{
 "finding_id": "DF-3024",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "tmpfs_chtimes (tmpfs_subr.c:1291) applies va_atime/va_mtime with no ownership/privilege check and ignores VA_UTIMES_NULL, while the VFS layer (kern_utimensat:3961, kern_futimens:3847, naccess_lva) deliberately admits root, the owner, OR anyone with write access and defers the stricter POSIX rule (explicit-timestamp forging is owner-only) to the filesystem - a rule every other local FS enforces (ufs_vnops.c:461-470, ext2:349, msdosfs:405, hpfs:535). Demonstrated live: unprivileged user maxx forged mtime/atime = 1000000000 (2001-09-09) on a root-owned 0666 file in the default tmpfs /tmp via utimensat; POSIX/UFS return EPERM for this. NFS SETATTR (tmpfs is exportable via tmpfs_mountctl MOUNTCTL_SET_EXPORT) reaches the same unguarded code regardless of write access - the DF-3001 (hammer1) pattern, here reachable locally on default mounts. Integrity-only impact: defeats timestamp-based tamper detection, make/rsync/tar freshness, tmpwatch semantics on /tmp and /var/run/shm. No memory-safety impact.",
 "exploit_chain": "",
 "evidence": [
  "run.log \u2014 root-owned 0666 /tmp files mtime/atime forged to 1000000000 by non-owner via utimensat (returns 0)",
  "trigger.c \u2014 minimal reproducer",
  "env.txt \u2014 guest default tmpfs mounts (/tmp, /var/run/shm), unpriv uid"
 ],
 "kernel_refs": [
  "sys/vfs/tmpfs/tmpfs_subr.c:1291",
  "sys/vfs/tmpfs/tmpfs_vnops.c:486",
  "sys/kern/vfs_syscalls.c:3961",
  "sys/kern/vfs_syscalls.c:3847",
  "sys/kern/vfs_nlookup.c:1869",
  "sys/vfs/ufs/ufs_vnops.c:461"
 ],
 "poc_changes": "none - seed sketch compiled and ran as-is once DFbsd header set (sys/sysctl.h, sys/mount.h) was corrected",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "cc -O2 -o poc/df3024 poc/df3024.c",
 "run_cmd": "root: touch /tmp/df3024_victim && chmod 666 /tmp/df3024_victim; unpriv: ./df3024 (expect utimensat=0 and mtime=1000000000 on the root-owned file)",
 "code_hash": "30e368f4be2a998a02f6cacc5e2a184b897f7d7a6d4470ed4653a06b320a230d",
 "notes": "impact enum has no integrity value; this is a timestamp-forgery (tamper) bug, not memory safety - recorded as impact=none with the integrity story in the verdict text. hammer2s setattr has the same missing check (hammer2_vnops.c:561) - ecosystem-wide divergence vs UFS family.",
 "recommended_fix": "Mirror ufs_vnops.c:461-470 in tmpfs_chtimes: owner-or-caps_priv_check(SYSCAP_NOVFS_SETATTR), else require VA_UTIMES_NULL plus effective write access (fix.diff in pack; not kernel-rebuilt - fix budget spent on DF-3023)",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored (mirrors UFS check) but not kernel-validated; Low-severity finding, verification budget allocated to DF-3023s mandatory fix validation",
 "fix_evidence": "fix.diff"
}