# DF-0915 — PoC: fuse_device_write trusts daemon ohd->len over actual write size

## Build
```
cc -O2 -o harness harness.c     # deterministic primitive proof
cc -O2 -o fused fused.c         # live FUSE daemon (heap overflow trigger)
```
(`build.sh` runs both.)

## Run
- **Deterministic harness** (any user, no kernel impact):
  ```
  ./harness
  ```
  Prints the overflow math: a daemon writing 12288 bytes while claiming
  `ohd->len=4112` drives an 8176-byte heap overflow write past `bp->b_data`.

- **Live kernel trigger** (must be root — `/dev/fuse` is 0660 root:operator and
  `mount("fuse")` needs `uid==0`):
  ```
  kldload fuse
  mkdir -p /mnt/fuse
  ./fused
  ```
  The daemon forks: the child `mount()`s `/mnt/fuse` (blocks on FUSE_INIT,
  answered by the parent's `/dev/fuse` I/O loop), then opens `/mnt/fuse/pwned`
  and `read()`s it.  On the FUSE_READ request the parent replies with 12288
  actual bytes claiming `ohd->len=4112`, triggering the consumer `memcpy`
  overflow at `fuse_vnops.c:2054`.

## Expected (bug present, unpatched #0 GENERIC)
- harness: `OVERFLOW = 8176 bytes past bp->b_data` / `HEAP OVERFLOW WRITE of 8176 bytes confirmed`.
- fused: kernel panic in `memcpy` —
  `panic: assertion "obj != NULL" failed in vm_object_hold_shared`
  (page fault during the overflow memcpy).  VM down at `db>`.

## Expected (after fix.diff applied + fuse.ko rebuilt/loaded)
- harness: unchanged (it transcribes the *unpatched* logic — it is the proof of
  the primitive, not of the fix).
- fused: `read() returned 4096`, **no panic**, VM stays up.  The fix clamps
  `fb.len = ohd->len` so the consumer memcpy copies only 4096 bytes (exact fit).

## Files
- `harness.c` — deterministic userspace transcription of the vulnerable path.
- `fused.c` — live FUSE daemon that triggers the real kernel heap overflow.
- `build.sh` / `run.sh` — exact build/run commands.
- `VERDICT.md` — full narrative + threat model + fix rationale.
- `panic.txt` — the unpatched panic signature from `boot.log`.
- `fix.diff` — git-apply-able fix (validate + clamp `fb.len`).
- `fix_build.log` — full single-fix kernel build output (rc=0).
- `fix_run.log` — before/after contrast.
- `env.txt` — guest environment.
- `manifest.json` — artifact catalog.