# Gate Reviews and Verdicts

Locally adapted from Trail of Bits; see ../LOCAL_ADAPTATIONS.md. Judge the technical claim and
program eligibility separately. Evaluate relevant gates with evidence; mark irrelevant ones N/A.

| Gate | Criterion | Pass | Fail |
|------|-----------|------|------|
| **1. Process** | All phases completed with documented evidence | Evidence exists for every phase | Phases lack concrete evidence |
| **2. Reachability** | Attacker can reach and control data at the vulnerability | Clear evidence of attacker-controlled path + PoC confirms | Cannot demonstrate attacker control or reachability |
| **3. Real Impact** | A meaningful security guarantee is violated, including eligible integrity, availability, accounting, or AI-context effects | Concrete consequence under the applicable threat model | Evidence disproves the claimed security effect |
| **4. PoC Validation** | An executed test or independently checkable proof establishes the effect | Controls support attacker control, trigger, and impact | The purported effect is refuted; missing evidence is inconclusive |
| **5. Math Bounds** | Mathematical analysis confirms vulnerable condition is possible | Algebraic proof shows condition is possible | Math proves validation prevents it |
| **6. Environment** | No environmental protections entirely prevent exploitation | Protections do not eliminate vulnerability | Environmental protections block it entirely |

## Verdict Format

- **TRUE POSITIVE**: The technical claim is supported. Separately state whether it is reproduced,
  eligible under the program, and ready to report.
- **FALSE POSITIVE**: Evidence disproves the claimed security effect under its stated conditions.
  Name the observed check, impossible prerequisite, intended authority, or other refutation.
- **INCONCLUSIVE**: Access, controls, or evidence are insufficient. Name the smallest missing test.
  An unexecuted PoC, failed harness, model assertion, or missing observation is not reproduction.

Record decisive evidence and stop redundant phases. A known or accepted-risk flaw can be technically
real and bounty-ineligible. Documented behavior can still cause a distinct flaw at a downstream
boundary. Do not invent defenses or dismiss demonstrated harm because remediation looks expensive.

## Example Verdict

```
BUG #3 FALSE POSITIVE — Integer underflow in packet_handler.c:142
  Gate 5 (Math Bounds) FAIL: validation at line 98 ensures packet_size >= 16,
  making (packet_size - header_size) >= 8. Underflow is mathematically impossible.
```