{
  "finding_id": "DF-3177",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT RUN ON GUEST (transport-gated): the trigger is a forged NFS file handle delivered by an export-authorized client to a root-exported hpfs mount; the harness guest runs no NFS server and setting one up (nfsd+mountd+export+raw ONC-RPC forgery from a permitted peer) was out of scope for a Medium non-corruption finding. The mechanism is code-certain: hpfs_vptofp emits handles carrying only a 32-bit LSN with the generation field commented out (hpfs_vfsops.c:450-453), hpfs_fhtovp checks neither hpfid_len nor any generation nor ino sanity (hpfs_vfsops.c:424-440), and hpfs_vget accepts ANY 512-byte sector whose first u32 == FN_MAGIC as a vnode with all h_fn fields attacker-supplied (hpfs_vfsops.c:529-544). The vget acceptance half was proven on this same guest by the DF-3137/DF-3141 crafted-image packs (valid fnode headers at chosen LSNs accepted by vget). Threat: on a RW-exported hpfs mount, an export-permitted client writes FN_MAGIC-carrying forged fnode structures as ordinary file content and addresses them with forged handles, reaching the already-filed crafted-fnode sinks (DF-3139 arbitrary raw-device R/W; DF-0857/3137/3138 heap OOB read/write) remotely, with no crafted image. hpfs itself cannot be user-mounted (get_fscap -> SYSCAP_RESTRICTEDROOT), so both the export and the handle forgery premise sit behind root configuration.",
  "exploit_chain": "(unverified) NFS client permitted by export -> forged fh{ino=X} where sector X is attacker-written file content starting with FN_MAGIC -> hpfs_fhtovp passes ino unchecked -> hpfs_vget breads sector X, magic matches, vnode minted with attacker h_fn -> hpfs_read via NFS READ walks forged alblk -> DF-3139/0857-class arbitrary device R/W or heap corruption",
  "evidence": [
    "README.md \u2014 code trace with path:line for every claim",
    "sys/vfs/hpfs/hpfs_vfsops.c:450-453 (generation commented out)",
    "sys/vfs/hpfs/hpfs_vfsops.c:424-440 (no len/gen/ino checks in fhtovp)",
    "sys/vfs/hpfs/hpfs_vfsops.c:529-544 (any-magic-sector acceptance in vget)",
    "findings/poc/DF-3141 (same guest: vget accepted crafted fnodes at chosen LSNs)"
  ],
  "kernel_refs": [
    "sys/vfs/hpfs/hpfs_vfsops.c:423-440",
    "sys/vfs/hpfs/hpfs_vfsops.c:442-454",
    "sys/vfs/hpfs/hpfs_vfsops.c:456-552"
  ],
  "poc_changes": "no PoC written (no seed; transport requires an NFS export + raw RPC client)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Classification: Medium / likely. Mirror precedent: DF-3097 (HAMMER1 zero-entropy handles, Low) \u2014 hpfss handle is weaker (32-bit LSN, no generation at all) and composes into memcorrupt sinks via the any-magic-sector vget acceptance.",
  "recommended_fix": "Add and check a generation number in vptofh/fhtovp, validate hpfid_len and ino < su_btotal in fhtovp (see README.md fix sketch).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "finding unverified on guest (NFS transport absent); no fix build performed.",
  "fix_evidence": ""
}