xenia-rs/audit-runs/phase-c12-NtQueryFullAttributesFile/diff-cold-vs-cold.md

# Phase A diff report

**This report is the output of Phase A's diff harness. Divergences
shown here are INPUT for Phase B (first-divergence localization),
not findings of Phase A.** Phase A's job is to make the harness
itself correct, not to analyze what it surfaces.

## Summary

| canary_tid | ours_tid | matched | canary_total | ours_total | first_divergence_at |
|---|---|---|---|---|---|
| 4 | 11 | 9 | 20000 | 9 | — |
| 6 | 1 | 103862 | 250000 | 108471 | 103862 |
| 7 | 2 | 29 | 29 | 30 | — |
| 12 | 7 | 2 | 10532 | 3 | 2 |
| 14 | 9 | 39 | 20000 | 75 | 39 |
| 15 | 10 | 15 | 20000 | 15 | — |

## canary_tid=4 → ours_tid=11

No divergence within the 9 compared events (canary has 20000, ours has 9).

## canary_tid=6 → ours_tid=1

First divergence at `tid_event_idx=103862`: payload.return_value: canary=18446744072635809844 ours=0

**Pre-context (last 5 matching events):**
```
  canary: [103857] import.call RtlInitAnsiString
  ours:   [103857] import.call RtlInitAnsiString
  canary: [103858] kernel.call RtlInitAnsiString
  ours:   [103858] kernel.call RtlInitAnsiString
  canary: [103859] kernel.return RtlInitAnsiString
  ours:   [103859] kernel.return RtlInitAnsiString
  canary: [103860] import.call NtCreateFile
  ours:   [103860] import.call NtCreateFile
  canary: [103861] kernel.call NtCreateFile
  ours:   [103861] kernel.call NtCreateFile
```

**Divergent event:**
```
  canary: [103862] kernel.return NtCreateFile
  ours:   [103862] kernel.return NtCreateFile
```

**Next event after the divergence (if any):**
```
  canary: [103863] import.call RtlNtStatusToDosError
  ours:   [103863] import.call RtlEnterCriticalSection
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 805501600, "kind": "kernel.return", "payload": {"name": "NtCreateFile", "return_value": 18446744072635809844, "side_effects": [], "status": "0xc0000034"}, "schema_version": 1, "tid": 6, "tid_event_idx": 103862}
{"deterministic": true, "engine": "ours", "guest_cycle": 5470532, "host_ns": 463681670, "kind": "kernel.return", "payload": {"name": "NtCreateFile", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 1, "tid_event_idx": 103862}
```

## canary_tid=7 → ours_tid=2

No divergence within the 29 compared events (canary has 29, ours has 30).

## canary_tid=12 → ours_tid=7

First divergence at `tid_event_idx=2`: payload.return_value: canary=258 ours=0

**Pre-context (last 5 matching events):**
```
  canary: [0] import.call KeWaitForSingleObject
  ours:   [0] import.call KeWaitForSingleObject
  canary: [1] kernel.call KeWaitForSingleObject
  ours:   [1] kernel.call KeWaitForSingleObject
```

**Divergent event:**
```
  canary: [2] kernel.return KeWaitForSingleObject
  ours:   [2] kernel.return KeWaitForSingleObject
```

**Next event after the divergence (if any):**
```
  canary: [3] import.call RtlEnterCriticalSection
  ours:   <end of stream>
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 935048400, "kind": "kernel.return", "payload": {"name": "KeWaitForSingleObject", "return_value": 258, "side_effects": [], "status": "0x00000102"}, "schema_version": 1, "tid": 12, "tid_event_idx": 2}
{"deterministic": true, "engine": "ours", "guest_cycle": 30, "host_ns": 479443976, "kind": "kernel.return", "payload": {"name": "KeWaitForSingleObject", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 7, "tid_event_idx": 2}
```

## canary_tid=14 → ours_tid=9

First divergence at `tid_event_idx=39`: payload.ord: canary=503 ours=293

**Pre-context (last 5 matching events):**
```
  canary: [34] kernel.call KeReleaseSpinLockFromRaisedIrql
  ours:   [34] kernel.call KeReleaseSpinLockFromRaisedIrql
  canary: [35] kernel.return KeReleaseSpinLockFromRaisedIrql
  ours:   [35] kernel.return KeReleaseSpinLockFromRaisedIrql
  canary: [36] import.call KfLowerIrql
  ours:   [36] import.call KfLowerIrql
  canary: [37] kernel.call KfLowerIrql
  ours:   [37] kernel.call KfLowerIrql
  canary: [38] kernel.return KfLowerIrql
  ours:   [38] kernel.return KfLowerIrql
```

**Divergent event:**
```
  canary: [39] import.call XAudioGetVoiceCategoryVolumeChangeMask
  ours:   [39] import.call RtlEnterCriticalSection
```

**Next event after the divergence (if any):**
```
  canary: [40] kernel.call XAudioGetVoiceCategoryVolumeChangeMask
  ours:   [40] kernel.call RtlEnterCriticalSection
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 1106484200, "kind": "import.call", "payload": {"module": "xboxkrnl.exe", "name": "XAudioGetVoiceCategoryVolumeChangeMask", "ord": 503}, "schema_version": 1, "tid": 14, "tid_event_idx": 39}
{"deterministic": true, "engine": "ours", "guest_cycle": 417, "host_ns": 1658972624, "kind": "import.call", "payload": {"module": "xboxkrnl.exe", "name": "RtlEnterCriticalSection", "ord": 293}, "schema_version": 1, "tid": 9, "tid_event_idx": 39}
```

## canary_tid=15 → ours_tid=10

No divergence within the 15 compared events (canary has 20000, ours has 15).