{
  "finding_id": "DF-3096",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not exercised on the guest this run (conditional-verify criteria not met: Medium severity, base:vfs bucket, privileged trigger). The state machine is fully code-proven: on a MNT_UPDATE ronly->rw transition hammer_vfs_mount() clears hmp->ronly and reopens all device vnodes FWRITE (vfsops:478-482) BEFORE running stage2 recovery, and hammer_recover_flush_buffers(...,1) at vfsops:485 writes the stage1-recovered root volume header to MEDIA (hammer_recover.c:1460-1466) before stage2 is known to succeed. When stage2 then fails, the error is returned (vfsops:509) but hmp->ronly stays 0 - sys_mount() rolls back only mp->mnt_flag/mnt_kern_flag (vfs_syscalls.c:405-408), leaving a kernel-RO-flagged mount whose internal state is RW: inodes load without HAMMER_INODE_RO (hammer_inode.c:469-470), all hmp->ronly-gated write ioctls (mirror/prune/reblock/dedup) become usable, and media was already mutated by the failed update.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3096/VERDICT.md - line-cited mechanism and suggested rollback fix"
  ],
  "kernel_refs": [
    "sys/vfs/hammer/hammer_vfsops.c:478",
    "sys/vfs/hammer/hammer_vfsops.c:485",
    "sys/vfs/hammer/hammer_vfsops.c:486",
    "sys/vfs/hammer/hammer_vfsops.c:509",
    "sys/kern/vfs_syscalls.c:405",
    "sys/vfs/hammer/hammer_recover.c:1460",
    "sys/vfs/hammer/hammer_inode.c:469"
  ],
  "poc_changes": "n/a - no PoC authored; a deterministic trigger requires an image that passes RO-mount stage1 but fails stage2 (REDO_SYNC-dependent error paths), judged disproportionate for a Medium root-triggered integrity bug this run",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Follow-up candidate: craft an image with valid REDO_SYNC + tiny blockmap alloc_offset to hit Undo size is absurd (hammer_recover.c EIO) at the mount -u stage2, then observe hmp->ronly==0 via write-enabled hammer ioctls.",
  "recommended_fix": "On stage2 failure in the MNT_UPDATE ronly->rw path, restore hmp->ronly=1 and re-run hammer_adjust_volume_mode before returning the error; do not bcopy the failed-recovery blockmap"
}