{
 "finding_id": "DF-3042",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced on the stock INVARIANTS guest: a newfs_hammer image whose volume header byte (vol_reserved[7], covered by vol_crc) was flipped WITHOUT fixing vol_crc mounted successfully (mount_hammer /dev/vn1 /mnt -> OK) - tree-wide hammer_crc_test_volume() has zero callers, so vol_no, vol_count, vol_version, vol0_blockmap[] etc. are consumed integrity-unchecked (hammer_ondisk.c:199-247 validates only signature/fsid/dup-vol_no/root vol_no). IMPORTANT fix-design discovery recorded by the corruptor: newfs_hammer leaves vol_crc == 0 on fresh images (two independent images verified), so a naive always-enforce fix would reject every new volume; the fix enforces the CRC only when vol_crc != 0. Post-fix A/B on F40FIX: image with a forged non-zero vol_crc is rejected with invalid header CRC/EFTYPE while a vol_crc==0 image still mounts (compat).",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_ondisk.c:199",
  "sys/vfs/hammer/hammer_crc.h:180",
  "sys/vfs/hammer/hammer_ondisk.c:217"
 ],
 "poc_changes": "corruptor computes CRC32C locally (userland has no iscsi_crc32) to prove stored-vs-computed mismatch; also discovered vol_crc==0 on fresh images",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "bc91772a6f9105731690a8335ae9bf8603704fce173ea1c64a3e385639a3b55f",
 "notes": "",
 "recommended_fix": "verify vol_crc after the signature check when vol_crc != 0 (newfs_hammer leaves it 0)",
 "fix_status": "fixed",
 "fix_verdict": "A/B complete: stock mounts any corrupted header (vol_crc never checked); F40FIX refuses an image whose stored vol_crc is nonzero-and-wrong (console: HAMMER: volume has an invalid header CRC, mount EINVAL) while fresh newfs_hammer images (vol_crc==0) still mount - compat retained. Fix verified end to end."
}