{
  "finding_id": "DF-3046",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The unvalidated TAG_OVERLOAD read was reproduced mechanically at every production shape on the guest kernel, calling the verbatim bootpc_tag_helper and bootpc_tag with guard bytes planted exactly where the walk over-reads: a zero-length TAG_OVERLOAD whose length byte is the final byte of the region passes the guard at :1283 (j + *j + 1 == ej), advances j to ej at :1287, and tctx->overload = *j at :1300 adopts the byte past the region (planted 0xa5, tracked attribution). In-packet variants adopted the byte past the struct at replylen 1460 (guard 0x03), the tail padding past the vend[1222] member at replylen 1458 (0xee), the adjacent in-struct field bp->file[0] via the sname walk (0x5c/0x77 tracked on repeat), and a chained double over-read via the cookie byte in T1f. A len=3 overload adopted its first value byte (0x02), confirming the missing len==1 check. Impact is none, exactly as the Info finding states: the adopted value only steers which bounded fixed-size areas (file[128], sname[64]) are re-walked, and in both production contexts the byte past the region lies inside the same kmalloc allocation (struct tail padding, the replylen member, or the cookie byte) - no crash, no leak to userspace, no corruption on the INVARIANTS kernel. The one-hunk fix (require len == 1 for TAG_OVERLOAD, else badopt) rejected every planted byte in A/B runs while leaving well-formed replies working.",
  "exploit_chain": "",
  "evidence": "run.log: T1a overload=0xa5 badopt=0 with the planted guard byte at ej; T1c overload=0x03 from bp+sizeof; T1c2 overload=0xee from past vend[1221]; T1d/T1e overload tracking planted bp->file[0] values 0x5c and 0x77; T1f chained adoption 0x77; run.fixed.log: all subtests rejected with badopt=1, overload constant at the legitimate len==1 value",
  "kernel_refs": [
    "sys/vfs/nfs/bootp_subr.c:1283-1287",
    "sys/vfs/nfs/bootp_subr.c:1299-1300",
    "sys/vfs/nfs/bootp_subr.c:1320-1332",
    "sys/vfs/nfs/bootp_subr.c:105"
  ],
  "poc_changes": "no seed PoC existed; first in-packet crafting used sizeof(struct bootp_packet) unaware of its 2 tail padding bytes and targeted sname[0] from the file walk (file+128 is actually vend[0], sname precedes file in the struct) - corrected after observing the adopted values, and the corrected shapes now demonstrate the exact production geometry including the padding and the chained double over-read",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2 Tue Oct 20 14:47:53 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline decisive boot); fixed decisive boot #2 Tue Oct 20 16:53:09 UTC 2026",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (sha256 gate + make -j6 nativekernel KERNCONF=X86_64_GENERIC + make installkernel)",
  "run_cmd": "sysctl -w kern.dfrig12=1; sysctl -n kern.dfrig12_status",
  "code_hash": "f017052c0ccd052813c7dabfb13ea4ec0b7e28046308beef1dbef707102b9902",
  "notes": "impact none is the honest ceiling: bounded one-byte read inside the parent allocation, value only steers bounded re-walks, no crash or leak observed on the INVARIANTS kernel across repeated runs. Fixed source sha256 52154f24f8d0f6fd8964d8cab366e81a377c5c10c622a7b3531c293d33be0148.",
  "recommended_fix": "require len == 1 for TAG_OVERLOAD in bootpc_tag_helper and set badopt on any other length (validated in fix.diff)"
}