{
  "finding_id": "DF-3092",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "FUNCTIONAL FALSE POSITIVE (mechanism refuted; filed under not_reproduced because the DB status enum has no false_positive value). False positive: the claimed phantom-free tail bits cannot exist. fillinusemap()s initial FULL_RUN fill (msdosfs_fat.c:897-898) covers every allocated pm_inusemap word (allocation is howmany(pm_maxcluster+1,32) words, msdosfs_vfsops.c:565-566), so clusters beyond pm_maxcluster stay marked USED; the FAT scan (:906-946) only clears bits for cn <= pm_maxcluster. chainlength(4104,7) therefore returns 6 (bits 14..31 of the last word are set), chainalloc(4104,7) is never called, usemap_alloc never sees cn>pm_maxcluster, and the KASSERT at msdosfs_fat.c:377 is unreachable regardless of INVARIANTS. Runtime A/B on the guest confirms: the 7-cluster append the finding predicts must succeed (or panic) returns ENOSPC with FAT[4110..4351] untouched; a 6-cluster append succeeds exactly to pm_maxcluster; a 7th cluster returns ENOSPC; offline tailcheck ALL PASS. The dead tail loop (:950-952) and the word-relative clamp (:636/642) are real code smells but inert; a naive bound fix of the dead loop would itself introduce a 1-word heap overflow when pm_maxcluster%32==31.",
  "exploit_chain": "",
  "evidence": "run.log phases A-D (A: write(3584)=ENOSPC/alive/size unchanged; C: write(512)=ENOSPC after the 6 real clusters; D: tailcheck ALL PASS, chain ends at 4109); VERDICT.md Why the mechanism is dead cites msdosfs_fat.c:897-898, :906-946, :636-644, msdosfs_vfsops.c:565-566",
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_fat.c:897",
    "sys/vfs/msdosfs/msdosfs_fat.c:950",
    "sys/vfs/msdosfs/msdosfs_fat.c:636",
    "sys/vfs/msdosfs/msdosfs_fat.c:377",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:565"
  ],
  "poc_changes": "Generalized trigger3092.c into trigger.c (byte-count argument); added tailcheck.c offline FAT/dir verifier; rewrote run.sh into the decisive A/B/C/D sequence (7-cluster vs 6-cluster vs +1-cluster appends on fresh images, offline tailcheck after umount).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o crafttail crafttail.c && cc -O -o trigger trigger.c && cc -O -o tailcheck tailcheck.c",
  "run_cmd": "sh run.sh",
  "code_hash": "9faf0d93eccc937fd0df0965a8def5b02189c444bb33787b89831c2ac48a9a62",
  "notes": "Classification: false_positive by analysis (see VERDICT.md) \u2014 the claimed phantom-free tail bits cannot exist because fillinusemap()s FULL_RUN pre-fill (msdosfs_fat.c:897-898) covers every allocated pm_inusemap word. Two inert code defects remain (dead tail loop, word-relative clamp); a naive fix of the dead loop bound (cn < pm_maxcluster + N_INUSEBITS) would OOB-write one word past pm_inusemap when pm_maxcluster%32==31 because the allocation only has howmany(maxcluster+1,32) words \u2014 any cleanup must delete the loop or resize the allocation. No fix.diff: false positive, no security impact to fix.",
  "recommended_fix": "none required (optionally delete the redundant dead tail-marking loop at msdosfs_fat.c:950-952 for clarity)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "n/a \u2014 false positive, nothing to fix",
  "fix_evidence": ""
}