=== DF-0790 LIVE KERNEL REPRODUCTION — mount_loop variant ===

Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (default GENERIC, INVARIANTS ON)
Image: ntfs_0790_mount_loop.img (ino 6/$Bitmap carries a $ATTRIBUTE_LIST whose
       first entry has reclen==0; no inline $DATA on ino 6)

Trigger (as root):
  vnconfig -c vn0 /root/ntfs_0790_mount_loop.img
  mount_ntfs -o ro /dev/vn0 /mnt/ntfs

Path to the buggy walk:
  ntfs_mountfs()                                    sys/vfs/ntfs/ntfs_vfsops.c:396
    VFS_VGET(NTFS_BITMAPINO)                        sys/vfs/ntfs/ntfs_vfsops.c:394
      ntfs_vget -> ntfs_vgetex(NTFS_A_DATA)         sys/vfs/ntfs/ntfs_vfsops.c:796
        ntfs_filesize(ntmp, fp, ...)                sys/vfs/ntfs/ntfs_subr.c:1292
          ntfs_ntvattrget(NTFS_A_DATA)              sys/vfs/ntfs/ntfs_subr.c:1295
            ntfs_findvattr -> returns -1            (no inline $DATA; lvap=ATTRLIST)
            buggy ATTRLIST walk                      sys/vfs/ntfs/ntfs_subr.c:196-236
              len -= aalp->reclen  (reclen==0)       sys/vfs/ntfs/ntfs_subr.c:207
              -> INFINITE LOOP

Result: mount(2) NEVER RETURNS. The ssh command timed out after 30s (rc=124).
The guest became completely unresponsive (subsequent ssh status check also
timed out, rc=124) — the kernel is spinning at 100% CPU in ntfs_ntvattrget.
No panic signature (this is CWE-835 infinite loop, not a crash); the serial
log shows a clean boot followed by the mount command being issued and never
completing. This is a confirmed local DoS via a crafted NTFS image.

=== serial boot.log tail (no panic — just a hang after the mount) ===
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Fri Jul 10 10:10:25 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)

=== reproduction commands ===
scp ... ntfs_0790_mount_loop.img dfbsd:/root/
vnconfig -c vn0 /root/ntfs_0790_mount_loop.img && mount_ntfs -o ro /dev/vn0 /mnt/ntfs
  # ^HANGS FOREVER — guest wedged, must reset