# DF-3115 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Unprivileged ls/stat churn on a crafted FAT directory drives the two unconditional kprintfs in mbnambuf_write at unbounded rate: pattern A (two id-1 LFN slots per group, 12 groups) printed 1212 non-decreasing-id lines across 100 unprivileged ls+stat passes; pattern B (10 full 13-char LFN slots, 130 bytes reassembled) printed 100 file-name-length-too-large lines across 100 ls passes. The serial console echoes every line (1312 msdosfs lines captured on the console log during the run), i.e. an unprivileged user floods msgbuf and any logging console with no kernel-side rate limit; a stock Windows LFN of 255 UCS-2 chars hits the 127-byte cap on ordinary directories. Availability only.

## Kernel references
- sys/vfs/msdosfs/msdosfs_conv.c:1038
- sys/vfs/msdosfs/msdosfs_conv.c:1048
- sys/vfs/msdosfs/msdosfs_lookup.c:270
- sys/vfs/msdosfs/msdosfs_vnops.c:1662

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

gate both prints behind MSDOSFS_DEBUG exactly as upstream FreeBSD; combined fixed kernel: same workload emits zero lines

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: host: python3 craft_lfn.py out.img A|B

run: guest: vnconfig -c -S 2m /dev/vn0 img && mount_msdos -o ro /dev/vn0 /mnt && su -m nobody -c 100x ls/stat loop, count dmesg lines

expected: 1212 non-decreasing lines + 100 too-large lines per 100 passes; console log floods

## Notes on the PoC (what changed vs the finding sketch)

first craft attempt printed nothing: win2unixfn only reaches mbnambuf_write when the highest-ordinal LFN slot carries WIN_LAST (0x40) so the checksum re-establishes; craft_lfn.py now sets it and a matching chksum byte

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.