# DF-0827 — PoC: FAT12 1-byte OOB read in pcbmap

## What this demonstrates

A crafted FAT12 image with `FATsecs=2` and a file whose cluster chain
walks `2 → 3 → ... → 681 → 682` triggers a 1-byte out-of-bounds read in
`pcbmap()` (`sys/vfs/msdosfs/msdosfs_fat.c:211`). When `pcbmap` reaches
`cn=682`, it computes `FATOFS(682)=1023` and reads `getushort(bp->b_data
+ 1023)` from a 1024-byte FAT block buffer — reading byte 1024 OOB.

## Files

- `craftfat.c` — builds two FAT12 images for a side-by-side comparison:
  - `bug` mode (default) → `fat12_oob.img`: `FAT[681]=682` (chain walks OOB).
  - `eof` mode → `fat12_eof.img`: `FAT[681]=0xff8` (clean EOF control).
- `build.sh` — `cc -o craftfat craftfat.c`.
- `run.sh` — mounts each image via `vnconfig` + `mount_msdos`, `cat`s
  `TRIGGER.TXT`, prints a byte-count comparison and verdict.
- `fix.diff` — one-line fix at `msdosfs_fat.c:187`.
- `VERDICT.md` — full analysis (mechanism, evidence, fix validation).
- `run.log` / `run.log.patched` — baseline (#0) and patched (#1) outputs.
- `fix_build.log` — single-fix kernel build log.
- `env.txt` — guest environment.
- `manifest.json` — artifact catalog.

## Build & run

```sh
./build.sh                 # cc -o craftfat craftfat.c
sudo ./run.sh              # root needed for vnconfig + mount_msdos
```

The read itself is the unprivileged trigger; the mount is the
realistic "admin mounted an attacker image" precondition.

## Expected output

### Baseline (bug present, kernel `#0`)
```
Control (eof.img): cat read   348213 bytes.   # E2BIG after cluster 680
Bug    (oob.img): cat read   349184 bytes.   # OOB read returns extra cluster
=> BUG CONFIRMED
```

### Patched (fix applied, kernel `#1`)
```
Control (eof.img): cat read   348213 bytes.
Bug    (oob.img): cat read   348213 bytes.   # behaves same as control
=> FIX CONFIRMED
```

## Impact

Low. 1-byte OOB kernel heap read; no escalation, no panic. The OOB
byte's low nibble is observable via the returned cluster's data
(slow ~4-bit-per-read heap-state side channel). See `VERDICT.md`.