# DF-3222 VERDICT

**status: reproduced / impact: panic (vkernel DoS from a mount-privileged user) / confidence: certain**

## Environment
Same harness as DF-3218: vkernel (VKDIRFS) built and run inside the QEMU
guest, minimal FFS root, fifo console. Guest uname in
`../DF-3218/env.txt`.

## Chain
`/bin/vkmount2 /hostroot` inside the vkernel calls
`mount("dirfs", "/hostroot", 0, (void *)0x1000)`.
`domount` (sys/kern/vfs_syscalls.c:416) passes `uap->data` through;
`dirfs_mount` copyinstr(0x1000) → EFAULT → fallback
`copystr(0x1000, dm_path, MAXPATHLEN, &done)` (dirfs_vfsops.c:129) treats
the user value as a kernel pointer; vkernel copystr (copyio.c:255-260)
loads `((const char *)0x1000)[0]` → fatal kernel-mode page fault.

## Observed
Baseline (run.log):
```
Fatal trap 12: page fault while in kernel mode
current process = 2 (vkmount2)
Stopped at 0x726b85: movzbl (%rdi),%eax
```
Symbolized: `copystr+0x5` (nm: copystr at 0x726b80; objdump shows the
faulting instruction is the loop's first `movzbl (%rdi),%eax` load).
The vkernel panics to ddb; the vkernel OS is dead.

Fixed (run.fixed.log + fix.diff — fallback removed):
```
mount failed: Bad address
# echo STILL-ALIVE
STILL-ALIVE
```
copyinstr's EFAULT propagates as a clean mount(2) error; vkernel alive.
fix_status: fixed.

## Why Low severity
Requires mount privilege (vkernel root, dirfs fscap holder, or
vfs.usermount=1 + mountpoint ownership — the caps gate is
sys/kern/vfs_syscalls.c:152-172). For the single-tenant vkernel the
crasher owns the process anyway; the security-relevant variant is the
capability-granted multi-tenant vkernel (tenant crashes the kernel for all
users), or the mapped-address variant (bounded arbitrary vkernel-kernel
read into dm_path, only indirectly observable). No memory *write* outside
the bounded dm_path destination.

## Note
The vkernel root-mount path (vfs_conf.c:457 `VFS_MOUNT(mp, NULL, NULL, ...)`)
passes data=NULL, so even the "kernel mount" case the comment claims to
serve would take this same crash path on a dirfs root mount — the fallback
serves no in-tree caller.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.