# DF-2618 environment

Guest: DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (QEMU/KVM, dfbsd-qemu/vm.sh)
       DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  (stock, INVARIANTS)
       panic evidence captured on this stock kernel (baseline).
Patched kernel (#fix) for fix validation: same config, rebuilt in-guest with
       cd /usr/src && make -j6 nativekernel && make installkernel
       after applying fix.diff to /usr/src/sys/vfs/hammer2/hammer2_chain.c.

vfs.usermount = 0  (PoC mounts performed as root; the forged-image threat
       model is a malicious/corrupt hammer2 volume -- mount requires root
       or vfs.usermount=1 with an accessible vn device, matching the
       finding's Medium severity / local-admin or multi-tenant host setup)

Root fs: hammer2 (vbd0s1d@ROOT) -- the fix kernel boots and runs the whole
       system on hammer2, an implicit regression test of the patch.

Tools: newfs_hammer2, vnconfig(4), host python3 forger.

Images:
  base2618.img  sha256 c449c5de8d4f42f8d36b1457f6abf9d7f9b5ae4f8af6cdeb280af3e01e1c9710
                (stock control: newfs_hammer2 -L testvol, files a,b,c,d
                 = inums 1024,1025,1026,1027, sync, umount)
  craft2618.img sha256 a23170c6ea498604b35790396314cfb6cf6ca955c5ec226042523aa7b8ae522c
                (forge: INODE(1024).keybits 0->1  => [1024,1025]
                        INODE(1025).keybits 0->1  => [1025,1026]
                 overlapping ranges in the indirect array @0x1c01000;
                 CHECK_NONE (methods=0x00) on the covering indirect bref,
                 the PFS inode bref, and the sroot bref in every volhdr;
                 volhdr CRC32Cs recomputed)