{
  "finding_id": "DF-3056",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "integrity",
  "confidence": "certain",
  "verdict": "REPRODUCED (deterministic harness with real syscalls on a real directory tree, 3/3 identical). dirfs_nrename :987 renames the node's NAME but never updates dn_parent when the file moves to another directory. All path construction (dirfs_findfd subr:470-481, dirfs_node_absolute_path[_plus] subr:412-425) walks dn_parent, so getattr and the whole setattr family (chflags :477, chsize/truncate :495, chown :521, chmod :545, chtimes :563) and nremove (:907-909) resolve the OLD path and operate on whatever file now occupies it, while fd-based I/O (strategy pwrite/pread on dn_fd) keeps hitting the original inode \u2014 a split-brain. Demonstrated: victim file recreated at the old path (mode 0600); user chmod 0777 on their own moved file applies lchmod() to the VICTIM (0600->0777) while the actual target stays 0644; getattr through the stale node reports the victim's attributes. Fixed variant (update dn_parent on cross-dir rename) targets the correct file.",
  "exploit_chain": "vkernel user A: mv shared/f mydir/f (own file; generic-layer checks run against A's vnode attrs and pass) -> another user (or A via a second path) re-occupies shared/f -> A chmod/truncate/utimes/chflags/unlink the MOVED file through the stale node -> dirfs builds shared/f (stale parent) -> host op applies to the occupant with vkernel-uid privileges -> cross-user file metadata/content modification (integrity break; truncate destroys content). No host-permission stop: all files under the mount are owned by the vkernel uid.",
  "evidence": "harness.c (node-graph + verbatim absolute_path/findfd path construction + real rename/lchmod/lstat on /tmp tree); run.log: 'lchmod(\"...dirA/f\", 0777) <-- STALE PATH', 'VICTIM MODIFIED (wrong-file op)', 'dirB/f mode=0644 untouched (split-brain confirmed)', 'getattr via stale node returns mode=0777'; FIXED variant chmods .../dirB/f and leaves the victim alone. Deterministic over 3 runs.",
  "kernel_refs": [
    "sys/vfs/dirfs/dirfs_vnops.c:984",
    "sys/vfs/dirfs/dirfs_vnops.c:987",
    "sys/vfs/dirfs/dirfs_vnops.c:172",
    "sys/vfs/dirfs/dirfs_vnops.c:389",
    "sys/vfs/dirfs/dirfs_vnops.c:477",
    "sys/vfs/dirfs/dirfs_vnops.c:495",
    "sys/vfs/dirfs/dirfs_vnops.c:521",
    "sys/vfs/dirfs/dirfs_vnops.c:545",
    "sys/vfs/dirfs/dirfs_vnops.c:563",
    "sys/vfs/dirfs/dirfs_vnops.c:907",
    "sys/vfs/dirfs/dirfs_subr.c:412",
    "sys/vfs/dirfs/dirfs_subr.c:470"
  ],
  "poc_changes": "Harness written fresh (no seed). One iteration: removed a nested /* inside a block comment that broke the build; initialized a warning-only variable.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "cd poc/DF-3056 && sh build.sh",
  "run_cmd": "cd poc/DF-3056 && sh run.sh",
  "code_hash": "67f45088cd020ddf351cffd44e2311dd6d977fc3bf13067287b564ce2848dc81",
  "notes": "Also breaks the passive-fd-list key (dn_parent,dn_name) used by nresolve:172-174, allowing duplicate dirfs nodes for one host file. Aggravator: the rename-over-open-file target path NULLs dn_parent (vnops:1000-1002) which is DF-0855's fstat-panic trigger.",
  "recommended_fix": "dirfs_nrename: when fdnp != tdnp, move dnp->dn_parent to tdnp with dirfs_node_ref(tdnp) and dirfs_node_drop() of the old parent.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff applies cleanly (git apply --check RC=0 on the local sys/ tree and on the guest /usr/src). Compile-neutral: patched vs unpatched dirfs_vnops.o/dirfs_subr.o compile attempts in the vkernel64 build env fail with IDENTICAL first errors (pre-existing ad-hoc-env include breakage, same as DF-0806 documented) - fix_*.log in this pack. Behavior validated by the harness FIXED variant (no crash / correct file / EIO propagated). Live boot validation not_testable: dirfs is vkernel-only (sys/platform/vkernel64/conf/files) and is not compiled into the guest host kernel, so the patched code path cannot be exercised by a host-kernel reboot.",
  "fix_evidence": "fix.diff; fix_base_vnops.log vs fix_p3056_vnops.log (identical first error); harness FIXED variant output in run.log"
}