# DF-5684 VERDICT

## Status: REPRODUCED (unprivileged authorization bypass → persistent write DoS for all users incl. root) — FIXED by fix.diff (validated on rebuilt kernel)

## Environment
Same guest as DF-5683: DragonFly 6.5-DEVELOPMENT x86_64, baseline kernel #0
(Jul 2 2026) / patched kernel #1 (Oct 10 00:36:54 2026), vfs.quota_enabled=1
boot tunable (feature default-off).

## Chain (baseline kernel)
1. uid 1001 `maxx` calls `vquota limit / 1` → `sys_vquotactl` has no
   privilege check (vfs_quota.c:328-413) → `cmd_set_limit` writes
   `mp->mnt_acct.ac_limit = 1` (vfs_quota.c:273-284). rc=0.
2. Every subsequent regular-file write on the mount by ANY user (root
   included) goes through vop_write → vq_write_ok (vfs_vopops.c:489):
   `ac_bytes + delta > ac_limit` → EDQUOT → write(2) fails.
3. Demonstrated: root append to /root/df5684.txt fails ("write error"),
   after having succeeded seconds earlier.
4. Same for per-uid targeting: `vquota ulim / root 1` as maxx → root's own
   appends blocked (ROOT_APPEND_BLOCKED), lifted by maxx (`ulim / root 0`).
5. `vquota show /` as maxx returns every uid/gid's usage (info disclosure of
   accounting data); `sync` (set usage all) wipes accounting.
6. Effect persists until an attacker-chosen lift or reboot — a persistent
   filesystem-write DoS of the whole root mount, executed by an
   unprivileged user. No root escape needed for impact; combined with any
   local setuid-root write (e.g. passwd(1), periodic scripts), it also
   breaks system maintenance entirely.

## Why beyond DF-2231
DF-2231 = memory-safety/DoS of the prop copyin primitive itself. This is the
missing-authorization defect of the syscall consuming it — the object is
parsed fine; the *command* should never have been executable by uid 1001.

## Fix validation
fix.diff adds `caps_priv_check_td(curthread, SYSCAP_NOQUOTA_WR)` right after
the vfs_quota_enabled gate (the same capability classic quota operations
require), plus the missing `if (error) return` after the plistref copyin.

Patched kernel #1:
- `vquota limit / 1` as maxx → "send_command: vquotactl = -1", rc=1 (EPERM);
  mount state unchanged; root writes unaffected (ROOT_WRITE_OK_ON_PATCHED).
- Regression: root can still set/lift limits (root_setlimit_rc=0,
  `limit = 1` observed via `vquota show`, restored to 0).

## kernel_refs
sys/kern/vfs_quota.c:328-413 (no priv_check), :273-284, :287-305, :308-326, :219-270
sys/kern/vfs_vopops.c:472-491 (EDQUOT enforcement, no root bypass)
sys/kern/vfs_init.c:431-432 (feature applies to every filesystem)
sys/sys/caps.h:173 (SYSCAP_NOQUOTA_WR — the capability the fix enforces)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.