{
  "entrypoint_kind": "tcp_peer",
  "entrypoint_detail": "QUIC/HTTP3 UDP peer: parameterized quic-go client dials XQUIC demo_server, opens HTTP/3 control stream + QPACK encoder uni stream, sends Set Dynamic Table Capacity / Insert instructions (3 payload shapes)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "xquic-demo_server-v1.9.4-ASAN",
    "babassl(tongsuo)-8.4-stable",
    "quic-go-v0.60.0-client",
    "gcc-AddressSanitizer"
  ],
  "sanitizer_used": true,
  "payloads": [
    {
      "name": "P1",
      "init_cap": 64,
      "insert_count": 61,
      "final_cap": 65,
      "mcap": 128,
      "sidx": 122,
      "role": "original PoC"
    },
    {
      "name": "P2",
      "init_cap": 64,
      "insert_count": 59,
      "final_cap": 65,
      "mcap": 128,
      "sidx": 118,
      "role": "alternate wrap state"
    },
    {
      "name": "P3",
      "init_cap": 64,
      "insert_count": 123,
      "final_cap": 200,
      "mcap": 256,
      "sidx": 246,
      "role": "alternate grow factor"
    }
  ],
  "vulnerable_crashes": 3,
  "fixed_bypasses": 0,
  "proof_artifacts": [
    "logs/vuln_variant/vuln_P1_server.stderr",
    "logs/vuln_variant/vuln_P1_client.stdout",
    "logs/vuln_variant/vuln_P1_result.txt",
    "logs/vuln_variant/fixed_P1_server.stderr",
    "logs/vuln_variant/fixed_P1_client.stdout",
    "logs/vuln_variant/fixed_P1_result.txt",
    "logs/vuln_variant/vuln_P2_server.stderr",
    "logs/vuln_variant/vuln_P2_client.stdout",
    "logs/vuln_variant/vuln_P2_result.txt",
    "logs/vuln_variant/fixed_P2_server.stderr",
    "logs/vuln_variant/fixed_P2_client.stdout",
    "logs/vuln_variant/fixed_P2_result.txt",
    "logs/vuln_variant/vuln_P3_server.stderr",
    "logs/vuln_variant/vuln_P3_client.stdout",
    "logs/vuln_variant/vuln_P3_result.txt",
    "logs/vuln_variant/fixed_P3_server.stderr",
    "logs/vuln_variant/fixed_P3_client.stdout",
    "logs/vuln_variant/fixed_P3_result.txt"
  ],
  "notes": "vuln ASAN crashed 3/3 payloads with heap-buffer-overflow READ in xqc_ring_mem_resize:139; fixed (one-line ori_sz1=rmem->capacity-soffset_ori) ASAN-clean/alive on 3/3; bypasses=0 -> NO BYPASS, fix is complete"
}