# DF-3139 VERDICT — REPRODUCED (unprivileged arbitrary raw-device sector read + write through a file descriptor)

## Observed (run.log, guest DragonFly 6.5-DEVELOPMENT X86_64_GENERIC)

Crafted image: file FILE, fn_size = 4 MB, root alblk = single alleaf
{al_off=0x1000, al_len=0, al_lsn=0x10}; mounted RW via direct mount(2)
on a uid-1001 mountpoint. Executed as uid 1001 (`maxx`):

1. pread(fd, 512, 0x200000)  -> lbn 0x1000 -> sector 0x10:
   returned the SUPERBLOCK, first 8 bytes = 0xfa53e9c5f995e849 (su_magic).
2. pread(fd, 512, 0x204000)  -> lbn 0x1020 -> sector 0x30:
   returned 0x00000038 (the bitmap-dir pointer word stored there).
3. pwrite(fd, "DF3139-PWNED-RAW-SECTOR-WRITE", 0x204000) -> rc=512.
4. Root-side raw dump of /dev/vn0 sector 0x30 afterwards contains
   "DF3139-PWNED-RAW-SECTOR-WRITE" (hex 44 46 33 31 33 39 2d 50 57 4e
   45 44 ...) — the unprivileged pwrite modified a raw device sector
   the file owns no allocation for (its declared allocation is ZERO
   blocks).
5. File pread afterwards returns the marker — the mapping is live.

The write path: hpfs_write -> hpfs_hpbmap (offset inside fn_size, so no
extend/allocation happens) -> getblk/bread(hp->h_devvp, dbtodoff(bn))
-> uiomove — i.e. plain device-relative I/O at the crafted address.
Aiming at sector 0x10 would have overwritten the mounted filesystem's
superblock (we targeted the bitmap-dir sector instead to keep the mount
usable; nothing restricts the target except `bn >= al_off` and the
device size).

## Impact

* On the audit guest: unprivileged destruction/disclosure of any sector
  of the backing device (dos-grade here — single-FS vn device).
* On a real system with the crafted image mounted (or via
  vfs.usermount): arbitrary read/write relative to the WHOLE disk
  device — other slices, other filesystems, disklabel — from an
  unprivileged file pwrite/pread. Filesystem-integrity and
  multi-tenant-disk confinement break; realistic host-compromise
  enabler when another slice holds the OS.

## Fix validation

fix.diff (shared, DF-3137 pack) drops the `!alp->al_len ||` escape so a
zero-length leaf matches nothing; patched kernel: the same pread/pwrite
return EFBIG, raw sector 0x30 unchanged (fix_run.log).

## Verdict

REPRODUCED — arbitrary raw-device sector read/write from unprivileged
file I/O. Kernel refs: sys/vfs/hpfs/hpfs_alsubr.c:113-143 (leaf match +
mapping), :118-119 (the `!alp->al_len` clause), :122 (*bnp arithmetic),
sys/vfs/hpfs/hpfs_vnops.c:283-289 (VOP_BMAP exposure), :322-346 (read),
:385-430 (write).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.