# DF-3251 — ext2 publish-before-validate: concurrent ext2_ihashget waiters receive half/fully-initialized VBAD/VNON inodes (DF-3208 twin)

**Status: untested** (Medium severity; outside the mandatory Phase V buckets;
structural analysis only — the twin pattern was verified as
Medium/not_reproduced for cd9660 as DF-3208).

## What

`ext2_vget()` publishes the new inode into the global ext2 ihash at
`ext2_alloc_vnode()` → `ext2_ihashins()` (sys/vfs/ext2fs/ext2_vfsops.c:1313)
and only then validates/initializes it. A concurrent `ext2_ihashget()`
(ext2_ihash.c:100 `vget()`) blocks on the creator's VX lock holding a
reference, so the creator's post-publish error branches hand the waiter a
"successfully looked up" vnode that is **VBAD with a zeroed dinode** or
**VNON with attacker-specified dinode contents**:

* ext2_vfsops.c:1358-1371 (bread error) — sets VBAD; inode all-zero
  (M_ZERO), `i_devvp` (= `i_ump->um_devvp` macro) never vref'd.
* ext2_vfsops.c:1373-1380 (`ext2_ei2i` EINVAL) — **v_type not set**;
  half-converted inode. Deterministic crafted-image triggers:
  `ext2_inode_cnv.c` ino-range check and bad `e2di_extra_isize` — both run
  after `i_nlink`/`i_mode` were already stored, so the escaped inode has a
  nonzero attacker-controlled mode with zeroed `i_db[]`.
* ext2_vfsops.c:1406-1410 (`ext2_vinit` EINVAL: `i_mode != 0 &&
  v_type == VNON`) — fully-converted attacker dinode that just FAILED the
  "only unallocated inodes should be VNON" validation; the validation is
  bypassed by handing the vnode out before it runs.

Single-threaded, the same paths self-clean via `vx_put` → VREF_FINALIZE →
synchronous reclaim (verified during the DF-3250 work: vfs_lock.c:763,
ext2_inode.c:527 `vrecycle`). Only the concurrent-waiter handoff escapes.
`ext2_inactive()` short-circuits on `i_mode == 0` (ext2_inode.c:527) but the
ei2i/vinit-failure variants have nonzero modes.

Impact ceiling: a VNON/VBAD vnode with crafted uid/mode/size escapes into
the VFS layer as a successful VFS_VGET result (namei/NFS), violating the
invariant `ext2_vinit` exists to enforce; no direct memory-safety sink was
identified (block pointers are only used for device-bounded I/O), matching
DF-3208's Medium assessment.

## Fix sketch

Do not insert into the ihash until the dinode has been read and validated
(move `ext2_ihashins` after `ext2_ei2i`/`ext2_vinit` — requires switching
the concurrency protocol to the ffs-style "hash a locked placeholder then
complete in place" or vhold'ing); at minimum, remove the inode from the
hash before `vx_put` on every post-publish error branch and set
`vp->v_type = VBAD` on the ei2i branch.