# DF-3028 verdict — REPRODUCED (deterministic panic, malicious-daemon DoS)

## Root cause (path:line)

* `sys/vfs/fuse/fuse_vnops.c:568-569` — S_IFMT-less mode falls through to
  `vtyp = VBAD` with no validation.
* `sys/vfs/fuse/fuse_node.c:103-104` — `fuse_alloc_node` rejects only
  VBLK/VCHR/VFIFO; VBAD (and VNON) pass.
* `sys/vfs/fuse/fuse_node.c:210-211` — switch default `KKASSERT(0)`.
* `sys/vfs/fuse/fuse.h:31-33` — INVARIANTS force-enabled module-wide, so the
  KKASSERT panics production kernels too.

## Reproduction (guest DragonFly 6.5-DEVELOPMENT #0)

Daemon mode `vbad-lookup` (single LOOKUP reply with mode bits = 0644, i.e.
S_IFMT clear).  Trigger: unprivileged `stat /mnt/fuse/target`.  Result
(panic.txt):

    panic: assertion "0" failed in fuse_node_vn at /usr/src/sys/vfs/fuse/fuse_node.c:211
    fuse_node_vn() at fuse_node_vn+0x3b8
    fuse_alloc_node() at fuse_alloc_node+0x110
    fuse_vop_nresolve() at fuse_vop_nresolve+0x246
    vop_nresolve() ... cache_resolve()

Guest dropped into DDB; ssh died.  One daemon reply = one guaranteed panic.

## Trust model

The FUSE daemon is a trust boundary (a compromised/malicious userspace FS, or
any process that obtained the /dev/fuse fd via SCM_RIGHTS).  This is a
single-reply, persistent-mount remote-equivalent DoS from that boundary; the
trigger itself runs unprivileged.

## Fix validation

`fix.diff` (reject VBAD/VNON in nresolve before alloc + harden
fuse_alloc_node) applied in-guest, module rebuilt: identical trigger returns
`EINVAL` (stat fails cleanly), guest stays up (fix_run.log).  fix_status=fixed.