{
  "finding_id": "DF-2669",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain-by-inspection quota-accounting corruption: kern_truncate() (sys/kern/vfs_syscalls.c:4048) and kern_ftruncate() (:4124) execute VFS_ACCOUNT(mp, uid, gid, length - old_size) after VOP_SETATTR even when VOP_SETATTR failed, moving per-uid accounting by the requested delta although the file size never changed; repeated failed truncates (e.g. EFBIG) drive accounting to arbitrary values, enabling quota bypass or spurious EDQUOT. Not exercised on the guest because the stock kernel/mounts do not wire vfs_account (VFS_ACCOUNT is a no-op without vfs.quota_enabled); code-level defect unambiguous (sibling setfown() guards the identical call at :3555).",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-2669/README.md (code excerpts + line refs + suggested fix)"],
  "kernel_refs": ["sys/kern/vfs_syscalls.c:4048", "sys/kern/vfs_syscalls.c:4124", "sys/kern/vfs_syscalls.c:3555"],
  "poc_changes": "n/a — inspection-only finding",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: requires VFS quota accounting enabled (non-default). Fix is a two-line error==0 guard.",
  "recommended_fix": "Guard both VFS_ACCOUNT calls in kern_truncate()/kern_ftruncate() with 'if (error == 0)', matching setfown()."
}