# DF-2620 evidence pack environment

Guest: DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (QEMU/KVM, 6 vCPUs, dfbsd-qemu/vm.sh)
       DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  (stock, INVARIANTS)
Patched: same config rebuilt with fix.diff
       DragonFly dfbsd 6.5-DEVELOPMENT #1: Fri Aug 28 14:29:04 UTC 2026
       (make nativekernel + installkernel in guest /usr/src)

hw.ncpu / kern.smp.cpus = 6
vfs.usermount = 0  (all PoC mounts performed as root; with vfs.usermount=1
                    and an owned vnode device the same forged images are
                    mountable by an unprivileged user per the finding's
                    threat model)
hammer2_xop_nthreads (derived, vfsops.c:258-267, 6 cpus): 36 groups
  -> xop_groups = 36 * sizeof(hammer2_xop_group)
              = 36 * 8 * sizeof(hammer2_thread_t=64) = 18432 bytes
Root fs: hammer2.  Toolchain: host python3 forger; guest
  newfs_hammer2, vnconfig(4), make nativekernel (cc 8.3).

Images (all forged from one 64M newfs_hammer2 -L testvol image):
  base.img  md5 f1a3fe206249f1d8e6c4c354810c008f  (stock)
  A.img     md5 fef22dc3ed311082b400f5f5f702ae19  (testvol pfs_nmasters=0xFF)
  C.img     md5 145886e4cd8972421b9ba6ad6addaef1  (testvol pfs_type=SLAVE)
Forger technique (from DF-2616): patch PFS inode bytes, set
methods=0x00 (CHECK_NONE) on the volhdr sroot bref and the PFS inode
bref so nothing is check-verified, recompute the 3 volume-header
CRC32Cs.  See forge_df2620.py.