{ "finding_id": "DF-3078", "status": "reproduced", "reproduced": 1, "impact": "panic", "confidence": "certain", "verdict": "REPRODUCED on stock #0: MNT_RELOAD (mount(2) MNT_UPDATE|MNT_RELOAD|MNT_RDONLY on a RO-mounted UFS) re-reads the superblock and adopts its geometry (ffs_vfsops.c:500) while fs_csp/fs_maxcluster/um_fs keep their mount-time sizes (allocated at :671/:685). Crafted re-read sb gives: heap OOB WRITE with fully attacker-controlled length AND content (cssize variant: 524288 pattern bytes bcopy'd into the 2053-byte fs_csp chunk, reload returned 0, ~522KB heap silently smashed); unbounded OOB write of controlled value (ncg variant: vm_fault stack-guard panic in the *lp++ refill); divide-by-zero (fsize=0: Fatal trap 18 idivl at ffs_mount+0x627); heap OOB READ past um_fs via adopted fs_sbsize at RW-upgrade ff_sbupdate bcopy (sbsize=65536: Fatal trap 12 supervisor-read in memmove; sbsize=8192: the 6144 bytes beyond um_fs written to the raw media). Adoption in returning reloads proven via crafted fs_dsize showing in df. NOT an unpriv->root LPE: trigger is root-gated (get_fscap maps ufs to SYSCAP_RESTRICTEDROOT; vfs.usermount=1 does not help — same blocker empirically proven in the DF-0820 pack). Impact ceiling: root-context kernel heap corruption + kernel-heap disclosure to media; panic DoS demonstrated.", "exploit_chain": "", "evidence": [ "findings/poc/DF-3078/run.log — full baseline transcript (all variants)", "findings/poc/DF-3078/panic_idivl_fsize0.txt — Fatal trap 18 idivl (fsize=0 adopted)", "findings/poc/DF-3078/panic_maxcluster_ncg.txt — vm_fault stack-guard panic (ncg=0x20000000 refill store)", "findings/poc/DF-3078/panic_sbupdate_oob_read.txt — trap 12 supervisor READ in memmove (sbsize=65536 sbupdate OOB read)", "findings/poc/DF-3078/run.patched.log — fix validation: all crafted variants EINVAL on #1, regressions pass", "findings/poc/DF-3078/build.log, env.txt, fix.diff" ], "kernel_refs": [ "sys/vfs/ufs/ffs_vfsops.c:479", "sys/vfs/ufs/ffs_vfsops.c:484", "sys/vfs/ufs/ffs_vfsops.c:493", "sys/vfs/ufs/ffs_vfsops.c:495", "sys/vfs/ufs/ffs_vfsops.c:500", "sys/vfs/ufs/ffs_vfsops.c:515", "sys/vfs/ufs/ffs_vfsops.c:526", "sys/vfs/ufs/ffs_vfsops.c:536", "sys/vfs/ufs/ffs_vfsops.c:671", "sys/vfs/ufs/ffs_vfsops.c:685", "sys/vfs/ufs/ffs_vfsops.c:1292", "sys/vfs/ufs/ffs_vfsops.c:1295" ], "poc_changes": "Trigger written from scratch: DF's mount_ufs has no '-o reload' option, so the PoC calls mount(2) directly with MNT_UPDATE|MNT_RELOAD|MNT_RDONLY and a zeroed >=sizeof(struct ufs_args) data buffer (a first draft passed a too-small struct and would have made ffs_mount's copyin over-read user memory). craft.c/dumpsb.c built on-guest with -I/usr/src; sb field offsets verified in-guest (fs_cssize=156, fs_fsize=52, fs_ncg=44, fs_sbsize=104, fs_dsize=40, fs_fmod=208).", "attempts": 9, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 3300, "guest_dirty": 0, "build_cmd": "cd /root/rt && cc -o craft craft.c && cc -I/usr/src -o dumpsb dumpsb.c && cc -o reload reload.c", "run_cmd": "sh run.sh (guest root; see README)", "code_hash": "8c248f01eaf8720192f80f1e6c4f974de69a358aac79d064cbcbe6a193c73854", "notes": "Related: DF-0820 (initial-mount geometry census — NOT re-filed; different function/root-cause), DF-3047 (ext2 MNT_RELOAD analog), DF-3015 (maxsymlinklen trust boundary gains a second import path at :504). fs_fmod adoption alone is NOT a reachable rofs-mod panic: sys_sync's callback (vfs_syscalls.c:1199) and the syncer (vfs_sync.c:731) both skip RDONLY mounts — killed empirically (95+ s with fs_fmod=1 adopted, 60 sync()s, no panic). Guest reset clean (vm.sh reset with-src) after validation.", "recommended_fix": "ffs_reload: reject any re-read superblock whose sizing geometry differs from the mounted one (fs_sbsize/bsize/fsize/frag/ncg/ipg/cssize/csaddr/contigsumsize/bshift/fshift) with EINVAL, and force fs_fmod=0 — see fix.diff; validated on a single-fix kernel.", "fix_status": "fixed", "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Sun Sep 6 02:02:00 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff applied to in-guest /usr/src, make -j6 nativekernel KERNCONF=X86_64_GENERIC + installkernel (BUILD_OK), rebooted into #1: all five crafted variants now return 'mount: Invalid argument' (EINVAL) with the guest staying up and the filesystem still accessible; unchanged-sb reload returns 0; fresh RW mount + file create works. Before/after matrix in VERDICT.md and run.patched.log.", "fix_evidence": [ "findings/poc/DF-3078/run.patched.log", "findings/poc/DF-3078/build.log", "findings/poc/DF-3078/fix.diff" ] }