{
  "finding_id": "DF-2675",
  "title": "allocbuf() maps 17 pages into the 16-page MAXBSIZE per-header KVA slot when (loffset & PAGE_MASK) + size > MAXBSIZE, aliasing one page between two live kernel buffers",
  "verdict": "reproduced",
  "impact": "memcorrupt (kernel memory corruption + cross-principal info disclosure + panic); Critical",
  "reproduce": {
    "build": "in-guest (root): cd /root && sh build.sh   (cc tools; gunzip image)",
    "run": "sh run.sh  — mount crafted FAT (512B sectors, 128 sec/cluster = 64KB clusters, first data cluster block 12 -> byte 6144), ls a directory; ovrdump shows npages=17 buffers; ladder.sh + demo.sh for alias/leak/panic",
    "expected": "OVRBUF n=.. kva=.. npages=17 kvasize=65536 loff=0x1800; after neighbor placement p16 maps foreign .ko bytes; ls returns 1986 entries incl. garbage; touch+sync -> panic: base_insert ... in hammer2_base_insert"
  },
  "kernel_refs": [
    "sys/kern/vfs_bio.c:638",
    "sys/kern/vfs_bio.c:1885",
    "sys/kern/vfs_bio.c:2736",
    "sys/kern/vfs_bio.c:2939",
    "sys/kern/vfs_bio.c:3039",
    "sys/kern/vfs_bio.c:3044",
    "sys/kern/vfs_bio.c:3211",
    "sys/kern/vfs_bio.c:3077",
    "sys/kern/vfs_bio.c:1854",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:423",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:446",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:505",
    "sys/vfs/msdosfs/msdosfs_vnops.c:513",
    "sys/vfs/msdosfs/msdosfs_vnops.c:1368",
    "sys/vfs/msdosfs/msdosfs_lookup.c:639",
    "sys/vfs/hammer2/hammer2_chain.c:5364"
  ],
  "fix": "fix.diff — getblk(): panic if size + (loffset & PAGE_MASK) > MAXBSIZE; allocbuf(): same accounting (defense in depth); msdosfs: reject mounts whose 64KB clusters sit at non-page-aligned device offsets (aligned 64KB clusters still supported, verified).",
  "fix_validation": {
    "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Sun Aug 30 12:36:11 UTC 2026 (X86_64_GENERIC, nativekernel with fix.diff)",
    "baseline_reproduced": 1,
    "patched_reproduced": 0,
    "result": "crafted image: 'msdosfs: 64KB clusters at non-page-aligned device offset 6144' + mount EINVAL (rc=71); ovrdump overflow-buffer count 0; aligned-64KB image still mounts and reads (1984 entries, 0 overflow buffers); normal newfs_msdos image mounts/mkdir/write/umount fine",
    "log": "fix_run.log"
  },
  "artifacts": [
    "mkfat64k.py", "fat64k.img.gz", "mkfat64kB.py", "fat64kB.img.gz",
    "mkfat64k_aligned.py", "fat64k_aligned.img.gz",
    "ptecheck.c", "pml4dump.c", "bufscan.c", "ovrdump.c", "findfield.c", "p16watch.c",
    "pindir.c", "pinread.c", "sweep.c", "ladder.sh",
    "runs17.sh", "build.sh", "run.sh",
    "run.log", "panic.txt",
    "fix.diff", "fix_build.log", "fix_run.log",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}