{
  "finding_id": "DF-3172",
  "title": "ffs_indirtrunc wild/aimed kernel bzero via unvalidated on-disk fs_nindir (and unclamped lastbn)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "in-guest: cc -o craft64 craft64.c; cc -o trigger3172 trigger3172.c; cc -o inopatch inopatch.c -I/usr/src; cc -o mkaim mkaim.c; cc -o aim3172 aim3172.c",
    "run": "sh setup1.sh; run_user '/tmp/trigger3172 /mnt/poc/d/f extend'; sh setup2.sh; run_user '/tmp/trigger3172 /mnt/poc/d/f shrink'  # -> Fatal trap 12 in memset, guest down",
    "expected": "Baseline stock kernel #0: wild ~16GiB zero-march panic (memset+0xd5 repe stosq). Aimed variant: 4100-byte zero at b_data+1GiB (panic, rip=memset+0xf0). Patched kernel #1: crafted mounts rejected EINVAL, legit 560GB sparse truncate works, guest never panics."
  },
  "kernel_refs": [
    "sys/vfs/ufs/ffs_inode.c:535",
    "sys/vfs/ufs/ffs_inode.c:311",
    "sys/vfs/ufs/ffs_inode.c:157",
    "sys/vfs/ufs/ffs_inode.c:550",
    "sys/vfs/ufs/ffs_vfsops.c:642",
    "sys/vfs/ufs/ffs_vfsops.c:729",
    "sys/vfs/ufs/ffs_vfsops.c:753",
    "sys/vfs/ufs/ufs_bmap.c:315",
    "sys/vfs/ufs/ffs_balloc.c:297",
    "sys/vfs/ufs/ufs_types.h:41"
  ],
  "artifacts": [
    "trigger3172.c", "aim3172.c", "mkaim.c", "inopatch.c", "craft64.c", "off.c",
    "setup1.sh", "setup2.sh", "setupB.sh",
    "run.log", "run.aimed.log", "run.patched.log",
    "boot_after_trigger.log", "panic_aimed.txt", "panic_wild.txt",
    "fix.diff", "fix_build.log", "env.txt",
    "VERDICT.md", "verdict.json", "manifest.json"
  ]
}