{
  "entrypoint_kind": "tcp_peer",
  "entrypoint_detail": "spoolss RPC StartDocPrinter(pDocName) over SMB pipe \\pipe\\spoolss (TCP 445, guest/anonymous); client opens printer via RpcOpenPrinter, starts document with crafted pDocName, writes data, ends document -> server runs print command with %J = document_name via system()",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "variant_triggered": true,
  "is_bypass": false,
  "runtime_stack": [
    "smbd 4.22.9 (vulnerable, sha ff3dd691f38e23f9ea8d18376df1b24ea9b335b6)",
    "smbd 4.22.10 (fixed, sha 0abfaceda097f447ac0284db9f639dabc5070595)",
    "impacket DCERPC/spoolss RPC client"
  ],
  "proof_artifacts": [
    "artifacts/smb-vuln-spoolss/printlog.txt",
    "artifacts/smb-vuln-spoolss/marker_check.txt",
    "artifacts/smb-vuln-spoolss/exploit_output.txt",
    "artifacts/smb-vuln-spoolss/has_id_output.txt",
    "artifacts/smb-fixed-spoolss/printlog.txt",
    "artifacts/smb-fixed-spoolss/marker_check.txt",
    "artifacts/smb-fixed-spoolss/exploit_output.txt",
    "artifacts/smb-fixed-spoolss/has_id_output.txt",
    "logs/vuln_variant/variant_repro.log"
  ],
  "vulnerable_id_output": "yes",
  "vulnerable_marker": "yes",
  "fixed_id_output": "no",
  "fixed_marker": "no",
  "notes": "Variant uses spoolss RPC StartDocPrinter(pDocName) instead of SMB file open. Both paths converge at generic_job_submit(). spoolss path is not subject to SMB filename character restrictions. Fix covers this path because it is at the sink (generic_job_submit), not the entry point."
}