## https://sploitus.com/exploit?id=79D8AB3B-D7A9-53DE-B14D-2762D712DE00
# CVE-2021-43267 Work Artifacts
This bundle preserves the current `case-001` pipeline artifacts and the later
primary-runner proof for CVE-2021-43267 from:
```text
/root/tests/cve4test/full_agent_runs/
20260714-goal-dev-priority-four-nonwindow-gpt56-02
```
## Verified result
The current route run classifies this case as `accepted_alternative`, and the
current downstream run classifies the generated build as
`runtime_ready_artifact`. A later runtime-assessor continuation in the copied
workdir publishes `outcome=support` for the same selected route.
The authoritative case-level proof is
`logs/runtime-evidence/runtime-0003.runner.json`. It records:
- `support_proof.full_observed=true`;
- UID and EUID 0 with effective capabilities `000001ffffffffff`;
- user namespace `user:[4026531837]`, equal to guest PID 1's namespace;
- `origin=run_created_helper` for `/tmp/tipc-helper`;
- `root_write=true`, `vm_alive=true`, and `stable_kernel=true`.
The corresponding support contract is
`artifacts/runtime/contracts/runtime_assessment.json`. The runner timed out
after proof while retaining the helper, but the proof was observed before the
timeout and the VM and kernel remained healthy.
## Summary provenance caveat
The enclosing harness summary was written before the successful
`runtime-0003` continuation. It therefore still says
`runtime_repair_evidence` and `selected_supported=false`. That older snapshot
is retained under `artifacts/runtime/pre-support-harness/`; it is not the
source of the support claim. The support claim is grounded in the later runner
record, authority sidecar, complete stdout/dmesg, support assessment, and
specialist publication result.
No fresh targeted harness `summary.json` was emitted after the continuation.
The parent Trellis task also remains open because manuscript-wide acceptance
requires nine current support cases in one frozen all-nine run.
## Integrity anchors
The proof-bearing runtime build is:
```text
source f1da810ea027777c552db06e789b8b0ec7e336cd56f1b9fc2c887703eab4e2de
binary f34658c6220116111d500113b1963142caef5f7fc9716c72720fe6814a5a1f24
```
The source and binary are in `exploits/runtime-tested/`. The earlier current
downstream build is retained separately in `exploits/current/` with hashes
`679b8e5714c6b9cc2b324c496ac6a0fa41fde7e24e1e2817cfbadbe56a9a67a3`
and `709e2ce0fc034e55b1e20af3adfb33e75cfc6611d4b04d9d0aa6fe26165408e8`.
## Layout
- `artifacts/current/`: accepted route, realization plan, generated-code
contract, stage summaries, validation reports, and reproduction metadata.
- `artifacts/runtime/`: proof-bearing support assessment and exact runtime
contracts; the older enclosing summary is isolated in
`pre-support-harness/`.
- `exploits/`: current downstream and proof-bearing runtime source/binary.
- `logs/runtime-evidence/`: runner, authority, stdout/stderr, and dmesg
sidecars. `runtime-0003` is authoritative.
- `logs/runtime-diagnostics/` and `logs/guest-shell-transcripts/`: specialist
continuation log and complete guest command transcripts.
- `logs/current/`: route-strategist, route-realizer, and code-builder records.
- `reference/`: fixture PoC and reviewed exploit materials from `/root/tests`.
All collected raw files are byte-for-byte copies. Absolute source paths inside
JSON records are intentionally preserved for provenance.
## Deliberate omissions
Linux source/build trees, QEMU overlays, primitive databases, CodeQL data,
full gadget dumps, and core files are not duplicated. They total several
gigabytes and are rebuild/replay inputs rather than authority proof. Their
source locations remain recorded in the copied contexts and manifests.