# DF-3206 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

32.2 million lstat(DIR/..) iterations against a crafted RRIP ISO (64 sibling entries in the raced directory) with two concurrent scanners produced zero misresolutions in 90 seconds. The defect is structurally real - dp->i_ino is shared scan scratch, cd9660_lookup unlocks the directory at :343 and only then evaluates dp->i_ino as the vget argument at :344-345 - but the window between the unlock return and the i_ino load is a few instructions, and a blocked scanner wakes from the vnode lock far too late (sleep-based handoff) to overwrite i_ino inside it on this guest. The crafted ISO and racer are retained; the fix (snapshot i_ino/reloc into locals before the unlock) is compile-validated.

## Kernel references
- sys/vfs/isofs/cd9660/cd9660_lookup.c:343-345
- sys/vfs/isofs/cd9660/cd9660_lookup.c:260-261

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

snapshot dp->i_ino and the reloc flag into locals before vn_unlock

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: host: python3 craft_dotdot_iso.py out.iso; guest: cc -O -o racer racer.c -lpthread

run: guest: mount_cd9660 -o ro /dev/vn2 /mnt && su -m nobody -c /tmp/racer /mnt 90

expected: expected occasional HIT lines (ino != root); observed zero in 32.2M iterations

## Notes on the PoC (what changed vs the finding sketch)

namecache serves .. after first resolution, so hit rate depends on cache churn (vfs.cache clean_neg_count 9M shows aggressive reclaim); 3 racing threads give 2 real scanners

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.