DF-0780 PoC environment
=======================

Guest: DragonFly 6.5-DEVELOPMENT (audit master DEV build)
uname:  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc:     cc 8.3 [DragonFly] Release/2019-02-22

FUSE is NOT in the default kernel (sys/conf/files: "vfs/fuse/*.c  optional fuse";
X86_64_GENERIC has no "options FUSE").  It is a loadable module (fuse.ko),
built from /usr/src/sys/vfs/fuse/.  Loading requires root (kldload).

/dev/fuse: created by fuse_device_init() as UID_ROOT, GID_OPERATOR, mode 0660
           (sys/vfs/fuse/fuse_device.c:313).  On a default boot it does NOT
           exist until the module is loaded.
maxx:      uid=1001 gid=1001 groups=1001  (NOT a member of `operator')
vfs.usermount: 0
mount_fusefs: /sbin/mount_fusefs, mode 0555 root:wheel (NOT setuid)

=> Trigger preconditions (all root-only on default DragonFly):
   1. kldload fuse               (root)
   2. open /dev/fuse             (root or operator group; maxx is neither)
   3. mount -t fuse              (caps_priv_check(SYSCAP_NOMOUNT_FUSE) -> root)
   The READ that trips the overflow can be issued by any user that can read
   a file on the mounted fs, but the daemon (which shapes the overflow) must
   hold the /dev/fuse fd => root/operator.

Hardening of the test guest: SMAP off, SMEP off, KASLR off, PTI off, NX on.
INVARIANTS ON (X86_64_GENERIC default; fuse.h also #define INVARIANTS).