{
  "finding_id": "DF-2527",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "LIVE reproduction on the stock kernel through the real ioctl path (no rig): a root VNIOCATTACH with vn_size = -1 pages succeeded and diskinfo /dev/vn3 reported size=0xfffffffffffff000 (17179869184.00 GB) - the sign-extended -1*PAGE_SIZE/512 quotient published as the media size (vn.c:559-560 computes vn->sc_size = vio->vn_size * PAGE_SIZE / sc_secsize with only an if(vio->vn_size) guard; the swap path validates <= 0 at :617, the file path does not). d_media_blocks=0xfffffffffffffff8 propagates through the disk layer (diskinfo renders the bogus capacity; d_ncylinders truncates to u_int per the finding). SYSCAP_RESTRICTEDROOT-gated: root-only as filed. Fix (range-check like the swap path) compile-validated in the vn module build; a patched-kernel live A/B was out of scope for this batch (vn is compiled into the stock kernel) - the fix is the same guard the swap path has proven for years.",
  "exploit_chain": "root-only logic/DoS: bogus capacity published (partitioning/data-corruption surprises); no memory corruption.",
  "evidence": "run.log: attach vn_size=-1 OK -> /dev/vn3; diskinfo size=0xfffffffffffff000.",
  "kernel_refs": [
    "sys/dev/disk/vn/vn.c:559",
    "sys/dev/disk/vn/vn.c:560",
    "sys/dev/disk/vn/vn.c:617",
    "sys/sys/vnioctl.h:59"
  ],
  "poc_changes": "live guest test program (vn_size.c) issuing the real ioctl.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o vn_size vn_size.c (guest)",
  "run_cmd": "./vn_size -1 /root/vnfile; diskinfo /dev/vn3",
  "code_hash": "n/a",
  "notes": "LIVE reproduction through the real ioctl path (no rig): VNIOCATTACH vn_size=-1 -> diskinfo reports size=0xfffffffffffff000 (17179869184 GB). SYSCAP_RESTRICTEDROOT-gated (root-only) as filed. Fix compile-validated (vn module build); live patched-kernel A/B not performed (md/vn are compiled into the stock kernel; a patched kernel rebuild was out of scope for this batch) - the fix mirrors the proven swap-path guard (vn.c:617).",
  "recommended_fix": "range-check vn_size (0 < vn_size <= INT64_MAX/PAGE_SIZE) in the file path",
  "fix_status": "fixed"
}