# VERDICT — DF-3112 (HAMMER1 ioctl dispatcher privilege-gate bypass)

**Status: reproduced** (unprivileged local execution of 9 gated-class ioctl
commands) — impact: none directly (info disclosure / policy bypass; no memory
corruption).  Fix validated on a patched guest kernel (see bottom).

## How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), cc 8.3.
A 1.1 GB HAMMER1 filesystem was created on `vn0`
(`newfs_hammer -f -L pocfs /dev/vn0`), mounted at `/mnt/h1`, with
`/mnt/h1/histfile` carrying 3 distinct history TIDs (write +
`hammer synctid` × 3).

`hammer_gate_poc.c` (uid 1001 `maxx`, plain `ioctl(2)` on an O_RDONLY fd):

- **[A] GETHISTORY**   → rc=0, 3 history entries  → gate bypassed
- **[B] GET_VERSION**  → rc=0, version string     → gate bypassed
- **[C] GET_INFO**     → rc=0, label 'pocfs'      → gate bypassed
- **[D] SYNCTID**      → rc=0, flusher TID        → gate bypassed
- **[E] SCAN_PSEUDOFS**→ rc=0, pfs 0 scanned      → gate bypassed
- **[F] PRUNE**        → EPERM (gated contrast — same dispatcher)
- **[G] ADD_SNAPSHOT** → EPERM (gated contrast — same dispatcher)

The same binary run **as root** shows [F]/[G] reaching the handler
(ADD_SNAPSHOT → EINVAL from its own `index >= count` validation), proving the
EPERM seen for the unprivileged run is exactly the
`caps_priv_check(SYSCAP_NOVFS_IOCTL)` result at hammer_ioctl.c:72 that
[A]-[E] overwrite.  Stable across 3 runs (see run.log, run.root.log).

## Root cause

sys/vfs/hammer/hammer_ioctl.c:72 computes the gate once; the nine case labels
listed in README.md assign `error = hammer_ioc_...(...)` without the
`if (error == 0)` guard used by every other case in the same switch.

## Impact ceiling

- Unprivileged disclosure of filesystem topology/state: volume list (compounds
  DF-0870), PFS configuration incl. shared/unique UUIDs and sync TIDs
  (GET_PSEUDOFS), snapshot TID inventory (GET_SNAPSHOT), per-file modification
  history (GETHISTORY), version/statistics (GET_VERSION/GET_INFO).
- Unprivileged SYNCTID drives global flusher synchronization
  (op=SYNC1/SYNC2 do full-mount flush cycles) — a resource/DoS amplifier
  comparable to sync(2) spam, but with TID-precision disclosure for backup
  tooling.
- On filesystems with corrupted/crafted records, GET_SNAPSHOT /
  GET_CONFIG / SCAN_PSEUDOFS copy disk-buffer contents to the caller without
  clamping to the record's `data_len` contract (hammer_pfs.c:363 uses the
  disk-controlled length directly as the copyout size) — the missing gate
  makes that path reachable by any local user.

No memory-safety violation was demonstrated from this finding alone.

## Fix validation

`fix_combined_for_validation.diff` (this finding's 9 dispatcher hunks + the
DF-3114 hunks) was applied to the guest's `/usr/src`, kernel rebuilt with
`make nativekernel KERNCONF=X86_64_GENERIC`, rebooted, and the identical PoC
re-run:

- unprivileged run: [A]-[E] now return **EPERM** (gate enforced), [F]/[G]
  unchanged (EPERM);
- root run: [A]-[E] succeed legitimately, [H] now returns **EINVAL**
  (DF-3114 fix).

Baseline vs patched transcripts: run.log / run.root.log (baseline) and
run.patched.log / run.patched.root.log (patched) in this directory.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.