{
  "finding_id": "DF-3054",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED (deterministic harness; dirfs is vkernel-only so no live-boot test \u2014 DF-0806/0807 precedent). dirfs_findfd returns NULL when the accumulated relative path from the nearest fd-holding ancestor exceeds MAXPATHLEN(1024); dirfs_vnops.c dereferences the return without a NULL check at getattr:391/:393 and readlink:1329, and dirfs_alloc_file (subr:194/:202, reached from nresolve/ncreate/nmkdir/nsymlink) likewise. Harness: verbatim findfd transcription walks 4x255-byte names fine (count=1024) and returns NULL at 5x255 (count=1280); all 3 consumer transcriptions die with SIGSEGV; fixed variants (NULL check + ENAMETOOLONG) survive. Impact: unprivileged vkernel user crashes the vkernel via stat/readlink/open on a deep path (pre-existing host tree needs no fds on intermediates because nresolve-created nodes never hold fds; dirfs-created trees reach it after passive-fd eviction (limit 100) or vnode recycling). Availability only.",
  "exploit_chain": "vkernel user -> path with >1024 bytes of component names between target and nearest open ancestor (e.g. 5 nested 255-char dirs pre-existing on the host) -> stat()/readlink()/open() through dirfs mount -> VOP_GETATTR/READLINK/NRESOLVE -> dirfs_findfd()==NULL -> *(NULL)->dn_fd -> vkernel panic. No escalation path: fixed-address NULL read, no controlled write.",
  "evidence": "harness.c (verbatim dirfs_findfd :450-497 + consumer derefs); run.log lines '5x255: count=1280 -> returns NULL' and three '[*] child killed by SIGSEGV -- NULL DEREF CONFIRMED'; run.2.log/run.3.log identical; fix.diff applies cleanly (git apply --check RC=0 local + guest /usr/src); fix_*_log compile-neutral.",
  "kernel_refs": [
    "sys/vfs/dirfs/dirfs_vnops.c:389",
    "sys/vfs/dirfs/dirfs_vnops.c:391",
    "sys/vfs/dirfs/dirfs_vnops.c:393",
    "sys/vfs/dirfs/dirfs_vnops.c:1326",
    "sys/vfs/dirfs/dirfs_vnops.c:1329",
    "sys/vfs/dirfs/dirfs_subr.c:194",
    "sys/vfs/dirfs/dirfs_subr.c:202",
    "sys/vfs/dirfs/dirfs_subr.c:450",
    "sys/vfs/dirfs/dirfs_subr.c:483",
    "sys/vfs/dirfs/dirfs_subr.c:496",
    "sys/vfs/dirfs/dirfs_vfsops.c:77",
    "sys/vfs/dirfs/dirfs_vfsops.c:258",
    "sys/kern/vfs_lock.c:505",
    "sys/platform/vkernel64/conf/files:45"
  ],
  "poc_changes": "Harness written fresh (no seed). One iteration: added <sys/stat.h> for fstatat. Findfd loop and all consumer derefs are verbatim transcriptions with fork/SIGSEGV detection.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 8,
  "guest_dirty": 0,
  "build_cmd": "cd poc/DF-3054 && sh build.sh",
  "run_cmd": "cd poc/DF-3054 && sh run.sh",
  "code_hash": "ef9e143c6af543bec71eed992dd88ca5b0694d3dee9462a18797af92dee24c43",
  "notes": "Reachability of the NULL return requires no race and no special state beyond a deep name chain: nodes created by dirfs_nresolve never hold fds (alloc_file only openats when vap!=NULL, subr:193-200). Distinct from DF-0855 (unlinked-node KKASSERT inside findfd) and DF-0808 (nrename EFAULT, no crash).",
  "recommended_fix": "dirfs_vnops.c getattr/readlink + dirfs_subr.c alloc_file: check dirfs_findfd() return for NULL and fail with ENAMETOOLONG (tear down the fresh node in alloc_file).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff applies cleanly (git apply --check RC=0 on the local sys/ tree and on the guest /usr/src). Compile-neutral: patched vs unpatched dirfs_vnops.o/dirfs_subr.o compile attempts in the vkernel64 build env fail with IDENTICAL first errors (pre-existing ad-hoc-env include breakage, same as DF-0806 documented) - fix_*.log in this pack. Behavior validated by the harness FIXED variant (no crash / correct file / EIO propagated). Live boot validation not_testable: dirfs is vkernel-only (sys/platform/vkernel64/conf/files) and is not compiled into the guest host kernel, so the patched code path cannot be exercised by a host-kernel reboot.",
  "fix_evidence": "fix.diff; fix_base_vnops.log vs fix_p3054_vnops.log (identical first error); harness FIXED variant output in run.log"
}