{
  "finding_id": "DF-3205",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "All claims demonstrated on the guest through the verbatim production code (sha256-gated include of krpc_subr.c compiled into the kernel; the rig calls the real krpc_call and krpc_portmap over the real UDP stack, the attacker is a userland process): the first krpc call of a fresh boot used xid 0xffffff00, predicted by the attacker purely from the source constants (static_xid = ~0xFF at krpc_subr.c:201, +1 per call at :282, never reading the request payload), the client bound reserved UDP port 1023 every call (deterministic sweep :256-262), replies from an address that is not the requested server were accepted because the socket is never connect()ed and the soreceive source is freed and discarded (:348-351, :432-435; only the xid at :380 is checked), and a blind forged portmap GETPORT reply made the verbatim krpc_portmap return an attacker-chosen port (err=0, port bytes ca fe) -- the first step of serving a diskless client its root filesystem. The resend loop with no global deadline was also observed live (eternal RPC timeout spam when the attacker stops answering). uid=0 is not reachable on this disk-root guest because krpc has no runtime callers (nfs_mountrpc.c only, reached from nfs_mountroot during diskless mountroot); the real-world ceiling is full compromise of a root-on-NFS booting machine by any host on its boot LAN, and the poc impact enum has no auth-bypass value so the manifested availability effect is recorded. The validated fix (karc4random xid + require reply source address and port to equal the requested server) killed the blind prediction, the wrong-origin acceptance and the portmap hijack in A/B runs with no regression.",
  "exploit_chain": "boot-LAN attacker predicts xid = 0xFFFFFF00 + n from source constants and knows the client endpoint (reserved port 1023 sweep, observed on the wire); sends a forged portmap GETPORT reply with matching xid from any origin; verbatim krpc_call accepts it (no source check, xid is the only filter); krpc_portmap returns the attacker-chosen mountd/NFS port; md_mount then mounts the diskless client root from the attacker (root filesystem authority = full client compromise); variant: attacker stops replying mid-boot and the for(;;) resend loop hangs the boot RPC forever",
  "evidence": "run.blindboot.log: REQ #1 xid=0xffffff00 blind prediction MATCH + marker krpc_portmap err=0 port bytes ca fe; run.log: T5 6/6 with dump.log xids 0xffffff01..06 all from 127.0.0.1:1023, T1 err=0 payload ATTA with spoof.log spoof sent from 127.0.0.2, T4 ca fe; run.fixed.log: T1 payload SERV, T4 port bytes 77 77, fx_dump.log xids 0x07d0b1bd 0x01e5b8d7 0xb88a504a 0x6d5d8e23 0xe974921d 0x77a3ea43 with blind predictions all differ; build.log/build_fixed.log VERBATIM GATE lines",
  "kernel_refs": ["sys/vfs/nfs/krpc_subr.c:201", "sys/vfs/nfs/krpc_subr.c:256-262", "sys/vfs/nfs/krpc_subr.c:282", "sys/vfs/nfs/krpc_subr.c:348-351", "sys/vfs/nfs/krpc_subr.c:380", "sys/vfs/nfs/krpc_subr.c:432-435", "sys/vfs/nfs/nfs_mountrpc.c:140-163", "sys/vfs/nfs/nfs_mountrpc.c:202-256", "sys/vfs/nfs/nfs_vfsops.c:557", "sys/config/X86_64_GENERIC:29"],
  "poc_changes": "replaced the assumed-impossible diskless-boot lab with the established verbatim-interposition kernel-compiled rig (stock guest boots from disk; krpc is boot-path only): dfrig13_krpc.c renames the three external symbols of krpc_subr.c and includes the file verbatim, driving the REAL UDP stack on lo0 with a REAL userland attacker server; added usched :1 CPU pinning for objcache locality (DragonFly has no cpuset(1)) and an lo0 127.0.0.2 alias (binds are refused without it); the blind attacker learns only the client endpoint via recvfrom (equivalent to a boot-LAN sniffer) and predicts the xid purely from source constants",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Tue Oct 20 17:57:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline decisive boot; fixed decisive boot #2: Tue Oct 20 18:25:39 UTC 2026)",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (and for the fix: sh build.sh af834f6e30225b1af68cc83cbcdaf25e29e0e39ca6deaec6f3c13663a661b886)",
  "run_cmd": "sh blindboot.sh ; sh run.sh  (baseline)   /   sh run_fixed.sh (fixed kernel)",
  "code_hash": "7e1e3ce06a6846a1b942d9d9f0098be5685fe36980db2620828f691ffb429520 (dfrig13_krpc.c) ; d7337b8717b8d4edb990f51ff612ea099085970756a8314fbbe9ab328c0507f1 (attacker.c)",
  "notes": "impact recorded as dos because the poc enum has no auth-bypass or integrity value and no kernel memory corruption manifested on the guest; the documented real-world ceiling is full compromise of a diskless client (attacker-chosen portmap results = attacker NFS server for root), same class as the verified DF-3044 BOOTP sibling whose rig drove the adoption chain to md_mount. Fixed source sha256 af834f6e30225b1af68cc83cbcdaf25e29e0e39ca6deaec6f3c13663a661b886 (fix_all.diff, all three krpc findings). Guest reset with-src performed after the run.",
  "recommended_fix": "xid = karc4random() instead of the ~0xFF counter and require the reply source address and port to equal the requested server before parsing (validated in fix.diff)"
}