{
  "finding_id": "DF-2669",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain-by-inspection quota-accounting corruption: kern_truncate() (sys/kern/vfs_syscalls.c:4048) and kern_ftruncate() (:4124) execute VFS_ACCOUNT(mp, uid, gid, length - old_size) after VOP_SETATTR even when VOP_SETATTR failed, moving per-uid accounting by the requested delta although the file size never changed; repeated failed truncates (e.g. EFBIG) drive accounting to arbitrary values, enabling quota bypass or spurious EDQUOT. Not exercised on the guest because the stock kernel/mounts do not wire vfs_account (VFS_ACCOUNT is a no-op without vfs.quota_enabled); code-level defect unambiguous (sibling setfown() guards the identical call at :3555).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2669/README.md (code excerpts + line refs + suggested fix)"
  ],
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:4048",
    "sys/kern/vfs_syscalls.c:4124",
    "sys/kern/vfs_syscalls.c:3555"
  ],
  "poc_changes": "n/a \u2014 inspection-only finding",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: requires VFS quota accounting enabled (non-default). Fix is a two-line error==0 guard.",
  "recommended_fix": "Guard both VFS_ACCOUNT calls in kern_truncate()/kern_ftruncate() with if (error == 0), matching setfown()."
}