# DF-3242 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

UAF window certain by inspection but gated on the privileged free side: vfs_export_lookup returns the matched netcred after releasing NE_LOCK, ufs_check_export hands out &np->netc_anon, and nfsrv_fhtovp reads cr_uid/cr_ngroups/cr_groups only after VFS_FHTOVP (which may block on disk I/O) - during which vfs_export (mount -u -o -export) frees the netcred, so the squashed credential is read from freed memory (wrong uid/groups, pathologically uid 0, or a fault). A faithful reproduction needs a root actor toggling exports against live NFS traffic; the free side makes it a correctness hazard rather than an attack. Fix copies the anon cred out under the lock (crdup) with the matching crfree in nfsrv_fhtovp; compile-validated.

## Kernel references
- sys/vfs/ufs/ufs_vfsops.c:246-251
- sys/vfs/nfs/nfs_subs.c:1272-1275

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

crdup the anon credential; crfree it in nfsrv_fhtovp

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a

run: n/a (needs export churn racing NFS requests)

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.