# DF-2955 VERDICT

**status: reproduced** (impact: timestamp-integrity / correctness — no memory
corruption; per the honest-impact enum this maps to `impact: none`)

## What was run

Guest: DragonFly 6.5-DEVELOPMENT, stock INVARIANTS `X86_64_GENERIC` #0
(Thu Jul 2 06:02:54 UTC 2026), x86_64, 64-bit time_t.

1. **Math harness** (`fattime_host.c`, verbatim function bodies, compiled with
   the guest cc): round-trips every day 1980-01-01..2107-12-31 through
   `timespec2fattime` → `fattime2timespec`. First failure: **2106-02-08**
   (tv_sec 4295030400). Total failing days: **692** (exactly the days
   2106-02-08..2107-12-31, i.e. the failure is purely the read path; the
   encoder is exact through 2107-12-31). See `harness_guest.log` section A.

2. **End-to-end kernel PoC** (`fattime_poc.c` + real msdosfs mount):
   - `dd`+`vnconfig`+`newfs_msdos`+`mount_msdos /dev/vn0 /mnt` (FAT12).
   - `utimes("/mnt/W1", 4295030400)` → stat: **1970-01-01 17:31:44** (=
     4295030400 − 2^32 = 63104 s). `utimes("/mnt/W2", 4354750800)` → stat:
     **1971-11-23 22:31:44** (= 4354750800 − 2^32). Control 2025 date MATCHes.
     (`poc_root.log`)
   - **Unprivileged**: remount `mount_msdos -u 1001`, run as uid 1001 on own
     file → identical MISMATCH, no root involved. (`poc_unpriv.log`)
   - **On-disk proof** (`findentry.c`): W1 entry has `MDate = 0xfc48`
     (year 126 = 2106, month 2, day 8), W2 has `MDate = 0xff9f` (2107-12-31)
     — i.e. the on-disk dates are *valid*; only `fattime2timespec`'s
     `tsp->tv_sec += DAY * day` (subr_fattime.c:251, int × unsigned = 32-bit
     unsigned multiply) wraps. (`findentry.log`)

## Root cause chain

`fattime2timespec` (sys/kern/subr_fattime.c:219) ←
`msdosfs_getattr` (sys/vfs/msdosfs/msdosfs_vnops.c:251,253-254) ←
`stat(2)` on any msdosfs file whose on-disk date ≥ 2106-02-08
(crafted media at mount — DF-2902 threat model — or `utimes()` today,
since `itimespecfix` (kern_time.c:1047) has no upper bound on tv_sec).

day(2107-12-31) = 50403 (days since 1970); 50403 × 86400 = 4,354,819,200 >
2^32−1 → product mod 2^32 = 59,851,904 → 1971-11-14..23 depending on
time-of-day. tv_nsec is unaffected ((dh%100)×1e7 ≤ 9.9e8, always canonical).

## Why not higher severity

The wrapped value is a valid timespec; no kernel consumer performs unsafe
arithmetic on it (stat/cache/NFS-attr only). This is silent timestamp
corruption (integrity), same class as the known DF-0199/DF-0200 (Low).

## Fix validation

`fix.diff`: `tsp->tv_sec += (time_t)DAY * day;` (+ unrelated DF-2956 hunk in
the same file, one build validates both).

- Baseline kernel #0: W1/W2 MISMATCH as above.
- Patched kernel (rebuilt `make nativekernel KERNCONF=X86_64_GENERIC`,
  `#1 Fri Sep 4 04:56:16 UTC 2026`, BUILD_RC=0/INSTALL_RC=0):
  W1 → **4295030400 MATCH**, W2 → **4354750800 MATCH** (`poc_fixed.log`).
  Control unchanged. fix_status: **fixed**.

Guest was reset (`vm.sh reset with-src`) after validation.