{
  "finding_id": "DF-2910",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "l64_readdisklabel (sys/kern/subr_disklabel64.c:183-187) accepts any CRC-valid on-media disklabel64 with uncontained p_boffset/p_bsize; dscheck (sys/kern/subr_diskslice.c:280-281) then routes partition I/O at (ds_offset+slicerel)*secsize with mod-2^64 wrap and no slice containment. Demonstrated on the stock guest via vn: cross-slice read of another slice's data, backwards wraparound read to pre-slice absolute LBA 128 (kernel-reported media_offset=65536), a single 2^55-sector universal-window partition, and a write through a partition device that clobbers the on-disk label magic while the identical whole-slice write is EROFS-rejected. Impact is disk-data redirection (slice isolation + label-area EROFS protection voided for crafted media), not kernel memory corruption; trigger requires root to attach/open attacker media (vnconfig/automount), so Medium. Concrete impact upgrade of DF-0134. Fix validated: structural bounds in the read path reject the crafted label (kernel #1) while valid labels still install and EROFS protection still works.",
  "exploit_chain": "1) attacker crafts media: MBR slice type 0xA5 containing disklabel64 with CRC-valid but uncontained partitions; 2) root attaches (vnconfig -c / USB automount) -> kernel auto-probes (subr_disk.c:491) and creates partition devices; 3) read/write via e.g. /dev/vn0s1a (p_boffset beyond slice) hits other slices' data; 4) p_boffset near 2^64 wraps dscheck's offset arithmetic to arbitrary small absolute offsets incl. before the slice start; 5) p_boffset=p_bsize=2^64-512 gives a universal window (media_blocks=2^55-1) where user seeks choose the absolute target; 6) wraparound makes slicerel_secno huge so the ds_reserved EROFS check never fires -> write to the label/MBR area through a partition device.",
  "evidence": [
    "findings/poc/DF-2910/run.log \u00a71: SLICE2-SECRET-MARKER read via /dev/vn0s1a (cross-slice)",
    "findings/poc/DF-2910/run.log \u00a72: SECTOR128-SECRET-MARKER read via /dev/vn0s1b (wrap to pre-slice LBA 128; DIOCGPART media_offset=65536)",
    "findings/poc/DF-2910/run.log \u00a74-6: control write EROFS errno=30 vs bypass write()=512 ok via /dev/vn0s1c; raw LBA 2049 shows PWNED-PARTITION-WRITE",
    "findings/poc/DF-2910/run.fixed.log: patched kernel logs 'vn0s1: cannot find label (disklabel64 corrupted, partition)'; DIOCGDINFO64 -> EINVAL; no vn0s1a/b/c",
    "findings/poc/DF-2910/run.fixed2.log + VERDICT.md: valid.img label still accepted on patched kernel, partition I/O round-trips, EROFS enforced",
    "findings/poc/DF-2910/makeimg.py: image generator with exact struct packing and zlib CRC32"
  ],
  "kernel_refs": [
    "sys/kern/subr_disklabel64.c:145",
    "sys/kern/subr_disklabel64.c:183",
    "sys/kern/subr_disklabel64.c:64",
    "sys/kern/subr_diskslice.c:206",
    "sys/kern/subr_diskslice.c:227",
    "sys/kern/subr_diskslice.c:280",
    "sys/kern/subr_disk.c:491"
  ],
  "poc_changes": "No seed existed; written fresh. Initial generator expressed the wrap as per-target p_boffset=target-ds_offset*512; guest ground truth (DIOCGPART) showed the general primitive is one partition with p_boffset=p_bsize=2^64-512 plus user-relative seeks; corrected accordingly. dd error lines must not be truncated (tail swallowed EROFS errors) - wprobe.c uses write(2) and prints errno.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1560,
  "guest_dirty": 1,
  "build_cmd": "cc -o probe probe.c (guest); make -j6 nativekernel && make installkernel (fix kernel #1)",
  "run_cmd": "vnconfig -c vn0 /root/df2910.img && sh /root/run.sh",
  "code_hash": "75f221f61cf7eb96dfb5d15b935659ccd591f3aeaacfc40f406612fd49f803a6",
  "notes": "impact field: primitive is OOB I/O on disk data (cross-slice read/write, arbitrary absolute offset incl. pre-slice and the EROFS-protected label area). No kernel-memory corruption; no unprivileged local trigger (device nodes root:operator 0640; install path bounded by l64_setdisklabel modulo known DF-0135). Fixes DF-0134's impact ceiling concretely: 'potential offset overflow panic' from the old summary is disproven (no panic; clean primitives instead). Guest was reset with-src after validation; fix.diff is git-apply-able (checked) and was applied only to the guest /usr/src copy.",
  "recommended_fix": "Validate on-media disklabel64 structure in l64_readdisklabel: label total/boot area and every partition sector-aligned and contained within sp->ds_size*secsize with wrap-safe sums (see fix.diff).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep  3 07:29:24 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "vm.sh reset with-src; fix.diff applied to guest /usr/src; make -j6 nativekernel + make installkernel; reboot into kernel #1. Crafted label now rejected ('vn0s1: cannot find label (disklabel64 corrupted, partition)'), no vn0s1a/b/c devices, label magic intact, all OOB primitives absent. Valid contained label (valid.img) still accepted with correct in-slice media_offset, working read/write, and EROFS reserved protection enforced.",
  "fix_evidence": [
    "findings/poc/DF-2910/run.fixed.log",
    "findings/poc/DF-2910/run.fixed2.log",
    "findings/poc/DF-2910/build.log",
    "findings/poc/DF-2910/fix.diff"
  ]
}