# DF-2617 environment

Guest: DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (QEMU/KVM, 6 vCPUs, dfbsd-qemu/vm.sh)
       DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  (stock, INVARIANTS)
Patched kernel (#1) for fix validation: same config rebuilt in-guest with
       make -j6 nativekernel && make installkernel  (cc 8.3 [DragonFly])

hw.ncpu = 6
vfs.usermount = 0  (all PoC mounts performed as root; with vfs.usermount=1
                    and an owned vn/vnode device the same forged images are
                    mountable by an unprivileged user per the finding's
                    threat model)
Root fs: hammer2 (vbd0s1d@ROOT).  Tools: newfs_hammer2, vnconfig(4),
host python3 forger.

Images (all forged from one 64M newfs_hammer2 -L testvol image with 33
files created + sync + umount, so the PFS root blockset has INDIRECTs):
  base2617.img  md5 b71e662181ea5b393df02fc8b83b86cd  (stock control)
  P1.img        md5 7a96f3bc768e45a5afafef25a982956b  (sroot INODE data_off=0)
  P2.img        md5 09970f2e069bebd59c825278b6939e22  (PFS INODE data_off=0)
  H.img         md5 a11eb2fb5dd61ac420c80c241d73ac30  (INDIRECT data_off=0)

Volume header layout note: only volhdr copy #0 (offset 0) carries the
magic in these images; the forger patches every copy that does.