# DF-0825 — nfs_getnickauth post-increment bug

**Finding:** `nfs_getnickauth` (sys/vfs/nfs/nfs_syscalls.c:1115-1119) has a
post-increment bug that leaves `auth_str` pointing 4 bytes into the 8-byte
kmalloc'd auth buffer instead of at its start.

## How to reproduce

```sh
./build.sh   # builds the df0825_harness.ko KLD module in-guest
./run.sh     # loads the module; nfs_getnickauth is called with a planted nickname
```

## Expected output

**Unpatched (bug present, kernel #0):**
```
DF-0825: auth_str = 0xfffff8008d680c84       ← off-by-4 (ends in 4)
DF-0825: auth_str[0..3] = 0xdeadbeef         ← nickname, NOT RPCAKN_NICKNAME
DF-0825: auth_str[4..7] = 0x00000000         ← OOB heap
DF-0825: *** BUG CONFIRMED ***
```
After kfree(auth_str), a deferred slab panic fires within ~30s:
```
panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0"
       failed in chunk_mark_free at kern_slaballoc.c:1675
```

**Patched (fix applied, kernel #1):**
```
DF-0825: auth_str = 0xfffff8008d382270       ← base (ends in 0)
DF-0825: auth_str[0..3] = 0x00000001         ← RPCAKN_NICKNAME ✓
DF-0825: auth_str[4..7] = 0xdeadbeef         ← nickname ✓
DF-0825: OK — auth_str points at allocation base (bug fixed)
```
No panic; guest stays alive.

## Harness design

The KLD module (`df0825_harness.c`) constructs a minimal fake `struct nfsmount`
with a nickname entry (uid 1001, nickname 0xDEADBEEF) and calls the real
in-kernel `nfs_getnickauth()` function. It inspects where `auth_str` points and
demonstrates:
1. auth_str is 4 bytes past the allocation base (the bug)
2. auth_str[0] = nickname instead of RPCAKN_NICKNAME
3. auth_str[4..7] reads 4 bytes OOB past the allocation (info leak)
4. kfree(auth_str) frees a non-base pointer → deferred slab corruption panic

## Files

| File | Description |
|------|-------------|
| `df0825_harness.c` | KLD module harness source |
| `Makefile` | Module build file |
| `build.sh` | Builds the module in-guest |
| `run.sh` | Loads the module and shows output |
| `fix.diff` | Standalone git-apply-able fix |
| `VERDICT.md` | Full narrative analysis |
| `build.log` | Final successful module build (baseline) |
| `run.log` | Baseline run (unpatched, bug confirmed) |
| `run.2.log` | Stress run 2 |
| `fix_build.log` | Full fixed-kernel build log |
| `fix_run.log` | Fixed-kernel run (bug gone) |
| `panic.txt` | Slab corruption panic signature |
| `env.txt` | Guest environment |
| `manifest.json` | Machine-readable catalog |