{
 "finding_id": "DF-2907",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Both halves reproduced on the stock INVARIANTS kernel. (1) Oversize fetch: md_get_mbuf(mdp, 128) against a 64-byte chain panics with panic: m_copym: length > size of mbuf chain - the ignored md_get_mem return at subr_mchain.c:518 lets the call proceed into m_copym with an unsatisfiable length (backtrace: m_copym <- md_get_mbuf <- sysctl trigger); on non-INVARIANTS kernels m_copym breaks with a short copy and the caller gets silent success with a short mbuf - the production form of the claim. (2) md_done leaves md_cur=0xfffff801174d2600 and md_pos dangling over the freed chain (md_top cleared only), and a stale read through md_cur->m_len after md_done returned 64 - the UAF read executed. Fix (check md_get_mem; clear md_cur/md_pos) A/B validated on the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "df2907p_panic.txt: panic m_copym length > size of mbuf chain via md_get_mbuf; run.log: md_done dangling pointers + stale read 64",
 "kernel_refs": [
  "sys/kern/libmchain/subr_mchain.c:518",
  "sys/kern/libmchain/subr_mchain.c:323",
  "sys/kern/uipc_mbuf.c:1547"
 ],
 "poc_changes": "drove the library from a kld harness (needs smbfs.ko loaded for mchain symbols)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 1,
 "build_cmd": "make (KMOD dfv_boom with KERNBUILDDIR)",
 "run_cmd": "kldload smbfs; kldload dfv_boom.ko; sysctl -w dfvboom.m2907=1",
 "code_hash": "dda19f1f5b27d94055ace3c314348bae1185bdc330304be9f0aa36bb0947d71d",
 "notes": "context is an active SMB session (only smbfs.ko provides mchain)",
 "recommended_fix": "check md_get_mem return; clear md_cur/md_pos in md_done",
 "fix_status": "fixed",
 "fix_verdict": "A/B on fix kernel #2: oversize md_get_mbuf(128) returns 72 (EBADRPC), no panic, guest alive. IMPORTANT: the first fix revision (check md_get_mem AFTER m_copym) did NOT survive A/B - the INVARIANTS KASSERT fires inside m_copym before any post-check; the validated fix pre-computes the remaining chain bytes and rejects before m_copym.",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}