# DF-3197 — verdict

REPRODUCED on a pristine guest (see README.md and run.log):
1. Host mounted devfs at /jail/dev and hid `mem` + `zero` via the rule ioctl
   (the standard way jail devfs rulesets are enforced).
2. Jailed uid-0 process (jail(2) v1, path=/jail) OPENED /dev/devfs — the only
   gate is 0600 root:wheel, which jailed uid 0 passes. devfs_dev_ioctl()
   (devfs_rules.c:419) has no priv_check()/jail check whatsoever.
3. A jailed-issued SHOW rule + APPLY "*" un-hid /dev/mem inside the jail.
4. JAIL-ESCAPE marker: un-hid and OPENED /dev/zero from inside the jail —
   the host's devfs ruleset was fully defeated from within the jail.
5. Cross-mount write: a jailed-issued PERM rule (mntpoint "/dev") changed the
   HOST's /dev/console from 0600 to 0666.
6. /dev/mem un-hid + stat-able from the jail; only memio(4)'s own jailed()
   check (EPERM) stopped the read — a driver-level defense devfs lacks.

Impact: jail escape. Any jail whose devfs does not hide the `devfs` control
node (this guest ships no /etc/devfs.rules, so a plain jail devfs exposes it;
same for custom rulesets that forget it) lets jailed root un-hide arbitrary
devices in its own mount and rewrite permissions/visibility on the host's
and every other jail's devfs mounts. Devices whose drivers lack their own
jailed() checks are then openable (demonstrated with /dev/zero; /dev/mem is
stopped only by memio).

Privilege ceiling note: on a non-jail system the ioctls are root-only
(0600 node) — the security boundary actually broken here is the jail
boundary (jailed root != host root).

Fix validated: fixed kernel returns EPERM to the jailed caller (fix.diff,
jailed(curthread->td_ucred) gate in devfs_dev_ioctl); run.fixed.log.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.