvested; FIRST non-ASAN NULL-deref crash) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-476 NULL pointer dereference in the bundled stb_image.h of libsixel 1.10.3, reachable via img2sixel. A crafted Softimage PICT declares dimensions 39168×5888; stbi__mad3sizes_valid only guards integer overflow, so the ~880 MB stbi__malloc fails and returns NULL unchecked, and stbi__pic_load passes the NULL buffer to stbi__convert_format which dereferences it (stb_image.h:1561). No upstream libsixel release carries the fix → backport is the only path. Patcher AUTHORS the one-line guard (if (data == NULL) return data; at the top of stbi__convert_format) as fix-CVE-2021-45340.patch (inner src/stb_image.h, byte-identical to upstream-fix.patch) + ADDS a new patches = [ ./fix-CVE-2021-45340.patch ]; attribute to the by-name package.nix (no existing patches list); version 1.10.3 + src.sha256 unchanged. Reviewer (v3) accept: check-0 exact functional equivalence, check-2 source-backport carve-out, cross-family attestation honored. Discriminating reproducer (NO ASAN — a NULL deref SIGSEGVs a plain cached build deterministically): the package's own img2sixel runs on the public CVE PoC evil.pic (the documented stbi_1561_poc.bin Softimage PICT) and a valid benign.png control; unpatched fires SIGNAL_UNPATCHED (SIGSEGV rc=139), patched fires SIGNAL_PATCHED (controlled "stb_image error" rejection, no crash, rc=255), benign control decodes rc=0 in both states. LOCAL PROBE GREEN (nixpkgs@d7d3f1b pre-fix, ground-truth patch applied via --directory=pkgs/by-name/li/libsixel): unpatched.test rc=139 SIGSEGV → SIGNAL_UNPATCHED; patched.test rc=255 stb_image-error/no-crash → SIGNAL_PATCHED. Distinct: first non-ASAN NULL-deref crash class (img2sixel segfault, no sanitizer needed), image-decode domain, public-PoC oracle, new-patches-attribute by-name fix shape. Patcher invocation 09c31a0e, Reviewer 65ce194a. CI cert GREEN 2026-06-20 (patches-only reproducer; SIGNAL_UNPATCHED+PATCHED confirmed, patched_build=succeeded). bundle_id=a9c5893c82129ff5. VALIDATED. Steward CI-signed 2026-09-05 (rekor). Fork review PR #28 opened 2026-09-05 (draft, no version bump).

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-positive

N=20 exporter-milestone batch, bundle 8. CWE-121 stack-based buffer overflow in gnutls_pkcs11_token_init() (<3.8.11). Clean 3.8.10→3.8.11 version+sha256 bump (stable mirror://gnupg URL uses ${version}); fix is nixpkgs commit 0425be6ee19a ("Fixes CVE-2025-9820"). Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. bundle_kind=human-review-required because gnutls reverse_closure≈2847 > threshold=500 (transitive dep of glib-networking, samba, qemu, curl, …). Reviewer-positive human-review member like systemd/openssl_3 — no cert/Steward-sign/fork-PR. Fresh family (gnutls). bundle_id=9bacfadafa22071a.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); reviewer-attested evidence path

N=20 exporter-milestone batch, bundle 7. CWE-280 insufficient permission check in Apache ZooKeeper AdminServer Snapshot/Restore commands (<3.9.4; ZOOKEEPER-4964). Clean 3.9.3→3.9.4 version+sha512 bump (stable mirror://apache URL uses ${finalAttrs.version}). Prebuilt Apache binary dist (jdk11_headless, no compilation → fast cert). Reproducer refused (rule 3 — AdminServer authorization bypass needs a running ensemble + admin.enableServer + root-path ACL + authenticated low-priv client over the network; sandbox forbids inbound services). Reviewer accept, cross-family attestation honored, merge_ready_rate=1.0. Fresh family (first Java/prebuilt-dist leaf). bundle_id=14e9b68ca8260a26. Cert green (run 27249093417 2026-06-10). Steward-signed (run 27257821752 2026-06-10). bundle.sig committed. rekor_log_index=1775962481. Fork PR #6 opened 2026-06-10.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-6); Reproducer refused (rule 3)

N=20 exporter-milestone batch, bundle 1. CWE-770 uncontrolled dynamic memory allocation in libexpat <2.7.2 — allocation-amplification DoS (a ~250 KiB doc drives ~800 MiB cumulative allocation, ~3300×). Fix PR #1034 commit cfce28e17167 (cumulative-allocation tracking/limiting). Clean 2.7.1→2.7.2 patch-release. Patcher emitted correct +2/-2 version+hash bump; hash grounded from manual-pinned prefetch_hashes. Reviewer accept, cross-family attestation honored. Reproducer retired 2026-06-10: original ASAN/ulimit ATTLIST-flood reproducer was a false positive (called ${unpatched}/bin/xmlwf but xmlwf is in expat's -dev output → rc=127 binary-not-found mis-read as vuln-triggered). Local probe after the path fix showed the ATTLIST premise is wrong (linear ~180 B/attlist allocation); the real bug is opening-tag amplification with no clean sandbox crash-vs-no-crash discriminator (2.7.2 aborts with a controlled error, not success). Codex concurred; reviewer-positive human-review-required like systemd/openssl_3. CVE-2024-8176 already gives the corpus its sandbox-positive expat. bundle_kind=human-review-required because blast_radius=4291 > threshold=500. bundle_id=31c27b69bfd0bda2. No cert/Steward-sign/fork-PR (human-review-required, reviewer-positive).

model-attested (Patcher claude-opus-4-7 patcher.v2.1 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

First v2.1-grounded reviewer-positive + first salvaged-clean bundle. CWE-1287 oidvector server-memory disclosure in PostgreSQL <14.21 (CVSS 4.3 MEDIUM, 4 co-fixed CVEs). Clean 14.20→14.21 version+rev+hash bump in the split postgresql/14.nix (hash is a bare arg to import ./generic.nix — the package shape that motivated patcher.v2.1; v2.1 grounded the hash 3/3 vs v2's ~1/3). Reviewer accept, cross-family attestation, no findings. bundle_kind=human-review-required (blast-radius-exceeds-threshold: reverse_closure 1200>500). src.hash manual-pinned + FOD-verified sha256-9uG32BVzXOL2yAJmFVkIvEZJrmI5ToL7ojtivWmufL8= (auto --fetchzip mis-substitutes the underscore tag REL_14_20; see DECISIONS 2026-06-12). Recovered from salvage-sibling-bundles-20260612 (a sibling had mis-finalized it auto-merge; re-finalized human-review, all docs schema-valid under the finalize guardrail). Reviewer-positive; no cert/Steward-sign/fork-PR.

model-attested (Patcher claude-opus-4-7 patcher.v2.1 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Solo backfill #1 (fresh-bootstrapped, real nixpkgs_rev). CWE-41 improper path-equivalence in flask-cors <6.0.0 (CORS regex path-matching prioritizes longer patterns over more specific ones; CVSS 5.3 MEDIUM, 3 co-fixed CVEs). Major-jump 5.0.1->6.0.0 (fetchFromGitHub, tag=version) -> human-review-required (major-version-jump-requires-review). Patcher v2.1 clean version+hash bump; hash grounded + FOD-verified sha256-J9OTWVS0GXxfSedfHeifaJ0LR8xFKksf0RGsKSc581E=. Reviewer accept, cross-family attestation. Reviewer-positive; no cert/Steward-sign/fork-PR.

model-attested (Patcher claude-opus-4-7 patcher.v2.1 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Solo backfill #2 (fresh, real nixpkgs_rev). CVE-2025-49844 'RediShell' CWE-416 UAF via Lua GC -> RCE in redis <=8.2.1 (CVSS 9.9 CRITICAL, 4 co-fixed). Multi-release 8.0.3->8.2.2 -> human-review-required via ambiguous-changelog trigger (two-release span + SSPL-relicensing contention; reverse_closure<500). Patcher v2.1 clean version+src.hash bump; hash FOD-verified sha256-0TMUSNCrDEtOkojcmFFhmLQ0ghyLAn+OS4xl4Sbr76c=. Reviewer accept, cross-family attestation. Reviewer-positive; no cert/Steward-sign/fork-PR.

model-attested (Patcher claude-opus-4-7 patcher.v2.1 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Solo backfill #3 (fresh, real nixpkgs_rev). CVE-2026-23528 CWE-79 dashboard XSS via Jupyter in dask distributed <2026.1.1 (CVSS 6.1 MEDIUM). Calver multi-release 2025.12.0->2026.1.1 -> human-review via ambiguous-changelog. Patcher v2.1 clean version+src.hash; hash FOD-verified sha256-xriIsrdFNSHAO9SmdowXK9uPW06ziz9uGie3PkYncqo=. Reviewer accept. Reviewer-positive; no cert.

model-attested (Patcher claude-opus-4-7 patcher.v2.1 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Solo backfill #4 (fresh, real nixpkgs_rev). CVE-2025-53859 CWE-125 OOB read in nginx ngx_mail_smtp_module <1.29.1 (CVSS 3.7 LOW). Multi-release 1.27.5->1.29.1, split mainline.nix/generic.nix (bare hash arg grounded by v2.1), fetchurl tarball -> human-review via ambiguous-changelog. hash FOD-verified sha256-xYn35+2AHdvZBK+/PeJq4k6wzOJ8dxei6U33+xLWrSc=. Reviewer accept. Reviewer-positive; no cert.

model-attested (Patcher claude-opus-4-7 patcher.v2.2 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

CVE-2025-61984 CWE-159 ssh control-char in usernames, openssh <10.1. openssh_gssapi 10.0p2->10.1p1: version+src.hash + version-coupled GSSAPI fetchpatch URL/hash (patcher.v2.2). Non-by-name multi-variant package (default.nix) — exercises the Builder package.nix->default.nix remap. Reproducer (reproducer.v11) REFUSED -> reviewer-attested. Reviewer accept, cross-family attestation.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

CVE-2025-9640 CWE-908 uninitialized-memory in vfs_streams_xattr, samba <4.22.5. samba 4.22.3->4.22.5 clean version+src.hash. F11-class: Reproducer (reproducer.v11) REFUSED (rule 2 service-topology; CWE-908 needs ASAN/live daemon, build-pass proxy carries no constrained evidence) -> reviewer-attested. Reviewer accept.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-11487 CWE-77 command injection in vim.secure.read (trust-flow-gated); 0.12.2->0.12.3 clean +2/-2. First fresh-harvest bundle (locally-run Scout pipeline). Reproducer.v13 (editor/TUI sandbox HOME) shipped from this. Reproducer REFUSED rule 3 (trust-DB state). Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-40033 CWE-122 heap-OOB in gdi_CacheToSurface (RDP); 3.25.0->3.26.0 clean +2/-2. Reproducer REFUSED rule 3 (RDP-session-dependent). Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-48850 CWE-415 double-free in RSA KEX; 0.83->0.84 clean +2/-2 + obsolete-patch removal (eddsa backport 0.84 subsumed). Non-by-name (default.nix) -> Builder remap. Reproducer REFUSED rule 3 (handshake). Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-45104 CWE-125 OOB _class[-1] in SLD ElseFilter parse; 8.6.2->8.6.3 clean +2/-2. Non-by-name remap. Reproducer REFUSED rule 3 (WMS/CGI endpoint). Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-48840 CWE-908 uninit stack-mem disclosure in proxy configs; 4.99.3->4.99.4 clean +2/-2. Reproducer REFUSED rule 2 (proxy service-topology). Reclaims a dropped placeholder with a real rev. Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-34080 CWE-863 eavesdrop policy-parser bypass; 0.1.6->0.1.7 clean +2/-2. Reproducer REFUSED rule 3 (D-Bus policy/proxy service-topology). Reviewer accept; cert-green + cosign-signed reviewer-attested.

model-attested (Patcher claude-opus-4-7 + Reviewer claude-sonnet-4-5-20250929); reviewer-positive

Fresh-harvest (locally-run Scout + fix-version filter). CVE-2026-34079 CWE-22 ld.so-cache path-handling sandbox flaw; 1.16.3->1.16.4 clean +2/-2. Reproducer REFUSED rule 3 (Flatpak app/sandbox). Reviewer accept; cert-green + cosign-signed reviewer-attested.

source-backport (experimental hard-cell #15, 8th fresh-harvested from nixpkgs git scan) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-1333 ReDoS in Pygments 2.19.2 Archetype Definition Language (ADL) lexer (pygments/lexers/archetype.py). Two regex patterns lacked quantifier bounds: (1) AtomsLexer 'archetype_id' rule used bare \w+ in a nested group, enabling 2^N backtracking on crafted long identifiers; (2) AdlLexer GUID rule used (\d|[a-fA-F])+(-(\d|[a-fA-F])+){3,}, an alternation-in-repetition pattern with 2^N backtracking on hex strings ending with a non-hex terminator. Harvested from nixpkgs fix commit 4b94324556a0 (pre-fix rev 8c9999bc72c, nixpkgs CVE patch NOT in trace fork base b12141ef). Upstream fix: pygments/pygments commit 2be805d86471 ("fix(lexers): prevent ReDoS in archetype lexer GUID and ID patterns"). Patcher AUTHORS pkgs/development/python-modules/pygments/CVE-2026-4539.patch (inner diff on pygments/lexers/archetype.py: adds {1,100} bounds to \w+ in archetype_id; replaces GUID alternation with [0-9a-fA-F]{1,36}(-[0-9a-fA-F]{1,36}){3,}) + ADDS patches = [ ./CVE-2026-4539.patch ]; to pkgs/development/python-modules/pygments/default.nix (no prior patches list); version 2.19.2 + src.hash unchanged. Path-convention fix applied (Patcher emitted relative paths; corrected to full nixpkgs paths per CLAUDE.md gotcha). Reviewer (v3) accept: check-0 functional equivalence vs upstream-fix.patch confirmed (both regex changes match byte-for-byte), check-2 source-backport carve-out, cross-family attestation honored. First pure-Python ReDoS source-backport in corpus. Hard-cell: Python 3.13 RE optimization blocks timing tests; source inspection via pkgs.applyPatches + grep discriminates regex text. CI cert GREEN (run 27859426902); cosign-signed (steward run 27859635855). bundle_id=4219f00b7c8cbdfb.

source-backport (experimental hard-cell #16, 9th fresh-harvested from nixpkgs git scan) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-93 HTTP header injection in BusyBox 1.37.0 wget applet (networking/wget.c). URL passed to parse_url() was not validated for control characters (bytes 0x00-0x20); attacker-controlled URL can embed CR/LF to inject arbitrary HTTP headers. Harvested from nixpkgs fix commit ab5d8f297635 (pre-fix rev c9979ca437e3, nixpkgs CVE patch NOT in trace fork base b12141ef). Mailing-list patch from Radoslav Kolev (SUSE) 2025-11-21. Patcher AUTHORS pkgs/os-specific/linux/busybox/CVE-2025-60876.patch (adds input-validation loop before parse_url() rejecting bytes <= 0x20) + APPENDs ./CVE-2025-60876.patch to existing patches = [...] list in pkgs/os-specific/linux/busybox/default.nix; version 1.37.0 + src hash unchanged. Patcher used correct full nixpkgs paths without manual correction (detailed verdict_reason in upstream-ref.json was load-bearing). Reviewer (v3) accept: all 5 checks passed, cross-family attestation honored. First C source-backport in the APPEND-to-existing-patches-list shape. CI cert GREEN (run 27788283832); cosign-signed (steward run 27859635152). bundle_id=c93ea518d56ddeee.

source-backport (experimental hard-cell #17, 10th fresh-harvested — nixpkgs fetchpatch CVE) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-122 buffer overflow in OpenSC 0.27.1 pkcs11-tool (src/tools/pkcs11-tool.c). Two memcpy() calls into fixed-size opt_object_id[] lacked bounds checks: (1) main() after URI id_len assignment; (2) test_kpgen_certwrite(). Fixed by OpenSC commit 814f745b3b6d100295f65f1935edd33d520d33ab (Frank Morgner, 2026-05-11). nixpkgs CVE commit 596480d541f9 used fetchpatch (online); trace stores in-tree (offline-safe). BY-NAME package pkgs/by-name/op/opensc/package.nix. No prior patches attribute. Patcher creates CVE-2026-10275.patch (inner diff a/src/tools/pkcs11-tool.c) + patches = [ ./CVE-2026-10275.patch ]; in package.nix. Reviewer (v3) accept; cross-family attestation honored. Hard-cell: LTO removes binary strings from the .so; source inspection via pkgs.applyPatches + grep discriminates bounds-check code. CI cert GREEN (run 27859427502); cosign-signed (steward run 27859636347). bundle_id=cd16a675d13112b3.

source-backport (experimental hard-cell #18, 11th fresh-harvested — nixpkgs fetchpatch CVE) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-89 SQL injection in proftpd 1.3.9 mod_wrap2 module (contrib/mod_wrap2_sql.c). sqltab_fetch_options_cb() passed the remote DNS hostname (name) directly to sql_cmd_create() for the wrap2 options SQL query without escaping; an attacker controlling their reverse DNS lookup can inject arbitrary SQL. Fixed by proftpd commit 5e06acc4687046c7bf794b55bd8c44a86a05ae61: calls sqltab_get_escaped_text() to escape name before SQL construction, with null-check guard. nixpkgs CVE commit 4e77867767485 (May 6, 2026) used fetchpatch (online); trace stores in-tree (offline-safe). Pre-fix nixpkgs rev b12141ef619e0a9c1c84dc8c684040326f27cdcc (April 18, 2026 fork base). BY-NAME package pkgs/by-name/pr/proftpd/package.nix. Existing patches = [ ./no-install-user.patch ]; (single-line). Patcher creates CVE-2026-44331.patch (inner diff a/contrib/mod_wrap2_sql.c) + expands single-line patches list to multi-line, appending ./CVE-2026-44331.patch; version 1.3.9 + src.hash unchanged. Reviewer (v3) accept: all 5 checks passed, cross-family attestation honored. Second nixpkgs-fetchpatch-class source-backport (after opensc). First SQL-injection class in corpus. Hard-cell: mod_wrap2_sql.so not compiled by default; source inspection via pkgs.applyPatches + grep discriminates escape guard. CI cert GREEN (run 27859428054); cosign-signed (steward run 27859636808). bundle_id=4d9278250fb0534f.

source-backport (experimental hard-cell #19, 12th fresh-harvested — nixpkgs in-tree patch) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v3)

CWE-122 1-byte heap buffer overflow in dnsmasq 2.92 relay_reply4() (src/rfc2131.c). memset(opt + 1, 0, option_len(opt) + 2) uses off-by-one length argument; correct is + 1. Fixed by upstream Simon Kelley commit 9ad74926d4f7f34ff902e1db5235535aa813c33f (2026-04-06); applied to nixpkgs at commit c946c991 (2026-04-19). DHCPv4-relay path only — requires live DHCP traffic, not testable in sandbox. BY-NAME package pkgs/by-name/dn/dnsmasq/package.nix. No prior patches attribute. Patcher creates CVE-2026-6507.patch (inner diff a/src/rfc2131.c, 1-line change +2 → +1) + adds patches = [ ./CVE-2026-6507.patch ]; to package.nix; version 2.92 + src.hash unchanged. Reviewer (v3) accept: byte-for-byte functional equivalence to upstream-fix.patch confirmed, cross-family attestation honored. Hard-cell: DHCPv4-relay path requires live network; source inspection via pkgs.applyPatches + grep on "option_len(opt) + 2)" discriminates. Reproducer hand-written (model refused DHCPv4 behavioral test). CI cert GREEN (run 27860768690); cosign-signed (steward run 27860867107). bundle_id=5c21bf7479e98619.

source-backport (semantic-adaptation cohort, adaptation lane) — deterministic-no-model (re-materialized; live Patcher claude-opus-4-7 v4 + Reviewer claude-sonnet-4-5 v10 — see detail)

Semantic-adaptation cohort member — a documented Reviewer LANGUAGE-GENERALITY MISS, not a merge-ready fix. CWE-377 predictable plot temp-file names in maxima 5.47.0 (Common Lisp): upstream adds a random-name helper in src/plot.lisp and replaces fixed/pid filenames with (random-name 16) across src/plot.lisp, src/gnuplot_def.lisp, src/xmaxima_def.lisp. Adaptation lane (applies_verbatim=false → patcher.v4/reviewer.v10): Patcher (opus-4-7) authored a grounded backport, canonicalized to fuzz-0 (patch.diff sha 21acad11). reviewer.v10 (sonnet-4-5) scored 0.0 on the ONLY oracle-scored cohort member: it rejected the adaptation as not-equivalent because random-name is CALLED in xmaxima_def.lisp/gnuplot_def.lisp but DEFINED only in plot.lisp — flagging an "unresolved construct" under a per-file (C translation-unit) reading of its rule, while itself acknowledging Common Lisp's shared (in-package :maxima) resolves the symbol cross-file. The UPSTREAM GROUND-TRUTH fix has the identical cross-file structure, so the rule would reject the ground truth itself → the oracle (equivalent) STANDS and this is a genuine reviewer miss (follow-up: reviewer.v11 scopes "no unresolved constructs" to the language's real symbol-resolution unit). NOT cert-green, NOT signed. See DECISIONS 2026-07-27. bundle_id=c3ad8fadc690f28e.

source-backport (compound-guard-positive) — model-attested (Patcher claude-opus-4-7 v4 + Reviewer claude-sonnet-4-5); reviewer-attested evidence path

CWE-191→CWE-125 integer underflow → OOB read in krb5 NegoEx parse_message(). Model authored the guard extension (adds header_len < (size_t)(in->ptr - msg_base) disjunct, matching upstream acea6182). Source-backport carries upstream-ref verdict eligible-requires-human-review, so rule-2 forbids auto-merge — classified human-review-required (kind_reason=source-backport-experimental); the cert just-reports the Steward verdict. Preflight GREEN on krb5-1.22.1. Reviewer accept, cross-family honored. Reproducer-refusal rule 11: a bounded probe showed unpatched returns GSS_S_DEFECTIVE_TOKEN rc=1 identically to patched (no observable discriminator; the model's narrated rc=139 crash was refuted). Model reproducer archived under adjudication/model-reproducer/. First cert failed on a sourceRoot path-strip: nixpkgs krb5 sourceRoot=krb5-1.22.1/src, so the direct-lane model patch's tarball-root paths (a/src/lib/...) failed patchPhase -p1 from inside src/; fixed by a representation-only src/-strip (guard bytes byte-identical, body_identity_proof.identical=true), tool-verified in signed patch-normalization.json, Reviewer re-run live on the normalized bytes (accept). bundle_id=6f3c4f8c8f9b6c52. Cert GREEN (run 30330317560, 2026-07-28): patched_build.succeeded, dispatch_outcome=refused-no-reproducer, Steward allow=True deny=0, verdict-match just-reported for the non-auto-merge kind.

source-backport (compound-guard-positive, by-name) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

CWE-369 (as advised) in fig2dev 3.2.9a: COMMON_PROPERTIES(o) in fig2dev/object.h bounded style_val (dash/dot pattern length) only from below (o->style_val < 0.0), so a crafted .fig object with an arbitrarily large style_val passes INVALID_LINE() in read.c and reaches the pict2e driver's pattern code. Upstream fix da8992f44b84 ('Reject huge pattern lengths, ticket #185') adds #define STYLE_VAL_MAX 6400.0 and extends the guard with || o->style_val > STYLE_VAL_MAX — a compound-guard disjunct addition. BY-NAME package pkgs/by-name/fi/fig2dev/package.nix, no prior patches attribute (Patcher CREATES the list). preflight.applies_verbatim=true → VERBATIM lane. Reviewer accept, all scorers 1.0, cross-family honored. OBSERVED-FAILURE-MODE DIVERGENCE (recorded, not smoothed over): the advisory's SIGFPE divide-by-zero in get_slope() could NOT be reproduced on this pinned base — a sweep over 4 object types x 5 patterned line styles x 7 geometries x 10 style_val magnitudes (6400.5 .. 2^32) yielded only rc=0 or non-termination, and a dedicated 300s trigger run produced zero output bytes. The unpatched predicate is therefore a hang (timeout rc=124 + empty stdout), not a crash signal. finding.json deliberately left recording the advisory's claim; reproducer-log.txt records the measurement. Reproducer analyst-authored (model path non-functional); patched arm additionally asserts bound precision — style_val exactly 6400.0 ACCEPTED (guard is >, not >=), 6400.5 rejected — to catch an off-by-one backport. Local probe GREEN both arms 2026-08-05. CI cert GREEN (run 30988685073, 2026-08-05): both SIGNAL substrings verbatim, bound-precision assertions hold, Steward allow=True deny=0. bundle_id=d61ceda495a43928.

source-backport (compound-guard-positive, by-name) — anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5)

CWE-674 uncontrolled recursion in jq 1.8.1: jv_setpath()/jv_getpath()/jv_delpaths() in src/jv_aux.c recurse once per element of a caller-supplied path array with no depth limit, so a sufficiently deep path overflows the process stack. Upstream fix fb59f1491058 adds #define MAX_PATH_DEPTH (10000) plus a depth guard at each of the three entry points, returning Path too deep. BY-NAME package, APPENDS to the existing patches list. preflight.applies_verbatim=true → VERBATIM lane. Reviewer accept, all scorers 1.0, cross-family honored. Reproducer analyst-authored (model path non-functional): trigger is a FLAT 200000-element path array of string keys built via [range(N)|"a"] so array construction itself does not recurse; string (object) keys keep each container single-key so heap stays O(N) (~40MB) and the process overflows an 8MB stack — a genuine stack overflow rather than an OOM kill (integer indices would force O(N^2) dense arrays and OOM instead). Recorded execution 2026-07-28: unpatched rc=139 SIGSEGV, patched rc=5 Path too deep, jq's own 9-test suite PASS under the backport. Local re-verification 2026-08-05 blocked by a corrupt tzdata-2026a store path in the dev sandbox (Stale file handle; nix cannot delete it), breaking autoreconf-hook and hence any local jq build — an environment fault, not a bundle fault. CI cert GREEN (run 30988687217, 2026-08-05): both SIGNAL substrings verbatim (patched Path too deep' (rc=5), no crash), Steward allow=True deny=0. bundle_id=7a0ee515e6ff35b6.

source-backport (compound-guard-positive, core-interpreter default.nix): model-attested (Patcher claude-opus-4-7 v4 + Reviewer claude-sonnet-4-5); reviewer-attested evidence path

CWE-190 SSize_t integer overflow in perl 5.42.0 Perl_study_chunk() (regcomp_study.c), 32-bit-specific: a quantified wide-UTF-8 substring whose byte-length product overflows on 32-bit ptrsize yields an undersized allocation and heap corruption. Model AUTHORED the 3-conjunct overflow guard (l > 0 && (mincount >= SSize_t_MAX / l \|\| old > SSize_t_MAX - mincount * l)) matching upstream commit 5e7f119e (blead-only; no 5.42.x maintenance release carries it, hence verdict eligible-requires-human-review → classified human-review-required, krb5 CVE-2026-40356 precedent; cert just-reports the Steward verdict). Preflight GREEN on perl-5.42.0. Reviewer (sonnet-4-5) accept, cross-family honored. Reproducer-refusal rule 8: the CVE is 32-bit-only and the cert platform is x86_64; a bounded local probe (pinned nixpkgs c530e744) showed the malicious pattern OOM-killed rc=137 identically on both arms, so no discriminating reproducer is feasible on the cert platform; model reproducer archived under adjudication/model-reproducer/ and hash-anchored in reproducer-refusal.json. Deferred 2026-07-28, re-included 2026-08-31: the core perl interpreter is a default.nix derivation, which no Builder apply mode handled; commit 7b988675 added canonical-source-backport-remap (package.nix + wired-in *.patch payloads remapped onto the real file by content-match, applied under --directory), and the real patch.diff probed green through it locally. Compound-guard-positive slate (with krb5 CVE-2026-40356). bundle_id=9faf1de887b9b4ab. Payload context-normalized + Reviewer re-attested (commit 919632b7): cert run 33393218833 was RED because the Patcher payload's context lines each carried one extra leading space (added lines byte-identical to upstream-fix.patch), failing patchPhase Hunk #1; trace bundle normalize-context substituted the hunk from ground truth (identity proofs green, signed patch-context-normalization.json), the Reviewer re-ran live on the normalized bytes (verdict accept, invocation b6e41c71), and the bundle was re-finalized. CERT-DEFERRED (cold-stdenv, VERIFIED-normalization-correct): the normalization is proven correct (both cert runs got past patchPhase cleanly), but the pinned-rev perl 5.42.0 closure is cache-cold on cache.nixos.org, so patched_build cold-rebuilds perl + its full stdenv bootstrap (~100 derivations) and timed out at both the 1h default (run 33393218833) and the 3h builder window (run 33455711917, elapsed 10800s). Same cold-closure profile as the cert-deferred zlib/sqlite/cpython bundles; the bundle is cert-ready for a cache-warm path. Reviewer re-attestation + context-normalization stand.

source-backport (LIVE LANE, first harvested candidate) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 2026-09-05)

CWE-770 uncontrolled resource consumption in wget 1.25.0 ftp_login() (src/ftp-basic.c). The FTP OPIE/S-KEY challenge supplies a sequence number that wget parses unbounded and uses as an MD5 iteration count, so a hostile or intercepted FTP server can force roughly 2.1 billion MD5 rounds; --timeout does not bound CPU work. Upstream fix commit e9697d98 (Tim Ruehsen, 2026-08-10) refuses the login once the parsed sequence exceeds 9999. First bundle harvested by the beat-upstream screen rather than picked from history. No upstream release carries the fix: wget 1.25.0 (2024-11-10) is the newest release and the fix landed on master in 2026, so the bump lane cannot reach it. Pinned rev c2460146 (2026-08-07) predates the fix commit, so the tree cannot carry a human backport; nixpkgs already backports four other wget CVEs into this same package.nix via fetchpatch. Preflight green on both upstream-fix.patch and the model payload against the extracted pinned source. Patcher payload is code-line identical to upstream. Reviewer verdict accept. bundle_id=0599d03cf7b75fd2. Discriminating reproducer (behavioral, loopback FTP server sending 331 opiekey 2147483640): unpatched wget stalls the full timeout window and is killed (SIGNAL_UNPATCHED), patched wget returns in about a second with "The server refuses login." (SIGNAL_PATCHED). LOCAL nix-build GREEN 2026-09-05 and Linux cert GREEN (run 33992102211: by-name-package-nix apply, wget rebuilt in 108 s, both arms discriminate). Steward CI-signed 2026-09-05. Fork review PR #45 opened 2026-09-05 (no version bump; no human nixpkgs backport exists to compare against).

source-backport (live lane, screened candidate) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 6 September 2026)

CWE-95 eval injection in CHIRP. _clean_tmode() in chirp/drivers/kenwood_itm.py passes the TXSIG and RXSIG columns of an imported Kenwood ITM file straight to eval(), so opening a crafted file runs arbitrary Python as the user. Upstream fix commit 39178db (Dan Smith, 17 August 2026) parses those columns with kenwood_tone.parse_qtdqt() instead. Second bundle from the screened shortlist. nixpkgs packages a git snapshot pinned at rev a89815c5 (7 May 2026), three months before the fix, so the tree predates it and no release carries it. Preflight green on both upstream-fix.patch and the model payload. Reviewer verdict accept. Discriminating reproducer (behavioral): the unpatched build runs the injected expression and creates a marker file (SIGNAL_UNPATCHED); the patched build refuses the value as a malformed tone and nothing runs (SIGNAL_PATCHED). Both arms additionally load a legitimate ITM file to one memory, asserted as a precondition, so the backport is shown not to break normal use. LOCAL nix-build GREEN 6 September 2026 and Linux cert GREEN (run 34022859557: by-name-package-nix apply, both arms discriminate, a legitimate file loads to one memory on each). The first cert attempt (34022604718) failed the signal-substring check alone, because the log still declared the model's draft strings after the fixture was corrected; the log now records the output actually observed. Steward CI-signed 6 September 2026. Fork review PR #46 opened 6 September 2026 (no version bump; no human nixpkgs backport exists to compare against).

source-backport (live lane, first bundle from trace candidate run) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 7 September 2026)

CWE-918 SSRF guard gap in Mailpit 1.31.0. IsInternalIP in internal/tools/net.go, the deny list behind Mailpit's SSRF protections, omitted the Azure WireServer address 168.63.129.16 and the 0.0.0.0/8 block, so a request steered through Mailpit could reach the platform metadata channel. The upstream fix adds both, plus the IPv4-translated ::ffff:0:0:0/96 prefix and the 6to4 relay range. Third live-lane bundle and the first taken through every step by the orchestrator. Patcher payload code-line identical to upstream; Reviewer accept. Reproducer rebuilt by hand: the model's fixture reimplemented the function inline and tested its own copy, and did not compile either. The rebuilt fixture drops a Go test into the real package's internal/tools and runs it the way nixpkgs builds mailpit, with a baseline case (loopback blocked on both builds) proving the real function ran and a deny-list case that fails unpatched and passes patched. LOCAL two-arm probe GREEN 7 September 2026, probe.json in the bundle. bundle_id=9f4cface6ee5c538. Linux cert GREEN (run 34080684006, the first cert to pass the probe gate in CI: by-name-package-nix apply, mailpit rebuilt in 123 s, both arms discriminate). Steward CI-signed 7 September 2026. Fork review PR #47 opened 7 September 2026 (no version bump; no human nixpkgs backport exists to compare against).

source-backport (live lane, reviewer-attested, no reproducer) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 7 September 2026)

CWE-863 incorrect authorization in Snipe-IT 8.4.1: the bulk asset restore endpoint checked the assets.edit permission where every other restore path requires assets.delete, so an editor could undo an administrator's soft-delete. Upstream fix switches the authorize() call to delete. Second bundle from the orchestrator and the first chosen from the free-gate survey. Patcher payload code-line identical to upstream; Reviewer accept. The Reproducer refused, with a reasoned refusal: the flaw is an authorization decision inside a running Laravel application and the sandbox cannot host the app, its database or authenticated sessions. Evidence class is therefore reviewer-attested, not behaviourally proven; an in-memory sqlite PHPUnit fixture is a recorded follow-up. Cert run 34134839794 green (dispatch_outcome=refused-no-reproducer, require_probe=false): patch applies, package builds. Signed by steward run 34135333871, bundle_id 8a6fa90cd1692fce, verified locally. Stub-harness arc: the Reproducer refused again under v17 (a per-ability Gate stub called a diff match) and under both v18 draws (harness rule 2 misread as forbidding the harness from loading the patched controller). Three prompt versions is the cap, so the bundle stays reviewer-attested with all four refusal invocations in replay.json; re-signed by steward run 34142079187, rekor 2752469020, verified. Fork PR not opened; the draft comment waits for approval.

source-backport (live lane, reviewer-attested, no reproducer) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 7 September 2026)

CWE-79 reflected XSS in Netron 9.0.9: node names, type names and value descriptions reached the sidebar through innerHTML unescaped, so a crafted model file could run script inside the Electron app. Upstream fix routes five render sites through the existing escape() helper and adds frame-src 'none' to the page CSP. Third bundle from the orchestrator. Reviewer: all hunks match upstream, accept. The Reproducer refused: the flaw is only observable in the renderer's DOM and the sandbox has no display. Evidence class reviewer-attested; a DOM-shim fixture is a recorded follow-up. Cert green (run 34136639574, dispatch_outcome: refused-no-reproducer, OPA allow); signed by steward run 34136989686, rekor index 2752033523, bundle verify VERIFIED. Stub-harness arc: refused again under v16 and under both v17 draws, the last while conceding a recording stub can observe the innerHTML sink and then demanding proof of script execution. Three prompt versions is the cap, so the bundle stays reviewer-attested with all four refusal invocations in replay.json; re-signed by steward run 34141952858, rekor 2752467353, verified. Fork PR not opened; the draft comment waits for approval.

source-backport (live lane, two-arm with a stub harness) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9 + Reproducer claude-sonnet-4-5 v16; live 7 September 2026)

CWE-862 missing authorization in ntopng 6.6: the REST v2 delete handlers for notification endpoints and recipients ran no capability check, so an authenticated non-administrator could delete every notification target and silence alerts. Upstream fix adds auth.has_capability guards to the two handlers and to pools_rest_utils.delete_all_instances_pools. Fourth bundle from the orchestrator. Reviewer: all three hunks match upstream, accept. Pioneer of the v16 stub-harness arc: under v15 the Reproducer refused (handlers only run inside a live daemon); that reviewer-attested checkpoint was certified (run 34137408419) and signed (steward run 34138362111, rekor 2752192851). Under v16 the Reproducer loads both handlers under lua5_4 with the daemon globals stubbed (ntop, _POST, _GET, rest_utils, endpoints, recipients, auth) and a user without the notifications capability: the unpatched arm reaches reset_configs / cleanup, the patched arm answers not_granted first. Local probe discriminates. Cert with the probe gate on: green (run 34140050680, both arms discriminate in CI). Signed (steward run 34141088905, rekor 2752436428, verified). First two-arm stub-harness bundle in the corpus. Fork PR not opened.

source-backport (live lane, two-arm) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9 + Reproducer claude-sonnet-4-5 v18; live 7 September 2026)

CWE-611 class option leak in libxml2 2.15.3: xmlXIncludeProcess and xmlXIncludeProcessTree passed flags 0 to the XInclude context, so XML_PARSE_NONET and the other parser options set on the top-level parse were not applied to included documents, and the text loader never applied the context's parseFlags. Upstream fix propagates doc->parseFlags in both entry points and calls xmlCtxtUseOptions in xmlXIncludeLoadTxt. Fifth bundle from the orchestrator, first through every gate in one run (the bootstrap multivariant version fix landed the same day). Reviewer: all four hunks match upstream, accept. The Reproducer's first harness read only the last error (the XInclude-domain 1604 in both arms) and its log claimed codes the harness never printed; a hand edit made the harness record every emitted error and rewrote the log to the observed output. Unpatched arm: the loader tries to open the http href (XML_IO_ENOENT); patched arm: XML_IO_NETWORK_ATTEMPT. Local probe discriminates. Cert with the probe gate on: green (run 34144339754, both arms discriminate in CI). Signed (steward run 34144542836, rekor 2752634269, verified). Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-sonnet-5 v3 + Reviewer claude-fable-5-1 v11 + Reproducer claude-haiku-4-5 v18; live 13 September 2026)

Integer overflow in libxml2 2.15.3 xmlURIEscapeStr (uri.c): xmlStrlen returns 0 for a string longer than INT_MAX, so len becomes 0 + 20 and the write loop overruns the undersized allocation through int wrapping of the out counter. Upstream fix 8edbbdb0 adds a two-line if (len == 0) return(NULL); guard after the xmlStrlen call, shipped in 2.15.4. Base checked two ways before spend: v2.15.3 carries the bare call with no guard where v2.15.4 has it, and bundle preflight applies upstream-fix.patch -p1 to the pinned nix source. Patcher wired a nested patch into the libxml2 (2.15.3) extraPatches list and correctly left the libxml2_13 variant declared earlier in the same file untouched; payload preflight applies. Reviewer accept, authored hunk token-identical to upstream. Reproducer refused under rule 4: triggering needs a string longer than INT_MAX and the bundle carries no PoC, so no fixture is constructible. Evidence path is therefore reviewer-attested and the cert proves patch-applies plus package-builds and nothing more. First bundle under the 13 September model routing. Cert green with the probe gate off (run 34785913425): patch_apply.applied=true, patched_build.outcome=succeeded on x86_64-linux, dispatch_outcome=refused-no-reproducer and no unpatched arm, which is the reviewer-attested shape and the limit of what this cert claims. Not signed. Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-sonnet-5 v3 + Reviewer claude-fable-5-1 v11 + Reproducer claude-haiku-4-5 v18; live 14 September 2026)

CVSS 8.0 stack-based strcat overflow in libxml2 2.15.3 xmlSnprintfElements (valid.c): the opening "(" before the sibling loop and the closing ")" after it are written with no remaining-space check, so a long element list overruns the caller's buffer. CVE-2025-24928 fixed the identical pattern in the sibling xmlSnprintfElementContent and left this one. Upstream fix d1686f91 adds a bounds check before each strcat, returning early with an ellipsis when space is short, matching the guard the function's own loop already uses. Base cleared before spend by a dry-run against the v2.15.3 file and by bundle preflight against the pinned nix source. The Patcher appended its nested patch after the existing fetchpatch, so the payload preflight ran against a tree prepared through that preceding patch, not pristine source. Reviewer accept, both hunks line-for-line. Reproducer refused for want of a PoC, the same reason as CVE-2026-86139. Cert green with the probe gate off (run 34795874785): patch_apply.applied=true, patched_build.outcome=succeeded on x86_64-linux, dispatch_outcome=refused-no-reproducer. Not signed. Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-sonnet-5 v3 + Reviewer claude-fable-5-1 v11 + Reproducer claude-haiku-4-5 v18; live 14 September 2026)

Integer overflow into a heap overflow in libxml2 2.15.3 xmlDictAddQString (dict.c): the sibling xmlDictAddString carries pool-size overflow guards and this function has none, so namelen + plen + 1 can wrap an unsigned int and the following 4 * value yields a small allocation that memcpy then overruns writing the prefix and name. Upstream fix a4cba4b5 adds the same SIZE_MAX-based guards and a safe size_t cast. Base cleared before spend by a dry-run against v2.15.3 and by bundle preflight. Patcher reproduced the hunk line-for-line, all 19 upstream changed lines present, and prepended its nested patch so the payload preflight ran against pristine source. Reviewer accept, noting that libxml2_13 at 2.13.9 is flagged affected and left out of scope, for a human to decide. Reproducer refused, and for a sharper reason than its predecessors: an integer overflow into a heap overflow is silent without ASAN, so a signal-substring two-arm fixture cannot discriminate. That points at the ASAN cert path. Cert green with the probe gate off (run 34796629286): patch_apply.applied=true, patched_build.outcome=succeeded on x86_64-linux. Not signed. Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-sonnet-5 v3 + Reviewer claude-fable-5-1 v11 + Reproducer claude-haiku-4-5 v18; live 14 September 2026)

Heap-based buffer overflow in libxml2 2.15.3 xmlXPtrEvalXPtrPart (xpointer.c) reached through xpointer length saturation in xmlXPtrEval. Upstream fix 6b3a736c adds an overflow check, seven added lines and nothing removed. Base cleared before spend by a dry-run against v2.15.3 and by bundle preflight. The Patcher appended its nested patch at the END of the extraPatches list with explanatory comments, a third distinct wiring position across the four bundles, so the payload preflight ran against a tree prepared through the preceding fetchpatch. Reviewer accept. Reproducer refused under rule 3: the fix is a defensive check that prevents the overflow without changing observable output, so signal-substring arms cannot discriminate. Cert green with the probe gate off (run 34796888522): patch_apply.applied=true, patched_build.outcome=succeeded on x86_64-linux. Not signed. Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 7 September 2026)

CWE-125 out-of-bounds read in valkey 9.1.1: slot import ranges read from an RDB were never validated, so a hostile or corrupted dump.rdb could carry an out-of-range or reversed range that reached kvstoreGetHashtable as an out-of-bounds index. Upstream fix rejects any range at or past CLUSTER_SLOTS or with start past end, and tightens two kvstore.c asserts against negative indices. One of two survivors in the 285-CVE screen of the 6 September window. Reviewer: all three hunks match upstream exactly, accept. The Reproducer refused under rule 3 (the trigger is a crafted RDB loaded by a cluster-enabled server at startup, which the sandbox cannot stand up), so the bundle is reviewer-attested and the cert proves only that the patch applies and the package builds. Cert with the probe gate off: green (run 34145567764). Signed (steward run 34145907042, rekor 2752713501, verified). Fork PR not opened.

source-backport (live lane, reviewer-attested) - anthropic (Patcher claude-opus-4-7 v3 + Reviewer claude-sonnet-4-5 v9; live 7 September 2026)

CWE-863 improper authorization in Open5GS 2.8.0: handling a partial NG RESET or S1 RESET, the AMF and MME never checked that the UE contexts named in the request belonged to the base station that sent it, so a peer gNB or eNB could reset another node's UE associations. Upstream fix validates the owning node id, requires the core-network and RAN identifiers to name the same association when both are present, and guards the deferred acknowledgement paths. The second survivor of the 285-CVE screen of the 6 September window, and the largest live-lane fix so far at four files. Reviewer: all four hunks match upstream line for line, accept. The Reproducer refused under rule 3 (the flaw needs a running core daemon and two base-station peers over SCTP), so the bundle is reviewer-attested. Cert with the probe gate off: green (run 34145984386). Signed (steward run 34147112834, rekor 2752745591, verified). Fork PR not opened.

source-backport (live lane) - anthropic (Patcher claude-opus-4-8 v3 + Reviewer claude-sonnet-4-5 v9; live 8 September 2026)

Two sanitiser-evasion vectors in svgo 4.0.1's removeScripts plugin (GHSA-2p49-hgcm-8545). The plugin matched the literal element name, so a namespace-prefixed <svg:script> survived optimisation, and hasScripts compared the URI scheme case-sensitively, so a mixed-case JAVASCRIPT: href survived. Either leaves executable content in an SVG the caller believes was sanitised. Upstream adds SCRIPT_NAMESPACES + isNamespaceAwareElem with prefix tracking, and lowercases before the scheme test. One of nine survivors in the 100-CVE screen of the 8 September window. Reviewer: both files match upstream, the omitted version bump and test fixtures are contract-correct minimalism, accept. Reproducer discriminates on both vectors, with the unpatched arm reconstructed inside the fixture by filtering the CVE patch out of pkgs.svgo.patches; probe green after one per-bundle fix (draw-0 used a --enable flag svgo 4 does not have and its patched arm passed vacuously over an output file that was never written, the finding behind reproducer prompt v21 and the signal_hygiene probe gate). Cert green (run 34279644105), both signals fire on CI. Signed by the Steward workflow (run 34283639384), rekor log index 2762560753. Fork PR not opened.