# DF-3024 — tmpfs utimes timestamp forgery by non-owner (VFS-contract divergence)

* unprivileged local user (write access, not owner)
* default-mounted tmpfs (`/tmp`, `/var/run/shm`)
* `utimensat()` with explicit old timestamps on a **root-owned 0666** file
  → returns **0**, timestamps forged (POSIX: EPERM; UFS enforces EPERM)

## Build & run

```
# guest, as root:
touch /tmp/df3024_victim && chmod 666 /tmp/df3024_victim

# guest, as unprivileged user:
cc -O2 -o df3024 trigger.c && ./df3024
```

Expected output (see `run.log`):

```
before : uid=0 mode=0666 mtime=1788606959
utimensat = 0
after  : mtime=1000000000 atime=1000000000 uid=0
SUCCESS-CRITERION: forged mtime==1000000000 by non-owner -> FORGERY REPRODUCED
```

Fix proposal: `fix.diff` (mirrors `ufs_vnops.c:461-470` ownership +
`VA_UTIMES_NULL` gating in `tmpfs_chtimes`). Not kernel-validated (Low
severity; fix validation was spent on DF-3023).