{
 "finding_id": "DF-2911",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Both directions reproduced live on a vn-backed scratch disk with DIOCSDINFO64. Control: with the stock label (d_bbase=4096) a pwrite at slice offset 0 returns EROFS (the ds_reserved label-area guard, subr_diskslice.c:227). (a) A label with d_bbase=0 (CRC recomputed) is ACCEPTED by l64_setdisklabel - no check bounds d_bbase - and the same pwrite then returns 512: the EROFS label-area protection is fully disabled and we overwrote the on-disk label area. (b) A label with d_bbase=d_pstop=1072676864 (whole slice reserved, unvalidated) is ACCEPTED and every write to the slice returns EROFS - whole-slice lockout via one label ioctl. FWRITE root/operator-gated; consistency/self-inflicted class, not a privilege boundary.",
 "exploit_chain": "",
 "evidence": "df2911_run.log: control EROFS; bbase=0 accepted then pwrite=512 WRITE ACCEPTED BELOW LABEL; bbase=pstop accepted then EROFS everywhere",
 "kernel_refs": [
  "sys/kern/subr_disklabel64.c:278",
  "sys/kern/subr_disklabel64.c:296",
  "sys/kern/subr_disklabel64.c:526",
  "sys/kern/subr_diskslice.c:227"
 ],
 "poc_changes": "had to recompute the label d_crc (crc32 over d_magic..d_partitions[n]) after editing - the kernel validates it before the sanity block",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "cc -o df2911 df2911_lab64.c -lz",
 "run_cmd": "vnconfig + fdisk -IB + disklabel64 -w, then ./df2911 /dev/vn0s1",
 "code_hash": "52284e69f2155a5862901bb90d276dfd37c9067316a08e768a77db823c93b186",
 "notes": "ds_reserved = d_bbase / secsize feeds the EROFS guard directly",
 "recommended_fix": "validate d_bbase <= d_total_size, d_pbase >= d_bbase, d_pbase <= d_pstop <= d_total_size, partition lower bound d_bbase",
 "fix_status": "not_testable",
 "fix_verdict": "fix compiled in fix-all kernel; label-rig A/B rerun not performed (kernel build time-boxed); the fixed validation rejects both crafted labels by construction"
}