{
  "finding_id": "DF-2671",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent hardening defect (Info): sys_extattr_set_file/get_file/delete_file copy exactly EXTATTR_MAXNAMELEN (255) attacker bytes into a stack buffer with plain copyin() (sys/kern/vfs_syscalls.c:5224, :5274, :5322) with no NUL-termination guarantee, then pass it as a C string to VOP_SETEXTATTR/VOP_GETEXTATTR. No in-tree filesystem implements those VOPs today (all route to vop_eopnotsupp), so no OOB read is currently reachable; any future FS extattr implementation doing strlen()/strcmp on attrname inherits a stack OOB read. sys_extattrctl():5189 already uses copyinstr() correctly.",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-2671/README.md (code excerpts + line refs + suggested fix)"],
  "kernel_refs": ["sys/kern/vfs_syscalls.c:5224", "sys/kern/vfs_syscalls.c:5274", "sys/kern/vfs_syscalls.c:5322", "sys/sys/extattr.h:62"],
  "poc_changes": "n/a — inspection-only finding",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info severity hardening; fix is a one-line copyin()->copyinstr() change per call site.",
  "recommended_fix": "Use copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL) in the three extattr syscalls so the name is guaranteed NUL-terminated."
}