{
  "finding_id": "DF-5710",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Pass-2 consumer-census finding from the sys/libkern/strncpy.c audit: the implementation itself is proven correct (libc-identical differential, exact-n pad-count, guard-page read/write bounds -- run_baseline.log), but the smbfs_mount caller at sys/vfs/smbfs/smbfs_vfsops.c:170-176 computes its strncpy budget as pe - pc - 2 AFTER a pc++ that the pc < pe-1 guard did not account for; when the name walk reaches offset 79 of the 80-byte mnt_stat.f_mntfromname the budget is -1, which wraps to (size_t)-1 and strncpy copies/pads unboundedly from f_mntfromname through the rest of struct mount and adjacent kernel heap. Reproduced on the DF 6.5 guest with the kernels own strncpy compiled unmodified: budget=-1 printed at the call point followed by SIGSEGV across a guard page on both the username route (>=76-char SMB username, allowed by SMB_MAXUSERNAMELEN=128 at smb_dev.h:76) and the share-name route (75-char username), plus a 1MB-runway case visualizing the unbounded zero-fill.",
  "exploit_chain": "Trigger requires mount privilege: vfs.usermount=0 and /dev/nsmb absent on the guest, and reaching smbfs_mount needs an established netsmb VC/SS (live SMB session) -- so no unprivileged->uid0 chain exists; that is a documented hard blocker, not an omitted step. Primitive characterized: unbounded strncpy from f_mntfromname[79] -- up to 15 (srvname) / 128 (share name) attacker-chosen bytes, then uncontrolled zero-fill until the kernel faults. No length control => even for the privileged triggerer this is reliable kernel-heap corruption/panic (crash/DoS class), not a shapeable overwrite primitive.",
  "evidence": "run.log: [case1 user-route] after user+@: pc offset=143 budget2=-1 + -> result: SIGSEGV (write crossed guard page); [case2 share-route] ... budget3=-1 (share=pub) + SIGSEGV; fix_run.log: same inputs on the fixed caller all clean exit(0) with NUL-terminated output; fix_build.log: patch applies (Hunk #1 succeeded at 167), smbfs.ko builds under -Werror, make rc=0; run_baseline.log: the audited strncpy implementation itself passes all differential/guard parts.",
  "kernel_refs": [
    "sys/vfs/smbfs/smbfs_vfsops.c:170",
    "sys/vfs/smbfs/smbfs_vfsops.c:173",
    "sys/vfs/smbfs/smbfs_vfsops.c:176",
    "sys/netproto/smb/smb_dev.h:76",
    "sys/netproto/smb/smb_usr.c:87",
    "sys/netproto/smb/smb_conn.c:479",
    "sys/sys/mount.h:93",
    "sys/libkern/strncpy.c:43"
  ],
  "poc_changes": "Seed PoC replaced entirely: harness compiles the guest kernel strncpy.c unmodified (-Dstrncpy=kstrncpy + 3-line sys/libkern.h shim), replicates smbfs_vfsops.c:165-178 verbatim with real sizes (MNAMELEN=80) against mmapd guard pages. Two rig iterations were needed: (1) missing <signal.h>; (2) budgets must be computed AT the strncpy call point (after pc++), exactly as the in-tree expression evaluates -- precomputing before the separator write hid the -1.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (cc -O2 -I shim -Dstrncpy=kstrncpy -c /usr/src/sys/libkern/strncpy.c; cc harnesses)",
  "run_cmd": "sh run.sh  (harness_strncpy; harness_smbfs; harness_smbfs_fixed)",
  "code_hash": "0014f5bea4d8f25ecb4026e8954a7156cd657ad2c952239b1376f82d3ada0868",
  "notes": "File under audit (sys/libkern/strncpy.c) is CLEAN: all four checklist axes pass on the guest (semantics differential identical to libc over matrix+100k fuzz; pad-count exactly n; src reads <= n with pad loop never re-reading src; dst writes exactly n). Census of ~150 in-tree callers: uipc_usrreq.c:1144/2430 (bounded+terminated), kern_environment.c:367-368, ng_pppoe.c:850-852, in6_ifattach.c:603-607, ng_ksocket.c:224-227, indefinite2.h:70-71, lwkt_token.c:510, netmap_mem2.c:1058, netmap_vale.c:868 all safe; ata-raid raid->name is write-only (no consumer); ip_fw3.c:180 strlen(src)-count is compile-time literals only; vfs_conf.c:427 boot-config only. Two caller findings filed: DF-5710 (this) and DF-5711 (netmap_vale.c:331 clamp off-by-one, Info). Guest left up and clean (source reverted, /tmp removed).",
  "recommended_fix": "smbfs_vfsops.c: guard every budget with pe - pc > 2 evaluated at the call point so pe - pc - 2 can never be negative (fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (pe - pc > 2 guards) applies clean to guest /usr/src (Hunk #1 succeeded at 167); guest builds sys/vfs/smbfs -> smbfs.ko with the fix under -Werror (make rc=0); fixed-caller harness reruns both -1 routes and the benign case: all clean exits with correctly truncated NUL-terminated f_mntfromname, and benign output byte-identical to baseline (//joe@fs01/pub). Full fixed-kernel boot not performed: smbfs is a KLD and reaching the vulnerable line in-kernel additionally requires a live SMB session; module compile + caller-level rerun is the decisive evidence for this defect. Guest source reverted after validation.",
  "fix_evidence": "fix_build.log (apply + make rc=0 + smbfs.ko + SOURCE-REVERTED); fix_run.log (fixed harness: all cases clean exit); run.log (baseline: budget=-1 + SIGSEGV on the same inputs)."
}