# DF-2910 — disklabel64 read-path trust → arbitrary absolute-media-offset I/O via partition devices of crafted media

**Impact upgrade of DF-0134** (which established the missing structural validation; this
pack concretely demonstrates and fixes the resulting I/O redirection primitives).

## What was proven (baseline, stock INVARIANTS kernel #0, 3/3 deterministic runs)

Attacker-controlled media (image file / USB disk) containing a CRC-valid `disklabel64`
with uncontained partition fields is auto-parsed by the kernel at attach time
(`disk_probe` → `disk_probe_slice`, sys/kern/subr_disk.c:491). `l64_readdisklabel`
(sys/kern/subr_disklabel64.c:145-201) checks only magic / `d_npartitions<=16` / CRC —
never bounds. Partition devices are then created, and `dscheck`
(sys/kern/subr_diskslice.c:206-212,280-281) routes their I/O using
`(sp->ds_offset + slicerel_secno) * dss_secsize` — mod-2^64 arithmetic with **no
containment check against the slice**:

1. **Cross-slice read/write** — `p_boffset` beyond the slice end: `/dev/vn0s1a`
   (partition of the 1 MiB slice s1) reads/writes slice s2's data at absolute LBA 6144.
   → slice isolation broken; a mounted attacker slice can read/modify *other* slices of
   the same disk (e.g. an OS partition, the running system's raw data).
2. **Wraparound slice escape (backwards)** — `p_boffset = 2^64-983040`:
   `(2048 + 2^55-1920)*512 mod 2^64 = 65536` → `/dev/vn0s1b` reads absolute LBA 128,
   **before the slice start** (kernel itself reports `media_offset=65536` via DIOCGPART).
3. **Universal window** — one partition `p_boffset = p_bsize = 2^64-512` yields a
   2^55-sector window (`media_offset=LBA 2047, media_blocks=2^55-1`); the user's own
   partition-relative seek selects the absolute target.
4. **EROFS label-area protection bypass** — writing slice-rel sector 1 via the
   whole-slice device is correctly rejected `EROFS` (ds_reserved=8), but the same byte
   written through the crafted partition (`slicerel_secno ≈ 2^55` → not `< ds_reserved`)
   succeeds: `write(/dev/vn0s1c, sec=2) = 512` and the on-disk label magic at absolute
   LBA 2049 is overwritten ("PWNED-PARTITION-WRITE" on raw read-back).

No panic; guest stays up; primitives are fully controlled read/write at
attacker-chosen absolute media offsets. Ceiling: with root attaching/opening attacker
media (automount, vnconfig, USB), all slice/label protections on that disk are void —
cross-slice data theft and targeted corruption (MBR, foreign labels, other OS's data).
It is *disk-data* redirection, not kernel-memory corruption.

## Build / run (in guest, as root)

```
# host: generate the crafted image (python3, no deps)
python3 makeimg.py df2910.img
# guest: attach; kernel auto-probes the crafted label
vnconfig -c vn0 /root/df2910.img
sh run.sh          # full sequence: dump label, 3 read primitives, EROFS control+bypass
```

Expected (vulnerable kernel): `SLICE2-SECRET-MARKER` via vn0s1a,
`SECTOR128-SECRET-MARKER` via vn0s1b, `EROFS` via vn0s1 control, `write=512 ok` via
vn0s1c and `PWNED-PARTITION-WRITE` at raw LBA 2049.

Expected (patched kernel): `vn0s1: cannot find label (disklabel64 corrupted,
partition)` in the message buffer; only `/dev/vn0s1` exists; every primitive absent;
valid labels (`valid.img`) still install with working partition I/O and EROFS intact.

## Fix

`fix.diff` adds structural validation to `l64_readdisklabel` (label total/boot-area and
every partition bounded within `sp->ds_size * secsize`, sector-aligned, wrap-safe
sums). Validated in-guest: baseline reproduces, patched kernel rejects the crafted
label and accepts valid ones (run.fixed.log, run.fixed2.log).