# VERDICT — DF-2703

**status: untested** (Phase V deliberately skipped: Low-severity latent hardening
finding — nothing observable to reproduce on a stock kernel; no handler reads the
uninitialized fields).

## Method (static proof)

1. Read sys/kern/vfs_vopops.c end-to-end (2227 lines) in pass 2.
2. Extracted every `struct vop_*_args` field list from sys/sys/vfsops.h and every
   `ap.a_* =` assignment from each wrapper in sys/kern/vfs_vopops.c; scripted diff
   reports exactly three gaps (plus the shared vestigial `a_head.a_reserved[4]`):
   - `vop_mountctl`: `ap.a_vp` never assigned (vfs_vopops.c:1300-1308;
     struct at vfsops.h:433-443). The `vp` function parameter is used at
     vfs_vopops.c:1310 (`VFS_MPLOCK(vp->v_mount)`) but never stored in `ap`.
   - `vop_markatime`: `ap.a_op` never assigned (vfs_vopops.c:1327-1330;
     struct at vfsops.h:445-450).
   - `vop_allocate`: `ap.a_op` never assigned (vfs_vopops.c:1349-1353;
     struct at vfsops.h:452-458).
3. Surveyed every consumer of these three ops in the tree:
   - vop_mountctl handlers: vfs_default.c:1301 (vop_stdmountctl — uses
     a_ops->head.vv_mount, a_op, a_ctllen, a_ctl, a_fp, a_buf, a_buflen, a_res),
     hammer2_vnops.c:2278, hammer_vnops.c:2532, tmpfs_vnops.c:1879,
     autofs_vnops.c:434, fuse_vnops.c:1806, dirfs_vnops.c:1418,
     null_vnops.c:206, vfs_jops.c:154 (journal_mountctl). **None read a_vp.**
     (null_vnops.c:224-229 references `a_nch` only inside `#if 0` dead code.)
   - vop_markatime handlers: ufs_vnops.c:355, hammer_vnops.c:2125,
     hammer2_vnops.c:2401, vfs_default.c:137 — none read `a_op`.
   - vop_allocate handlers: vfs_default.c:1334 (vop_stdallocate) — reads
     a_vp/a_offset/a_len only.

## Conclusion

Certain, latent, Low. Uninitialized kernel-stack pointer (`a_vp`) is handed to
every mountctl dispatch; today's handlers all ignore it, so there is no runtime
symptom to reproduce. One new handler that trusts `ap->a_vp` turns this into a
wild-pointer dereference with attacker-influenced stack contents (mountctl itself
is root-gated, sys/kern/vfs_syscalls.c:1277-1283; markatime/allocate are
user-reachable but expose only a garbage `int`). Fix is a 3-line initialization
(or deleting the dead `a_op` fields). No fix-kernel build required: no behavioral
change to validate beyond compilation.

Cross-checked: `union vop_args_union` referencing these structs is `#if 0`-dead
(vfsops.h:680-745), so no alternate consumer exists.