{
  "finding_id": "DF-3178",
  "title": "hpfs_mountfs performs no super/spareblock census validation: unvalidated su_btotal panics the kernel at mount (bread > MAXBSIZE) or wires attacker-chosen kernel heap (32 MiB demonstrated) and is echoed verbatim into statfs",
  "file": "sys/vfs/hpfs/hpfs_vfsops.c",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "panic variant: python3 craft_img.py df3178p.img panic; guest: vnconfig vn0 df3178p.img && /root/mount_ro /dev/vn0 /tmp/hpfsmp  |  wiring variant: ./run_wiring.sh",
    "expected": "panic variant: 'panic: getblk: size(1048576) > MAXBSIZE(65536)' with hpfs_bminit in the trace. wiring variant: MOUNT_RC=0 wall=0s, vmstat -m 'HPFS_mount 3 32.1M', v_free_count drops ~9,000 pages, released on umount."
  },
  "kernel_refs": [
    "sys/vfs/hpfs/hpfs_vfsops.c:265-291",
    "sys/vfs/hpfs/hpfs_vfsops.c:301",
    "sys/vfs/hpfs/hpfs_vfsops.c:408",
    "sys/vfs/hpfs/hpfs_subr.c:109-120"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "craft_img.py", "mount_ro.c", "statfs_probe.c",
    "build.sh", "run_wiring.sh", "run_full.sh", "build.log", "run.log",
    "run_wiring_partial_df0927_trip.log", "run_panic_attempt.log",
    "boot_panic_console.log", "panic.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}