# DF-3065 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Attempted with the gate open: vfs.ext2fs.doreallocblks set to 1 (default 0, root-only sysctl confirmed), crafted ext2 image with i_block[0]=0xFFFFFFFF and i_block[1]=0x7FFFFFFF via debugfs. The wild block numbers short-circuit earlier: reads/writes of the crafted file fail with the vn driver rejecting negative device offsets (dscheck(vn2): negative bio_offset -1024 in dmesg; cat returns EINVAL, dd writes 0 bytes) before ext2_reallocblks consumes the garbage pref. The claimed OOB index of e2fs_maxcluster/e2fs_gd could not be observed; the root-sysctl gate (default off) plus this early rejection keep it unreachable from the crafted-image route on this rig.

## Kernel references
- sys/vfs/ext2fs/ext2_alloc.c:302
- sys/vfs/ext2fs/ext2_alloc.c:710
- sys/vfs/ext2fs/ext2_alloc.c:130

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.