{
 "finding_id": "DF-3186",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Loop arithmetic confirmed, trigger REFUTED on this guest: patching vol_version=3 and a non-512-congruent UNDO alloc_offset into a clean newfs_hammer image makes the RW mount FAIL with EIO before HAMMERIOC_SET_VERSION can run - hammer_recover_stage1 replays the undo stream up to alloc_offset, hits the unparseable tail (FIFO record bad head signature / Illegal UNDO TAIL signature) and the mount aborts with Failed to recover HAMMER filesystem. Since every on-media undo record is 512-aligned and alloc_offset only advances in aligned units, the non-congruent precondition cannot exist on a mountable volume; the non-terminating while-loop in hammer_upgrade_undo_4 (reachable only through the EROFS-gated SET_VERSION ioctl on a mounted fs) is therefore defense-in-depth only. Fix (alignment validation at mount) authored and compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log: patch_undo output, mount EIO, and the recovery dmesg lines; patch_undo.c",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_undo.c:381-405",
  "sys/vfs/hammer/hammer_ioctl.c:627-641",
  "sys/vfs/hammer/hammer_recover.c:228-243"
 ],
 "poc_changes": "first patch variant computed the skew from first_offset (0xFFFF... sentinel on a fresh image) producing an invalid alloc and an unrelated EIO; the second variant anchors on next_offset and the recovery rejection is then exercised exactly",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 180,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O -o patch_undo patch_undo.c; image: newfs_hammer, first mount clean, umount, patch version=3 + alloc skew, remount",
 "run_cmd": "guest: mount_hammer /dev/vn0 /mnt/h1 (expect EIO: Failed to recover)",
 "code_hash": "4cd47f863c7bcfd6a1b5e63e259bcdea65b1e85f8fb988eb3267949c068456e7",
 "notes": "reachability refuted: hammer_recover_stage1 rejects the incongruent alloc_offset at RW mount with EIO before SET_VERSION can run",
 "recommended_fix": "validate UNDO alloc_offset alignment at mount"
}