# DF-3084 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Exact predicted reproduction: ext2 image crafted on the host (mke2fs + debugfs sif <dir> size 0x80000000), mounted read-write in the guest, then an UNPRIVILEGED touch(1) inside the oversized directory panics the stock INVARIANTS kernel: "panic: ext2_write: uio->uio_offset < 0" with the trace ext2_write <- ext2_direnter <- ext2_makeinode <- vop_old_create. The doff_t (int32_t, ext2_inode.h:53) truncation of the directory size makes the search loop skip silently (0 < INT32_MIN false), the CREATE path sets dp->i_offset = (int32)0x80000000 = negative, and ext2_add_first_entry passes it to VOP_WRITE hitting the KASSERT at ext2_vnops.c:1980. Production kernels return EFBIG via the maxfilesize check instead. Unpriv-user trigger on a root-mounted crafted image: local DoS.

## Kernel references
- sys/vfs/ext2fs/ext2_lookup.c:424
- sys/vfs/ext2fs/ext2_lookup.c:496
- sys/vfs/ext2fs/ext2_vnops.c:1980
- sys/vfs/ext2fs/inode.h:53

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: fixed - A/B validated: same crafted image + unpriv touch on the fix kernel returns clean EINVAL (touch: /mnt/e84/d/newfile: Invalid argument), no panic (baseline panic.txt vs fixed-run log)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.