{
  "finding_id": "DF-5755",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "utf8_to_ucs4() (sys/libiconv/iconv_ucs.c:411-478) performs no shortest-form validation, so overlong UTF-8 sequences decode to arbitrary characters: on a stock DragonFly 6.5-DEVELOPMENT guest, the kernel converter turned \"\\xC0\\xAF\" into U+002F and \"\\xF0\\x8F\\xBF\\xBF\" into a wrapped surrogate pair (witness: 00 2f / db ff df ff), and an unprivileged uid-65534 user on a root-mounted msdosfs KICONV volume (cs_local=UTF-8, pairs auto-registered by iconv_ucs_init) created files whose on-disk LFN and 8.3 alias contain the synthesized / (proven in the raw image dump), with readdir returning OV/SLASH \u2014 a filename containing a path separator \u2014 while base-system userland iconv(3) returns EILSEQ for the same inputs. Not memory corruption; filesystem-metadata corruption and filename spoofing. Fix (shortest-form rejection) rebuilt and validated: overlong creates fail EINVAL, all / patterns absent from the image, valid conversions byte-identical.",
  "exploit_chain": "root mounts msdosfs with MSDOSFSMNT_KICONV + cs_local=cs_dos=UTF-8 -> unprivileged user (uid 65534, write access) open(2)s a component containing 0xC0 0xAF -> VFS passes raw bytes -> msdosfs unix2winchr -> iconv_convchr(pm_u2w) -> iconv_ucs_conv FROM_UTF8 branch -> utf8_to_ucs4 decodes overlong to U+002F without validation (iconv_ucs.c:419-477) -> unix2winfn writes / into LFN units and unix2dosfn into the 8.3 alias (msdosfs_conv.c:559-579/431-458, unvalidated) -> readdir: LFN rejected by win2unixfns literal-/ check, 8.3 fallback carries the / to userland -> dirent OV/SLASH with embedded separator; overlong . variant aliases to the distinct name OV.DOT.",
  "evidence": "witness.log (kernel module: overlong-slash out=00 2f; overlong-4b out=db ff df ff); run.log (nobody creates OK; dirents OV/SLASH hex 4f 56 2f 53 4c 41 53 48, OV.DOT; raw-image [FOUND] LFN 4f 00 56 00 2f 00 ... seq=0x41 attr=0x0f and 8.3 alias OV/SLASH   ); logs/difftest.log (userland EILSEQ); logs/witness_patched.log + logs/run5755_patched.log (ret=-1, EINVAL, patterns absent); logs/module_build_patched.log (-Werror clean)",
  "kernel_refs": [
    "sys/libiconv/iconv_ucs.c:411",
    "sys/libiconv/iconv_ucs.c:419",
    "sys/libiconv/iconv_ucs.c:460",
    "sys/libiconv/iconv_ucs.c:215",
    "sys/libiconv/iconv_ucs.c:218",
    "sys/libiconv/iconv_ucs.c:524",
    "sys/libiconv/iconv_ucs.c:377",
    "sys/vfs/msdosfs/msdosfs_vfsops.c:119",
    "sys/vfs/msdosfs/msdosfs_conv.c:990",
    "sys/vfs/msdosfs/msdosfs_conv.c:559",
    "sys/vfs/msdosfs/msdosfs_conv.c:431",
    "sys/vfs/msdosfs/msdosfs_conv.c:669"
  ],
  "poc_changes": "authored fresh (no seed): msdosfs mount args.mask/args.dirmask are literal mode bits (not umask); msdosfs chmod cannot add bits (use mount-time mask); DF dirent has no d_reclen (use _DIRENT_DIRSIZ); LFN dump patterns must be per-wePart (entries split names with 3 metadata bytes); vn0 must be detached between runs or vnconfig goes stale",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh   (cc -O0 -g -I/usr/src/sys ... ; make -m /usr/share/mk in cesu_witness/)",
  "run_cmd": "kldload /boot/kernel/msdos_iconv.ko; sh run5755.sh; ./difftest; kldload ./cesu_witness/cesu_witness.ko; dmesg | grep witness; ./dump5755 /root/fat5755.img",
  "code_hash": "6882e60df7c5e5da0b611488e3fb50efb9600c7978537318dd062ce084d62e29",
  "notes": "Upstream FreeBSD sys/libkern/iconv_ucs.c compared 2026-10-11: identical defect (fix owner should be upstream-shared). DF-2235 (1-byte src overread at iconv_ucs.c:247-254) not re-reported. Witness module is shared with DF-5756.",
  "recommended_fix": "reject non-shortest UTF-8 in utf8_to_ucs4(): if ((w==2 && ucs4<0x80) || (w==3 && ucs4<0x800) || (w==4 && ucs4<0x10000)) return 0;",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "libiconv.ko rebuilt with fix.diff (stacked with DF-5756s) and reloaded before msdos_iconv.ko; witness ret=-1 for both overlong cases with output untouched; nobodys overlong creates fail EINVAL while the plainok control still creates; all 7 //. patterns absent from the image dump; valid-slash/valid-pair outputs byte-identical (no regression).",
  "fix_evidence": "logs/module_build_patched.log (clean -Werror module build); logs/witness_patched.log (ret=-1 x4, valid cases unchanged); logs/run5755_patched.log (EINVAL creates + [absent] dump patterns + plainok OK)"
}