# DF-3131 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

The race landed 21 times out of 800 successful mounts: with the fspec string page munmapped inside the mountmsdosfs device-probe window, the copyinstr at msdosfs_vfsops.c:281 faults, its return is ignored, and the memset at :282 runs with stale stack size - observed live as statfs f_mntfromname coming back EMPTY (stale size 0 zeroed the whole field) on exactly those 21 mounts. That is the un-initialized-length write executing in-kernel; on this kernel build the stale slot held the benign value 0, so the out-of-bounds variant (stale size > MNAMELEN makes MNAMELEN - size wrap to a huge memset length) was not manifested, only its precondition. Requires mount privilege (root self-race, or vfs.usermount=1; note the stock DFly 6.5 caps layer denied the unprivileged mount attempt outright even with vfs.usermount=1, an additional reachability constraint recorded here).

## Kernel references
- sys/vfs/msdosfs/msdosfs_vfsops.c:281-282
- sys/vfs/msdosfs/msdosfs_vfsops.c:229-236

## Exploit chain
race2.c: thread A calls mount(2) with fspec pointing into a private page; thread B cycles munmap/mmap with a swept delay tuned into the device-probe window; after each successful mount statfs is checked for a garbled f_mntfromname (= faulted copyinstr + stale-size memset)

## Fix

check the copyinstr return before the memset; compile-validated

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: guest: cc -O -o race2 race2.c -lpthread

run: guest: race2 /dev/vn0 /mnt/raceroot 800

expected: GARBLED mntfromname lines proving the ignored copyinstr + stale-size memset executed; OOB variant depends on the stale stack value

## Notes on the PoC (what changed vs the finding sketch)

v1 (loop mount + free-running unmapper) never landed the window: 50000 attempts, 8712 successful mounts, 0 hits; v2 sweeps the munmap delay 0.3-4.3 ms around each mount and checks statfs, landing 21/800

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.