{
  "finding_id": "DF-3091",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "cross-volume read+write: kernel-mediated out-of-volume disclosure and persistent tampering of device sectors beyond the mounted FAT volume (crafted media; root mount or vfs.usermount=1)",
  "confidence": "certain",
  "verdict": "REPRODUCED on the stock kernel (fresh vm reset): a crafted FAT16 chain value (7000) between pm_maxcluster (5119) and the reserved range passes pcbmap()s only guards (fatmask + reserved-range, msdosfs_fat.c:187) and is mapped by cntobn() (:230) to device block 7020 \u2014 3.4MiB beyond the 4MiB claimed volume. Reading LEAK.TXT offset 512 returned the planted out-of-volume marker (disclosure); a 34-byte write through the mount persisted PWNED-BY-DF3091 at that raw device block (tampering). Fix validated on a single-fix rebuilt kernel: read fails EIO with no out-of-volume bytes, write fails EIO, marker sector unchanged, in-volume control file unaffected.",
  "exploit_chain": "craft image (FAT[2]=7000, HugeSectors=8192, FATsecs=20 -> pm_maxcluster=5119) -> root mounts image (vfs.usermount=0 default; crafted-media model) -> open+read/write /mnt/LEAK.TXT -> pcbmap maps file cluster 1 to device block 7020 outside the volume -> kernel bread/bwrite hit other partitions sectors: read = cross-volume disclosure, write = cross-volume tampering persisted to the medium",
  "evidence": "run.2.log lines TEST 1 (marker returned) and TEST 2 (PWNED-BY-DF3091 in the AFTER hexdump); fix_run.log (EIO both tests, marker unchanged); run.log/run.log.patched = identical pass-1 results; VERDICT.md has the full line-accurate trace",
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_fat.c:183-193",
    "sys/vfs/msdosfs/msdosfs_fat.c:225-230",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:484-490",
    "sys/vfs/msdosfs/msdosfs_vnops.c:728"
  ],
  "poc_changes": "none vs pass-1 pack (same craftfat16.c/run.sh); this run added README/VERDICT/manifest/verdict.json/build.sh/build.log/fix_build.log and fresh baseline+fixed logs (run.2.log, fix_run.log)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1300,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df3091 && cc -O -Wall -o craftfat16 craftfat16.c",
  "run_cmd": "cd /root/df3091 && sh run.sh",
  "code_hash": "497c99713c7f1f928be50bc3c04eb4e6ba0adda4706c5cf7c78aa6debcf8f362",
  "notes": "impact is a filesystem containment break (other partitions of attacker-supplied media), not kernel memory corruption; not a standalone uid=0 chain on this guest. Mount printed the vfsops clamp warning number of clusters (8172) exceeds FAT capacity (5120) corroborating pm_maxcluster=5119. vfs.usermount=0 on guest; tests run as root per the crafted-media model.",
  "recommended_fix": "clamp cn > pm_maxcluster -> hiteof in the pcbmap walk and after FAT assembly, plus reject bio_offset==NOOFFSET buffers in msdosfs_write (see fix.diff)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 12:07:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Single-fix kernel (fix.diff applied to clean /usr/src, nativekernel X86_64_GENERIC, installkernel, reboot): baseline had reproduced both out-of-volume read and write; on the patched kernel TEST1 returns no out-of-volume bytes (EIO), TEST2 fails EIO with 0 bytes transferred, the out-of-volume marker sector is byte-identical before/after, and the in-volume control file still reads correctly. Bad behavior gone; honest I/O unaffected.",
  "fix_evidence": "fix_run.log (patched-kernel run: dd: Input/output error, empty TEST1 hexdump, unchanged AFTER marker); fix_build.log (build/install/uptime record)"
}