{
  "finding_id": "DF-2648",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "HAMMER2IOC_VERSION_GET (hammer2_ioctl.c:86-88) and HAMMER2IOC_INODE_GET (137-139) overwrite the caps_priv_check(SYSCAP_NOVFS_IOCTL) error instead of gating on it; verified on the stock guest that uid=65534 (nobody) successfully invokes INODE_GET on an opened hammer2 path while the gated PFS_GET returns EPERM in the same process. Disclosed content (inode meta + data/inode counts) is stat(2)-equivalent, so impact is hardening/consistency (same class as DF-0815's missing gates, different commands); Low severity.",
  "exploit_chain": "",
  "evidence": [
    "run.log: 'uid=65534 euid=65534 fd=3 / INODE_GET: SUCCESS (ungated!) data_count=0 inode_count=0 inum=1 / PFS_GET: errno=1 (Operation not permitted) -- gate works'",
    "sys/vfs/hammer2/hammer2_ioctl.c:86-88 and 137-139: unconditional error overwrite vs gated neighbors"
  ],
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_ioctl.c:86",
    "sys/vfs/hammer2/hammer2_ioctl.c:137",
    "sys/vfs/hammer2/hammer2_ioctl.c:83"
  ],
  "poc_changes": "none (self-contained PoC with mirrored struct layouts and _IOWR numbers from hammer2_ioctl.h)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC (stock)",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o inodeget_user inodeget_user.c",
  "run_cmd": "su -m nobody -c '/tmp/inodeget_user /mnt/h2' (mount chmod a+rx)",
  "code_hash": "see code_hashes.txt",
  "notes": "No fix build (trivial gating fix; validation would be a one-line behavioral check). Guest was reset after the DF-2647 runs.",
  "recommended_fix": "Gate both commands on the caps_priv_check result like the neighboring cases."
}