Align contribution with CONTRIBUTING checklist

- redact the local lab username from the published proof example
- document the FPM profile in docs/profile-inventory.md (table synced
  with php2shell_inventory.py output, including the pre-existing
  missing 8.3.0/8.5.0 rows)
- state the two-slot reclaim/retry behaviour in the profile status and
  the README table (probabilistic disclosure)
- correct the README profile counters (14 profiles, 6 verified RCE)

Author: VABISMO

README.md

@@ -36,7 +36,7 @@ not match the profile.
 | PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
 | PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
 | PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
-| PHP 8.4.26 FPM | `php:8.4.26-fpm` (nginx) | `8.4.26-fpm` | n/a | n/a | **yes** | `BG(unserialize)` chain; worker runs `uid=1000` proof |
+| PHP 8.4.26 FPM | php-8.4.26 source tarball (nginx+FPM) | `8.4.26-fpm` | n/a | n/a | **yes** | `BG(unserialize)` chain; two-slot reclaim, self-correcting retries |
 | PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
 | PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
 | PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
@@ -48,10 +48,10 @@ not match the profile.
 | PHP 7.4.33 aarch64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
 | PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
 
-**13 heap profiles, 5 with verified RCE. Offsets extracted for 12 builds.**
-Plus one FPM profile (`8.4.26-fpm`) with verified RCE through the
-`BG(unserialize)` stale-state chain (no heap-leak stages; the stale struct is
-located with the oracle each run).
+**14 profiles (13 heap + 1 FPM), 6 with verified RCE. Offsets extracted for
+12 builds.** The FPM profile has no heap-leak stages: the stale
+`BG(unserialize)` struct is located with the oracle each run
+([docs/fpm-chain.md](docs/fpm-chain.md)).
 
 `Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
 proof on an isolated lab. `no` means not verified, not necessarily impossible;

docs/fpm-chain.md

@@ -132,7 +132,7 @@ proof separately:
 
 ```sh
 curl http://127.0.0.1:8110/out/p1
-# uid=1000(cryptocalypse) gid=1000(cryptocalypse) groups=...
+# uid=1000(...) gid=1000(...) groups=...
 ```
 
 On the reference run the proof was `uid=1000` (the unprivileged lab user),

docs/profile-inventory.md

@@ -8,13 +8,19 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 | 8.0.30 | php-8.0.30-bookworm-aarch64 | 0x31ef70 | 0x40ddb0 | - | - | - | - | no |
 | 8.1.34 | php-8.1.34-bookworm-aarch64 | 0x341e08 | 0x42e7a0 | - | - | - | - | no |
 | 8.2.34 | php-8.2.34-bookworm-aarch64 | 0x36ff48 | 0x4606c0 | - | 0 | 0 | 406 | no |
+| 8.3.0 | php-8.3.0-bookworm | 0x3771f0 | 0x467cf0 | - | - | - | 406 | no |
 | 8.3.33 | php-8.3.33-wordpress-mod_php | 0x377248 | 0x4737e0 | - | 815 | 63 | 406 | no |
 | 8.3.35 | php-8.3.35-bookworm-aarch64 | 0x377428 | 0x46fcc0 | - | 841 | 63 | 406 | no |
 | 8.4.25 | php-8.4.25-bookworm-aarch64 | 0x42fa30 | 0x637ae0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.4.26 | php-8.4.26-bookworm-amd64 | 0x465370 | 0x65eb60 | 0x690d8 | 841 | 79 | 406 | yes |
+| 8.4.26 | php-8.4.26-fpm | 0x386660 | 0x54a0d0 | - | - | - | - | yes |
+| 8.5.0 | php-8.5.0-bookworm | 0x503510 | 0x731d80 | - | 841 | 63 | 406 | no |
 | 8.5.10 | php-8.5.10-bookworm-aarch64 | 0x52e130 | 0x75d360 | 0x690d8 | 841 | 63 | 406 | yes |
-| 8.5.11 | php-8.5.11-bookworm-amd64 | 0x5996e0 | 0x7b47a0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-aarch64 | 0x5314f0 | 0x761b80 | 0x690d8 | 841 | 63 | 406 | yes |
+| 8.5.11 | php-8.5.11-bookworm-amd64 | 0x5996e0 | 0x7b47a0 | 0x690d8 | 841 | 63 | 406 | yes |
+
+**14 profiles, 6 with verified RCE** (5 Apache/mod_php + 1 PHP-FPM).
+| 8.4.26 FPM | php-8.4.26-fpm | 0x386660 | 0x54a0d0 | - | - | - | - | yes |
 
 ## Per-build notes
 
@@ -38,6 +44,18 @@ This is the 8.5 branch, fixed in 8.5.12.
 `php:8.4.26-apache`, bookworm. Verified 3/3 manually and through the factory.
 Fixed in 8.4.27. This is the profile used against the local 8.4.26 laboratory.
 
+### PHP 8.4.26 FPM — RCE verified
+
+nginx + PHP-FPM, amd64, user-prefix build of the php-8.4.26 source tarball
+(no Docker image; built by `lab/fpm/build_php.sh`). Exploits the stale
+`BG(unserialize)` state instead of the Apache progress-cache chain — the
+stage columns do not apply. `basic_globals=0xa04660`, `struct_size=8216`;
+the 8216-byte struct recycles between two heap slots and a mismatch
+self-corrects within four retries. Verified `uid=...` proof in the local
+laboratory; `php2shell_fpm.py patchcheck` confirms 8.4.27 is clean
+(`level=0`, workers survive). Fixed in 8.4.27. See
+[docs/fpm-chain.md](fpm-chain.md).
+
 ### PHP 8.3.35 — leaks only
 
 `php:8.3.35-apache`. Stage 1 (heap base) and stage 2 (libphp base) reproduce;

profiles/8.4.26-fpm.json

@@ -29,6 +29,6 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified in the nginx+FPM lab: post-RINIT OOM leaves BG(unserialize) stale (level=1), the pre-RINIT rfc1867 session_start of a follow-up multipart reuses the freed struct, a controlled buffer forges var_hash so R:2 yields an IS_REFERENCE -> fake HashTable whose pDestructor is zif_system; the worker aborts after the command and FPM respawns it.",
+  "status": "RCE verified in the nginx+FPM lab: post-RINIT OOM leaves BG(unserialize) stale (level=1), the pre-RINIT rfc1867 session_start of a follow-up multipart reuses the freed struct, a controlled buffer forges var_hash so R:2 yields an IS_REFERENCE -> fake HashTable whose pDestructor is zif_system; the worker aborts after the command and FPM respawns it. The 8216-byte struct recycles between two heap slots; a mismatch self-corrects within four retries (see docs/fpm-chain.md).",
   "oom_mb": 4
 }