{
  "finding_id": "DF-3150",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Runtime-proven logic bug: HAMMER_MREC_TYPE_REC_NODATA case in hammer_ioc_mirror_write is dead code because the dispatch mask HAMMER_MRECF_TYPE_MASK (0x800000FF) strips the NODATA bit 0x10000000 that the case label requires. A NODATA-flagged REC (which the read side genuinely emits for HAMMER_IOC_MIRROR_NODATA streams, mirror.c:244-248,272) is dispatched to the plain REC install path and the record is created with data_len==0 (content hole) instead of being skipped. Baseline run.log shows obj=1234 dlen=0 installed and read back; patched run.fixed.log (switch mask extended with HAMMER_MRECF_NODATA) shows the mrec consumed but NO record created. Integrity/data-loss only (crafted master or misapplied histogram stream); no kernel memory-safety effect -> Low.",
  "exploit_chain": "",
  "evidence": [
    "run.log: baseline - NODATA mrec processed (head.error=0, count=80) and readback shows the installed obj=1234 dlen=0 record",
    "run.fixed.log: patched - same mrec consumed, readback shows only PFS root records (skip case reached)",
    "VERDICT.md: mask arithmetic walkthrough"
  ],
  "kernel_refs": [
    "sys/vfs/hammer/hammer_mirror.c:429",
    "sys/vfs/hammer/hammer_mirror.c:442",
    "sys/vfs/hammer/hammer_mirror.c:244",
    "sys/vfs/hammer/hammer_ioctl.h:379",
    "sys/vfs/hammer/hammer_ioctl.h:383",
    "sys/vfs/hammer/hammer_ioctl.h:388"
  ],
  "poc_changes": "nodata mode sets head.type = 0x10000001 (REC|MRECF_NODATA); readback mode parses returned mrecs to prove presence/absence of the record",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /tmp/mirror_poc mirror_poc.c",
  "run_cmd": "/tmp/mirror_poc /mnt/f1 nodata && /tmp/mirror_poc /mnt/f1 readback",
  "code_hash": "4b94e084cfbf563d1409e503e025609a43f52a9bd48992fdf68e1e296f2ba3a6",
  "notes": "impact none in the kernel-memory sense; the real impact is silent data loss / integrity corruption on the mirror target (records installed as holes).",
  "recommended_fix": "Include HAMMER_MRECF_NODATA in the dispatch mask so the existing REC_NODATA skip case is reachable (see fix.diff; kernel-local change, avoids rippling the shared header constant into userland dispatchers).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Sep  7 05:10:35 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel consumes the NODATA mrec without error and creates no record (readback clean) - the intended skip semantics. Fix proven.",
  "fix_evidence": "run.fixed.log"
}