Mark the deb13 profile as contributor-reported

Author: devploit

README.md

@@ -57,8 +57,8 @@ offsets-only entry. All `yes` rows use the lab configuration: Apache prefork
 `session.upload_progress=On`. Per-image offsets and `libphp` sha256 are in
 [the offset inventory](docs/offset-inventory.md). The 8.4.25 profile needs the
 default retries because its stage 3 is probabilistic. The 8.4.26 deb13/apxs2
-row is a **source build**, not an official image: its stage-3 phase is
-instance-dependent (the contributor reported 4/4 runs on one Apache master and
+row is a **contributor-reported source build**, not an official image: its
+stage-3 phase is instance-dependent (the contributor reported 4/4 runs on one Apache master and
 0/5+ on others), so treat `rce: true` as “reproduced on the reporter's lab” and
 retry on a fresh worker/master. Because two 8.4.26 amd64 profiles exist, the
 dispatcher requires `--profile deb13-apxs2` for this build.

profiles/php-8.4.26-deb13-apxs2-amd64.json

@@ -18,17 +18,50 @@
     "stage2_t": 442,
     "stage2_v": 1,
     "stage3_pads": [
-      [4, 4],
-      [4, 4],
-      [4, 4],
-      [4, 4],
-      [4, 4],
-      [31, 31],
-      [31, 31],
-      [31, 31],
-      [31, 31],
-      [31, 31],
-      [31, 31]
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ]
     ],
     "stage3_carrier": false,
     "stage3_cookie": true,
@@ -46,7 +79,7 @@
   "measured": {
     "chunk_base": "0x7fbcf4200000"
   },
-  "status": "RCE verified on a source-built Debian 13 lab (apxs2, Apache 2.4.69 prefork, 1 worker): uid=33(www-data) 4/4 runs through the vendor engine with this profile's parameters; stages 1-2 dispatch cleanly on every attempt. Stage-3 phase is instance-dependent (after an apache restart, a fresh master may not reclaim; retry on a new instance) and the layout differs from the docker 8.4.26 image (different toolchain): third stage-3 layout with a K=5 bin-32 phase shift. Each (4,4) pad allocates the session reference at the k-th bin-32 slot, shifting the fake-reference slot linearly, R0 = chunk+0x2260+0x60*K (gdb watchpoint sweep 0..16); K=5 places the bin-56 reclaim slot so the 31-byte fake reference is written whole (chars at R0, framing differs from the upstream 55-byte carrier whose chars land at R0+8). Stage-3 request 1 carries a PHPSESSID cookie and five 5-char/1-byte fill fields; request 2 reclaims with 15x 167-byte fake hashtables then 12x 31-byte fake references, all with 3-char field names. Command proof read out-of-band from /tmp inside the apache mount namespace (PrivateTmp; nsenter).",
+  "status": "contributor-reported — RCE verified on a source-built Debian 13 lab (apxs2, Apache 2.4.69 prefork, 1 worker): uid=33(www-data) 4/4 runs through the vendor engine with this profile's parameters; stages 1-2 dispatch cleanly on every attempt. Stage-3 phase is instance-dependent (after an apache restart, a fresh master may not reclaim; retry on a new instance) and the layout differs from the docker 8.4.26 image (different toolchain): third stage-3 layout with a K=5 bin-32 phase shift. Each (4,4) pad allocates the session reference at the k-th bin-32 slot, shifting the fake-reference slot linearly, R0 = chunk+0x2260+0x60*K (gdb watchpoint sweep 0..16); K=5 places the bin-56 reclaim slot so the 31-byte fake reference is written whole (chars at R0, framing differs from the upstream 55-byte carrier whose chars land at R0+8). Stage-3 request 1 carries a PHPSESSID cookie and five 5-char/1-byte fill fields; request 2 reclaims with 15x 167-byte fake hashtables then 12x 31-byte fake references, all with 3-char field names. Command proof read out-of-band from /tmp inside the apache mount namespace (PrivateTmp; nsenter).",
   "oom_mb": 12,
   "oom_margin_mb": 12,
   "memory_limit_tested_mb": [