{
 "finding_id": "DF-3115",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Unprivileged ls/stat churn on a crafted FAT directory drives the two unconditional kprintfs in mbnambuf_write at unbounded rate: pattern A (two id-1 LFN slots per group, 12 groups) printed 1212 non-decreasing-id lines across 100 unprivileged ls+stat passes; pattern B (10 full 13-char LFN slots, 130 bytes reassembled) printed 100 file-name-length-too-large lines across 100 ls passes. The serial console echoes every line (1312 msdosfs lines captured on the console log during the run), i.e. an unprivileged user floods msgbuf and any logging console with no kernel-side rate limit; a stock Windows LFN of 255 UCS-2 chars hits the 127-byte cap on ordinary directories. Availability only.",
 "exploit_chain": "",
 "evidence": "run.log (both patterns, before/after msgbuf counts), console_flood_excerpt.log (serial console echo of 1312 lines), craft_lfn.py (WIN_LAST + chksum details needed to reach mbnambuf_write)",
 "kernel_refs": [
  "sys/vfs/msdosfs/msdosfs_conv.c:1038",
  "sys/vfs/msdosfs/msdosfs_conv.c:1048",
  "sys/vfs/msdosfs/msdosfs_lookup.c:270",
  "sys/vfs/msdosfs/msdosfs_vnops.c:1662"
 ],
 "poc_changes": "first craft attempt printed nothing: win2unixfn only reaches mbnambuf_write when the highest-ordinal LFN slot carries WIN_LAST (0x40) so the checksum re-establishes; craft_lfn.py now sets it and a matching chksum byte",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "host: python3 craft_lfn.py out.img A|B",
 "run_cmd": "guest: vnconfig -c -S 2m /dev/vn0 img && mount_msdos -o ro /dev/vn0 /mnt && su -m nobody -c 100x ls/stat loop, count dmesg lines",
 "code_hash": "1d2ebfca4790c584c6a2c132e7926ecea77c0801ede4f7b707fec9a41ade4b6a",
 "notes": "A/B on fixed kernel: 50 unprivileged ls passes emit delta=0 msgbuf lines (baseline: 1212 per 100 passes).",
 "recommended_fix": "gate both prints behind MSDOSFS_DEBUG exactly as upstream FreeBSD; combined fixed kernel: same workload emits zero lines"
}