# DF-0766 — NFS READDIR/READDIRPLUS reply XDR null-pad OOB (verification pack)

**Result: NOT REPRODUCED — the claimed heap OOB write is UNREACHABLE. Impact: none.**

The finding claims the NFS server's READDIR/READDIRPLUS reply encoder appends
XDR null-pad bytes without first calling `nfsm_clget`, so a directory entry
whose name fills a 2048-byte mbuf cluster exactly would cause 1..3 NUL bytes to
be written past the cluster into adjacent kernel heap.

Verification (source trace + simulation + live test) shows this state is
**unreachable**: the XDR 4-byte alignment invariant keeps every entry name from
ever ending exactly on a cluster boundary when padding is needed, so the pad
bytes always have room. The missing `nfsm_clget` is a real latent
defense-in-depth gap (the only unguarded write site in the encoder) but has no
achievable security impact on current code.

## Files

| file | purpose |
|---|---|
| `reach.c` | faithful cursor simulation + exhaustive/random brute force over directory layouts; prints the alignment-invariant proof. **Definitive: 0 OOB-state entries ever, both variants.** |
| `nfs_pad_oob.c` | structural demonstration that the pad loop is unguarded (forced `bp==be` → red-zone write); proves the code gap is real even though unreachable live. |
| `sizes.c` | verifies `sizeof(struct flrep)=132 (mod4=0)` and `NFSX_V3FH=28` against kernel headers. |
| `build.sh` / `run.sh` | build & run `reach`. |
| `live_test.sh` | sets up NFS server, exports, mounts, runs 800 listings of a 720-file dir (names ≠ 0 mod 4); no panic on unpatched #0 or patched #1. |
| `run.log` | `reach` output (unreachability proof). |
| `fix_run.log` | `live_test.sh` on the single-fix kernel #1. |
| `fix_build.log` | full `make nativekernel` log of the single-fix kernel (rc=0). |
| `fix.diff` | defense-in-depth: add `nfsm_clget` before each pad byte (READDIR + READDIRPLUS). git-apply-able. |
| `env.txt` | guest uname / cc / kernel version. |
| `VERDICT.md` | full narrative + mechanism + why-it-fails + fix validation. |
| `manifest.json` | machine-readable catalog. |

## Reproduce (on the guest)

```sh
sh build.sh && sh run.sh        # maxx: reachability analysis -> UNREACHABLE
cc -o sizes sizes.c && ./sizes  # maxx: struct-size verification
sh live_test.sh                 # root: live NFS readdir corroboration (no panic)
```