{
  "finding_id": "DF-2670",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain-by-inspection wrong-mount accounting: sys_fchown() (sys/kern/vfs_syscalls.c:3637) passes p->p_fd->fd_ncdir.mount \u2014 the mount of the callers CWD \u2014 to setfown(), whose VFS_ACCOUNT() transfers ownership accounting on that mount instead of the mount of the file being chowned (fp->f_nchandle.mount / vp->v_mount). With cwd and file on different mounts the files quota accounting is never updated (quota bypass) while the CWDs mount gets phantom \u00b1size deltas (spurious EDQUOT for unrelated users). Not exercised on the guest because stock mounts do not wire vfs_account; code-level defect unambiguous (kern_chown():3578 and kern_ftruncate():4123 select the files mount correctly).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2670/README.md (code excerpts + line refs + suggested fix)"
  ],
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:3637",
    "sys/kern/vfs_syscalls.c:3578",
    "sys/kern/vfs_syscalls.c:4123",
    "sys/kern/vfs_syscalls.c:1495"
  ],
  "poc_changes": "n/a \u2014 inspection-only finding",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: requires VFS quota accounting enabled (non-default). Fix mirrors kern_fstatfs():1495-1496 mp selection.",
  "recommended_fix": "Pass fp->f_nchandle.mount (falling back to vp->v_mount) instead of p->p_fd->fd_ncdir.mount to setfown() in sys_fchown()."
}