{
 "finding_id": "DF-3243",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Runtime reproduction impossible on the stock kernel - UFS quotas are compiled out (#ifndef QUOTA -> EOPNOTSUPP at ufs_vfsops.c:77; confirmed live: Q_QUOTAON returns EOPNOTSUPP as root on a mounted UFS image), and an unfixed-QUOTA comparison kernel was judged disproportionate for this Info-tier batch. Line-accurate confirmation: the unprivileged Q_GETQUOTA path compares only uid == cred->cr_ruid (ufs_vfsops.c:119-124) regardless of quota type, so any user can read the group-quota record for gid == their uid (group membership never consulted). The F40FIX kernel enables options QUOTA with the fix applied: live post-fix check shows user t2 (uid 4242, NOT a member of group 4242) gets EPERM for QCMD(Q_GETQUOTA,GRPQUOTA,4242) while maxx (member of 1001) reads his own group record. Fix = type-aware self-check with groupmember().",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/vfs/ufs/ufs_vfsops.c:119",
  "sys/vfs/ufs/ufs_vfsops.c:124",
  "sys/vfs/ufs/ufs_vfsops.c:77"
 ],
 "poc_changes": "probe extended with a root Q_SETQUOTA installer; mount_ufs has no userland quota option string so MNT_QUOTA was set via direct mount(2)",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "ea6ffa3312c3bc8f7a3558359b69fe953a39adf3b4db80245ab83163a871dd23",
 "notes": "",
 "recommended_fix": "USRQUOTA requires id==cr_ruid, GRPQUOTA requires groupmember(id, cred)",
 "fix_status": "fixed",
 "fix_verdict": "verified on the QUOTA-enabled F40FIX kernel: t2 (uid 4242, NOT a member of group 4242) -> EPERM for QCMD(Q_GETQUOTA,GRPQUOTA,4242); maxx (member of 1001) still reads his own group record. Type-aware self-check behaves exactly as designed. (Bug-side live demo impossible on the stock kernel: options QUOTA is compiled out there - EOPNOTSUPP confirmed live.)"
}