# DF-0811 — Proof of Concept

## Bug
OOB kernel heap write in `ext2_cg_block_bitmap_init` via buggy
`ext2_get_group_number` divisor (divides by `e2fs_bsize` bytes instead of
`e2fs_bpg` blocks-per-group). Under FLEX_BG + GDT_CSUM, a crafted group
descriptor's block-bitmap pointer wraps the `tmp - start` uint64 subtraction,
producing a wild `setbit(bp->b_data, ~2^64)` write.

## Files
- `harness.c` — deterministic transcription of the buggy kernel math with a
  guard-paged allocator. Proves the wild byte offset without needing a kernel.
- `craft_img.py` — creates a crafted ext2 image (FLEX_BG + GDT_CSUM) with a
  patched group-1 descriptor that triggers the uint64 wrap.
- `mount_trigger.sh` — root-only mount + write trigger (in-kernel panic).
- `fix.diff` — the verified fix (divisor + bounds check).
- `VERDICT.md` — full analysis and citations.
- `panic.txt` — the kernel panic signature from the baseline run.
- `fix_run.log` — the patched-module run (no panic).
- `run.log` — harness output.

## Build & run (harness — deterministic proof)
```sh
./build.sh   # cc -O2 -Wall -o harness harness.c
./run.sh     # shows wild offset + SIGSEGV
```

## Craft image & trigger in-kernel panic (root on DragonFlyBSD guest)
```sh
python3 craft_img.py df0811.img     # craft the image (needs mke2fs)
# on the guest:
kldload ext2fs
vnconfig -c /dev/vn0 df0811.img
mount -t ext2fs /dev/vn0 /mnt/df0811
dd if=/dev/zero of=/mnt/df0811/trigger bs=1024 count=1   # PANIC
```

## Expected behavior
- **Bug present** (unpatched `ext2fs.ko`): kernel panic —
  `Fatal trap 9: general protection fault` at `ext2_alloccg+0x811: orb %sil,(%rdx)`.
- **Bug fixed** (patched `ext2fs.ko`): dd exits 0, no panic, file created.

## Fix
Apply `fix.diff` to `sys/vfs/ext2fs/ext2_alloc.c`, rebuild the `ext2fs.ko`
module (or kernel):
```sh
cd /usr/src/sys/vfs/ext2fs && make obj && make
```