# DF-3192 — VERDICT

**status: reproduced / impact: panic (cross-driver type confusion + OOB write, root-gated)**

## Baseline run (stock INVARIANTS kernel #0, fuse.ko + cuse.ko loaded)

```
$ kldload fuse; kldload cuse; cc -O2 -Wall -o tc tc.c && ./tc
opened /dev/cuse fd=3 — cdevpriv is now a struct cuse_server*
mount(fuse, /mnt/tc3192, fd=<cuse>) — kernel now writes a fuse_mount layout into the cuse_server ...
```
serial console (run.log / panic.txt):
```
Cuse v0.1.37 @ /dev/cuse
fuse_init(kldload|831): FUSE ABI 7.28
panic: assertion "fmp->refcnt > 0" failed in fuse_mount at /usr/src/sys/vfs/fuse/fuse_vfsops.c:186
fuse_mount.part.6() at fuse_mount.part.6+0x777
sys_mount() at sys_mount+0x36b
```

The panic fires at fuse_vfsops.c:186 — i.e. **after** fuse_mount already
executed :176-185 against the cuse_server: `fmp->mp = mp`,
`fmp->dead = false`, `mtx_init()` ×3, `TAILQ_INIT()` ×2, `RB_INIT()`,
`fmp->devvp`, `fmp->cred = crhold(cred)` — a struct fuse_mount layout
stamped over the foreign `struct cuse_server` (cuse.c:768-777). The
KKASSERT reads the fuse-`refcnt` offset inside cuse_server memory
(M_ZERO'd at open) and reads 0 → INVARIANTS panic. This is direct proof
of the type confusion; with a victim object whose bytes at that offset
are non-zero, initialization continues (node tree inside the victim,
INIT IPC on the victim's TAILQs, `wakeup(fmp)` on a foreign address) and
the corrupted object detonates later inside its own driver (e.g.
`cuse_server_free` walking fuse pointers, `cv_destroy` on a clobbered
cv). fuse_mount layout is also larger than `struct cuse_server`, so the
writes at :176-199 are an OOB write into adjacent M_CUSE slab objects.

## Why it stops at root

Same privilege ceiling as DF-3191: the mount must pass
`caps_priv_check(cred, SYSCAP_NOMOUNT_FUSE)` (fuse_vfsops.c:153-155);
`SYSCAP_NOMOUNT_FUSE = 0xA4` carries no `__SYSCAP_NOROOTTEST`/`__SYSCAP_WHEELOK`
(sys/caps.h:96-97,227; sys/kern/kern_caps.c:328-331), so uid != 0 gets
EPERM before reaching the confusion. Not an unprivileged escalation;
root-gated cross-driver kernel memory corruption.

## Fix validation

`fix.diff` applied in guest /usr/src, fuse.ko rebuilt, rebooted:

```
$ ./tc
opened /dev/cuse fd=3 — cdevpriv is now a struct cuse_server*
mount(fuse, /mnt/tc3192, fd=<cuse>) ...
mount failed: Invalid argument        <- EINVAL at the fd==devvp check, BEFORE any foreign write
closing the cuse fd -> cuse_server_free dtor on corrupted object
survived close
TC_RC=0
```
No panic; guest up (fix_run.log). The EINVAL is returned by the new
`file->f_type != DTYPE_VNODE || file->f_data != devvp` check before
`devfs_get_cdevpriv()` is even called, so the cuse_server is never
touched (the PoC's canned "corrupted" text is informational only).

## Kernel references

- sys/vfs/fuse/fuse_vfsops.c:140-168 (name looked up, fd used, never cross-checked)
- sys/vfs/fuse/fuse_vfsops.c:176-199 (fuse_mount layout written into the foreign object)
- sys/vfs/devfs/devfs_core.c:2938-2958 (devfs_get_cdevpriv returns any driver's cdevpriv)
- sys/dev/misc/cuse/cuse.c:768-777 (cuse_server attached to /dev/cuse at open)
- sys/dev/virtual/nvmm/nvmm_dragonfly.c:315, net/netmap/netmap_freebsd.c:387, dev/misc/evdev/cdev.c:150, dev/misc/ipmi/ipmi.c:99 (other cdevpriv victims)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.