{
 "finding_id": "DF-3257",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced on the stock INVARIANTS guest: lseek(fd, 0, SEEK_DATA) and SEEK_HOLE on a cd9660 file both return EINVAL (cd9660_vnops.c:226 catch-all ENOTTY) while the same calls on a UFS file return 0/58 - cd9660 is the only mainstream filesystem not wired into the SEEK_DATA/SEEK_HOLE infrastructure. The findings second half is confirmed from source: vn_bmap_seekhole_locked hands the RAW user offset to VOP_BMAP on its first iteration, so the naive wiring would reach cd9660_bmaps KKASSERT((loffset & (bsize-1))==0) at cd9660_bmap.c:76 with lseek(fd,1,SEEK_DATA). The fix wires both ioctls to vn_bmap_seekhole AND aligns the offset down inside cd9660_bmap; compiled in the F40FIX build; post-fix A/B: lseek SEEK_DATA/SEEK_HOLE on cd9660 return 0 and filesize.",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/vfs/isofs/cd9660/cd9660_vnops.c:226",
  "sys/vfs/isofs/cd9660/cd9660_bmap.c:76"
 ],
 "poc_changes": "n/a",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "ab07feb298e10e26283b8645750b146ca4e3c819447786e8eda34c118df4be78",
 "notes": "",
 "recommended_fix": "align loffset down in cd9660_bmap; dispatch FIOSEEKDATA/FIOSEEKHOLE to vn_bmap_seekhole",
 "fix_status": "fixed",
 "fix_verdict": "A/B complete: lseek(SEEK_DATA/SEEK_HOLE) on cd9660 now returns 0/filesize (stock: EINVAL); unaligned lseek(1,SEEK_DATA) also works with no KKASSERT panic, validating the bmap alignment companion fix."
}