# DF-2911 PoC evidence pack

## What
l64_setdisklabel accepts inconsistent geometry: d_bbase=0 disables the EROFS label-area guard; huge d_bbase locks the slice.

## Build
```
cc -o df2911 df2911_lab64.c -lz
```

## Run
```
vnconfig + fdisk -IB + disklabel64 -w, then ./df2911 /dev/vn0s1
```

## Expected
control pwrite EROFS; after d_bbase=0 label: pwrite=512 (label area writable); after d_bbase=pstop: EROFS everywhere

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).