{
 "finding_id": "DF-3254",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "HAMMERIOC_DEDUP with a leaf whose data_offset was forged to a NON-ZERO zone-0 value (0x100000) panics the INVARIANTS kernel exactly through the claimed ordering: hammer_ioc_dedup.c:66 calls hammer_btree_extract_data BEFORE the hammer_is_zone_data validation at :92-93, and _hammer_bread hits KKASSERT(HAMMER_ZONE(buf_offset) != 0) at hammer_ondisk.c:1123 - live trace: panic assertion failed in _hammer_bread, backtrace hammer_bread_ext -> hammer_btree_extract -> hammer_ioc_dedup -> hammer_ioctl -> hammer_vop_ioctl. Verification refines the original claim: a raw data_offset of exactly 0 is caught by the early guard at hammer_btree.c:730-731 (extract returns 0 with NULL data and the INVALID_ZONE flag fires cleanly, as observed in the first attempt); the zone validation is only ordered after a dereference for non-zero zone-0 (and forged non-data-zone) offsets. Privileged ioctl on a crafted RW-mounted image; availability only.",
 "exploit_chain": "",
 "evidence": "panic.txt (assertion + full backtrace), run.log (patch output showing the DATA leaf and its zone-10 offset being rewritten to 0x100000), patch_doff.c (leaf data_offset rewriter with node CRC recompute), dedup_trigger.c",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_dedup.c:66",
  "sys/vfs/hammer/hammer_dedup.c:82",
  "sys/vfs/hammer/hammer_dedup.c:92-93",
  "sys/vfs/hammer/hammer_ondisk.c:1123",
  "sys/vfs/hammer/hammer_btree.c:730-731"
 ],
 "poc_changes": "first attempt used data_offset 0 (caught by the btree.c:730 guard, INVALID_ZONE flag, no panic); second used non-zero zone-0 0x100000 which passes the guard into the KKASSERT; also the DATA records live in zones 10/11 on this newfs, not 8/9, so the patcher filter was widened",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 240,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O -o patch_doff patch_doff.c; cc -O -I/usr/src/sys/vfs/hammer -o dedup_trigger dedup_trigger.c; image: newfs_hammer + a data file + synctid, offline-patch a DATA leaf data_offset to 0x100000 with CRC fix",
 "run_cmd": "guest: mount_hammer /dev/vn0 /mnt/h1 && ./dedup_trigger /mnt/h1 --copy h1.img <element-offset>",
 "code_hash": "ea43b97febcad9b4b2421ac0c2fc67f70f19ded3be4ebaa08a22790794182f07",
 "notes": "refinement recorded: raw data_offset 0 is caught by the hammer_btree.c:730 guard; only non-zero zone-0 offsets reach the KKASSERT sink A/B on fixed kernel #4: the identical non-zero zone-0 trigger returns cleanly with head.flags=4 (INVALID_ZONE) and no panic (ab_fixed.log). First fix iteration jumped to done_cursors before cursor2 was initialized (documented panic); the corrected fix unwinds cursor1 via done_cursor.",
 "recommended_fix": "extract leaf and zone-check BEFORE extract_data for both cursors; combined fixed kernel: the same trigger returns cleanly with the INVALID_ZONE flag and no panic"
}