# DF-3054 — findfd NULL deref (over-length path) — evidence pack

**Finding:** dirfs_findfd() returns NULL when the relative path to the nearest
fd-holding ancestor exceeds MAXPATHLEN; dirfs_getattr (:391/:393),
dirfs_readlink (:1329) and dirfs_alloc_file (subr :194/:202) dereference it
without a NULL check → vkernel panic (unprivileged local DoS on any dirfs
mount).

**Verdict:** REPRODUCED (deterministic harness; dirfs is vkernel-only so no
live-boot test is possible — same precedent as DF-0806/DF-0807).

## Reproduce
```
./build.sh   # cc -O2 -Wall -o harness harness.c
./run.sh     # expect 3/3 consumer SIGSEGV + FIXED variants survive; rc=2
```

## Files
- `harness.c` — verbatim transcription of dirfs_findfd + the three consumer
  derefs, fork/SIGSEGV detection, boundary demo (4x255 OK vs 5x255 NULL)
- `build.sh` / `run.sh` — exact commands
- `build.log`, `run.log`, `run.2.log`, `run.3.log` — full untrimmed output
- `fix.diff` — NULL checks + ENAMETOOLONG (applies cleanly, compile-neutral,
  harness-validated)
- `fix_base_*.log`, `fix_p3054_*.log` — baseline vs patched compile comparison
- `VERDICT.md` — full narrative
- `manifest.json` / `verdict.json` — machine-readable results