# DF-3001 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: corruption | confidence: certain

Missing ownership check proven at the exact VFS layer the NFS server drives, with a UFS control. A kernel probe issued VOP_SETATTR(va_atime/va_mtime = 1234567890, va_vaflags=0, credential uid 32767 nobody) on a root-owned 0644 file: HAMMER1 returned 0 and the mtime WAS forged to 1234567890 (hammer_vop_setattr applies va_atime/va_mtime unconditionally, hammer_vnops.c:2344-2350); the identical probe against UFS returned EPERM with mtime unchanged (the ufs_setattr contract guard, ufs_vnops.c:462-468, that hammer omits). The NFS server builds vap->va_atime/va_mtime straight from the RPC (nfs_serv.c:391-399) and calls VOP_SETATTR with the mapped client credential, so any NFS client with mapped credentials can forge timestamps on files it does not own in a HAMMER1 export; the local syscall path is shielded by the client-side NLC check. Raw-RPC end-to-end not driven (no scripting runtime on guest; timeboxed) - the VOP-layer A/B is the mechanism proof. Fix (mirror the UFS guard) A/B validated on the fix-all kernel.

## Evidence pointers
run.log DF3001: hammer mtime 1792879535 -> 1234567890 FORGED; UFS control -> 1 (EPERM) rejected

## Kernel references
- sys/vfs/hammer/hammer_vnops.c:2344
- sys/vfs/ufs/ufs_vnops.c:462

## PoC changes vs the filing sketch
VOP-layer probe with a forged non-owner credential instead of a raw NFS RPC client (no python on guest); threat-model reachability from nfs_serv.c source

## Fix
recommendation: mirror ufs_setattr ownership/privilege check for atime/mtime

fix status: fixed

A/B on fix-all kernel: non-owner probe returns EPERM, mtime unchanged (pending final session confirm)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.