# DF-3227 — VERDICT

**Status: REPRODUCED (deterministic, no race) — impact: panic (kernel heap
corruption class) — fix VALIDATED in-guest (module rebuild).**

## Root cause (line-by-line)

1. `fuse_ipc_get()` assigns sequential uniques from `fmp->unique`
   (starts at 0, `atomic_fetchadd_long`, fuse_ipc.c:100) — after seeing
   ONE request the daemon can predict every future unique.
2. `fuse_ipc_tx()` inserts the fip on **both** queues
   (fuse_ipc.c:258-261) and sleeps (fuse_ipc.c:266).
3. `fuse_device_write()` matches the daemon's reply by
   `fip->unique == ohd->unique` while walking `reply_head`
   (fuse_device.c:191-196) — **it never checks `fip->sent`**, i.e. it
   never verifies the daemon actually *read* the request
   (`fuse_device_read` is what dequeues from `request_head`,
   fuse_device.c:148). On match it removes the fip from `reply_head`
   only, assigns `fip->reply`, sets `replied`, wakes the waiter
   (fuse_device.c:205-220).
4. The woken waiter's success path (fuse_ipc.c:266-286) consumes the
   reply and returns; the caller (e.g. `fuse_statfs`, fuse_vfsops.c:395,
   411) calls `fuse_ipc_put()` → refcnt 1→0 → `objcache_put`
   (fuse_ipc.c:110-117). **Nothing ever removed the fip from
   `request_head`** — the kernel just freed an object that is still the
   head of a live TAILQ.
5. Every subsequent queue operation on `request_head` now touches freed
   memory: `fuse_device_read` pops the freed chunk
   (`fuse_in_size()` reads the `request.len` that `fuse_buf_free`
   zeroed → `uiomove(NULL, 0)` → **read() returns 0** — impossible on a
   healthy /dev/fuse); objcache recycling double-links chunks; and the
   next `TAILQ_INSERT_TAIL` (any new `fuse_ipc_tx`) stores a kernel
   pointer through the dangling `tqh_last` of the freed entry —
   `sys/queue.h:516` INVARIANTS check fires:
   `panic: Bad tailq NEXT(0x...->tqh_last) != NULL, last 0x...`.

## What ran on the guest (stock `#0` INVARIANTS kernel, fresh `with-src` resets)

- Run 1: 41/41 blind replies accepted (incl. unique 1 — the FUSE_STATFS
  issued *inside* fuse_mount, fuse_vfsops.c:238, completing the bug
  before mount(2) even returns); 6 zero-byte reads (SIG-1); teardown
  `umount` → after the un-replied waiters' 35 s timeouts spliced around
  the stale head → **panic: Bad tailq NEXT(0xfffff80117700380->tqh_last)
  != NULL, last 0xfffff8011718bd60 / fuse_ipc_tx+0x7e5 ← fuse_unmount**
  → guest down in DDB (panic.txt, serial_full.txt).
- Run 2 (fresh reset): blind_ok=41, SIG1=7 (daemon_mode0.log,
  run2_summary.txt, serial_run2.txt); teardown wedged uninterruptibly
  (kill -9 ineffective — `fuse_ipc_wait` tsleeps without PCATCH) until
  forced reset. The freed-while-linked state is 100% deterministic; the
  exact panic site depends on teardown shape (insert-time when the stale
  tail is reached).

## Why this is NOT a duplicate of DF-0917

DF-0917 = the device read/write paths drop `ipc_lock` then dereference
`fip` with no refcount, racing the 35 s timeout free — a *timing* UAF;
its fix (refcount_acquire around the device paths) does nothing for this
finding, because here the free is **fully synchronized**: the waiter
wakes, consumes, and puts *after* the write path released the fip
normally. The defect is the **missing dequeue** of a blind-reply-completed
fip — a protocol/lifetime invariant violation with zero timing
requirements. (DF-0918 covers a related but different NULL-reply panic
via `fuse_device_clear`.)

## Exploitability

Attacker = the fuse daemon (root on stock config; operator group opens
the fd, uid 0 mounts — identical trust boundary to DF-0915/0917/3191/
3192; no unpriv→uid0 chain exists on this guest for this family). The
primitive itself is deterministic kernel heap corruption: on
non-INVARIANTS kernels the poisoned insert writes a kernel pointer at a
fixed offset (`tqe_next`) into a freed, immediately-recyclable
`fuse_ipc` chunk (type-stable objcache) — corrupting a live IPC object's
queue links; plus unbounded freed-object deliveries to userspace and an
unkillable 35 s/op D-state wedge. INVARIANTS kernels (this guest) panic
at the first poisoned insert.

## Fix validation

`fix.diff` adds `fuse_ipc_remove(fip)` to the tx success path
(membership-checked under `ipc_lock` → no-op for well-behaved daemons).
Rebuilt fuse.ko in-guest, rebooted, reran the identical PoC:
blind_ok=41 (replies still accepted — protocol unchanged for honest
daemons), **SIG1=0**, reads deliver live requests or time out on a
genuinely empty queue, `umount -f` rc=0, guest up, no panic
(fix_run.log, fix_run2.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.