offsets: fix env override being wiped under kptr_restrict (unblocks all full-chains)

skeletonkey_offsets_resolve() runs sources in priority order: env vars first,
then /proc/kallsyms. On any default host kallsyms returns all-zero addresses
(kptr_restrict), and parse_symfile treated "all zero" by UNCONDITIONALLY zeroing
modprobe_path/init_task — clobbering the values apply_env had just set from
SKELETONKEY_MODPROBE_PATH / SKELETONKEY_INIT_TASK. Net effect: the documented
env-var offset override silently did nothing, so every --full-chain kernel
primitive reported "offsets couldn't be resolved" even when correct offsets were
supplied. Now the all-zero path only clears fields it tagged OFFSETS_FROM_KALLSYMS
itself, preserving env (and table/System.map) values.

Verified on Ubuntu 22.04.0 / 5.15.0-25: with SKELETONKEY_MODPROBE_PATH set, the
resolver now reports "modprobe_path=0x... (env)", the modprobe_path finisher
engages, and nf_tables' pipapo arb-write fires. (nf_tables itself still returns
an honest EXPLOIT_FAIL: the reconstructed double-free arb-write doesn't reliably
land the write yet — recorded in docs/EXPLOITED.md.) This fix is the prerequisite
for verifying any of the ~13 primitive full-chains. Unit harness green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

core/offsets.c

@@ -212,10 +212,20 @@ static int parse_symfile(const char *path,
     fclose(f);
 
     /* /proc/kallsyms returns all-zero addrs under kptr_restrict — treat
-     * that as "couldn't read", not "actually zero". */
+     * that as "couldn't read", not "actually zero". Undo ONLY the bogus
+     * KALLSYMS source tags this pass may have set on still-zero fields —
+     * do NOT clobber values a higher-priority source (env vars) already
+     * provided, or the env override is silently wiped on any kptr_restrict
+     * host (which is every default host). */
     if (!saw_nonzero) {
-        o->modprobe_path = o->poweroff_cmd = o->init_task = o->init_cred = 0;
-        o->source_modprobe = o->source_init_task = OFFSETS_NONE;
+        if (o->source_modprobe == OFFSETS_FROM_KALLSYMS) {
+            o->modprobe_path = 0;
+            o->source_modprobe = OFFSETS_NONE;
+        }
+        if (o->source_init_task == OFFSETS_FROM_KALLSYMS) {
+            o->init_task = 0;
+            o->source_init_task = OFFSETS_NONE;
+        }
         return 0;
     }
     return filled;

docs/VERIFICATIONS.jsonl

@@ -50,3 +50,4 @@
 {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - SUDO_EDITOR/-- injection hits sudoedit writable-dir guard; needs target-file tuning + module debug. Structural, tractable.","status":"needs_debug"}
 {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via su skel; /etc/passwd gained skel::0:0 (after 2 fixes: chdir / + helper basename match)","status":"root"}
 {"module":"sudo_host","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + host-restricted sudoers rule","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via sudo -h fakehost01; module works as shipped (needs host-restricted rule + resolvable host)","status":"root"}
+{"module":"nf_tables","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - offset resolver FIXED (env modprobe_path now resolves + finisher engages + pipapo arb-write fires), but the reconstructed double-free arb-write does not reliably land the write. Honest FAIL. Primitive needs slab-groom hardening.","status":"primitive_fires_no_root"}