{
 "finding_id": "DF-3002",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Crafted-image panic at the exact predicted sink. A HAMMER1 filesystem image was built with newfs_hammer, populated, then offline-patched (CRC32C-verified leaf matching; node CRCs recomputed via the v6-crc32 fallback the kernel accepts) so that the DIRENTRY leaf for d/file_2902 has data_offset == 0. hammer_btree_extract returns cursor->data = NULL with error == 0 (hammer_btree.c:705,:730 - the data CRC is never computed on this path). Mount succeeds clean; ls of the crafted directory dereferenced the NULL data pointer in kernel mode: Fatal trap 12, fault virtual address = 0x0, Stopped at hammer_vop_readdir+0x1e8 - the vop_write_dirent sink (:1734 area); nresolve/readlink/strategy_read sinks are the same NULL-data shape. Deterministic, INVARIANTS or not (KKASSERT at :1728 passes for data_len>7). Mount of crafted media requires privilege (DF-2902-2912 family threat model). Fix (EINVAL for data_off==0) A/B validated on the fix-all kernel.",
 "exploit_chain": "crafted HAMMER1 image with direntry leaf data_offset=0 -> mount (root) -> getdents on crafted dir -> hammer_btree_extract success+NULL -> vop_write_dirent deref NULL -> kernel page fault at 0x0",
 "evidence": "df3002_panic.txt: Fatal trap 12 fault VA 0x0 Stopped at hammer_vop_readdir+0x1e8; df3002_run.log: mount clean, root ls ok, crafted-dir ls -> panic",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_btree.c:730",
  "sys/vfs/hammer/hammer_vnops.c:1734",
  "sys/vfs/hammer/hammer_vnops.c:1254"
 ],
 "poc_changes": "wrote a scan-based offline patcher: b-tree leaf located by CRC32C-matching the direntry data blob; node CRC rewritten with v6 crc32 (accepted fallback)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 300,
 "guest_dirty": 1,
 "build_cmd": "guest: newfs_hammer -f on 12G sparse vn image; host: python3 h1patch2.py IMG 3002 file_2902",
 "run_cmd": "vnconfig -c vn0 IMG; mount_hammer /dev/vn0 /mnt/h1t; ls /mnt/h1t; ls -la /mnt/h1t/d  -> panic",
 "code_hash": "cdb5649bb32188c07d78a1e98f0c5f5c011ca9bc017118a4ffbc7ed0bfb9549c",
 "notes": "zone offsets decode as vol_buf_beg-relative; single-leaf fs root at 0x21088000",
 "recommended_fix": "return EINVAL for data_off == 0 in hammer_btree_extract",
 "fix_status": "fixed",
 "fix_verdict": "A/B on fix kernel #2: same crafted image mounts; ls of the crafted dir completes with rc=0 and the diagnostic hammer_btree_extract: illegal zero data_offset logged twice - NO panic (stock: NULL-deref at hammer_vop_readdir+0x1e8).",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}