DF-3094 / verdict.json
{ "finding_id": "DF-3094", "status": "not_reproduced", "reproduced": 0, "impact": "none", "confidence": "likely", "verdict": "The claimed panic path is not reachable by geometry crafting on this guest, and the current code propagates FAT read errors correctly: (a) crafting BPB sectors-per-FAT=32767 on an 8MB image is rejected at mount (mount_msdos: Invalid argument - geometry validated); (b) with the mount-accepted original geometry, 300x64KB extending writes complete cleanly; (c) the cited chain in the current tree returns the bread error (fatentry, msdosfs_fat.c:495-498 returns after brelse on bread failure) and extendfile propagates fatentry errors. Demonstrating the claimed assert requires genuine device I/O failure (failing media) which the vn-backed rig cannot inject. Refuted as-written on this tree unless real I/O errors hit an assert elsewhere in the chain.", "exploit_chain": "", "evidence": "VERDICT.md + run.log + sources", "kernel_refs": [ "sys/vfs/msdosfs/msdosfs_fat.c:495", "sys/vfs/msdosfs/msdosfs_fat.c:400" ], "poc_changes": "adjusted from finding sketch to guest syscall/layout reality", "attempts": 2, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 60, "guest_dirty": 0, "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread", "run_cmd": "see README.md", "code_hash": "bb9affe56b4db4bddf237b680c7635a061d47a2f5ea5ca5c986893b375b3c8d1", "notes": "fix_status: not_testable (not reproduced)", "recommended_fix": "No fix required for the cited site (bread errors already propagate); optional hardening: initialize bp = NULL before bread in fatentry and guard brelse(bp) for bp == NULL.\n" } |