Add libssh2 CVE-2026-55200 benign PoC

libssh2-cve-2026-55200-poc/evidence/2026-06-23-local-harness-output.txt

@@ -0,0 +1,79 @@
+Repository HEAD during verification:
+cef60fd581c508f1193410f2eb1a9c6cd73523ae
+
+Compiler:
+gcc.exe (MinGW-W64 x86_64-ucrt-posix-seh, built by Brecht Sanders, r7) 15.2.0
+
+Build command:
+gcc -std=c11 -Wall -Wextra -O0 -g -o libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
+
+Built binary SHA256:
+06BD85420C0B9DD29681637EFD83F4C5791357CEDF53859183D88018C0375920
+
+Source comment check:
+rg "//|/\*|\*/" libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
+exit status: 1
+meaning: no comment markers matched
+
+Default benign run:
+libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe
+
+benign CVE-2026-55200 proof
+build_size_t_bytes=8
+build_size_t_bits=64
+packet_length=0xffffffff (4294967295)
+mac_len=0
+auth_len=16
+mathematical_total=4294967315
+vulnerable32_decision=accepted
+vulnerable32_total=19
+vulnerable32_allocation=19
+fullpacket_style_length=4294967294
+allocation_gap=4294967275
+fixed32_decision=rejected: out of boundary
+native_unpatched_decision=rejected: out of boundary
+native_unpatched_total=4294967315
+native_note=64-bit native arithmetic rejects this default input; modeled 32-bit arithmetic remains vulnerable
+result=PASS
+
+Native-size run:
+libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe --native
+
+native-size_t check
+build_size_t_bytes=8
+build_size_t_bits=64
+unpatched_decision=rejected: out of boundary
+unpatched_total=4294967315
+unpatched_allocation=0
+fixed_decision=rejected: out of boundary
+fixed_total=0
+fixed_allocation=0
+
+Detailed arithmetic run:
+libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe --check
+
+detailed CVE-2026-55200 arithmetic check
+build_size_t_bytes=8
+build_size_t_bits=64
+packet_length=0xffffffff (4294967295)
+mac_len=0
+auth_len=16
+mathematical_total=4294967315
+vulnerable32_total=19
+vulnerable32_decision=accepted
+vulnerable32_allocation=19
+fullpacket_style_length=4294967294
+fixed32_decision=rejected: out of boundary
+native_unpatched_decision=rejected: out of boundary
+native_unpatched_total=4294967315
+
+Final scratch verification build command:
+gcc -std=c11 -Wall -Wextra -O0 -g -o ..\cve_2026_55200_probe_verify.exe libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
+
+Final scratch verification binary SHA256:
+7220CDCF99CE3E456D5E709CF94762FBE502B1782B4F4494FB5D4CD0C9BD5277
+
+Final scratch verification result:
+default run result=PASS
+--native exited 0
+--check exited 0