DF-0794 ENVIRONMENT
====================

GUEST KERNELS TESTED
--------------------
Unpatched baseline:
  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Single-fix kernel (Phase 8):
  DragonFly 6.5-DEVELOPMENT #1: Mon Jul 13 19:38:48 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
  /boot/kernel/kernel sha256:
    9bda5319a0f577f760b48ae11528c73e502fe8b488123959f9902606604183b7

HOST HARDENING (verified, all OFF on this guest)
-------------------------------------------------
SMAP      OFF
SMEP      OFF
KASLR     OFF  (vm.randomize_mmap=0; no kernel-text randomization)
PTI/KPTI  OFF
INVARIANTS ON  (X86_64_GENERIC default)

The hardening state is irrelevant to this finding: DF-0794 is a #DE
divide-by-zero trap (DoS), not memory corruption, so there is no
escalation chain to develop.

USERLAND TOOLS USED
-------------------
/sbin/newfs        (4.3BSD UFS1 format option `-O`)
/sbin/mount        (mount_ufs)
/usr/sbin/vnconfig (attach regular file to /dev/vn0)
cc                 (DragonFly gcc 8.3, system default)

PoC SOURCE LAYOUT
-----------------
patch_image.c   - opens image, reads superblock from SBOFF, sets
                  fs_ncg=0, fs_cstotal.cs_nifree=1, fs_clean=1,
                  writes back. Uses <vfs/ufs/fs.h> struct fs.
build.sh        - cc -O2 -Wall -o patch_image patch_image.c
run.sh          - newfs UFS1 image, patch it, vnconfig + mount, mkdir
                  (triggers ffs_valloc -> ffs_dirpref -> div-by-zero)
fix.diff        - validate fs_ncg/ipg/frag > 0 in ffs_mountfs