DF-0872 — NTFS BPB bpmftrec divide-by-zero / undefined-shift

Finding: Divide-by-zero and undefined-shift in BPB bpmftrec computation from crafted boot sector Severity: Medium (mount-time kernel DoS via crafted filesystem image) CWE: CWE-369 (Integer Divide-by-Zero) CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reproduce

./build.sh &&
# as root on a DragonFlyBSD guest with vnconfig + mount_ntfs:
./run.sh

Expected on the unpatched 6.5-DEVELOPMENT #0 kernel: the guest kernel-panics with Fatal trap 18: integer divide fault ... Stopped at ntfs_mountfs.isra.0+0x5ca: idivl %ecx,%eax and drops to the db> DDB prompt. The ssh session dies; the guest must be reset.

Expected on the patched kernel (fixed ntfs.ko): mount_ntfs prints mount_ntfs: /dev/vn1: Invalid argument and exits 71 (EINVAL); the guest stays up.

How it works

ntfs_mountfs() reads the NTFS boot sector (BPB) and computes the bytes-per-MFT-record divisor at sys/vfs/ntfs/ntfs_vfsops.c:349-355:

int8_t cpr = ntmp->ntm_mftrecsz;          /* u8 from BPB offset 0x40 */
if( cpr > 0 )
    ntmp->ntm_bpmftrec = ntmp->ntm_spc * cpr;
else
    ntmp->ntm_bpmftrec = (1 << (-cpr)) / ntmp->ntm_bps;   /* bps==0 => #DE */

bf_bps (bytes per sector) and bf_spc (sectors per cluster) are taken directly from attacker-controlled disk content with no validation — only the 8-byte OEM id ("NTFS ") is checked (:343). A crafted image with bf_bps = 0 and bf_mftrecsz <= 0 (signed) drives the (1 << (-cpr)) / ntm_bps division by zero → CPU #DE → non-resumable kernel trap → panic.

Two related sub-bugs: - bf_mftrecsz == 0x80 (cpr = INT8_MIN = -128) → 1 << 128, undefined shift. - bf_spc == 0 with cpr > 0 → bpmftrec = 0, which later divides by zero in ntfs_statfs() at :620 / ntfs_statvfs() at :646.

Files

Threat model

A local user who can cause a crafted NTFS image to be mounted instantly kernel-panics the machine. With vfs.usermount=1 and a root-created vnode disk owned by the attacker, the trigger is fully unprivileged. The standard model for this class (admin mounts an untrusted filesystem image) also applies. Impact is pure DoS — no memory corruption, no escalation.

DF-0872 — Divide-by-zero and undefined-shift in BPB bpmftrec computation

Verdict: REPRODUCED (panic / kernel DoS) → FIX VALIDATED

Bug class: integer divide-by-zero (#DE kernel trap) + undefined shift, both from attacker-controlled on-disk BPB fields parsed at NTFS mount time.

Impact: panic (deterministic, non-resumable kernel trap). This is a pure DoS — the #DE fires before any memory write, so there is no memory-corruption primitive and no escalation chain. No SMAP/SMEP/KASLR-bypass chain is relevant here.

Severity rationale: local attacker who can cause a crafted NTFS image to be mounted (or an admin who mounts an untrusted image) instantly kernel-panics the machine. Mount-time DoS from a filesystem image is the standard threat model for FS-parsing bugs.

Mechanism (trigger → primitive → effect)

Trigger: mount a crafted NTFS image via mount_ntfs -o ro <dev> <mnt>. The first sector (boot sector / BPB) is read by ntfs_mountfs() at sys/vfs/ntfs/ntfs_vfsops.c:327 (bread(devvp, BBLOCK, BBSIZE, &bp)) and bcopy'd into ntmp->ntm_bootfile at :331.

Guard that passes: the only validation before the vulnerable computation is a strncmp(ntm_bootfile.bf_sysid, "NTFS ", 8) at :343. A crafted image with the correct 8-byte OEM id passes this trivially.

Sink (the bug): sys/vfs/ntfs/ntfs_vfsops.c:349-355:

{
    int8_t cpr = ntmp->ntm_mftrecsz;          /* u8 at BPB offset 0x40 */
    if( cpr > 0 )
        ntmp->ntm_bpmftrec = ntmp->ntm_spc * cpr;
    else
        ntmp->ntm_bpmftrec = (1 << (-cpr)) / ntmp->ntm_bps;   /* <-- #DE */
}

Three distinct sub-bugs the finding cites, all confirmed:

1. Divide-by-zero at mount (:354) — ntm_bps (bytes-per-sector, u16 at BPB offset 0x0B) is never validated. With bf_bps == 0 and any bf_mftrecsz with signed value <= 0 (e.g. 0xF6 → cpr = -10, the canonical "1<<10 bytes per MFT record" value), the else branch executes (1 << 10) / 0 → CPU raises #DE → Fatal trap 18 → kernel panic. This is the primary trigger the PoC exercises.

2. Undefined shift (:354) — if bf_mftrecsz == 0x80 (int8_t cpr = -128 = INT8_MIN), then -cpr promotes to int 128 and 1 << 128 is undefined behaviour (shift count >= type width). gcc 8.3 emits an idivl/shll sequence whose result is unpredictable; on this guest the shll $0x80,%eax yields 0 (masked to 5 bits → shift by 0 → 1), which then divides by bps — if bps != 0 this does not #DE but produces a garbage bpmftrec that later corrupts statfs arithmetic.

3. Divide-by-zero at statfs (:620 / :646) — if bf_spc == 0 and bf_mftrecsz > 0 (e.g. 0x01), then bpmftrec = spc * cpr = 0 * 1 = 0. Mount succeeds past :354, but the very next VFS_STATFS at :263 (called immediately after ntfs_mountfs returns) reaches sbp->f_ffree = sbp->f_bfree / ntmp->ntm_bpmftrec at :620 → divide by zero → panic. (Variant v2 in craft_variants.c exercises this path.)

Effect: Fatal trap 18: integer divide fault while in kernel mode — the CPU raises a non-resumable trap, the kernel drops into DDB (db> prompt), the system is dead. Confirmed twice deterministically on the unpatched #0 baseline kernel.

Reproduction (unpatched baseline)

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

[*] crafting image
[+] crafted ntfs_crafted.img  (bf_bps=0, bf_mftrecsz=0xF6 -> div#0 at ntfs_vfsops.c:354)
[*] attaching ntfs_crafted.img to /dev/vn1
[*] mount_ntfs -o ro /dev/vn1 /mnt_df0872

Panic signature (from serial console dfbsd-qemu/boot.log, full excerpt in panic.txt):

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 2; lapic id = 2
instruction pointer  = 0x8:0xffffffff82600b1a
kernel: type 18 trap, code=0
CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      ntfs_mountfs.isra.0+0x5ca:      idivl   %ecx,%eax
db>

The idivl %ecx,%eax at ntfs_mountfs+0x5ca is the compiled form of the / ntmp->ntm_bps at :354. Reproduced twice (run.log + run.2.log) — fully deterministic.

Exploit chain

None. This is a pure integer-divide-by-zero (CWE-369). The #DE trap fires before any memory write occurs — there is no write primitive, no heap/stack corruption, no UAF, no type confusion. The only effect is a non-resumable kernel trap (DoS). No escalation chain exists or is relevant. The realistic impact ceiling is: a local user who can get a crafted NTFS image mounted instantly panics the kernel (mount-time DoS).

Reachability note: vfs.usermount defaults to 0 on this guest, so a non-root user cannot directly mount_ntfs. The realistic threat model is an administrator mounting an untrusted filesystem image (USB stick, downloaded VM image, NFS export) — the standard model for filesystem-parsing bugs. With vfs.usermount=1 and a root-created vnode disk owned by the attacker, the chain is fully unprivileged (the attacker crafts the image content, not the mount syscall — the mount itself is the trigger).

PoC changes

The finding had no pre-existing PoC folder (the evidence pack was authored from scratch during this verification). Files written:

• craft_ntfs.c — minimal trigger: crafts a 1 MB NTFS image with bf_bps=0 and bf_mftrecsz=0xF6 (the canonical -10 value that forces the else branch into (1<<10)/0).
• craft_variants.c — emits 4 images exercising all three sub-bugs (bps=0, spc=0, mftrecsz=0x80) plus a structurally-valid control.
• build.sh / run.sh — exact build and run invocations (vnconfig + mount_ntfs).
• fix.diff — the validated fix.

Fix (validated)

File: findings/poc/DF-0872/fix.diff (git-apply-able against sys/vfs/ntfs/ntfs_vfsops.c).

Root-cause fix: add validation of the BPB-derived divisor/shift fields immediately after the bf_sysid strncmp check at :343 and before the vulnerable computation at :349-355. Concretely:

1. Reject ntm_bps == 0 || ntm_spc == 0 with EINVAL — closes the mount-time #DE at :354 and the statfs #DE at :620/:646 (bpmftrec can no longer be 0 via spc * cpr).
2. Bound the shift count: compute int shift = -cpr and reject shift < 0 || shift >= 32 with EINVAL — closes the 1 << 128 undefined-shift case (bf_mftrecsz == 0x80).
3. Final guard: reject ntm_bpmftrec == 0 with EINVAL — defense-in-depth for the statfs divisor (covers any future path that could zero bpmftrec).

Why this is correct: every divisor used downstream (ntm_bps at :354, ntm_bpmftrec at :620/:621/:646/:647) is now guaranteed non-zero before the first division, and the shift count is guaranteed in [0, 31]. The fix is minimal (one validation block, no control-flow rewrite) and uses the existing goto out error path that already frees ntmp and releases devvp.

Module vs kernel note: on DragonFlyBSD X86_64_GENERIC, NTFS is not compiled into the static kernel — it is a loadable module (ntfs.ko, auto-loaded on first mount_ntfs). The fix therefore lives entirely in the module. The single-fix build rebuilds ntfs.ko; the main kernel binary is unchanged.

Fix validation (Phase 8)

Before (unpatched #0 baseline, ntfs.ko sha256 = original):

mount_ntfs -o ro /dev/vn1 /mnt_df0872
Fatal trap 18: integer divide fault while in kernel mode
Stopped at      ntfs_mountfs.isra.0+0x5ca:      idivl   %ecx,%eax
db>                                  <-- guest DEAD

After (patched ntfs.ko module, sha256 = 1906300f73d2c3b82e69e9ea628a028616f713c4b28afa72993ca90e1211be2f):

mount_ntfs -o ro /dev/vn1 /mnt_df0872
mount_ntfs: /dev/vn1: Invalid argument
MOUNT_EXIT=71                        <-- EINVAL, guest stays UP

All four crafted variants (bps=0, spc=0, mftrecsz=0x80, and a structurally-valid control) are rejected with EINVAL and no panic — the guest remains responsive. Fix is deterministic across two runs.

Build: make -j6 nativekernel KERNCONF=X86_64_GENERIC from /usr/src (rc=0, full log in fix_build.log). The standalone module build (cd sys/vfs/ntfs && make) also produces the patched ntfs.ko in seconds.

Kernel references (verified during this run)

• sys/vfs/ntfs/ntfs_vfsops.c:327 — bread(devvp, BBLOCK, BBSIZE, &bp) reads the boot sector
• sys/vfs/ntfs/ntfs_vfsops.c:331 — bcopy into ntm_bootfile
• sys/vfs/ntfs/ntfs_vfsops.c:343 — the only pre-vulnerability guard (strncmp sysid)
• sys/vfs/ntfs/ntfs_vfsops.c:349-355 — the vulnerable bpmftrec computation (divide-by-zero + UB shift)
• sys/vfs/ntfs/ntfs_vfsops.c:263 — VFS_STATFS called immediately after mount
• sys/vfs/ntfs/ntfs_vfsops.c:620 — f_bfree / ntm_bpmftrec (statfs divide-by-zero)
• sys/vfs/ntfs/ntfs_vfsops.c:646 — same divide in ntfs_statvfs
• sys/vfs/ntfs/ntfs.h:223-241 — struct bootfile BPB layout (#pragma pack(1))
• sys/vfs/ntfs/ntfs.h:267-269 — ntm_mftrecsz / ntm_spc / ntm_bps macros