# DF-3030 verdict — REPRODUCED (unbounded kernel heap exhaustion, unprivileged)

## Root cause (path:line)

`sys/vfs/fuse/fuse_vnops.c:1219-1227`:

    newname = kmalloc(tncp->nc_nlen + 1, M_TEMP, M_WAITOK | M_ZERO);
    KKASSERT(newname);
    memcpy(newname, tncp->nc_name, tncp->nc_nlen);
    newname[tncp->nc_nlen] = '\0';
    fuse_dbg("newname=\"%s\"\n", newname);   <-- only use

No `kfree(newname)` anywhere in the function (verified through the `out:`
label).  The allocation happens on every rename whose target name differs
from the source name.

## Reproduction (guest DragonFly 6.5-DEVELOPMENT #0)

    BEFORE:  temp   474   336K      (vmstat -m)
    su -m maxx -c "./rename_leak /mnt/fuse 50000"    # 100000 renames, 4.57s
    AFTER:   temp  98.1K  19.4M
    + 20000 more iterations (40000 renames):
    AFTER2:  temp   137K  27.0M

Linear, unbounded, no ceiling: an unprivileged user loops renames (the
PoC sustains ~22k renames/s; multiple processes multiply this) until the
390M kmem pool is exhausted -> allocation failures/panic system-wide.

## Fix validation

`fix.diff` adds `kfree(newname, M_TEMP)` right after the debug use (the
allocation itself is only needed by fuse_dbg; kept for minimal diff).
Patched module, identical 100000-renames run: M_TEMP 474 -> 474, 336K in use
before AND after.  fix_status=fixed.