# DF-3033 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Crafted-image reproduction on a fresh HAMMER1 volume: newfs_hammer, one 16K data file, sync, unmount; craft_3033 then located the B-Tree leaf holding the DATA record (phys 0x21088000, data_off a000000022000000), patched data_len 16384 -> 0x20000 (128K) and recomputed both the leaf data_crc (crc32c over 128K) and the btree node crc (vol_version=7). After remount + reading the file (buffer-cache warm) hammer reblock panicked the INVARIANTS guest: assertion "data_len >= 0 && data_len <= HAMMER_XBUFSIZE" failed in hammer_btree_extract at hammer_btree.c:736, via hammer_ioc_reblock. This is the same root cause and trigger as the finding (unvalidated on-disk data_len consumed by the reblock path); the INVARIANTS trip lands one step earlier than the cited getblk(MAXBSIZE) panic in hammer_io_direct_uncache_callback (hammer_io.c:1950) - both are on the unvalidated-length path. Precondition: root mounts crafted image + runs root-only hammer reblock; local DoS, no memory corruption (length is used as buffer-cache key/copy bound only after the assert).

## Kernel references
- sys/vfs/hammer/hammer_io.c:1948
- sys/vfs/hammer/hammer_io.c:1950
- sys/vfs/hammer/hammer_btree.c:736
- sys/vfs/hammer/hammer_reblock.c:321

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: not_testable - the authored single-site fix (reblock-helper data_len gate) proved INSUFFICIENT in A/B: the crafted record moved through the delete path and panicked the fix kernel at hammer_ip_delete_range (hammer left edge case ... 131072, fixkernel_second_panic.txt). Amended recommendation: validate leaf data_len at hammer_btree_extract / hammer_io_direct_uncache entry AND the delete-range path (single chokepoint), per the original finding advice

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.