{
  "finding_id": "DF-3155",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "NOT RUNTIME-TESTABLE (dead code). ext2_extent_blk_csum_verify/set (ext2_csum.c:387-433) have zero callers in the tree; extent-tree blocks on metadata_csum filesystems are never checksum-verified by this port (ext2_extents.c contains no csum logic). The dormant ext2_extent_blk_csum() computes its crc length from EXT4_EXTENT_TAIL_OFFSET(ehp) = 12 + 12*eh_max (ext2_extents.h:113-114) with eh_max raw on-disk u16 — a crafted eh_max=65535 would read 786,432 bytes from a bsize buffer (worse than DF-0877) the moment anyone wires the verification in (FreeBSD calls these from ext4_ext_find_extent).",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-3155/README.md", "sys/vfs/ext2fs/ext2_extents.h:113-114", "grep -rn extent_blk_csum sys/ (definitions + prototypes only)"],
  "kernel_refs": ["sys/vfs/ext2fs/ext2_csum.c:366", "sys/vfs/ext2fs/ext2_csum.c:387", "sys/vfs/ext2fs/ext2_csum.c:416", "sys/vfs/ext2fs/ext2_extents.h:113"],
  "poc_changes": "n/a — no runtime path exists to test",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "", "run_cmd": "", "code_hash": "",
  "notes": "Info-severity hardening finding: either wire verification up WITH eh_max bounding (<= (bsize-12-4)/12 and eh_magic check) or delete the dead functions.",
  "recommended_fix": "Bound eh_max by the block size and check eh_magic before computing the extent tail offset, or remove the dead verification functions"
}