# DF-3087 — nfssvc(NFSSVC_AUTHIN) resume of an ENEEDAUTH'd nfsd enters the reply loop with nd == NULL → kernel NULL-deref panic (nfs_syscalls.c:671)

## Threat / trigger
`nfssvc(2)` is root-only (`caps_priv_check_td(SYSCAP_RESTRICTEDROOT)`).
An AUTH_KERB/FULLNAME NFS request drives the kernel nfsd loop out to
userland with ENEEDAUTH, keeping the in-progress request in
`nfsd->nfsd_nd` with `NFSD_REQINPROG` set (sys_nfssvc returns at
nfs_syscalls.c:623 *without* freeing nd). The documented daemon protocol
(4.4BSD kerb NFS) then calls `nfssvc(NFSSVC_AUTHIN|NFSSVC_NFSD, &nsd)`
with the same nsd. `nfssvc_nfsd()` re-enters with a fresh local
`nd = NULL` (:448), takes the NFSD_REQINPROG else-branch (:549) which
never reloads `nfsd->nfsd_nd`, skips the `if (nd)` cache/auth block
(:599), and the reply do-loop evaluates `nd->nd_procnum` at :671 with
`writes_todo == 0` → deterministic NULL-deref.

Base-system `nfsd(8)` never triggers it (its zeroed nsd makes the
:616-620 copyouts fail → RC_DROPIT), so exploitation requires a daemon
implementing the kerb AUTHIN protocol (root) — severity Low. A remote
amplification exists only against such a (non-base) daemon.

## Build (guest, root)
```
cc -O -o /root/kerbd kerbd.c      # needs <vfs/nfs/*.h> from base
```

## Run (guest, root; stock nfsd(8) must not be running)
```
killall nfsd 2>/dev/null; sleep 1
/root/kerbd 20497
```

## Expected (vulnerable kernel)
```
kerbd: nfssvc(NFSD) returned -1 errno=81 (Need authenticator)
kerbd: ENEEDAUTH ok (nfsd=0x...), resuming with NFSSVC_AUTHIN
-> guest dies:
Fatal user address access from kernel mode from kerbd at ...
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x70            <- offsetof(nd_procnum)
Stopped at      sys_nfssvc+0x3d4:       movl    0x70(%rdi),%eax
```

## Expected (fixed kernel, fix.diff applied)
Resume completes inside the kernel (request re-dispatched, error reply
sent to the still-open connection); kerbd prints
`nfssvc(AUTHIN|NFSD) returned ... NO PANIC`; guest stays up.

## Verified on
DragonFly 6.5-DEVELOPMENT #0 (stock, fresh `vm.sh reset with-src`) —
panic reproduced, 1st attempt, deterministic; and on an instrumented
INVARIANTS build (same fault VA 0x70, sys_nfssvc+0x3e4).