{
  "finding_id": "DF-2478",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "denial_of_service",
  "confidence": "certain",
  "verdict": "Mechanism reproduced live on the stock kernel: opening the highest md unit auto-creates the next one (opening /dev/md0 produced /dev/md1 with a fresh md_s, devstat entry and cdev; mdopen md.c:135-136 fires whenever sc->unit+1 == mdunits and nothing caps mdunits anywhere in md.c). IMPORTANT threat-model correction, same gate as DF-2504: raw disk opens require SYSCAP_RESTRICTEDROOT (sys/kern/subr_disk.c:1070-1073) - a member of group operator gets EPERM opening /dev/md0 (demonstrated live, three attempts), so the filed unprivileged-operator exhaustion arm is REFUTED on current master; only root (or a RESTRICTEDROOT principal) can drive the growth, and root can already create units without limit by design (mdconfig). Effective severity: Low, privileged. Fix (cap auto-create at 256 units) compile-validated in the md module build.",
  "exploit_chain": "no unpriv path (RESTRICTEDROOT gate demonstrated); privileged resource-exhaustion only.",
  "evidence": "run.log: /dev/md1 auto-created by opening /dev/md0; operator-group dd: Operation not permitted (EPERM) x3; root dd: 1+0 records in/out.",
  "kernel_refs": [
    "sys/dev/disk/md/md.c:135",
    "sys/dev/disk/md/md.c:136",
    "sys/dev/disk/md/md.c:410",
    "sys/kern/subr_disk.c:1070"
  ],
  "poc_changes": "live guest test (no rig); unpriv arm refuted live; growth cap fix compile-validated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "live: cc -O -o md_grow md_grow.c (guest)",
  "run_cmd": "kldload md (built-in); ./md_grow 3; ls /dev/md*; su -m operator_user -c dd if=/dev/md0 ...",
  "code_hash": "b0e0fd711f06ebc68896a1a8404ecd262a5cac6ddb5bde80f8859f4ceb7d154a",
  "notes": "Threat-model correction (same gate as DF-2504): raw disk open requires SYSCAP_RESTRICTEDROOT (sys/kern/subr_disk.c:1070-1073); operator-group open of /dev/md0 EPERM demonstrated live. Auto-create-on-open exists (md1 appeared after opening md0) but is root-only; effective severity Low privileged.",
  "recommended_fix": "cap mdopen auto-creation at 256 units",
  "fix_status": "fixed"
}