{
 "finding_id": "DF-2874",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "The authorization gap is real at the kernel-service level - DIOCRECLUSTER has no priv_check and accepts any fd; BLK_OPEN then does dev_dopen(rawdev, FREAD|FWRITE, S_IFCHR, proc0.p_ucred, ...) (subr_diskiocom.c:281) and BLK_WRITE/READ/FLUSH/FREEBLKS execute raw I/O with zero open/keyid validation - and the peer-position chain was verified (BLK_OPEN error=0; a write through the channel landed on the raw boot disk and was md5-verified by root dd). BUT the unprivileged claim does not reproduce on this system: diskopen() gates every disk-volume open with caps_priv_check_self(SYSCAP_RESTRICTEDROOT) (subr_disk.c:78-80), so an operator-group user cannot even open /dev/vbd0 O_RDONLY (EPERM) and never reaches the ioctl. Filed as Info/defense-in-depth: had the gate not been there, 0640 root:operator + O_RDONLY would have sufficed for operator->root-equivalent raw disk R/W.",
 "exploit_chain": "",
 "evidence": [
  "run.log (BLK_OPEN modes=3 -> error=0; raw write md5-verified on disk; unpriv open EPERM)",
  "VERDICT.md",
  "run.fix.log (fixed: O_RDONLY ioctl -> EPERM, O_RDWR works)"
 ],
 "kernel_refs": [
  "sys/kern/subr_diskiocom.c:108",
  "sys/kern/subr_diskiocom.c:118",
  "sys/kern/subr_diskiocom.c:281",
  "sys/kern/subr_disk.c:1191",
  "sys/kern/subr_disk.c:78"
 ],
 "poc_changes": "No seed; wrote dfpeer.c (openwr/write/read modes) plus the operator-user orchestration run_f1.sh/run_f1b.sh",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 600,
 "guest_dirty": 1,
 "build_cmd": "cc -O -Wall -o /tmp/dfpeer dfpeer.c",
 "run_cmd": "sh run_f1.sh; sh run_f1b.sh",
 "code_hash": "e748ca2203c63d4fc7c412513eefcdf465800329f3e8ff3c36dbd9f5d0583722",
 "notes": "External mitigation (RESTRICTEDROOT) closes the unpriv path on DF 6.5; on older kernels without the cap check this was a real operator->root escalation vector - worth checking historically.",
 "recommended_fix": "Require FWRITE on the device node for DIOCRECLUSTER so the gate is explicit (devfs then enforces write permission at open)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 18:43:16 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix.diff applied, make nativekernel)",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Fix kernel: DIOCRECLUSTER via O_RDONLY fd returns EPERM; via O_RDWR (root) still works. Gate explicit.",
 "fix_evidence": [
  "run.fix.log"
 ]
}