# DF-3172 VERDICT — reproduced (panic; controlled zero-write primitive; uid0 not achieved)

## Bottom line

`ffs_indirtrunc()`'s tail-zering `bzero()` (sys/vfs/ufs/ffs_inode.c:535-536)
computes its start index and length from `lastbn` (attacker-chosen through
the truncate length) and `NINDIR(fs)` (raw superblock data, never validated
at mount). On a filesystem whose superblock carries a crafted `fs_nindir`,
an unprivileged `ftruncate(2)` by the file's owner produces an
attacker-sized (up to ~16 GiB) and attacker-placed (start anywhere in a
~4 GiB window above the buffer, 4-byte granularity) kernel zero-write.
Proven on the stock INVARIANTS guest by two deterministic panics:

1. **Wild march (run A)** — `fs_nindir` 1024→512 (one int32 in the sb):
   shrink of a 560 GB sparse file to `Sigma'*4096+4096` =
   550,831,706,112 → `lastiblock[TRIPLE] == NINDIR³` → `last == NINDIR` →
   `bzero(&bap[NINDIR+1], (uint)-1 * sizeof(ufs_daddr_t))` = 16 GiB-4 march
   starting 2052 bytes into the 4096-byte indirect-block buffer:
   `Fatal trap 12, supervisor write data, page not present`,
   `Stopped at memset+0xd5: repe stosq %es:(%rdi)`, fault VA
   0xfffff80066de7000 (first non-resident page above the buffer), guest
   down at `db>`.

2. **Aimed write (run B)** — `fs_nindir = 2^28` + on-disk-crafted
   `di_size` (so no balloc is needed on the trigger path): shrink drives
   `lastbn = NINDIR-1026` at the SINGLE level → a **4100-byte zero at
   `b_data + 1,073,737,724` (+1.000 GiB)** → `panic: assertion "obj != NULL"
   failed in vm_object_hold_shared`, `rip = memset+0xf0` — the fault is in
   the bzero itself, at the aimed address (unmapped ⇒ fault; a mapped
   target would be silent corruption instead).

Bonus (same root cause, sibling sink): with `fs_nindir = 2^28`, growing the
file *through the kernel* first makes `ufs_getlbns` return
`in_off = (lbn-12) % 2^28` and `ffs_balloc` reads
`bap[268434431]` (ffs_balloc.c:297) = `b_data + 1 GiB` OOB →
`ffs_balloc+0x5e7` → vm_fault → `vm_object_hold_shared(obj==NULL)` panic.
The `ffs_inode.c:550-563` free loop has the same NINDIR-bound OOB-read
shape (reads then `ffs_blkfree()`s values past the buffer).

## Why the mount-time clamps do not save you

- `ffs_mountfs` checks only `fs_magic` and
  `sizeof(struct fs) <= fs_bsize <= MAXBSIZE` (ffs_vfsops.c:642-646);
  `fs_nindir` is adopted verbatim (ump->um_nindir, :729) and governs
  `NINDIR(fs)` everywhere (bmaparray levels, balloc offsets, indirtrunc
  bounds).
- The `fs_maxfilesize` clamp (:753-758, `min(2^30*bsize-1, 2^43-1)`) caps
  *lbns* at 2^30 — exactly the triple-indirect capacity `Sigma` of an
  *honest* NINDIR=bsize/4 filesystem ≥ 4096-byte blocks. It was verified
  numerically and empirically that an honest geometry is safe (an honest
  `fs_maxfilesize = Sigma*bsize-1` from newfs keeps `last <= NINDIR-1`,
  and the first PoC attempt via crafted `fs_maxfilesize` alone did NOT
  fire — the clamp neutralizes it for every bsize newfs can produce).
  The invariant collapses as soon as `fs_nindir` itself is a lie: with
  M=512 the tree capacity is 134,480,396 blocks while the clamp still
  permits lbns up to 2^30 — an 8x gap the attacker closes with the same
  truncate that the clamp was supposed to bound.

## uid0 push — what was tried, where it stops

The write primitive is **zero-only**, **forward-marching**, and anchored at
`bp->b_data`, which lives in the buffer KVA submap
(platform/pc64/x86_64/machdep.c:499-505: kernel_map ⊃ clean_map ⊃
buffer_map, `nbuf*MAXBSIZE` ≈ 838 MB on this guest, 12634 buffers;
kern/vfs_bio.c:638 assigns each struct buf a 64K window of which only the
buffer's own pages are mapped).

- The march from run A dies at the first non-resident page (observed:
  within one page above the 4096-byte buffer). Victims before that point
  are **buffer-cache page images** (cached file data/metadata), not kernel
  objects: zeroing them can only *clear* bits — it cannot set ISUID or
  forge a credential; at worst it corrupts written-back filesystem state.
- `struct proc`/`ucred` live in kernel_map kmem slab allocations that are
  *not* contiguous with the resident buffer windows; a march that survives
  the arena would have to cross unmapped pager_map/clean_map reservations
  first (it cannot — it faults at the first hole).
- The **aimed** variant (start anywhere in a 4 GiB window above b_data,
  arbitrary length) is the exploitation direction: with no KASLR the guest
  layout is boot-deterministic, so a two-boot campaign (probe boot leaks
  b_data from the fault VA, target boot zeroes a sprayed ucred at
  `b_data + delta` and a child process polls `geteuid()==0`) is
  *theoretically* viable. It was not completed: (a) locating one's own
  ucred needs a disclosure companion — the only candidate here is the
  OOB-read→`ffs_blkfree`→cg-bitmap oracle, whose values are fsblock-cast
  int32s and whose INVARIANTS checks abort the run long before a usable
  sample; (b) each probe costs a full boot cycle; (c) an aimed zero that
  crosses live kernel objects between the anchor and the ucred zeroes
  spinlocks/list pointers first, so the race window closes before
  `exec` of a root shell can complete. Documented as a hard blocker for
  this primitive shape; impact recorded as `panic` (deterministic DoS +
  controlled kernel heap corruption window), severity High under the
  crafted-media threat model (same class as DF-3035/DF-3078).

## Fix validation (fix.diff)

- Baseline (stock #0): run A panic + run B aimed panic (above).
- Patched (#1, `make nativekernel` in-guest, 0 warnings):
  - T1 regression: legit `newfs -b 4096` mount; unpriv user extends sparse
    file to 560,000,000,000 then truncates to 550,831,706,112 → returns 0,
    `stat` size exact, guest up.
  - T2: run-A craft (fs_nindir 1024→512) → `mount_ufs: /dev/vn0 on
    /mnt/poc: incorrect super block` (EINVAL), guest up.
  - T3: run-B craft (fs_nindir = 2^28) → same EINVAL rejection, guest up.
- fix.diff = mount-time `fs_nindir == fs_bsize/sizeof(ufs_daddr_t)` check
  (mirrors newfs/mkfs.c:316 exactly, cannot reject honest media) +
  `fs_maxfilesize` capped at the representable `Sigma*bsize-1` (same
  formula as mkfs.c:332-335) + defense-in-depth clamp of `last` to
  `NINDIR(fs)-1` in `ffs_indirtrunc` (also protects MNT_RELOAD geometry
  re-adoption à la DF-3078).

## Kernel references

- sys/vfs/ufs/ffs_inode.c:535-536 — the bzero sink (start+len from media)
- sys/vfs/ufs/ffs_inode.c:311-314 — lastblock/lastiblock from length
- sys/vfs/ufs/ffs_inode.c:157-158 — only length validation (fs_maxfilesize)
- sys/vfs/ufs/ffs_inode.c:550-563 — NINDIR-bounded OOB read loop + blkfree
- sys/vfs/ufs/ffs_vfsops.c:642-646 — insufficient superblock validation
- sys/vfs/ufs/ffs_vfsops.c:729 — um_nindir adopted raw
- sys/vfs/ufs/ffs_vfsops.c:753-758 — maxfilesize clamp (invariant needs honest nindir)
- sys/vfs/ufs/ufs_bmap.c:315 — in_off = (bn/blockcnt) % MNINDIR
- sys/vfs/ufs/ffs_balloc.c:297 — sibling OOB read sink
- sys/vfs/ufs/ufs_types.h:41 — ufs_daddr_t is int32 (NINDIR = bsize/4)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.