# DF-3037 — PoC evidence pack

**msdosfs `doscheckpath()` unbounded ".." ancestor walk → `rename(2)` kernel
livelock / system-wide DoS via crafted FAT image.**

* File audited: `sys/vfs/msdosfs/msdosfs_vnops.c` (call site `msdosfs_rename`
  line 1045); root cause in `sys/vfs/msdosfs/msdosfs_lookup.c:822-863`.
* Severity: Medium (local DoS, crafted-image-mount precondition).
* Verdict: **reproduced** (baseline: hang + unkillable process + guest-wide
  ssh outage; fix validated — see `fix.diff`, `run.fixed.log`).

## Contents

| file | what |
|---|---|
| `dirpatch.c` | image tool: lists `.`/`..` directory entries (offset + own cluster); patches a `..` entry's `deStartCluster` |
| `trigger.c` | plain `rename(2)` caller |
| `build.sh`  | compiles both (guest) |
| `run.sh`    | full flow: base image → control rename → install B↔D `..` cycle → exploit rename under watchdog |
| `run.log`   | baseline run on stock kernel: control OK; cycle rename hangs; `kill -9` ineffective; capture session lost when guest wedged |
| `run.2.log` | post-trigger probe: ssh "Connection timed out during banner exchange" (guest-wide outage, no panic on serial) |
| `run.fixed.log` | same `run.sh` on patched kernel `#1`: cycle rename returns `EINVAL` in <1 s, guest stays responsive |
| `fix.diff`  | bound the walk (depth cap 4096 → `EINVAL`) |
| `verdict.json` / `manifest.json` | machine verdict |

## Reproduce

```sh
# guest (root), stock kernel:
sh /root/df3037/build.sh && sh /root/df3037/run.sh     # → hang + wedge (expect to lose the guest)
# guest (root), patched kernel:
sh /root/df3037/run.sh                                  # → "rename: Invalid argument", guest fine
```

Success criterion (vulnerable): `TRIGGER STILL RUNNING AFTER 15s`,
`KILL -9 INEFFECTIVE`, subsequent ssh sessions time out during banner
exchange, serial console shows no panic.