{
  "finding_id": "DF-3091",
  "title": "pcbmap() accepts cluster numbers beyond pm_maxcluster — cross-volume kernel-mediated read/write on the backing device",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "cross-volume read+write: kernel-mediated out-of-volume disclosure and tampering of device sectors beyond the mounted FAT volume (crafted media; root mount or vfs.usermount=1)",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df3091 && cc -O -Wall -o craftfat16 craftfat16.c",
    "run": "cd /root/df3091 && sh run.sh",
    "expected": "TEST1 dd of LEAK.TXT offset 512 returns DF3091-OUT-OF-VOLUME-MARKER (out-of-volume read); TEST2 write through the mount persists PWNED-BY-DF3091-CROSS-VOLUME-WRITE at raw device block 7020, outside the volume (out-of-volume write)"
  },
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_fat.c:183-193",
    "sys/vfs/msdosfs/msdosfs_fat.c:225-230",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:484-490",
    "sys/vfs/msdosfs/msdosfs_vnops.c:728"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "craftfat16.c", "build.sh", "build.log",
    "run.sh", "run.log", "run.2.log", "fix_run.log", "fix_build.log",
    "run.log.patched", "fix.diff", "env.txt", "manifest.json", "verdict.json"
  ]
}