{
  "finding_id": "DF-3157",
  "title": "msdosfs_fhtovp passes unvalidated NFS file-handle fields into deget/readep: OOB kernel heap read+write (fatal panic), arbitrary in-volume device-offset read/write via stat()/SETATTR, nfsd wedge -- remotely reachable on NFS-exported msdosfs",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_vfsops.c:848-863",
    "sys/vfs/msdosfs/msdosfs_denode.c:236-428",
    "sys/vfs/msdosfs/msdosfs_denode.c:363-377",
    "sys/vfs/msdosfs/msdosfs_denode.c:430-473",
    "sys/vfs/msdosfs/msdosfs_lookup.c:880-901",
    "sys/vfs/msdosfs/msdosfsmount.h:139-141",
    "sys/vfs/nfs/nfs_subs.c:1212-1246",
    "sys/vfs/nfs/nfsm_subs.c:934-965"
  ],
  "reproduce": {
    "build": "cc -O2 -o /tmp/df3157 df3157.c ; cc -O2 -o /tmp/fhtest fhtest.c (guest, cc 8.3)",
    "run": "setup: sh setup.sh (vnconfig/mount/exports/rpcbind+mountd+nfsd); then run.sh",
    "expected": "baseline kernel: fhstat(3,0) st_size=0x44434241 marker; fhstat(3,511) heap garbage; NFS getattr 0 32 -> Fatal trap 12 at deget+0x2b5 (3/3); setattr 0 511 -> nfsd wedge; fhtest 3 0 write -> 32B persisted at forged offset. patched kernel: all OOB/out-of-range probes EINVAL; no panic; nfsd healthy."
  },
  "artifacts": ["README.md","VERDICT.md","df3157.c","fhtest.c","mkfat.py","setup.sh","build.sh","run.sh","build.log","run.log","run.2.log","panic.txt","panic_capture.txt","env.txt","fix.diff","manifest.json","verdict.json","manifest.sha"]
}