{
 "finding_id": "DF-3108",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Reproduced deterministically: one flipped byte (d_reclen 12 -> 516) in a directory of a vn-mounted RW UFS image makes the first name resolution inside that directory panic the kernel via ufs_dirbad (ufs_lookup.c:608-609). Deliberate repro on the guest captured panic: ufs_dirbad: bad dir with ufs_dirbad <- ufs_lookup <- vop_nresolve backtrace; reconfirmed on the DF-3106-patched kernel (independent code path), plus three incidental identical panics during DF-3106 PoC development (offsets 168/500/508). Threat: untrusted/corrupted image mounted RW (root or vfs.usermount=1); reboot-loopable. UFS instance of the ext2_dirbad fail-stop pattern filed as DF-3083.",
 "exploit_chain": "crafted/corrupted UFS image -> mount RW -> any user resolves a name inside the corrupted directory -> ufs_lookup walk flags mangled entry -> ufs_dirbad -> panic(ufs_dirbad: bad dir) -> reboot; re-fires on every subsequent access",
 "evidence": [
  "findings/poc/DF-3108/panic.txt: /dev/vn7: bad dir ino 3 at offset 0: mangled entry + panic: ufs_dirbad: bad dir + ufs_lookup backtrace",
  "findings/poc/DF-3108/run.log: one-byte flip (reclen 12 -> 516), mount, stat inside /d, guest down"
 ],
 "kernel_refs": [
  "sys/vfs/ufs/ufs_lookup.c:608",
  "sys/vfs/ufs/ufs_lookup.c:609",
  "sys/vfs/ufs/ufs_lookup.c:269",
  "sys/vfs/ufs/ufs_lookup.c:264"
 ],
 "poc_changes": "Initial trigger used `ls` (VOP_READDIR uses ufs_readdirs lenient walk \u2014 no panic); changed to resolving a name inside the corrupted directory (stat /mnt/df3108/d/x) which drives ufs_lookups walk.",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0/#1 (reproduced on both stock and DF-3106-patched kernels)   root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 90,
 "guest_dirty": 0,
 "build_cmd": "cc -O2 -o patch_one patch_one.c (guest, gcc 8.3 DragonFly)",
 "run_cmd": "(as root on guest) ./repro.sh",
 "code_hash": "fe309be6e426de5b478f634dc14239ec21d7078f11c3cd0ec0eef1c881ccddb3",
 "notes": "Same fail-stop class as DF-3083 (ext2_dirbad); FreeBSD upstream retains the panic as well \u2014 this is a shared-heritage design issue, filed so UFS gets the same treatment decision as ext2. Fix not validated in this run (kernel-build budget spent on DF-3106s mandatory memcorrupt validation); harness is trivially re-runnable for any candidate patch.",
 "recommended_fix": "In ufs_dirbad(), do not panic on RW mounts: report and return (the walk already skips forward past mangled entries), matching the DF-3083 direction for ext2_dirbad.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Fix not built this run (kernel-build budget spent on DF-3106s mandatory memcorrupt fix validation); the repro harness is trivially re-runnable against a candidate ufs_dirbad de-panicking patch. Note the deliberate repro ran ON the DF-3106-patched kernel and still panicked \u2014 independent code path."
}