{
 "finding_id": "DF-2912",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced as root on the stock guest: a vn disk carrying a 1-sector MBR slice yields d_total_size=512 < ressize=4096, and DIOCGDVIRGIN64 on /dev/vn0s1 returned d_abase = 0xfffffffffffff200 (= 512-4096 twos complement, exactly the predicted unsigned underflow at subr_disklabel64.c:482) and d_pstop = 0xffffffffffffe000 (derived wrap at :491) - a bogus virgin label that makes disklabel64(8) unable to label tiny slices (every partition rejected); no kernel memory impact (no in-kernel consumer of d_abase). On the fix kernel the same ioctl returns d_abase = 0x9000 (clamped, no wrap) and d_pstop clamped to d_pbase. Fix iterated twice: v1 clamped only d_abase (A/B still showed wrapped d_pstop), v2 clamps both.",
 "exploit_chain": "",
 "evidence": "run.log baseline: d_abase=0xfffffffffffff200; fix kernel: d_abase=0x9000, d_pstop clamped (0xffffffff... gone)",
 "kernel_refs": [
  "sys/kern/subr_disklabel64.c:474",
  "sys/kern/subr_disklabel64.c:482",
  "sys/kern/subr_disklabel64.c:491"
 ],
 "poc_changes": "vn slice created via a hand-built MBR image (1 sector at LBA 16, type 0xA5); DIOCGDVIRGIN64 on the slice device",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o dl64_tiny dl64_tiny.c",
 "run_cmd": "./dl64_tiny (as root; vnconfig inside)",
 "code_hash": "be48d7e2557af91867780d259b476be0328a66f84fca0eb2656986bf8f0d1e6f",
 "notes": "Functional self-DoS for disklabel64(8) on tiny slices; no memory unsafety",
 "recommended_fix": "Clamp d_abase (and derived d_pstop) when d_total_size < ressize",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline underflowed d_abase/d_pstop; fix kernel returns clamped sane values."
}