# DF-0869 — PoC: missing bounds validation in `hammer_format_volume_header`

## Goal

Trigger the missing-bounds-validation defect in
`hammer_format_volume_header` (`sys/vfs/hammer/hammer_volume.c:617-671`)
by issuing `HAMMERIOC_ADD_VOLUME` with attacker-controlled int64 fields
(`boot_area_size`, `memory_log_size`, `vol_size`) that produce an
out-of-range `vol_buf_size`. The only validation in the formatter is a
signed-`<0` check, which a huge-positive `vol_buf_size` happily passes;
the resulting `KKASSERT` in `hammer_format_freemap`
(`hammer_volume.c:407`) then panics the default GENERIC kernel.

## Files

- `trigger.c` — opens a HAMMER mountpoint and issues
  `HAMMERIOC_ADD_VOLUME` with `boot_area_size = -1`,
  `memory_log_size = 0`, `vol_size = 2^49` (~512 TiB).
- `run.sh` — sets up a base HAMMER filesystem (newfs_hammer), mounts it,
  creates the second-volume file, then runs the trigger. Must run as
  root.
- `build.sh` — compiles `trigger.c`.

## Build & run

```
# build (as unprivileged user, from this dir)
./build.sh

# run (as root, on the guest)
./run.sh
```

## Expected output (unpatched #0 kernel, INVARIANTS on)

```
[+] mounted base HAMMER fs at /mnt/df0869
[+] new-volume file: /root/df0869/newvol.img (0 bytes)
[*] issuing HAMMERIOC_ADD_VOLUME on '/root/df0869/newvol.img'
[*]     boot_area_size  = -1
[*]     memory_log_size = 0
[*]     vol_size        = 562949953421312 (~512 TiB, has bit 48 set)
```
…and the guest dies mid-syscall. The panic signature in
`dfbsd-qemu/boot.log` names `hammer_format_freemap` and the
`KKASSERT` is the `(vol_buf_size & ~HAMMER_OFF_SHORT_MASK) == 0`
assertion at `hammer_volume.c:407`.

## Privilege / threat model

`HAMMERIOC_ADD_VOLUME` is gated behind `caps_priv_check(cred,
SYSCAP_NOVFS_IOCTL)` at `hammer_ioctl.c:197` — root only. This is a
root-only kernel-panic DoS, not an unprivileged escalation. CVSS
matches the filed `PR:H` (the bug requires a HAMMER admin / a
compromised userspace HAMMER tool to issue the malicious ioctl).