{
  "finding_id": "DF-3183",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED (forgery): unprivileged mount (vfs.usermount=1) with ta_root_uid=0/ta_root_gid=0 produced a tmpfs whose root directory reports uid=0 gid=0 (mode correctly forced to 0600) and whose statfs f_owner is 0 while the mounter is uid 1001; the mounters own unmount then fails EPERM (sys_unmount authorizes via mnt_stat.f_owner at vfs_syscalls.c:670, which tmpfs_statfs overwrote with tm_root->tn_uid at tmpfs_vfsops.c:494). Control run without spoof: f_owner=1001 and unmount OK. tmpfs_mount copies ta_root_uid/ta_root_gid verbatim (tmpfs_vfsops.c:142-144) and sanitizes only root_mode (:151-155). Impact ceiling modest: unmount-authorization confusion (forged uid may unmount/update the attackers mount; real mounter locked out \u2014 demonstrated) and ownership spoofing; no direct privilege gain found.",
  "exploit_chain": "",
  "evidence": [
    "run.log (spoof + control)",
    "umount_demo.c",
    "VERDICT.md"
  ],
  "kernel_refs": [
    "sys/vfs/tmpfs/tmpfs_vfsops.c:142",
    "sys/vfs/tmpfs/tmpfs_vfsops.c:151",
    "sys/vfs/tmpfs/tmpfs_vfsops.c:494",
    "sys/kern/vfs_syscalls.c:670"
  ],
  "poc_changes": "same binary as DF-3182 (spoof uid argument)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o umount_demo umount_demo.c",
  "run_cmd": "as unpriv user with vfs.usermount=1: ./umount_demo <dir> 0",
  "code_hash": "e264a2a48737ce1e584baa147d849bbb1c0ef3c45a8b5578ebf5808d0ed9ec86",
  "notes": "matches upstream NetBSD lineage behavior, but DFs f_owner-based unmount authorization turns it into an authorization-confusion primitive",
  "recommended_fix": "force root_uid/root_gid to cred values for non-root mounters; stop overwriting f_owner in tmpfs_statfs",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "",
  "fix_evidence": []
}