DF-3058 / verdict.json
{ "finding_id": "DF-3058", "status": "not_reproduced", "reproduced": 0, "impact": "none", "confidence": "certain", "verdict": "Not executable on this rig: dirfs is dead code in the current tree - sys/vfs/dirfs/ has no Makefile, is not referenced by sys/conf/files, is in no kernel config, and kldload dirfs fails (module not built). mount_dirfs additionally refuses to run on non-vkernel platforms (sbin/mount_dirfs/mount_dirfs.c:105). The contract breach is code-certain from source: dirfs_vnops.c:588-595 computes error = fsync(dnp->dn_fd) twice (second call on failure stores -1, not errno) and then returns 0 unconditionally.", "exploit_chain": "", "evidence": "VERDICT.md + run.log + sources", "kernel_refs": [ "sys/vfs/dirfs/dirfs_vnops.c:588", "sys/vfs/dirfs/dirfs_vnops.c:595" ], "poc_changes": "none", "attempts": 0, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 0, "guest_dirty": 0, "build_cmd": "", "run_cmd": "see README.md", "code_hash": null, "notes": "fix_status: not_testable (not reproduced)", "recommended_fix": "diff: error = fsync(dnp->dn_fd); if (error) error = errno; ... return error (drop the second fsync call and the forced 0).\n" } |