[variant] ROOT=/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle
[variant] Testing timeout self-cancel candidate against vulnerable and fixed c-ares
[variant] vulnerable v1.34.6 -> 3ac47ee46edd8ea40370222f91613fc16c434853
[variant] fixed v1.34.7 -> d63b7de3a3568d14ab1351374b205365aed51cca
[variant] reusing build /data/pruva/project-cache/9df4008f-3939-41d4-a08c-7804dd0a4a95/repo/build-prod
[variant] reusing build /data/pruva/project-cache/9df4008f-3939-41d4-a08c-7804dd0a4a95/repo-fixed/build-prod
[variant] compiling /data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe_vuln
/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c: In function 'process_loop':
/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c:95:5: warning: 'ares_getsock' is deprecated: Use ARES_OPT_EVENT_THREAD or ARES_OPT_SOCK_STATE_CB instead [-Wdeprecated-declarations]
   95 |     int bitmask = ares_getsock(channel, socks, ARES_GETSOCK_MAXNUM);
      |     ^~~
In file included from /data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c:13:
/data/pruva/project-cache/9df4008f-3939-41d4-a08c-7804dd0a4a95/repo/include/ares.h:903:31: note: declared here
  903 |   ARES_OPT_SOCK_STATE_CB) int ares_getsock(const ares_channel_t *channel,
      |                               ^~~~~~~~~~~~
[variant] compiling /data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe_fixed
/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c: In function 'process_loop':
/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c:95:5: warning: 'ares_getsock' is deprecated: Use ARES_OPT_EVENT_THREAD or ARES_OPT_SOCK_STATE_CB instead [-Wdeprecated-declarations]
   95 |     int bitmask = ares_getsock(channel, socks, ARES_GETSOCK_MAXNUM);
      |     ^~~
In file included from /data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/timeout_cancel_probe.c:13:
/data/pruva/project-cache/9df4008f-3939-41d4-a08c-7804dd0a4a95/repo-fixed/include/ares.h:903:31: note: declared here
  903 |   ARES_OPT_SOCK_STATE_CB) int ares_getsock(const ares_channel_t *channel,
      |                               ^~~~~~~~~~~~
[variant] === vulnerable timeout self-cancel candidate ===
/data/pruva/runs/632d040c-983d-409b-aa50-83e9e54bd367/bundle/vuln_variant/reproduction_steps.sh: line 266:  3884 Aborted                    (core dumped) ASAN_OPTIONS=detect_leaks=0 MALLOC_CHECK_=3 timeout 20 "$VULN_BIN" > "$LOGS/vuln_variant_timeout_vuln.log" 2>&1
[client] issuing public ares_query_dnsrec() to blackhole DNS peer 127.0.0.1:40232
[client] ares_query_dnsrec rc=0 (Successful completion) qid=1930
[server] received UDP DNS query bytes=64 qid=1930; intentionally withholding response to drive process_timeouts()
[callback] entry #1 status=12 (Timeout while contacting DNS servers) timeouts=1 cancel_called=0
[callback] reentering public ares_cancel(channel) from timeout callback
[callback] entry #2 status=24 (DNS query cancelled) timeouts=0 cancel_called=1
[callback] returned from reentrant ares_cancel(channel)
free(): double free detected in tcache 2
[variant] === fixed timeout self-cancel candidate ===
[client] issuing public ares_query_dnsrec() to blackhole DNS peer 127.0.0.1:52122
[client] ares_query_dnsrec rc=0 (Successful completion) qid=21529
[server] received UDP DNS query bytes=64 qid=21529; intentionally withholding response to drive process_timeouts()
[callback] entry #1 status=12 (Timeout while contacting DNS servers) timeouts=1 cancel_called=0
[callback] reentering public ares_cancel(channel) from timeout callback
[callback] returned from reentrant ares_cancel(channel)
[result] received_query=1 done=1 callback_count=1 cancel_called=1 first_status=12
[variant] ALTERNATE TRIGGER ONLY: vulnerable timeout path double-free confirmed, but v1.34.7 blocks it
[variant] wrote runtime_manifest.json
[variant] wrote validation_verdict.json variant_result=confirmed_alternate_trigger bypass=False
[variant] FINAL setup_ok=1 vuln_rc=134 fixed_rc=0 vuln_repro=1 fixed_repro=1 vuln_memory_safety=1 fixed_memory_safety=0 alternate_trigger=1 bypass_confirmed=0