# DF-3026 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Behaviorally reproduced with a differential control. As unprivileged user maxx: opened a tmpfs file O_WRONLY (plain), then root set SF_APPEND (chflags sappnd): a pwrite() at offset 0 (middle-of-file) SUCCEEDS on tmpfs (ret=1) while the identical sequence on a UFS filesystem returns EPERM (ufs_readwrite.c:239 per-write APPEND check). Phase 2: root set SF_IMMUTABLE (schg) - a write() through the pre-opened fd succeeds on tmpfs (and, notably, on UFS too: IMMUTABLE is open-time-only there, so only the APPEND half is a tmpfs-specific divergence). Administrator-intent bypass confirmed exactly as filed; no memory-safety impact.

## Kernel references
- sys/vfs/tmpfs/tmpfs_vnops.c:268
- sys/vfs/tmpfs/tmpfs_vnops.c:666
- sys/kern/vfs_vnops.c:451

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: fixed - A/B validated on the fix kernel: PHASE1 pwrite(mid) ret=-1 EPERM and PHASE2 write ret=-1 EPERM under sappnd/schg (baseline: both succeeded)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.