nightly: refresh public-CVE cut (automated; release-cert passing)

README.md

@@ -45,10 +45,10 @@ trained on `public-cve-replication` primitives only).
 - Decision threshold 0.5 (calibrated). Inference is **scoreability-gated**: a record with no network
   signal (e.g. an economic/DeFi bundle) returns `scoreable=False` with no verdict.
 
-## Training data — 67 public-CVE attack primitives, 10 chains, 1711 bundles
+## Training data — 77 public-CVE attack primitives, 10 chains, 1751 bundles
 
-**This is the public-CVE cut** (`public-cve-replication` only): 1132 attack + 579 benign
-bundles (`pcap + responses + manifest`), 73 chain×primitive instances. Benign traffic
+**This is the public-CVE cut** (`public-cve-replication` only): 1172 attack + 579 benign
+bundles (`pcap + responses + manifest`), 83 chain×primitive instances. Benign traffic
 exercises the **same methods / wire messages** the attacks abuse, at normal scale — so the model
 separates attack-*use* from benign-*use*, not message type. Every attack reproduces an external public
 disclosure with a `provenance.public_source` URL. (0 `original` primitives — NullRabbit's own
@@ -59,6 +59,7 @@ above is literal.)
 | primitive | chain · layer | public source | source_class |
 |---|---|---|---|
 | `bitcoin_dup_input_crash` | Bitcoin · p2p | [CVE-2018-17144](https://bitcoincore.org/en/2018/09/20/notice/) | public-cve-replication |
+| `bitcoin_tx_relay_jamming` | Bitcoin · p2p | [CVE-2024-55563](https://nvd.nist.gov/vuln/detail/CVE-2024-55563) | public-cve-replication |
 | `btc_addr_overflow_flood` | Bitcoin / Dogecoin / Litecoin · p2p | [CVE-2024-52919](https://bitcoincore.org/en/2025/04/28/disclose-cve-2024-52919/) | public-cve-replication |
 | `btc_alert_flood` | Bitcoin · p2p | [CVE-2016-10724](https://nvd.nist.gov/vuln/detail/CVE-2016-10724) | public-cve-replication |
 | `btc_blocktxn_double_fillblock` | Bitcoin · p2p | [CVE-2024-35202](https://bitcoincore.org/en/2024/10/08/disclose-blocktxn-crash/) | public-cve-replication |
@@ -85,6 +86,7 @@ above is literal.)
 | `tx_malleability_txid_mutate` | Bitcoin · p2p | [public disclosure](https://github.com/slowmist/Cryptocurrency-Security-Audit-Guide/blob/main/Blockchain-Common-Vulnerability-List.md) | public-cve-replication |
 | `cometbft_bitarray_mismatch` | Cosmos · cometbft-p2p-secretconn | [GHSA-hrhf-2vcr-ghch](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch) | public-cve-replication |
 | `cometbft_blockpart_mismatch` | Cosmos · cometbft-p2p-secretconn | [GHSA-r3r4-g7hq-pq4f](https://github.com/advisories/GHSA-r3r4-g7hq-pq4f) | public-cve-replication |
+| `cometbft_blocksync_height_decrease_stuck` | Cosmos · cometbft-blocksync-reactor | [CVE-2025-24371](CVE-2025-24371) | public-cve-replication |
 | `cometbft_blocksync_malicious_peer` | Cosmos · cometbft-p2p-secretconn | [GHSA-hg58-rf2h-6rr7](https://github.com/cometbft/cometbft/security/advisories/GHSA-hg58-rf2h-6rr7) | public-cve-replication |
 | `cometbft_mempool_dup_tx_leak` | Cosmos · cometbft-p2p-secretconn | [CVE-2023-34451](https://github.com/cometbft/cometbft/security/advisories/GHSA-w24w-wp77-qffm) | public-cve-replication |
 | `cometbft_voteext_panic` | Cosmos · cometbft-p2p-secretconn | [GHSA-p7mv-53f2-4cwj](https://github.com/cometbft/cometbft/security/advisories/GHSA-p7mv-53f2-4cwj) | public-cve-replication |
@@ -97,10 +99,12 @@ above is literal.)
 | `geth_blob_kzg_dos` | Ethereum · devp2p-rlpx | [CVE-2026-22868](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-mq3p-rrmp-79jg) | public-cve-replication |
 | `geth_devp2p_ping_flood` | Ethereum · devp2p-rlpx | [CVE-2023-40591](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm) | public-cve-replication |
 | `geth_eth_receipt_flood` | Ethereum · devp2p-rlpx | [EL-2024-20](https://reports.immunefi.com/ethereum-protocol-or-attackathon/37466-bc-medium-evil-client-oom-crash-fast-p2p-crash) | public-cve-replication |
+| `geth_ethash_memory_exhaustion_dos` | Ethereum · ethereum-eth-devp2p | [CVE-2021-42219](CVE-2021-42219 — https://nvd.nist.gov/vuln/detail/CVE-2021-42219 (MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42219). go-ethereum v1.10.9 remote DoS: an excessive amount of block/header messages to a node drives repeated ethash cache generation in consensus/ethash/algorithm.go -> memory exhaustion. CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No vendor GHSA (third-party exploit-doc ref).) | public-cve-replication |
 | `geth_getblockheaders_count_zero` | Ethereum · devp2p-rlpx | [CVE-2024-32972](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652) | public-cve-replication |
 | `geth_graphql_aliased_logs_dos` | Ethereum · ethereum-http-graphql | [CVE-2023-42319](https://github.com/advisories/GHSA-v9jh-j8px-98vq) | public-cve-replication |
 | `geth_les_getproofsv2_dos` | Ethereum · devp2p-rlpx | [CVE-2020-26264](https://nvd.nist.gov/vuln/detail/CVE-2020-26264) | public-cve-replication |
 | `geth_les_skip_negative` | Ethereum · devp2p-rlpx | [CVE-2018-12018](https://peckshield.medium.com/epod-ethereum-packet-of-death-cve-2018-12018-fc9ee944843e) | public-cve-replication |
+| `geth_mempool_spend_all_flood` | Ethereum · devp2p-eth-transactions | [CVE-2022-23328](https://nvd.nist.gov/vuln/detail/CVE-2022-23328) | public-cve-replication |
 | `geth_rlpx_auth_flood` | Ethereum · devp2p-rlpx | [EL-2026-06](https://notes.ethereum.org/gDWKW5RtSym02t2aGYkmSQ) | public-cve-replication |
 | `geth_rpc_unlocked_wallet_drain` | Ethereum · ethereum-http-rpc | [public disclosure](https://github.com/slowmist/Cryptocurrency-Security-Audit-Guide/blob/main/Blockchain-Common-Vulnerability-List.md) | public-cve-replication |
 | `geth_snap_trienode_dos` | Ethereum · devp2p-rlpx | [CVE-2021-41173](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v) | public-cve-replication |
@@ -110,23 +114,29 @@ above is literal.)
 | `monero_levin_array_memcorrupt` | Monero · levin-p2p | [CVE-2018-3972](https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0637) | public-cve-replication |
 | `monero_portable_storage_oom` | Monero · levin-p2p | [PR#7190](https://github.com/monero-project/monero/pull/7190) | public-cve-replication |
 | `monero_rpc_conn_exhaustion` | Monero · http-rpc | [CVE-2025-26819](https://nvd.nist.gov/vuln/detail/CVE-2025-26819) | public-cve-replication |
+| `firedancer_metrics_flood_crash` | Solana · prometheus-metrics-http | [public disclosure](https://github.com/firedancer-io/firedancer/releases/tag/v0.106.11814 — Firedancer v0.106.11814 (Testnet) Bug Fixes: "Fixed an issue where a connection flood to the metrics server could crash the validator." Firedancer's fd_metrics tile serves Prometheus-compatible metrics over HTTP (default 127.0.0.1:7999/metrics; listen address operator-configurable / internet-exposable per the Firedancer bug-bounty guidance). A remote inbound TCP connection flood to the metrics port could crash the whole validator prior to this fix.) | public-cve-replication |
 | `sol_tpu_quic_handshake_flood` | Solana · tpu-quic | [ND-FD04-LO-01](https://neodyme.io/reports/Firedancer-v0.4.pdf) | public-cve-replication |
 | `sol_tpu_quic_initial_cpu` | Solana · tpu-quic | [ND-FD1-MD-02](https://neodyme.io/reports/Firedancer.pdf) | public-cve-replication |
 | `sol_tpu_quic_slowloris` | Solana · tpu-quic | [ND-FD04-IN-02](https://neodyme.io/reports/Firedancer-v0.4.pdf) | public-cve-replication |
+| `solana_repair_protocol_dos` | Solana · solana-serve-repair | [public disclosure](https://github.com/solana-labs/solana/releases/tag/v1.1.16 — release note "Avoid possible repair orphan DoS"; fix PR https://github.com/solana-labs/solana/pull/10290 ("Fix run_orphan DOS", merged 2020-05-28), core/src/serve_repair.rs.) | public-cve-replication |
 | `sui_disassemble_panic` | Sui · json-rpc | [CertiK Skyfall](https://medium.com/certik-skyfall/blockchain-rpc-vulnerabilities-why-memory-safe-blockchain-rpc-nodes-are-not-panic-free-9fbb990115e0) | public-cve-replication |
 | `sui_move_recursion` | Sui · json-rpc | [CVE-2023-36184](https://nvd.nist.gov/vuln/detail/CVE-2023-36184) | public-cve-replication |
 | `sui_verifier_hamsterwheel` | Sui · json-rpc | [CertiK Skyfall HamsterWheel](https://medium.com/certik-skyfall/the-hamsterwheel-an-in-depth-exploration-of-a-novel-attack-vector-on-the-sui-blockchain-522f80623bc7) | public-cve-replication |
+| `zcash_sapling_woodchip_tx_flood` | Zcash · zcash-p2p-tx-relay-flood | [CVE-2019-11636](https://nvd.nist.gov/vuln/detail/CVE-2019-11636) | public-cve-replication |
 | `zcash_zebra_addr_vector_preallocation_amplification` | Zcash · zcash-p2p-addr-addrv1-vec | [CVE-2026-40881](https://github.com/advisories/GHSA-xr93-pcq3-pxf8) | public-cve-replication |
 | `zcash_zebra_coinbase_script_preallocation_amplification` | Zcash · zcash-p2p-tx-coinbase-input-script | [CVE-2026-44500](https://nvd.nist.gov/vuln/detail/CVE-2026-44500) | public-cve-replication |
 | `zcash_zebra_equihash_solution_preallocation_amplification` | Zcash · zcash-p2p-headers-block-solution | [CVE-2026-44500](https://nvd.nist.gov/vuln/detail/CVE-2026-44500) | public-cve-replication |
 | `zcash_zebra_headers_message_preallocation_amplification` | Zcash · zcash-p2p-headers-countedheader-vec | [CVE-2026-44500](https://nvd.nist.gov/vuln/detail/CVE-2026-44500) | public-cve-replication |
+| `zebra_block_discovery_dos` | Zcash · zcash-p2p-block-discovery | [CVE-2026-44499](CVE-2026-44499 / GHSA-h9hm-m2xj-4rq9 — https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9 (also https://nvd.nist.gov/vuln/detail/CVE-2026-44499). Permanent Block Discovery Halt in Zebra via Gossip Queue Saturation and Syncer Poisoning.) | public-cve-replication |
+| `zebra_rpc_premature_disconnect_crash` | Zcash · zcash-jsonrpc-http | [CVE-2026-41585](CVE-2026-41585 / GHSA-29x4-r6jv-ff4w https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-29x4-r6jv-ff4w (Zebra JSON-RPC HTTP middleware: DoS via interrupted/truncated request body from an authenticated client)) | public-cve-replication |
+| `zebra_sync_restart_poisoning` | Zcash · zcash-p2p-inv+block-sync-poison | [CVE-2026-52737](CVE-2026-52737 / GHSA-gvjc-3w7c-92jx — https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gvjc-3w7c-92jx) | public-cve-replication |
 | `gossipsub_ihave_iwant_flood` | libp2p · libp2p-gossipsub | [CVE-2026-49866](https://nvd.nist.gov/vuln/detail/CVE-2026-49866) | public-cve-replication |
 | `gossipsub_prune_backoff_overflow` | libp2p · libp2p-gossipsub | [CVE-2026-34219](https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-xqmp-fxgv-xvq5) | public-cve-replication |
 | `gossipsub_subscribe_flood` | libp2p · libp2p-gossipsub | [CVE-2026-46679](https://github.com/advisories/GHSA-4f8r-922h-2vgv) | public-cve-replication |
 | `libp2p_signed_peer_record_flood` | libp2p · libp2p-gossipsub | [CVE-2023-40583](https://github.com/advisories/GHSA-gcq9-qqwx-rgj3) | public-cve-replication |
 | `libp2p_stream_exhaustion` | libp2p · libp2p-gossipsub | [CVE-2022-23492](https://github.com/advisories/GHSA-j7qp-mfxf-8xjw) | public-cve-replication |
 
-Distribution: **1132** `public-cve-replication` attack bundles — **67 distinct primitives
+Distribution: **1172** `public-cve-replication` attack bundles — **77 distinct primitives
 across 10 chains** (Bitcoin, Cosmos, Dogecoin, Ethereum, libp2p, Litecoin, Monero, Solana, Sui, Zcash) — plus **579** benign. This published cut contains
 **no `original` bundles**; the `original` RPC-measurement primitives live in the full internal corpus
 and ship only if the operator explicitly opts in, always under their honest label.
@@ -145,9 +155,9 @@ the numbers below always match the shipped model.
 Diagnostic ML checks (the corpus of faithfully-modelled public attacks is the deliverable; these are
 secondary). Reproduced by `scripts/known_class_loco_eval.py` + `scripts/corpus_quality.py`.
 
-- **Within-corpus held-out — binary attack-vs-benign ROC-AUC, GroupKFold by primitive: 0.9416.** `corpus_sha256 known-class-v10-publiccve`.
-- **Leave-one-chain-out — binary ROC-AUC (HARD zero-shot transfer, *not* a deployment metric):** Dogecoin 1.000 / Litecoin 1.000 / Sui 1.000 / Cosmos 0.977 / Ethereum 0.972 / Bitcoin 0.909 / Zcash 0.887 / libp2p 0.832 / Monero 0.790 / Solana 0.770. Chains with few public-CVE primitives have the fewest cross-chain near-neighbours; the companion [`nr-bundles-public`](https://huggingface.co/datasets/NullRabbit/nr-bundles-public) dataset card reports the *stricter* held-out-chain 7-class family macro-F1 (0.17 Sui / 0.35 Solana vs ~0.14 floor). Reported honestly, not a deployment claim.
-- **Leave-one-attack-primitive-out within Bitcoin (leak-clean disjoint-benign):** all Bitcoin primitives ≥ 0.994. Detection is on traffic *shape*, not deep wire-semantics.
+- **Within-corpus held-out — binary attack-vs-benign ROC-AUC, GroupKFold by primitive: 0.9674.** `corpus_sha256 known-class-v10-publiccve`.
+- **Leave-one-chain-out — binary ROC-AUC (HARD zero-shot transfer, *not* a deployment metric):** Dogecoin 1.000 / Sui 1.000 / Litecoin 0.997 / Ethereum 0.978 / Cosmos 0.968 / Bitcoin 0.918 / Solana 0.829 / libp2p 0.799 / Monero 0.797 / Zcash 0.765. Chains with few public-CVE primitives have the fewest cross-chain near-neighbours; the companion [`nr-bundles-public`](https://huggingface.co/datasets/NullRabbit/nr-bundles-public) dataset card reports the *stricter* held-out-chain 7-class family macro-F1 (0.17 Sui / 0.35 Solana vs ~0.14 floor). Reported honestly, not a deployment claim.
+- **Leave-one-attack-primitive-out within Bitcoin (leak-clean disjoint-benign):** all Bitcoin primitives ≥ 0.998. Detection is on traffic *shape*, not deep wire-semantics.
 
 ## Intended uses
 

model.joblib

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5db9806bd80685d1930f9b8ae3e39ee8b260139e2a7527d74722ea34e5a39894
-size 3590365
+oid sha256:c758fafa61b08dd3a0e94384b09bbca105d0c47b915053e6411f5521a7ca284d
+size 3620093