{
  "entrypoint_kind": "dns_query_timeout",
  "entrypoint_detail": "public ares_query_dnsrec() sends a DNS query to a real localhost UDP DNS peer that receives but withholds the response; process_timeouts() invokes the completion callback, which reenters c-ares through public ares_cancel().",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "c-ares v1.34.6 vulnerable static libcares.a",
    "c-ares v1.34.7 fixed static libcares.a",
    "gcc non-sanitized harness with glibc MALLOC_CHECK_=3",
    "public ares_query_dnsrec() API",
    "public ares_cancel() reentrancy from callback",
    "localhost UDP DNS blackhole peer"
  ],
  "source_revisions": {
    "vulnerable": "3ac47ee46edd8ea40370222f91613fc16c434853",
    "fixed": "d63b7de3a3568d14ab1351374b205365aed51cca"
  },
  "candidate_result": {
    "vulnerable_reproduced_candidate": true,
    "fixed_reached_same_candidate_path": true,
    "vulnerable_memory_safety_observed": true,
    "fixed_memory_safety_observed": false,
    "alternate_trigger_confirmed_on_vulnerable": true,
    "bypass_confirmed": false
  },
  "proof_artifacts": [
    "logs/vuln_variant_reproduction_steps.log",
    "logs/vuln_variant_timeout_vuln.log",
    "logs/vuln_variant_timeout_fixed.log",
    "logs/vuln_variant_fixed_version.txt",
    "vuln_variant/timeout_cancel_probe.c",
    "vuln_variant/reproduction_steps.sh"
  ]
}