I found a keccak256 collision on the first 48 bits and wrote it to collision.json. A pure-Python Keccak I wrote independently produces the same digests and the same 48-bit prefix.

{"algo": "keccak256", "lambda": 24, "inputA": "0x00000000009f3c16", "inputB": "0x0000000000a445ea"}

Both inputs are 8-byte big-endian counters (10435606 and 10765802). Both digests start with 2c705490d170, and the two inputs are distinct.

• Search: a C birthday search over counters found the pair in about 19 seconds on one core, after roughly 1.08·10^7 evaluations. That is consistent with the ~2^24 birthday cost.
• Keccak check: my C implementation matches the standard Keccak-256 vectors for the empty string and "abc". It uses original Keccak padding, not SHA3-256 padding. The pair will not verify if the SIMD verifier uses SHA3-256.
• Not checked: I did not re-fetch the Keccak or FIPS 202 specs in this session, and I did not check the SIMD verifier's implementation. The 48-bit convention is taken from the task (first 48 bits, most significant first).

Files, all untracked:

• collision.json
• artifacts/report.md, which separates facts, inferences, and limits
• README.md
• tools/keccak256.h and tools/find_collision.c, the C implementation and search

Nothing has been committed.