# DF-2910 VERDICT — reproduced / OOB I/O (disk-data redirection, slice escape, EROFS bypass)

## Classification

- **status: reproduced** (3/3 deterministic baseline runs; no panic; guest stable)
- **impact: dos-level ceiling is not the point — this is out-of-bounds I/O**: kernel-mediated
  read/write at attacker-chosen *absolute media offsets* through partition devices created
  from attacker-crafted media. Not kernel-memory corruption; disk-data boundary break.
- **confidence: certain** — every step traced to source and demonstrated empirically.

## Root cause chain (path:line)

1. `sys/kern/subr_disk.c:491` — every BSD-type MBR slice is label-probed at attach
   (`disk_probe_slice`), zero user interaction beyond media presence.
2. `sys/kern/subr_disklabel64.c:183-187` — `l64_readdisklabel` validates only
   `d_magic`, `d_npartitions<=16`, CRC. `p_boffset`/`p_bsize`/`d_bbase`/`d_total_size`
   are never checked against the media/slice (this is the DF-0134 gap).
3. `sys/kern/subr_disk.c:228-269` — partition devices are created for every partition
   with nonzero `p_fstype`, regardless of geometry.
4. `sys/kern/subr_diskslice.c:206-212` — `dscheck` takes `start`/`blocks` straight from
   `l64_getpartbounds` (subr_disklabel64.c:64-82) with no clamp to `sp->ds_size`
   (contrast the WHOLE_DISK/WHOLE_SLICE branches at :189/:197 which use `ds_size`).
5. `sys/kern/subr_diskslice.c:280-281` — `nbio->bio_offset =
   (off_t)(sp->ds_offset + slicerel_secno) * ssp->dss_secsize` — mod-2^64 arithmetic:
   huge `p_boffset` wraps the product to *any* small absolute offset; the EROFS
   reserved check at :227 (`slicerel_secno < sp->ds_reserved`) never fires because the
   wrapped `slicerel_secno` is astronomically large.

## What was demonstrated (baseline, kernel #0 stock INVARIANTS)

- **Cross-slice read**: `/dev/vn0s1a` (partition of 1 MiB slice s1, `p_boffset=2 MiB`)
  returned `SLICE2-SECRET-MARKER` living in slice s2 (abs LBA 6144) — run.log §1.
- **Wraparound backwards read**: `p_boffset=0xffffffffff10000` → kernel-reported
  `media_offset=65536` (DIOCGPART) → `/dev/vn0s1b` returned the marker at abs LBA 128,
  *before* the slice start — run.log §2.
- **Universal window**: `p_boffset=p_bsize=0xfffffffffffffe00` → `media_blocks=2^55-1`
  (16 EiB) partition whose user-relative seeks map to arbitrary absolute offsets —
  run.log §3/pinfo.
- **EROFS bypass write**: control write via `/dev/vn0s1` at slice-rel sec 1 →
  `EROFS` (errno 30); identical byte via `/dev/vn0s1c` at sec 2 → `write()=512 ok`,
  raw read-back at abs LBA 2049 shows `PWNED-PARTITION-WRITE` — the on-disk label magic
  clobbered through a partition device. run.log §4-6.
- Stable across runs (run.log, run.2.log, run.3.log); guest alive; no panic.

## Threat model

Unprivileged attacker supplies the media (USB stick, disk image, cloud volume); root (or
an automount daemon) attaches it and the kernel auto-parses the label. Partition devices
appear root:operator 0640. Root opening/mounting the crafted slice gives the attacker
cross-slice read/write of the *same physical disk* — including the MBR, foreign labels,
and other OS partitions — plus voiding of the label-area EROFS protection. On the PoC
guest the trigger is `vnconfig` (root). Severity Medium: powerful primitive, but requires
privileged attach/open of attacker media (no unprivileged local trigger found; the
DIOCSDINFO/WDINFO64 install path is separately bounds-checked in `l64_setdisklabel`
modulo DF-0135).

## PoC changes vs. seed

Seed sketch did not exist (finding filed from this run). Generator initially computed the
wrap `p_boffset` as `target - ds_offset*512` per-partition; corrected after guest
ground-truth (`DIOCGPART media_offset`) showed the general form: backwards reach comes
from `(ds_offset + p_boffset/512)*512 mod 2^64` — best expressed as one partition with
`p_boffset = p_bsize = 2^64-512` plus a user seek. CRC32 is zlib-compatible
(sys/libkern/crc32.c table = 0xEDB88320 reflected).

## Fix validation (mandatory — memory-boundary class)

- `fix.diff`: structural validation in `l64_readdisklabel` (total/boot-area contained;
  each partition sector-aligned, `p_boffset<=slicebsize`, `p_bsize<=slicebsize`,
  `p_boffset+p_bsize<=slicebsize` — terms bounded first so the sum cannot wrap).
- Baseline reproduced on kernel #0; guest `vm.sh reset with-src`, patch applied to
  /usr/src, `make -j6 nativekernel && make installkernel`, reboot → kernel #1.
- Patched result: kernel log `vn0s1: cannot find label (disklabel64 corrupted,
  partition)`; no vn0s1a/b/c devices; all primitives absent (run.fixed.log,
  run.fixed2.log); label magic at LBA 2049 intact.
- No false positives: a fully-contained label (`valid.img`) is accepted on the patched
  kernel; `vn1s1a` created with correct in-slice `media_offset`, read/write round-trip
  works, EROFS reserved protection enforced (`EROFS` on whole-slice write at sec 1).
- Note: on the patched kernel an *unlabeled* slice has `ds_reserved=0`, so whole-slice
  writes into the (absent) label area succeed — pre-existing behavior for label-less
  slices, not a regression of this fix.

**fix_status: fixed** — baseline reproduced / patched behavior gone / valid labels unaffected.