# DF-0835 — smbfs_advlock unconditional lock-type overwrite

## Summary

`smbfs_advlock` (`sys/vfs/smbfs/smbfs_vnops.c:943`) unconditionally sets
`lkop = SMB_LOCK_EXCL` after an inner switch has already mapped the POSIX lock
type (F_RDLCK→SHARED, F_WRLCK→EXCL, F_UNLCK→RELEASE). The overwrite makes the
switch dead code: every `F_SETLK` advisory-lock request is sent to the SMB server
as an **exclusive** lock, regardless of the requested type.

## Impact

- F_RDLCK (shared/read) → sent as exclusive → readers serialize (logic/auth violation)
- F_UNLCK via F_SETLK → sent as exclusive acquire (not release) → server lock table
  exhaustion → local-triggered remote DoS

Medium severity. No memory corruption, no escalation.

## Reproduction

Full runtime proof requires an SMB server + `mount_smbfs` (root-only mount).
The audit guest has no SMB server, so the **primary evidence is the deterministic
code trace + compiled disassembly** showing the switch is dead-code-eliminated
in the shipping `smbfs.ko`.

### Build & run the trigger

    cc -o trigger trigger.c
    ./trigger <file-on-smbfs-mount>

Without an smbfs mount, the trigger validates the fcntl syscall surface and
documents the call path. See `VERDICT.md` for the full code trace and
disassembly proof.

### Files

| File | Description |
|------|-------------|
| `trigger.c` | C trigger: fcntl(F_SETLK, F_RDLCK) on an smbfs file |
| `fix.diff` | One-line fix: remove `lkop = SMB_LOCK_EXCL` at line 943 |
| `VERDICT.md` | Full analysis: mechanism, trace, before/after disassembly |
| `baseline_disasm.txt` | Unpatched smbfs_advlock disassembly (bug present) |
| `patched_disasm.txt` | Patched smbfs_advlock disassembly (bug fixed) |
| `fix_build.log` | Patched smbfs.ko build output |
| `fix_run.log` | Before/after disassembly comparison |
| `env.txt` | Guest environment |
| `manifest.json` | Machine-readable catalog |