# DF-5817 VERDICT — reproduced (baseline) / fixed (patched kernel)

## Bottom line
On the stock DragonFly 6.5-DEVELOPMENT guest (hammer2 root filesystem), an
unprivileged user (maxx, uid 1001) grew a file past RLIMIT_FSIZE=1MiB
through an O_APPEND descriptor: `write()` returned 4096 with no EFBIG and
no SIGXFSZ, repeatedly (lseek(0) resets the checked offset). The identical
binary and sequence on the same kernel's UFS filesystem gets -1/EFBIG +
SIGXFSZ. After applying `fix.diff` (move the rlimit check after the
IO_APPEND offset override, into hammer2_write_file) and rebuilding the
kernel, the hammer2 behavior matches UFS: -1/EFBIG + SIGXFSZ.

## Reproduced — evidence
- `run.hammer2.log` (baseline, unprivileged):
  `append-write(4096): ret=4096 errno=0 sigxfsz=0 size=2101248 -> BUG`
  repeatable after `lseek(0)`; control plain write at 2MiB: `-1 errno=27
  sigxfsz=1` proving the check itself works for non-append writes.
- `run.hammer2.2.log`, `run.hammer2.3.log`: same result (3/3 runs).
- `run.ufs.control.log` (root, /boot ufs): `-1 errno=27 sigxfsz=1 -> OK:
  EFBIG (limit enforced)` for the same append write — same kernel, same
  syscalls, only the filesystem differs.
- `run.hammer2.patched.log`: after `fix.diff` kernel — `-1 errno=27
  sigxfsz=1 -> OK: EFBIG (limit enforced)`.

## Why (path:line)
- sys/vfs/hammer2/hammer2_vnops.c:869-874 — rlimit check on the
  syscall-entry offset.
- sys/vfs/hammer2/hammer2_vnops.c:1017-1018 — IO_APPEND offset override
  applied only later, inside hammer2_write_file.
- sys/vfs/ufs/ufs_readwrite.c:237-238 then :264-269 — UFS order: override
  first, check second (the contract).

## Fix validation
fix.diff (this pack): removes the pre-override check from
hammer2_vop_write, adds the post-override check inside hammer2_write_file
(after old_eof is established, releasing ip->lock + truncate_lock on the
error exit). Guest /usr/src matched the audited tree (md5
cf7018082a9e765d352342b2a642e624), patch applied clean (3/3 hunks),
`make nativekernel KERNCONF=X86_64_GENERIC` + installkernel + reboot,
PoC re-run: bypass gone. Baseline vs patched outputs in run.hammer2.log vs
run.hammer2.patched.log.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.