{
  "finding_id": "DF-2844",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "vnode_pager_haspage() (sys/vm/vnode_pager.c:260) computes loffset % f_iosize with no zero guard. All filesystems that hand vnodes VM objects initialize f_iosize to a positive constant at mount, so the division is currently safe; however autofs leaves mnt_stat.f_iosize == 0 (autofs_vfsops.c:285 via mount-time VFS_STATFS at :185) and is only unreachable because autofs vnodes never get VM objects. One future vinitvmio() in autofs turns this into a kernel divide-by-zero panic. Filed as Info hardening.",
  "exploit_chain": "",
  "evidence": ["README.md: analysis + fix"],
  "kernel_refs": ["sys/vm/vnode_pager.c:259", "sys/vm/vnode_pager.c:260", "sys/vfs/autofs/autofs_vfsops.c:285"],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hardening/defense-in-depth; no demonstrated impact on current tree",
  "recommended_fix": "guard bsize<=0 in vnode_pager_haspage (return TRUE, defer to I/O path) and give autofs a real f_iosize"
}