{
  "schemaVersion": 1,
  "caseId": "smallvec-cve-2021-25900",
  "run": "historical-detection-20261020",
  "preregistration": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/preregistration.json",
    "sha256": "6c7ef71cffa3729de787444c67823b01afcda71d61b42f2a005fda892a07db91",
    "websiteCommit": "aeb254a5673d716048f72d500fc57aaca477042c"
  },
  "tool": {
    "name": "vettalon",
    "version": "0.3.0"
  },
  "models": {
    "finder": "claude-opus-5-5 via claude CLI 2.1.300 (Anthropic)",
    "verifiers": [
      "grok-4.7 via grok CLI 1.0.62 (xAI, container sandbox)",
      "gpt-oss-120b-medium via agy 1.4.3 (OpenAI family, host)"
    ]
  },
  "command": "vettalon scan <release tree> --profile deep --config roster.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --source-receipts --trace trace.jsonl --report report.json --fail-on none --lang en",
  "hintLevel": "L0",
  "target": {
    "file": "src/lib.rs",
    "vulnerableRanges": [
      [
        1011,
        1070
      ]
    ],
    "fixedRanges": [
      [
        1011,
        1090
      ]
    ],
    "acceptedCwes": [
      "CWE-787",
      "CWE-119",
      "CWE-120",
      "CWE-122",
      "CWE-131",
      "CWE-805",
      "CWE-788"
    ]
  },
  "arms": {
    "vulnerable": {
      "version": "1.6.0",
      "archiveUrl": "https://static.crates.io/crates/smallvec/smallvec-1.6.0.crate",
      "archiveSha256": "1a55ca5f3b68e41c979bf8c46a6f1da892ca4db8f94023ce0bd32407573b1ac0",
      "treeSha256": "beac46b7d4c9e50af85375caf5fd432dd89b889360afd6a157b174d81e17b058",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "calls": {
        "total": 7,
        "finder": 6,
        "verifier": 1,
        "failed": 0
      },
      "reportSha256": "9849a3cc419303d1f92ed11810582931d29cfe064ef6a17dbcaa1f970d8b817b",
      "modules": {
        "selected": 6,
        "reviewed": 6
      },
      "targetFile": {
        "reviewed": true,
        "truncated": true,
        "submittedSha256": "1012cb230baf0302f5a4f0642f30bbde40da72cc016e45b8f966f5ea0b21bdff"
      },
      "outcome": "found",
      "matches": [
        {
          "file": "src/lib.rs",
          "line": 1044,
          "cwe": "CWE-787",
          "severity": "high",
          "status": "needs_human",
          "title": "insert_many heap/stack buffer overflow when iterator yields more items than its size_hint lower bound",
          "verification": [
            {
              "model": "grok",
              "family": "xai",
              "verdict": "plausible"
            }
          ]
        }
      ],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    },
    "fixed": {
      "version": "1.6.1",
      "archiveUrl": "https://static.crates.io/crates/smallvec/smallvec-1.6.1.crate",
      "archiveSha256": "fe0f37c9e8f3c5a4a66ad655a93c74daac4ad00c441533bf5c6e7990bb42604e",
      "treeSha256": "be05a1573cbb69261b8933a06da740df3b4e9dc65dd611bd85bed0a28fece046",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "calls": {
        "total": 6,
        "finder": 6,
        "verifier": 0,
        "failed": 0
      },
      "reportSha256": "057e3821747265be68c472941d633a0ccf7c4ca62fa21b7217f18e461e51218f",
      "modules": {
        "selected": 6,
        "reviewed": 5
      },
      "targetFile": {
        "reviewed": true,
        "truncated": true,
        "submittedSha256": "6ba7c3add4e6f4db7c0162e390c20d861181ff746c04f3b3329cba63fe90dc20"
      },
      "outcome": "notFlagged",
      "matches": [],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    }
  },
  "limitations": {
    "zh": "這是已公開、已修補漏洞的偵測基準，不是新發現。模型訓練資料可能已包含此公告或修補，命中不能證明模型是從程式碼推理出來的。候選與 needs_human 都不是自動確認，也沒有執行 PoC。比對標準在掃描前登錄；其他輸出只列數量，未經審閱、未公開位置。原始 report.json 與 trace 不公開，只列 SHA-256。單次執行，模型輸出有隨機性，重跑結果可能不同。",
    "en": "This is a detection benchmark on an already disclosed and patched issue, not a new discovery. The models may have seen the advisory or the fix during training, so a match does not show that the model reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC was run. Match criteria were registered before scanning. Other findings are listed as counts only; they were not reviewed and their locations are not published. The raw report.json and trace are not public; only their SHA-256 is listed. Single run; model output is nondeterministic and a rerun may differ."
  }
}