{
  "finding_id": "DF-3177",
  "title": "hpfs NFS file handles are a bare 32-bit LSN (generation commented out) with no len/ino validation in fhtovp and any-magic-sector acceptance in vget: forged handles reach the crafted-fnode sinks (DF-3139/0857/3137) remotely on exported mounts",
  "file": "sys/vfs/hpfs/hpfs_vfsops.c",
  "verdict": "untested",
  "impact": "none",
  "confidence": "likely",
  "reproduce": {
    "build": "n/a — requires an NFS-exported hpfs mount and a raw ONC-RPC forgery client",
    "run": "n/a on this harness (no NFS server in guest)",
    "expected": "forged fh {ino = sector whose content starts with FN_MAGIC} -> vnode minted with attacker h_fn -> NFS READ/WRITE exercise forged alblk"
  },
  "kernel_refs": [
    "sys/vfs/hpfs/hpfs_vfsops.c:423-440",
    "sys/vfs/hpfs/hpfs_vfsops.c:442-454",
    "sys/vfs/hpfs/hpfs_vfsops.c:529-544"
  ],
  "artifacts": ["README.md", "manifest.json", "verdict.json"]
}