{
 "finding_id": "DF-3077",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Crafted-image reproduction using the DF-3040 forger technique: vol0_blockmap[zone 10 large-data].next_offset patched to HAMMER_ZONE_ENCODE(11, 0) (a foreign zone nibble; volume-header CRC is never verified per DF-3042). Read-only mount succeeds; the first large-data allocation (512KB dd) trips the cited entry guard exactly: panic assertion \"HAMMER_ZONE_DECODE(blockmap->next_offset) == zone\" failed in hammer_blockmap_reserve at hammer_blockmap.c:449, via hammer_ip_add_bulk/hammer_vop_strategy. On production (non-INVARIANTS) kernels the same crafted state would allocate cross-zone silently, as filed. Preconditions: root mount of crafted image + a >=16K write; local DoS / fs-internal zone confusion only.",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + panic.txt + fix.diff + craft_3077.c (A/B: SURVIVED_3077_AB with zone-mismatch diagnostic)",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_blockmap.c:137",
  "sys/vfs/hammer/hammer_blockmap.c:449",
  "sys/vfs/hammer/hammer_blockmap.c:162",
  "sys/vfs/hammer/hammer_blockmap.c:466"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "c9b3ad35d5cf4c03910581924297edff7eb9da0f0bcb34a7e483ff06f97369e1",
 "notes": "fix_status: fixed - A/B validated: identical crafted image + 512KB write on the fix kernel completes with console diagnostic HAMMER(t77) blockmap zone mismatch for zone 10 and no panic (baseline panic.txt)",
 "recommended_fix": "fix.diff adds a production zone check with early EINVAL return at both blockmap entry sites and turns the wrap equality checks into >=; A/B validated on the fixed kernel."
}