{
  "entrypoint_kind": "tcp_peer",
  "entrypoint_detail": "raw TCP writes against the inets httpd listener: POST with Transfer-Encoding: chunked, headers in one write, then a separate write with non-hex chunk-size line 'ZZZ\\r\\n', socket held open",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "erlang-otp-source-build",
    "inets-httpd"
  ],
  "target_identity": {
    "repository_url": "https://github.com/erlang/otp.git",
    "commit_sha": "e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8",
    "target_digest": "fac886b1b27ab179e4541c7bf166b06ff9e1f3800dd1334f5f510e6a5cf67449",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "repro/evidence/vulnerable_attempt1/result.json",
    "repro/evidence/vulnerable_attempt1/census.log",
    "repro/evidence/vulnerable_attempt1/client_output.log",
    "repro/evidence/vulnerable_attempt1/stdout.log",
    "repro/evidence/vulnerable_attempt1/port.txt",
    "repro/evidence/vulnerable_attempt2/result.json",
    "repro/evidence/vulnerable_attempt2/census.log",
    "repro/evidence/vulnerable_attempt2/client_output.log",
    "repro/evidence/vulnerable_attempt2/stdout.log",
    "repro/evidence/vulnerable_attempt2/port.txt",
    "repro/evidence/fixed_attempt1/result.json",
    "repro/evidence/fixed_attempt1/census.log",
    "repro/evidence/fixed_attempt1/client_output.log",
    "repro/evidence/fixed_attempt1/stdout.log",
    "repro/evidence/fixed_attempt1/port.txt",
    "repro/evidence/fixed_attempt2/result.json",
    "repro/evidence/fixed_attempt2/census.log",
    "repro/evidence/fixed_attempt2/client_output.log",
    "repro/evidence/fixed_attempt2/stdout.log",
    "repro/evidence/fixed_attempt2/port.txt",
    "repro/evidence/summary.json",
    "repro/evidence/vuln_bare_catch.txt",
    "repro/evidence/fix_hunk.txt"
  ],
  "artifact_sha256": {
    "repro/evidence/vulnerable_attempt1/result.json": "bb5bbc58f870ff9ed0977450bfc5cd180fb7d433f6bb68e23e3006c23637cc3b",
    "repro/evidence/vulnerable_attempt1/census.log": "e436f37ca0ae2ebeaf20e7d14fa5f2959f6cce0e6356473a3a07b12931e655c8",
    "repro/evidence/vulnerable_attempt1/client_output.log": "ad3c6d3976990f850a68ee8a54522ff7d3d43ea2f97f87dae5ce186840559f25",
    "repro/evidence/vulnerable_attempt1/stdout.log": "85baf64e33edca7ca863249efb50a68bdde85abc3cdbaa9734d44d8aed305778",
    "repro/evidence/vulnerable_attempt1/port.txt": "b48f1ea52eac503bcda8ca98e35cc52ef085da0e675f25cb355539516bc190a8",
    "repro/evidence/vulnerable_attempt2/result.json": "d9ee5ea279238da2090b789564548d4b8b5947d0d13bec51f4430951eccc2c6b",
    "repro/evidence/vulnerable_attempt2/census.log": "fa13e7e1d1f36f3a0737c21b18de33c0e3327a461b4bf6650b7b461de1bb82f1",
    "repro/evidence/vulnerable_attempt2/client_output.log": "1c100a36f26046b34bfd67e70d63404ac247eca979f15b3dbb4050574be176ad",
    "repro/evidence/vulnerable_attempt2/stdout.log": "b4229a3fd977524c6c0a12e2ab7b0257aa607107dc2e978d5170634c27be04de",
    "repro/evidence/vulnerable_attempt2/port.txt": "b8f937b29cc914535d903eab954727b4fc29391d59e56386bb1a335d035e8843",
    "repro/evidence/fixed_attempt1/result.json": "30a64e3bcd44cffc06dcab0545a693194c55d8bb968a8da5424f8e58d219f292",
    "repro/evidence/fixed_attempt1/census.log": "9e8250d31fff9fa690fcb6073bc3756a70ffdf6cc6c246164a5e0a0168aa3862",
    "repro/evidence/fixed_attempt1/client_output.log": "c80d9324fe5d841c7a84f3a01d01488f38a0026eceaf22c818fb212cf91e1388",
    "repro/evidence/fixed_attempt1/stdout.log": "98781d4ba6fdd931d0ccc05587a08247472c59440d14c7cf810d0d96bb78dfd2",
    "repro/evidence/fixed_attempt1/port.txt": "1b19663d75a2fe8b201a62f57983c697308217f81d067da5d108b274909efd7d",
    "repro/evidence/fixed_attempt2/result.json": "65d784f93c91896cfa6bcfc778a40849584e4224e74dda039bda8ce939d1a473",
    "repro/evidence/fixed_attempt2/census.log": "41555cfb08d0eb9e7c142c09662d93309900b93b5fb1e89a039d7956f653083d",
    "repro/evidence/fixed_attempt2/client_output.log": "2f7a266ebe1090ba70edbf0d18918c575a7395a47694d775acf72d788eb4c188",
    "repro/evidence/fixed_attempt2/stdout.log": "447df4ab6acc1029263829408021eaa51ac054808d76343cb6c87ce158bc9c65",
    "repro/evidence/fixed_attempt2/port.txt": "0907f0353157e02bdc0b7d16240cd761b5d99cfd8af1898e634b22dc6d6a8066",
    "repro/evidence/summary.json": "57880bdd678c7acccbe865621c6fb79ebcda6050585f805d109c6f355108a05e",
    "repro/evidence/vuln_bare_catch.txt": "e4eb0511ea3e9f37e8e934bc00a3824426dd60a9d2957206ecb77cf440b92fc1",
    "repro/evidence/fix_hunk.txt": "7174b6160385d51ed52ace91734fc6bb940351fa52531a6a8ed8f35b926107b9"
  },
  "notes": "Vulnerable commit e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8 (inets 9.3.2.6) parks the request worker indefinitely (census proves the same handler pid alive beyond the 150s default keep-alive timeout with zero traffic, and 160 parked connections deny service to fresh legitimate clients); fixed control commit a3adf63078438c86527d704e23282b7721d8ca12 (same tree rebuilt at the fix) returns 400 Bad Request immediately and cannot be exhausted. Two vulnerable and two fixed attempts, each on a fresh node; census.log per attempt is the server-side process census, finalized before node shutdown."
}