# DF-0141 — Missing privilege check in `sys_vquotactl`

**Bug:** `sys/kern/vfs_quota.c:sys_vquotactl` (syscall 530) has no
`caps_priv_check` / privilege test. Any unprivileged local user can read
every user's disk usage, set/remove per-uid/gid quota limits (including
root's), and set the filesystem-wide `ac_limit` (filesystem-wide write DoS).

**Class:** privilege boundary violation (logic/auth). Not memory corruption.

## Reproduce

**Admin precondition** (realistic — admin deploying VFS quotas):
```
echo 'vfs.quota_enabled=1' >> /boot/loader.conf
reboot
```

**Build & run as unprivileged user:**
```
./build.sh
./run.sh        # defaults to /tmp
# or: ./df0141_poc /tmp
```

**Expected (bug present, unpatched kernel):** all `vquotactl` operations
return rc=0 (SUCCESS). maxx reads root's usage, sets root's limit to
99999999 (confirmed by re-read), sets `/tmp` fs-wide limit. The DoS takes
effect: `dd` to `/tmp` returns "Disc quota exceeded".

**Expected (fixed kernel):** all `vquotactl` operations return EPERM
(errno=1, Operation not permitted). Writes to `/tmp` succeed normally.

## Files
- `df0141_poc.c` — the PoC source
- `fix.diff` — the one-line fix (add `caps_priv_check_td` + include)
- `run.log` — baseline (unpatched) decisive run
- `fix_run.log` — patched kernel decisive run
- `build.log` — full single-fix kernel build log
- `VERDICT.md` — detailed analysis
- `manifest.json` — artifact catalog