# DF-3139 — `al_len == 0` alleaf treated as an infinite extent by hpfs_hpbmap: unprivileged arbitrary raw-device sector read/write

## Build

    ./build.sh      # crafts df3139.img on host, pushes + compiles on guest

## Run

    ./run.sh        # mounts RW on uid-1001-owned mountpoint, runs the PoC
                    # as uid 1001, then (root) dumps raw sector 0x30

## Expected (and observed)

    DF3139 read  sector 0x10 via file offset 0x200000:
        first8 = 0xfa53e9c5f995e849   (the HPFS SUPERBLOCK magic — read
                                        through a file that owns 0 blocks)
    DF3139 read  sector 0x30 via file offset 0x204000:
        first4 = 0x00000038           (the bitmap-dir word)
    DF3139 write sector 0x30 via file offset 0x204000: rc=512
    raw /dev/vn0 sector 0x30 afterwards: "DF3139-PWNED-RAW-SECTOR-WRITE"

Root cause: sys/vfs/hpfs/hpfs_alsubr.c:118-119 —
`if ((bn >= alp->al_off) && (!alp->al_len || (bn < al_off+al_len)))`
treats a zero-length alleaf as matching every bn >= al_off, and :122
maps it to `*bnp = bn - al_off + al_lsn` on the raw device vnode
(h_devvp). With al_off/al_lsn crafted, every file offset maps to a
chosen raw sector of the whole backing device — reading/writing the
superblock, disklabel area, or (on multi-slice disks) other partitions'
data from an unprivileged pread/pwrite on an ordinary file. Distinct
from DF-3099 (hpfs_write's (runl+1)*DEV_BSIZE arithmetic; the feed is
this branch's `*runp = 3`, but the arbitrary-device-addressing
consequence of the `!alp->al_len` clause itself is this finding).