{
  "finding_id": "DF-3182",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED (derivation bypass): with vfs.usermount=1, unprivileged user maxx (uid 1001) mounted a tmpfs with ta_size_max=1TiB; statfs reports f_blocks=268435456 pages (1024 GiB) vs the kernel-derived machine cap of ~784,447 pages (~3GiB) — tmpfs_vfsops.c:163-173 assigns pages=OFF_TO_IDX(size_max) with no clamp in the over-limit branch (identical code in both branches; the comment admits the clamp was dropped for root fstab boot-order reasons, and usermounts were not considered). tm_pages_max (and derived tm_nodes_max) are therefore attacker-declared; the ENOSPC guard in tmpfs_reg_resize (tmpfs_subr.c:1007) cannot fire and the only backstop is machine-wide memory exhaustion. The OOM wedge itself was not executed to preserve the single-tenant guest; the bypass is captured in run.log.",
  "exploit_chain": "",
  "evidence": ["run.log (f_blocks=268435456 = 1TiB from uid 1001 mount)", "umount_demo.c", "VERDICT.md"],
  "kernel_refs": ["sys/vfs/tmpfs/tmpfs_vfsops.c:157", "sys/vfs/tmpfs/tmpfs_vfsops.c:163", "sys/vfs/tmpfs/tmpfs_vfsops.c:170", "sys/kern/vfs_syscalls.c:151"],
  "poc_changes": "sys/statfs.h include removed (DF: statfs in sys/mount.h); struct tmpfs_mount_info mirrored locally",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o umount_demo umount_demo.c",
  "run_cmd": "as unpriv user on self-owned dir with vfs.usermount=1: ./umount_demo <dir>",
  "code_hash": "e264a2a48737ce1e584baa147d849bbb1c0ef3c45a8b5578ebf5808d0ed9ec86",
  "notes": "conditional on vfs.usermount=1 (non-default); root mounts are by-design unclamped (fstab boot rationale). Feeds DF-3179-style unbounded resource use.",
  "recommended_fix": "clamp pages to pages_limit for non-root mounters (cred->cr_uid != 0)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "",
  "fix_evidence": []
}