{
  "finding_id": "DF-3024",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "tmpfs_chtimes (tmpfs_subr.c:1291) applies va_atime/va_mtime with no ownership/privilege check and ignores VA_UTIMES_NULL, while the VFS layer (kern_utimensat:3961, kern_futimens:3847, naccess_lva) deliberately admits root, the owner, OR anyone with write access and defers the stricter POSIX rule (explicit-timestamp forging is owner-only) to the filesystem - a rule every other local FS enforces (ufs_vnops.c:461-470, ext2:349, msdosfs:405, hpfs:535). Demonstrated live: unprivileged user maxx forged mtime/atime = 1000000000 (2001-09-09) on a root-owned 0666 file in the default tmpfs /tmp via utimensat; POSIX/UFS return EPERM for this. NFS SETATTR (tmpfs is exportable via tmpfs_mountctl MOUNTCTL_SET_EXPORT) reaches the same unguarded code regardless of write access - the DF-3001 (hammer1) pattern, here reachable locally on default mounts. Integrity-only impact: defeats timestamp-based tamper detection, make/rsync/tar freshness, tmpwatch semantics on /tmp and /var/run/shm. No memory-safety impact.",
  "exploit_chain": "",
  "evidence": [
    "run.log — root-owned 0666 /tmp file's mtime/atime forged to 1000000000 by non-owner via utimensat (returns 0)",
    "trigger.c — minimal reproducer",
    "env.txt — guest default tmpfs mounts (/tmp, /var/run/shm), unpriv uid"
  ],
  "kernel_refs": [
    "sys/vfs/tmpfs/tmpfs_subr.c:1291",
    "sys/vfs/tmpfs/tmpfs_vnops.c:486",
    "sys/kern/vfs_syscalls.c:3961",
    "sys/kern/vfs_syscalls.c:3847",
    "sys/kern/vfs_nlookup.c:1869",
    "sys/vfs/ufs/ufs_vnops.c:461"
  ],
  "poc_changes": "none - seed sketch compiled and ran as-is once DFbsd header set (sys/sysctl.h, sys/mount.h) was corrected",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o poc/df3024 poc/df3024.c",
  "run_cmd": "root: touch /tmp/df3024_victim && chmod 666 /tmp/df3024_victim; unpriv: ./df3024 (expect utimensat=0 and mtime=1000000000 on the root-owned file)",
  "code_hash": "30e368f4be2a998a02f6cacc5e2a184b897f7d7a6d4470ed4653a06b320a230d",
  "notes": "impact enum has no 'integrity' value; this is a timestamp-forgery (tamper) bug, not memory safety - recorded as impact=none with the integrity story in the verdict text. hammer2's setattr has the same missing check (hammer2_vnops.c:561) - ecosystem-wide divergence vs UFS family.",
  "recommended_fix": "Mirror ufs_vnops.c:461-470 in tmpfs_chtimes: owner-or-caps_priv_check(SYSCAP_NOVFS_SETATTR), else require VA_UTIMES_NULL plus effective write access (fix.diff in pack; not kernel-rebuilt - fix budget spent on DF-3023)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (mirrors UFS check) but not kernel-validated; Low-severity finding, verification budget allocated to DF-3023's mandatory fix validation",
  "fix_evidence": "fix.diff"
}