{
  "finding_id": "DF-3097",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not exercised on the guest (requires an NFS server + client pair against a hammer1 export). Mechanism is code-certain: hammer_vfs_vptofp (vfsops:1083-1095) builds file handles from three fully predictable fields (sequential obj_id, constant obj_asof=HAMMER_MAX_TID for live files, small PFS id in fid_ext) with zero per-inode entropy - unlike UFSs random generation number - and hammer_vfs_fhtovp (vfsops:1104-1141) validates NOTHING from the wire: not fid_len, not the PFS id (fid_ext -> pfs_to_lo, vfsops:1120), and honors an arbitrary attacker-chosen obj_asof (vfsops:1116,1130-1131) which returns the inode as of ANY historical transaction. On an NFS-exported hammer1 mount any permitted client can therefore forge handles to (a) enumerate inodes, (b) read any historical version of any file (snapshot policy bypass, deleted-content disclosure), (c) cross PFS boundaries via fid_ext.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3097/VERDICT.md - line-cited fh encode/decode analysis and fix sketch"
  ],
  "kernel_refs": [
    "sys/vfs/hammer/hammer_vfsops.c:1090",
    "sys/vfs/hammer/hammer_vfsops.c:1115",
    "sys/vfs/hammer/hammer_vfsops.c:1120",
    "sys/vfs/hammer/hammer_vfsops.c:1130",
    "sys/vfs/nfs/nfs_subs.c:1243"
  ],
  "poc_changes": "n/a - no PoC authored this run",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Verification path for a follow-up run: export a hammer1 vn mount on the guest (mountd -r /mnt), then from the host craft NFS LOOKUP/READ calls with forged fhs (obj_id sweep, asof=past TID, fid_ext sweep) - no legit fh needed since obj_id=1/asof=MAX_TID/pfs=0 is the known-good root handle.",
  "recommended_fix": "Add per-inode non-guessable entropy to the handle (e.g. xor the leaf record CRC or a per-mount secret into obj_asof high bits) and verify it in fhtovp; validate fid_len; clamp obj_asof to hmp->asof"
}