{
  "finding_id": "DF-3050",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "s_blocks_count is never checked against the mounted device's size; a 4MB crafted 64BIT image claiming ~2^45 blocks passes all mount checks and reaches kmalloc(~256GB, M_WAITOK|M_ZERO) before any group-descriptor read. Reproduced: mount(2) never returned, console showed 'pagedaemon: WARNING! Continuous paging', guest fully wedged until reset.",
  "exploit_chain": "crafted sb (64BIT, desc_size=64, bcount=0x7FFC00000000, valid bpg/ipg/fdb) -> mount -o ro -> ext2_compute_sb_data:647 kmalloc(2^38) M_WAITOK -> unsatisfiable -> eternal vm wait + page-daemon thrash -> system-wide DoS",
  "evidence": "run.log (full session), hanglog.txt (console pagedaemon warning), fix_run.txt (fixed: instant EINVAL, guest alive)",
  "kernel_refs": ["sys/vfs/ext2fs/ext2_vfsops.c:591", "sys/vfs/ext2fs/ext2_vfsops.c:620", "sys/vfs/ext2fs/ext2_vfsops.c:647", "sys/vfs/ext2fs/ext2_vfsops.c:649", "sys/vfs/ext2fs/ext2fs.h:332"],
  "poc_changes": "crafted from scratch: mke2fs 4MB base, patched feature_incompat |= 0x80, desc_size=64, blocks_count lo/hi, zeroed rb/fb counts; no checksums involved (^metadata_csum).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "python3 craft.py df3050.img ; cc -O2 -o /root/vntool /root/vntool.c",
  "run_cmd": "/root/vntool attach 0 /root/df3050.img; mount -t ext2fs -o ro /dev/vn0 /mnt/e2",
  "code_hash": "b5d33588bee27030b104e4455f4f5477d6cade6b7b357b2924ba45120afabe88",
  "notes": "full-system wedge (impact=dos), not a memory-corruption bug; requires mount privilege (root or usermount=1).",
  "recommended_fix": "reject s_blocks_count > device media blocks (si_disk->d_info) in ext2_compute_sb_data()",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 (same kernel; ext2fs.ko rebuilt with fix.diff hunk 3, 2026-09-05)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed module rejects the image immediately with EINVAL ('filesystem larger than device'); mount returns instantly, guest responsive (date command answered); pristine fs RW mount unaffected.",
  "fix_evidence": "findings/poc/DF-3050/fix_run.txt; findings/poc/DF-3047/fix.diff (hunk 3)"
}