{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "7764ad4b4a89ccc051bd7f8469afd8255e29cd6502f0e301494fc90bc0c29c2e",
    "authored_runtime_manifest_sha256": "4c642d86934b822e3c33088382fa9d85d7ce75508a320d52fe4b15aab15aeabb",
    "authored_verdict_sha256": "a55ba6d107872a44835ac83e7e33ebc08d80543eced70a38edba0bc6babe4629",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "accepted_exploit_knowledge_record_ids": [
    "0d8b40ff-f204-4bc6-b95a-25601c647444",
    "580bce02-0339-43d0-b49a-dd9b1df07e92",
    "68f34ef7-0595-4dd9-a05c-1618ac8d088e",
    "c80d7fbf-9da5-456d-a9ae-7b8e33293eff"
  ],
  "attacker_controlled_input": "A malicious TLS/HTTP/2 TCP peer controls flow-control stalls, REFUSED_STREAM resets, HPACK headers, TLS session tickets used for heap grooming, resurrected-stream window updates, and the final fake Curl_easy callback trigger while the victim runs curl -Z -T on a 586035-byte file.",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "code_execution",
  "claimed_surface": "network_protocol",
  "crash_observed": true,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "code_execution",
  "read_write_primitive_observed": true,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "RST_STREAM retry -> vulnerable multi_done ordering flushes queued upload bytes as a new h2 request -> orphaned stream retains freed Curl_easy pointer -> TLS-ticket/HPACK heap grooming reclaims and corrupts it -> forged-stream over-read discloses current libc/libcurl bases -> fake Curl_easy sets fdebug to fresh libc system() -> invalid frame callback executes id>mk_<nonce> in the curl process",
  "validated_surface": "network_protocol"
}