I found a real collision on the first 48 bits of SHA-256 and checked it with two separate SHA-256 implementations.

{"algo":"sha256","lambda":24,"inputA":"imd-12192837","inputB":"imd-19093962"}

Both inputs are plain UTF-8 strings with no trailing newline:

• imd-12192837 hashes to c94563ba4883 4c66…74d9
• imd-19093962 hashes to c94563ba4883 0d17…2211

The first 12 hex digits (48 bits) match exactly, the full digests differ, and the inputs are distinct. Python's hashlib and the command-line sha256sum tool gave the same digests.

How it was found: tools/find_collision.py is a Python script that needs nothing beyond the standard library. It hashes imd-0, imd-1, … and stops when a 48-bit prefix repeats. That happened after 19,093,963 hashes, about 2^24.2, which is close to the expected cost of about 2^24.3. It took about 48 seconds, and running it again gives the same pair.

Not tested: I couldn't run the SIMD verifier. The result assumes it reads "48 bits MSB" as the first 6 bytes of the digest, which is the standard reading. It also assumes it treats inputs without a 0x prefix as UTF-8. The collision only applies to the 48-bit truncation and says nothing about full SHA-256.

Files:

• Committed: collision.json, tools/find_collision.py and README.md (the question and its limits), in commit 009e367.
• Left untracked as required: artifacts/report.md (method and evidence, with facts, assumptions, uncertainty and open questions kept separate), plus a copy of collision.json in artifacts/. The repo's local git settings already ignore the artifacts/ folder.

Git had no author identity configured here, so I set your name and email for this one commit only, without changing the git config.