diff --git a/core/offsets.c b/core/offsets.c
index dba63c4..d2fa716 100644
--- a/core/offsets.c
+++ b/core/offsets.c
@@ -212,10 +212,20 @@ static int parse_symfile(const char *path,
     fclose(f);
 
     /* /proc/kallsyms returns all-zero addrs under kptr_restrict — treat
-     * that as "couldn't read", not "actually zero". */
+     * that as "couldn't read", not "actually zero". Undo ONLY the bogus
+     * KALLSYMS source tags this pass may have set on still-zero fields —
+     * do NOT clobber values a higher-priority source (env vars) already
+     * provided, or the env override is silently wiped on any kptr_restrict
+     * host (which is every default host). */
     if (!saw_nonzero) {
-        o->modprobe_path = o->poweroff_cmd = o->init_task = o->init_cred = 0;
-        o->source_modprobe = o->source_init_task = OFFSETS_NONE;
+        if (o->source_modprobe == OFFSETS_FROM_KALLSYMS) {
+            o->modprobe_path = 0;
+            o->source_modprobe = OFFSETS_NONE;
+        }
+        if (o->source_init_task == OFFSETS_FROM_KALLSYMS) {
+            o->init_task = 0;
+            o->source_init_task = OFFSETS_NONE;
+        }
         return 0;
     }
     return filled;
diff --git a/docs/VERIFICATIONS.jsonl b/docs/VERIFICATIONS.jsonl
index 6f70a60..9ea3261 100644
--- a/docs/VERIFICATIONS.jsonl
+++ b/docs/VERIFICATIONS.jsonl
@@ -50,3 +50,4 @@
 {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - SUDO_EDITOR/-- injection hits sudoedit writable-dir guard; needs target-file tuning + module debug. Structural, tractable.","status":"needs_debug"}
 {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via su skel; /etc/passwd gained skel::0:0 (after 2 fixes: chdir / + helper basename match)","status":"root"}
 {"module":"sudo_host","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + host-restricted sudoers rule","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via sudo -h fakehost01; module works as shipped (needs host-restricted rule + resolvable host)","status":"root"}
+{"module":"nf_tables","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - offset resolver FIXED (env modprobe_path now resolves + finisher engages + pipapo arb-write fires), but the reconstructed double-free arb-write does not reliably land the write. Honest FAIL. Primitive needs slab-groom hardening.","status":"primitive_fires_no_root"}