# DF-3091 — pcbmap() accepts cluster numbers beyond pm_maxcluster

Cross-volume kernel-mediated read AND write through a mounted FAT
filesystem, from a crafted FAT chain whose value lies between
`pm_maxcluster` and the reserved range.

## Threat model

Crafted media: the attacker controls a disk image / USB stick that a
victim mounts (root, or any user with `vfs.usermount=1`). The crafted
FAT volume claims a small slice of the device; a file's FAT chain then
references cluster numbers that pass `pcbmap()`'s only guards
(`pm_fatmask` + reserved-range) but exceed `pm_maxcluster`, so
`cntobn()` maps them to device blocks beyond the volume — e.g. into
neighboring partitions on the same medium. Reads disclose those bytes;
writes persist attacker data there.

## Build (in the DragonFly guest, as root)

    cd /root/df3091
    cc -O -o craftfat16 craftfat16.c     # see build.sh / build.log

## Run

    sh run.sh                            # baseline: expect the two markers below

Success criteria (stock kernel):

1. TEST 1 read: `dd if=/mnt/df3091/LEAK.TXT bs=512 skip=1 count=1`
   returns `DF3091-OUT-OF-VOLUME-MARKER` — bytes from device block
   7020, which lies *beyond* the 4 MiB claimed volume (blocks 0..8191)
   on the 8 MiB device.
2. TEST 2 write: writing `PWNED-BY-DF3091-CROSS-VOLUME-WRITE` through
   the mount changes the raw image at device block 7020 (outside the
   volume).

Fixed kernel (`fix.diff`, single-fix rebuild): TEST 1 returns no data
(EIO), TEST 2 fails with `Input/output error`, the out-of-volume marker
sector is unchanged, and the in-volume control file still reads
correctly. See run.2.log (fresh baseline), fix_run.log (fresh
fixed-kernel run), and the pass-1 logs (run.log, run.log.patched).

## Artifacts

See manifest.json for the full list.