{
 "finding_id": "DF-3132",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "A FAT32 BPB with bpbFATs=1 and bpbExtFlags=0x8F (mirror bit set, active FAT 15) mounts successfully: msdosfs_vfsops.c:409-410 sets pm_curfat=15 without ever checking it against pm_FATs, and every subsequent FAT read AND write is displaced 15*FATsecs sectors past the real FAT by fatblock (msdosfs_fat.c:87). After creating NEW.TXT on the RW mount and unmounting, the image shows the real FAT sector 32 unchanged (entry 7 still free) while the EOC chain write for cluster 7 landed at sector 152 inside CANARY.BIN data clusters - kernel-mediated writes outside the FAT region, silently corrupting file data. The landing zone had been pre-seeded with a copy of the real FAT so the displaced reads see a workable filesystem, proving the kernel operates consistently against the wrong blocks.",
 "exploit_chain": "",
 "evidence": "run.log hexdumps: sector 32 (real FAT) entry 7 = 0 after umount vs sector 152 (displaced) entry 7 = 0x0FFFFFFF EOC; mount line shows the crafted volume accepted RW",
 "kernel_refs": [
  "sys/vfs/msdosfs/msdosfs_vfsops.c:409-410",
  "sys/vfs/msdosfs/msdosfs_fat.c:87"
 ],
 "poc_changes": "initial canary filled the landing zone with 0xAA, which made the displaced FAT census read all clusters as busy (ENOSPC before any write); the zone now carries a copy of the real FAT so the displaced reads work and the misplaced WRITE is observable",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "host: python3 craft_curfat.py out.img (FATs=1 extflags=0x8F; landing zone seeded with a FAT copy)",
 "run_cmd": "guest: vnconfig -c -S 64m /dev/vn0 img && mount_msdos /dev/vn0 /mnt && echo hi > /mnt/NEW.TXT && umount, then hexdump sectors 32 and 152",
 "code_hash": "5ae35966bfdf13993cb751ada33273474c8fb5d8c097980ae1d76b1acd13f0d9",
 "notes": "A/B on fixed kernel: the same FATs=1/extflags=0x8F volume is rejected at mount (bad active FAT) and no byte anywhere is displaced.",
 "recommended_fix": "reject pm_curfat >= pm_FATs and pm_FATs == 0 at mount; combined fixed kernel: the crafted volume is refused with bad active FAT and no FAT byte is written anywhere"
}