{
  "finding_id": "DF-2670",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain-by-inspection wrong-mount accounting: sys_fchown() (sys/kern/vfs_syscalls.c:3637) passes p->p_fd->fd_ncdir.mount — the mount of the caller's CWD — to setfown(), whose VFS_ACCOUNT() transfers ownership accounting on that mount instead of the mount of the file being chowned (fp->f_nchandle.mount / vp->v_mount). With cwd and file on different mounts the file's quota accounting is never updated (quota bypass) while the CWD's mount gets phantom ±size deltas (spurious EDQUOT for unrelated users). Not exercised on the guest because stock mounts do not wire vfs_account; code-level defect unambiguous (kern_chown():3578 and kern_ftruncate():4123 select the file's mount correctly).",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-2670/README.md (code excerpts + line refs + suggested fix)"],
  "kernel_refs": ["sys/kern/vfs_syscalls.c:3637", "sys/kern/vfs_syscalls.c:3578", "sys/kern/vfs_syscalls.c:4123", "sys/kern/vfs_syscalls.c:1495"],
  "poc_changes": "n/a — inspection-only finding",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: requires VFS quota accounting enabled (non-default). Fix mirrors kern_fstatfs():1495-1496 mp selection.",
  "recommended_fix": "Pass fp->f_nchandle.mount (falling back to vp->v_mount) instead of p->p_fd->fd_ncdir.mount to setfown() in sys_fchown()."
}