{
 "finding_id": "DF-2957",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced via the harness on the stock guest by calling the exported fattime2timespec with crafted FAT fields: (1) month nibble 0 with year 127 decoded to tv_sec=4229884768 = 2104-01-15 - the out-of-range month aliases into January of the leap cycle (daytab[(dd>>5)&0x3f] entry 0) exactly as filed; (2) month nibble 13 decoded to a January-of-cycle date as well; (3) hour field 31 + minute 63 decoded to a time 32.05h past midnight spilling into the following day (1980-01-02 08:03 for a 1980-01-01 entry). No OOB is possible (the 6-bit index is safely masked into the 64-entry table; geometry re-verified), tv_nsec stays canonical - garbage mtime class only, same family as DF-0199. On the fix kernel all fields clamp (hh=23/mm=59/ss<=59, month to [1,12]: the hh31/mm63 case returned exactly 23:59:00 same-day). NOTE: the clamped month-0/year-127 sample lands at day > 49710 where the separately-filed DF-2955 32-bit DAY*day wrap applies - the printed value there is compounded by that known bug, not a clamp failure.",
 "exploit_chain": "",
 "evidence": "harness.log T10: three crafted-field decodes; fix kernel T10: hh31/mm63 -> exactly 23:59:00 (clamp proof)",
 "kernel_refs": [
  "sys/kern/subr_fattime.c:226",
  "sys/kern/subr_fattime.c:231",
  "sys/kern/subr_fattime.c:200"
 ],
 "poc_changes": "crafted dd/dt/dh values driven directly into the exported kernel function",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 25,
 "guest_dirty": 0,
 "build_cmd": "cd /root/h41 && make",
 "run_cmd": "kldload ./h41.ko; sysctl -w debug.h41.cmd=10",
 "code_hash": "85d6e241caa2a7fb1fb44b80c7736a4e83c36d29314b0c96ce91769bc9bdf839",
 "notes": "Clamp belongs at the msdosfs parse boundary together with the DF-0199 fix",
 "recommended_fix": "Clamp month to [1,12] and hh/mm/ss to their ranges when unpacking",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline garbage month/hour decodes; fix kernel clamped decodes (exact 23:59:00 for the 31:63 case)."
}