{
  "finding_id": "DF-4063",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Deterministic 2/2: with the shared fdc queue stalled >20 s by 128 concurrent readers, fdformat()s biowait_timeout fires and fdformat() itself biodone()s the bio the driver still owns and relpbuf()s the pbuf; the recycled pbuf is re-queued by a second FD_FORMAT while the stale entry is still linked, and the next dequeue panics the kernel (Bad link elm ... next->prev != elm in fdstate via fdc_intr). Root-only trigger (FD_FORM needs write open, 0640 root:operator). Fix (plain biowait, ownership respected) built in-guest and validated: formats return 0 after the real queue drain, no panic.",
  "exploit_chain": "root: 128 reader threads pread-loop /dev/fd0 (deep queue) -> FD_FORM#1 returns EIO at 20.0 s while its bio is still in fdc->bio_queue and the pbuf has been freed -> FD_FORM#2 recycles the same pbuf and re-links the same bio -> double-linked TAILQ element -> panic in fdstate on dequeue. Primitive beyond the panic: recycled pbufs b_data/b_bcount are attacker-set and drive the FDC DMA (isa_dmastart at bp->b_data+fd->skip, b_bcount bytes) plus a final biodone()/devstat on the recycled buffer - kernel-memory corruption, but actor is already root so no uid0 chain is pursued.",
  "evidence": "run.log (fdform#1 EIO at 20.010/20.014 s, 2 runs), panic.txt (panic backtrace fdstate+0xdfb), run.patched_console.log + /tmp/uaffix.log lines in run.log (patched: rc=0 at 37.4/38.0 s, no panic), fix.diff",
  "kernel_refs": [
    "sys/dev/disk/fd/fd.c:2244",
    "sys/dev/disk/fd/fd.c:2276",
    "sys/dev/disk/fd/fd.c:2279",
    "sys/dev/disk/fd/fd.c:2286",
    "sys/dev/disk/fd/fd.c:2293",
    "sys/dev/disk/fd/fd.c:1530",
    "sys/dev/disk/fd/fd.c:1668",
    "sys/kern/vfs_bio.c:3299"
  ],
  "poc_changes": "PoC authored from scratch for this finding (no seed): 128-reader saturation to hold the single-controller queue >20 s, legal nsecs=18 format (distinct from known DF-1364/2456), second FD_FORM to recycle the freed pbuf deterministically.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Sep 17 20:25:05 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline) / #1: ... 20:51:04 ... (patched)",
  "runtime_sec": 2400,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -pthread -o /tmp/fd_timeout_uaf /tmp/fd_timeout_uaf.c",
  "run_cmd": "/tmp/fd_timeout_uaf 128",
  "code_hash": "62b7f4ee44f5f630fe619321a90311fa40694c65ad95c12f940db8c4fecfd999",
  "notes": "Guest kernel rebuilt with device fdc0/fd0/fd1 (stock GENERIC omits fdc); QEMU ISA floppy via temp launcher dfbsd-qemu/run_fdtest.sh (vm.sh untouched). Suspected SMP state-machine race (callout vs ioctl contexts) investigated and REFUTED: all fd callouts use non-MPSAFE callout_init so softclock executes them under the mplock; fd_ops is non-D_MPSAFE (dev_d* take mplock); fdc0 ithread registered non-INTR_MPSAFE (dmesg: interrupt uses mplock: fdc0). A 32-thread 4-minute stress run also stayed healthy. /tmp on guest is tmpfs - PoC stdout after fdform#1 was captured live over ssh (in run.log), not from a surviving file.",
  "recommended_fix": "Replace the 20 s biowait_timeout + manual biodone in fdformat() with an unbounded biowait(&bp->b_bio1, \"fdform\") so the bio stays owned by the driver until it is really completed.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel (in-guest rebuild, #1 20:51:04): identical PoC, fdform#1 rc=0 after 37.4 s real queue drain (no 20 s early return, no premature biodone/relpbuf), fdform#2 rc=0 after 38.0 s, program completed, guest healthy, no panic. Baseline unpatched: 2/2 panics.",
  "fix_evidence": "findings/poc/DF-4063/run.log (patched section), run.patched_console.log, fix.diff, guest /usr/src/sys/dev/disk/fd/fd.c:2292 grep output"
}