{
 "finding_id": "DF-3001",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Missing ownership check proven at the exact VFS layer the NFS server drives, with a UFS control. A kernel probe issued VOP_SETATTR(va_atime/va_mtime = 1234567890, va_vaflags=0, credential uid 32767 nobody) on a root-owned 0644 file: HAMMER1 returned 0 and the mtime WAS forged to 1234567890 (hammer_vop_setattr applies va_atime/va_mtime unconditionally, hammer_vnops.c:2344-2350); the identical probe against UFS returned EPERM with mtime unchanged (the ufs_setattr contract guard, ufs_vnops.c:462-468, that hammer omits). The NFS server builds vap->va_atime/va_mtime straight from the RPC (nfs_serv.c:391-399) and calls VOP_SETATTR with the mapped client credential, so any NFS client with mapped credentials can forge timestamps on files it does not own in a HAMMER1 export; the local syscall path is shielded by the client-side NLC check. Raw-RPC end-to-end not driven (no scripting runtime on guest; timeboxed) - the VOP-layer A/B is the mechanism proof. Fix (mirror the UFS guard) A/B validated on the fix-all kernel.",
 "exploit_chain": "NFS SETATTR RPC -> nfs_serv builds vap with client-supplied atime/mtime + mapped unpriv cred -> VOP_SETATTR -> hammer applies with no ownership check -> timestamps forged on non-owned files",
 "evidence": "run.log DF3001: hammer mtime 1792879535 -> 1234567890 FORGED; UFS control -> 1 (EPERM) rejected",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_vnops.c:2344",
  "sys/vfs/ufs/ufs_vnops.c:462"
 ],
 "poc_changes": "VOP-layer probe with a forged non-owner credential instead of a raw NFS RPC client (no python on guest); threat-model reachability from nfs_serv.c source",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "make (KMOD dfv_safe)",
 "run_cmd": "mount hammer1+ufs rigs; kldload dfv_safe.ko; sysctl -w dfv.sa3001=1",
 "code_hash": "8211ab6aada2d050ed579802377f08a3b6aeddeabcc33fd0679d43540120a7f4",
 "notes": "HAMMER1 analog of DF-2629; backup/incremental/forensic integrity break, no memory safety",
 "recommended_fix": "mirror ufs_setattr ownership/privilege check for atime/mtime",
 "fix_status": "fixed",
 "fix_verdict": "A/B on fix kernel #2: non-owner VOP_SETATTR on HAMMER returns EPERM with mtime unchanged, matching the UFS control (stock forged mtime to 1234567890).",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}