# DF-3077 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Crafted-image reproduction using the DF-3040 forger technique: vol0_blockmap[zone 10 large-data].next_offset patched to HAMMER_ZONE_ENCODE(11, 0) (a foreign zone nibble; volume-header CRC is never verified per DF-3042). Read-only mount succeeds; the first large-data allocation (512KB dd) trips the cited entry guard exactly: panic assertion "HAMMER_ZONE_DECODE(blockmap->next_offset) == zone" failed in hammer_blockmap_reserve at hammer_blockmap.c:449, via hammer_ip_add_bulk/hammer_vop_strategy. On production (non-INVARIANTS) kernels the same crafted state would allocate cross-zone silently, as filed. Preconditions: root mount of crafted image + a >=16K write; local DoS / fs-internal zone confusion only.

## Kernel references
- sys/vfs/hammer/hammer_blockmap.c:137
- sys/vfs/hammer/hammer_blockmap.c:449
- sys/vfs/hammer/hammer_blockmap.c:162
- sys/vfs/hammer/hammer_blockmap.c:466

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: fixed - A/B validated: identical crafted image + 512KB write on the fix kernel completes with console diagnostic HAMMER(t77) blockmap zone mismatch for zone 10 and no panic (baseline panic.txt)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.