# VERDICT — DF-3150

## Status: REPRODUCED (logic/integrity) / fix VALIDATED

## Baseline (stock kernel `#0`)

`HAMMER_IOC_MIRROR_NODATA`-style mrec (`head.type = 0x10000001`,
`HAMMER_MREC_TYPE_REC | HAMMER_MRECF_NODATA`), data_len=0:

```
MIRROR_WRITE rc=0 head.error=0 head.flags=00000000 count=80   <- processed as REC
MIRROR_READ rc=0 error=0 count=664
  mrec[0] ... obj=1234 key=100 ctid=1000 dtid=0 btype=52 rt=0012 ... dlen=0
```

The record WAS installed on the mirror target — proving the switch in
`hammer_ioc_mirror_write` (hammer_mirror.c:429) dispatched
`type & HAMMER_MRECF_TYPE_MASK` (0x800000FF, hammer_ioctl.h:383) to
`case HAMMER_MREC_TYPE_REC` and the `case HAMMER_MREC_TYPE_REC_NODATA`
label (0x10000001, hammer_ioctl.h:379-380) is UNREACHABLE — the mask strips
the NODATA bit 0x10000000 (hammer_ioctl.h:388). The read side genuinely emits
this type for NODATA streams (hammer_mirror.c:244-248, :272), so such records
are silently installed with `data_len == 0` (content hole) instead of being
skipped as the case body intends (mirror.c:442-452).

Impact ceiling: silent data loss / integrity corruption on a mirror target fed
a NODATA stream (a crafted master can do this deliberately; the records become
holes). No kernel memory-safety effect → severity Low.

## Fix validation (patched kernel `#1`, fix.diff: switch mask includes HAMMER_MRECF_NODATA)

```
=== nodata + readback on fresh fs (patched) ===
MIRROR_WRITE rc=0 head.error=0 head.flags=00000000 count=80   <- consumed
MIRROR_READ rc=0 error=0 count=584
  mrec[0] ... obj=1 key=0 ctid=100000001 dtid=0 btype=52 rt=0001 loc=00000001 dlen=128
  mrec[208] ... obj=1 ... rt=0015 ...
```

count=80 (mrec consumed, no error) but readback shows ONLY the PFS root
records — no obj=1234 record exists: the REC_NODATA case now runs and skips
the record, exactly as designed. Fix proven.

## Bottom line

Certain. Dead switch case caused by mask/flag bit mismatch; NODATA mirror
records installed instead of skipped. Low severity (integrity), fix proven.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.