# DF-0108 — Unvalidated d_secsize in writedisklabel

**Verdict:** REPRODUCED (panic/DoS on default GENERIC) + FIX VALIDATED.
**Impact:** panic (root/operator-only DoS; no unpriv escalation).
**Privilege:** root/operator only — `DIOCWDINFO32` needs `FWRITE` on a
`root:operator 0640` slice device node. `maxx` (not in `operator`) cannot reach it.

## Build & run

```
cc -o poc_secsize poc_secsize.c      # build.sh
# as root/operator:
rm -f /root/scratch.img
dd if=/dev/zero of=/root/scratch.img bs=1m count=64
vnconfig -c -s labels /dev/vn0 /root/scratch.img
./poc_secsize /dev/vn0s0              # run.sh
```

## Expected

- **Unpatched GENERIC kernel (#0, INVARIANTS ON):** kernel panic at
  `subr_disklabel32.c:336` — `KKASSERT "d_secsize <= b_bufsize"`. The ssh
  session dies; the panic is captured in the serial log
  (`dfbsd-qemu/boot.log`).
- **Patched kernel (#1):** `ioctl returned rc=-1`, `errno=22 (Invalid
  argument)`, guest stays up.

## Files

| file | purpose |
|------|---------|
| `poc_secsize.c` | trigger: DIOCWDINFO32 with `d_secsize = 2 MiB > MAXPHYS` |
| `build.sh` / `run.sh` | exact build/run commands |
| `run.log` | baseline run output + panic signature |
| `fix_run.log` | patched-kernel run output (3×, all EINVAL) |
| `panic.txt` | panic call trace from serial console |
| `fix.diff` | git-apply-able fix (validates d_secsize before getpbuf_mem) |
| `fix_build.log` | full single-fix kernel build output (rc=0) |
| `VERDICT.md` | full narrative |
| `manifest.json` | artifact catalog |
| `env.txt` | guest environment |