{
  "finding_id": "DF-5534",
  "status": "reproduced",
  "verdict": "nfs_mount() discards nfs_mountroot()s error and returns 0 (nfs_vfsops.c:942-945), so a failed diskless NFS-root mount is reported to vfs_mountroot_try as success; the success path then calls VFS_ROOT on a never-mounted mp whose mnt_data is NULL and nfs_root executes lwkt_gettoken(&nmp->nm_token) at 0x450 -> Fatal trap 12 panic-spin loop at boot instead of the intended Root mount failed + manual prompt fallback. Triggered from vkernel command-line boot args via pxe_setup_nfsdiskless (autoconf.c:388-486, nfs_diskless_valid=1 at :485, rootdevnames[0]=nfs: at :279) with an unreachable NFS server; shared nfs_vfsops.c code means pc64 NFS-root clients hit the same panic when the server is unreachable. NULL-deref only (fixed struct offset) - DoS ceiling, no corruption. Fix (error propagation + single refcount drop) validated on the guest: patched kernel prints Root mount failed: 65, falls back to the manual mountroot prompt, boots ufs:vkd0 to userland with zero traps.",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log (baseline: mount ... : 65 then Fatal trap 12 x2), run.crashloop_tail.log + panic.txt (trap blocks VA 0x450/0x458, IP lwkt_gettoken+0x64 / lwkt_relalltokens+0x3c, nm symbolization), run.fixed.log (patched: Root mount failed: 65, mountroot> prompt, ufs:vkd0 boots, 0 traps, 57-line console), build.log (baseline a3a76c8c... / patched 3cb21e35... kernel MD5s), fix.diff",
  "kernel_refs": [
    "sys/vfs/nfs/nfs_vfsops.c:942",
    "sys/vfs/nfs/nfs_vfsops.c:660",
    "sys/vfs/nfs/nfs_vfsops.c:772",
    "sys/kern/vfs_conf.c:441",
    "sys/kern/vfs_mount.c:340",
    "sys/kern/vfs_mount.c:344",
    "sys/platform/vkernel64/x86_64/autoconf.c:279",
    "sys/platform/vkernel64/x86_64/autoconf.c:388",
    "sys/platform/vkernel64/x86_64/autoconf.c:485"
  ],
  "poc_changes": "Seed-less (fresh pass-2 finding). Rig adapted from DF-5337 proven vkernel rig; trigger boots the vkernel with in-bounds hostile boot.netif.*/boot.nfsroot.* args pointing at 127.0.0.1 (fast TCP refuse -> md_mount error 65).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 2760,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64 (guest; plus /vkroot.img raw-newfs image, see build.sh)",
  "run_cmd": "sh run.sh  (vkernel: kernel.debug -m 512m -r /vkroot.img -n 1 -e init_path=/bin/vkinit -e boot.netif.ip=10.1.2.3 -e boot.netif.netmask=255.255.255.0 -e boot.netif.name=lo0 -e boot.nfsroot.server=127.0.0.1 -e boot.nfsroot.nfshandle=X...X -s)",
  "code_hash": "f31b5ad193c971a2308eefb4d9ad5b3735f4733d3285351bbac4f9ec12dcc36c",
  "notes": "Pass-2 audit of sys/platform/vkernel64/x86_64/autoconf.c. Broader negative validation in matrix.sh: all boot-arg parse sinks in the file survived hostile input (overflow %d fields, unbounded %x runs, MNAMELEN-boundary path truncation byte-exact at 87, kern.nbuf clamped at autoconf.c:156). Guest reset with-src after run.",
  "recommended_fix": "Propagate nfs_mountroot() failure out of nfs_mount() (return the error) and remove the duplicate vfc_refcount-- at nfs_vfsops.c:660 so exactly one drop pairs vfs_rootmountalloc().",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": true,
  "fix_verdict": "Baseline vkernel (kernel.debug MD5 a3a76c8c358d3df60cea81a31587ccf6): Fatal trap 12 at lwkt_gettoken+0x64, fault VA 0x450 (NULL nfsmount via mnt_data) immediately after nfs_mountroot: mount 127.0.0.1: on /: 65, then unbounded db> re-fault loop (4,186,854 console lines). Patched vkernel (fix.diff applied in guest /usr/src, rebuilt, MD5 3cb21e35f1447c8d69ceb1401226fefee): identical boot args -> Root mount failed: 65, auto-retry fails cleanly (no disk named vkd0s1a/Root mount failed: 6), manual mountroot> prompt accepts ufs:vkd0, devfs+ufs mount and the system boots to userland; 0 traps, vkernel alive (run.fixed.log). Bad behavior gone.",
  "fix_evidence": "fix.diff, run.log, run.crashloop_tail.log, panic.txt, run.fixed.log, build.log"
}