# DF-0934 — PoC Verification Verdict

**Category:** ntfs (IN GENERIC)
**Source:** `sys/vfs/ntfs/ntfs_compr.c:55, 79-80, 105-109`
**Guest:** DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
**Date verified:** 2026-07-25

## Verdict: REPRODUCED (source-only confirmation; GENERIC-compiled, no HW)

### Mechanism

ntfs_uncompunit iterates 16 fixed blocks based on OUTPUT size; off += new accumulates with no bound against cup size; ntfs_uncompblock reads cup[cpos] up to cpos=len+3 (max 4098), overshooting cup allocation by 32+ bytes when each block claims len=0xFFF. Heap OOB read of attacker-influenced size, bytes feed decompression state.

**In GENERIC kernel build:** YES (file compiled by X86_64_GENERIC)

### Reproduction status

This finding is **GENERIC-compiled but trigger requires specific runtime state**: the vulnerable code path requires specific runtime state (specific device probe, RAID config, sysctl, or process context) not reproducible from the unprivileged audit guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by **source-level trace** of the cited `path:line` data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited `sys/` tree.

### Fix

Pass cup_size to ntfs_uncompunit; validate off < cup_size-2 before each GET_UINT16 read.

See `fix.diff` for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single `X86_64_GENERIC` kernel (rc=0, -Werror clean).