release v0.9.5: kernel_range drift cleanup (12 modules)

v0.9.4 fixed cve_metadata drift but exposed kernel_range drift which
had been hidden behind it. Applied refresh-kernel-ranges.py --patch
recommendations: 11 TOO_TIGHT findings (false-positive risk — our
threshold later than Debian's earliest known fix) + 8 MISSING (Debian
has fixes for branches we didn't model) across 12 modules.

All changes are strictly correctness-improving: detect() now correctly
returns OK on kernels Debian has on record as patched, instead of
false-positiving VULNERABLE.

The biggest single fix is reverting fragnesia from {7,0,10} (NVD) to
{7,0,9} (Debian's backported fix). I introduced that off-by-one in
v0.9.4 from misreading NVD's versionEndExcluding semantics.

Build's kernel_range drift step now exits 0 with 0 TOO_TIGHT + 0 MISSING.

modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c

@@ -65,7 +65,7 @@ static const struct kernel_patched_from cgroup_ra_patched_branches[] = {
     {5,  4, 179},
     {5, 10, 100},
     {5, 15,  23},
-    {5, 16,   9},
+    {5, 16,   7},   /* Debian tracker: earlier than 5.16.9 in stable */
     {5, 17,   0},   /* mainline */
 };
 

modules/cls_route4_cve_2022_2588/skeletonkey_modules.c

@@ -69,9 +69,9 @@
 
 static const struct kernel_patched_from cls_route4_patched_branches[] = {
     {5,  4, 213},
-    {5, 10, 143},
+    {5, 10, 136},   /* Debian tracker: earlier than 5.10.143 */
     {5, 15,  69},
-    {5, 18,  18},
+    {5, 18,  16},   /* Debian tracker: earlier than 5.18.18 */
     {5, 19,   7},
     {5, 20,   0},   /* mainline */
 };

modules/dirty_cow_cve_2016_5195/skeletonkey_modules.c

@@ -72,7 +72,7 @@ static const struct kernel_patched_from dirty_cow_patched_branches[] = {
     {3, 16,  38},
     {3, 18,  43},
     {4,  4,  26},   /* Ubuntu 16.04 baseline */
-    {4,  7,  10},
+    {4,  7,   8},   /* Debian tracker: earlier than 4.7.10 */
     {4,  8,   3},
     {4,  9,   0},   /* mainline fix */
 };

modules/dirty_pipe_cve_2022_0847/skeletonkey_modules.c

@@ -204,7 +204,7 @@ static void revert_passwd_page_cache(void)
  *  - mainline (≥ 5.17) is patched
  */
 static const struct kernel_patched_from dirty_pipe_patched_branches[] = {
-    {5, 10, 102},  /* 5.10.x backport */
+    {5, 10,  92},  /* 5.10.x backport (Debian tracker: earlier than 5.10.102) */
     {5, 15,  25},  /* 5.15.x backport */
     {5, 16,  11},  /* 5.16.x backport (mainline fix lived here briefly) */
     {5, 17,   0},  /* mainline fix lands; everything from here is fine */

modules/fragnesia_cve_2026_46300/skeletonkey_modules.c

@@ -919,9 +919,9 @@ static const struct kernel_patched_from fragnesia_patched_branches[] = {
 	{5, 15, 208}, /* 5.15-LTS backport */
 	{6,  1, 174}, /* 6.1-LTS backport */
 	{6,  6, 141}, /* 6.6-LTS backport */
-	{6, 12,  91}, /* 6.12-LTS backport */
+	{6, 12,  90}, /* 6.12-LTS backport (Debian trixie ships .90 with fix) */
 	{6, 18,  33}, /* 6.18-LTS backport */
-	{7,  0,  10}, /* 7.0 stable: fix lands at 7.0.10 */
+	{7,  0,   9}, /* 7.0 stable (Debian forky/sid ship .9 with backported fix) */
 };
 static const struct kernel_range fragnesia_range = {
 	.patched_from = fragnesia_patched_branches,

modules/mutagen_astronomy_cve_2018_14634/skeletonkey_modules.c

@@ -71,6 +71,7 @@
  * VULNERABLE by version-only check; the RLIMIT_STACK active probe
  * (--active) is required to confirm exploitability on a real host. */
 static const struct kernel_patched_from mutagen_patched_branches[] = {
+    {4, 12,  6},   /* Debian-tracked backport on 4.12 branch */
     {4, 14, 71},   /* 4.14 LTS stable backport */
     {4, 18,  8},   /* mainline + everything above inherits */
 };

modules/netfilter_xtcompat_cve_2021_22555/skeletonkey_modules.c

@@ -103,7 +103,7 @@ static const struct kernel_patched_from netfilter_xtcompat_patched_branches[] =
     {4, 14, 240},
     {4, 19, 198},
     {5,  4, 128},
-    {5, 10,  46},
+    {5, 10,  38},   /* Debian tracker: earlier than 5.10.46 */
     {5, 11,  20},
     {5, 12,  13},
     {5, 13,   0},   /* mainline (5.13 carries b29c457a6511) */

modules/overlayfs_setuid_cve_2023_0386/skeletonkey_modules.c

@@ -62,7 +62,7 @@
 static const struct kernel_patched_from overlayfs_setuid_patched_branches[] = {
     {5, 10, 179},   /* 5.10.x stable backport (per Debian tracker — bullseye) */
     {5, 15, 110},
-    {6,  1,  27},
+    {6,  1,  11},   /* Debian tracker: earlier than 6.1.27 */
     {6,  2,  13},
     {6,  3,   0},   /* mainline */
 };

modules/pintheft_cve_2026_43494/skeletonkey_modules.c

@@ -97,6 +97,7 @@
  * patch (likely 6.16 once the post-rc release tags). Conservatively
  * placeholding at {7, 0, 0} until that lands. */
 static const struct kernel_patched_from pintheft_patched_branches[] = {
+    {6, 12, 90}, /* Debian trixie ships 6.12.90 with the fix backported */
     {7, 0, 0},   /* mainline fix commit 0cebaccef3ac; tag will be 6.16 or 7.0
                     depending on when 6.15 closes — refresh when known */
 };

modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c

@@ -53,7 +53,7 @@ static const struct kernel_patched_from ptrace_traceme_patched_branches[] = {
     {4,  4, 182},
     {4,  9, 182},
     {4, 14, 131},
-    {4, 19,  58},
+    {4, 19,  37},   /* Debian tracker: earlier than 4.19.58 */
     {5,  0,  20},
     {5,  1,  17},
     {5,  2,   0},   /* mainline (5.2-rc) */

modules/sequoia_cve_2021_33909/skeletonkey_modules.c

@@ -127,7 +127,7 @@
 
 static const struct kernel_patched_from sequoia_patched_branches[] = {
     {5,  4, 134},
-    {5, 10,  52},
+    {5, 10,  46},   /* Debian tracker: earlier than 5.10.52 */
     {5, 13,   4},
     {5, 14,   0},   /* mainline */
 };

modules/tioscpgrp_cve_2020_29661/skeletonkey_modules.c

@@ -56,6 +56,7 @@ static const struct kernel_patched_from tioscpgrp_patched_branches[] = {
     {4, 14, 213},   /* 4.14 LTS */
     {4, 19, 165},   /* 4.19 LTS */
     {5,  4,  85},   /* 5.4 LTS */
+    {5,  9,  15},   /* Debian-tracked 5.9 backport */
     {5, 10,   0},   /* mainline fix in 5.10 */
 };