{
 "finding_id": "DF-3051",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation of both halves. (a) ext2_statfs/statvfs compute overhead and f_bavail in uint32_t (gcount*overhead_per_group wraps with itpg up to 32768; f_bavail = f_bfree - rbcount underflows - both fields declared uint32_t at ext2_vfsops.c:1092-1093/1152-1153, arithmetic at :1103-1129). (b) ext2_check_sb_compat (:296-331) never masks compat features, so EXT2F_COMPAT_HASJOURNAL (ext3) images mount read-write with no journal replay. The RW-journal half was exercised live through the DF-3217 rig (host mke2fs ext4 image carries has_journal): on the stock kernel the mount path never consults compat bits; on the F40FIX kernel the same image is refused for R/W with an explicit journal warning. Overflow half verified by arithmetic inspection + fixed with 64-bit clamped math; compiled in F40FIX (EXT2FS in kernel).",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/vfs/ext2fs/ext2_vfsops.c:1103",
  "sys/vfs/ext2fs/ext2_vfsops.c:1129",
  "sys/vfs/ext2fs/ext2_vfsops.c:306",
  "sys/vfs/ext2fs/ext2_vfsops.c:331"
 ],
 "poc_changes": "n/a - overflow half by inspection; journal half demonstrated via the DF-3217 image",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": null,
 "notes": "",
 "recommended_fix": "64-bit clamped statfs/statvfs arithmetic; deny R/W mount of HASJOURNAL images",
 "fix_status": "fixed",
 "fix_verdict": "journal half A/B complete: ext3 image R/W mount now denied with an explicit journal warning; RO mount still allowed. Overflow half compile-validated (64-bit clamped math) by inspection + F40FIX build."
}