DF-0932 / DF-0933 / DF-0934 — shared PoC scaffolding

Goal

Reproduce three distinct NTFS LZNT1 decompression bugs reachable by any local user reading a crafted compressed file:

• DF-0932 (High): LZ77 back-reference offset not bounded to current output position → buf[pos+boff] underflows buf and reads up to ~2 KB of preceding kernel heap (ntfs_compr.c:79,82).
• DF-0933 (Medium): Compressed branch leaves output tail uninitialized; uup allocated with M_WAITOK (no M_ZERO) and reused across compression units, so stale slab content is shipped to the reader (ntfs_compr.c:70-92).
• DF-0934 (Medium): ntfs_uncompunit accumulates off += new (new = len+3, attacker-controlled 3..4098) with no bound against cup size; on the last block of a unit the GET_UINT16/cbuf[] reads overshoot cup (ntfs_compr.c:55,71,79-80,109).

Files (shared)

• patch_img.py — locates the first non-resident compressed $DATA attribute of a file in the MFT of base.ntfs and overwrites the first bytes of its on-disk compression unit with one of the three trigger payloads below. Run with --variant oob|tail|input.

Trigger payloads

DF-0932 (oob)     0x02 0x80 0x01 0x00 0xF0
                   block header 0x8002 (compressed, len=2), ctag=0x01
                   (token is back-ref), GET_UINT16=0xF000 at pos=0 ->
                   boff=-1-(0xF000>>12)=-1-15=-16, blen=3 -> reads
                   buf[-16..-14] into buf[0..2].

DF-0933 (tail)    0x01 0x80 0x00
                   block header 0x8001 (compressed, len=1), ctag=0x00
                   (one literal). Payload 2 bytes, pos ends at 1,
                   buf[1..4095] left uninitialized.

DF-0934 (input)   set every 4096-byte block header in the compression
                   unit to 0xFF 0x8F (GET_UINT16=0x8FFF: compressed,
                   len=0xFFF=4095, new=4098). After 16 blocks off
                   reaches 16*4098=65568 > 65536; the last block's
                   GET_UINT16/cbuf[] reads overrun cup.

Build & run (DragonFlyBSD guest)

# 1. Build a base NTFS image (mkntfs from ntfs-3g), large enough to
#    hold a 16-cluster (64 KB) compressed file. Create the file, mark
#    it compressed, populate with a known pattern, and let ntfs-3g
#    write the compressed representation to disk.

# 2. Patch:
python3 patch_img.py --variant oob   base.ntfs evil.ntfs   # DF-0932
python3 patch_img.py --variant tail  base.ntfs evil.ntfs   # DF-0933
python3 patch_img.py --variant input base.ntfs evil.ntfs   # DF-0934

# 3. Mount and read (root mounts; any reader triggers):
mount -t ntfs -o ro evil.ntfs /mnt
dd if=/mnt/secret.bin bs=4096 count=1 | hexdump -C | head

Expected output

DF-0932 (oob)

Either a kernel panic on the underread page boundary, OR a read buffer whose first 16 bytes are kernel heap pointers/data not present anywhere in the mounted image (info leak). On INVARIANTS kernels the panic is near-immediate; on production kernels the leak is silent.

DF-0933 (tail)

No panic; leak.bin bytes [1..4095] are stale uup slab content (recognizable kernel pointers / data not present in the file). Repeat reads across compression units shows cross-file content correlation.

DF-0934 (input)

Either a kernel panic in ntfs_uncompblock (page-fault-on-read at cup_size + small delta), or — if the adjacent slab is mapped — subtly wrong decompression output whose tail bytes are heap content from the slab neighbor of cup.

Notes

• DragonFly NTFS is read-only; the malicious bytes must be written into the image offline (Python/script), not via the kernel.
• The three findings share the same mount-and-read trigger; they differ only in the patched bytes.
• All three are fixed by validating the LZ77 displacement (pos + boff >= 0), zeroing the output tail, and bounding the input offset against the compression-unit size.

DF-0933 — Compressed NTFS block leaves output tail uninitialized → stale kernel-heap info leak

Verdict

REPRODUCED — confirmed two ways: (1) deterministic userspace harness transcribing ntfs_uncompblock line-for-line shows the output tail retains a pre-poisoned sentinel; (2) live on the default #0 GENERIC kernel, a crafted NTFS image with a short compressed block leaks 1358 non-zero bytes of stale kernel heap (kernel-virtual pointers in the 0x0008_0073_xxxx range) to any reader of the mounted file — root or unprivileged maxx (uid 1001), identical.

Impact: leak:4095 (up to 4088 bytes/block on this trigger; the finding's theoretical ceiling is 4095). Pure confidentiality (CWE-908); no write, no corruption, no escalation chain.

Fix: VALIDATED — a one-line bzero(buf+pos, NTFS_COMPBLOCK_SIZE-pos) before the compressed-branch return drops the leak from 1358 → 0 non-zero bytes on a built-and-booted single-fix #1 kernel.

Mechanism (trigger → primitive → effect)

ntfs_uncompblock() (sys/vfs/ntfs/ntfs_compr.c) decompresses one 4096-byte LZNT1 block into buf:

1. Uncompressed branch (ntfs_compr.c:59-67): if the block header's bit15 is clear, the data is stored raw. It memcpys then explicitly zeroes the tail at :65: c bzero(buf + len + 1, NTFS_COMPBLOCK_SIZE - 1 - len);
2. Compressed branch (ntfs_compr.c:68-92): if bit15 is set, the LZ77 decode loop advances pos as it writes output bytes. The loop exits as soon as the compressed payload is consumed (cpos >= len+3) regardless of how many output bytes were produced. At :92 it returns len+3 with no zeroing of buf[pos..NTFS_COMPBLOCK_SIZE-1].

That asymmetry (the uncompressed branch zeroes, the compressed branch does not) is direct evidence the tail is expected to be defined.

Caller (sys/vfs/ntfs/ntfs_subr.c:1687-1690): the output buffer uup is kmalloc(65536, M_NTFSDECOMP, M_WAITOK) — no M_ZERO — and is reused for every compression unit in the read loop (:1695-1732). The decompressed bytes are shipped to the reader via uiomove(uup+off, tocopy, uio) at :1722-1725. Whatever the slab previously held in the unwritten tail uup[pos..] reaches userspace.

Trigger block (01 80 00)

header 0x8001 (LE): bit15=1 COMPRESSED, len = 1
ctag  0x00:        all 8 sub-tokens are LITERALS

Trace of ntfs_uncompblock on this block: - len=1; cpos=2; pos=0 - outer while cpos(2) < len+3(4) → true; ctag=cbuf[2]=0x00; cpos=3 - inner for i=0..7 (ctag==0 → all literals): writes buf[0..7]=cbuf[3..10] (zeros); pos=8; cpos=11 - outer while cpos(11) < 4 → false → EXIT - return len+3 = 4 - → buf[8..4095] never written, never zeroed → 4088 bytes of stale heap

Evidence

Deterministic harness (harness.c, transcribes ntfs_compr.c:46-93): pre-poisons the output buffer with 0xDE + an ASCII marker, runs the trigger, then inspects: 4072/4088 tail bytes still hold the sentinel (the other 16 are the ASCII marker, also intact). LEAK CONFIRMED.

Live on #0 GENERIC (after heap warming): reading /mnt/evil/F as maxx:

00 00 00 00 00 00 00 00  d8 33 73 00 08 00 00 00   <- 0x0008007333d8 (kvaddr)
e0 33 73 00 08 00 00 00  88 30 73 00 08 00 00 00   <- more kernel pointers
90 30 73 00 08 00 00 00  98 30 73 00 08 00 00 00

• 1358 non-zero bytes in the first 4096 (stable across 3 reads).
• 177 kernel-virtual-address-shaped qwords (high-32 == 0x0008).
• Identical for root and unprivileged maxx (uid 1001).
• First 8 bytes are 0x00 (the 8 literals from the zero-padded trigger) — exactly as the trace predicts — confirming this is block-0's tail, not some other data.

Exploit chain

none — pure info-leak / CWE-908 read primitive. No write, no corruption. The realistic impact ceiling is disclosure of kernel heap memory (useful for KASLR defeat — though KASLR is OFF on this guest — or for grooming/confirming a separate write primitive). Realistic preconditions: an admin has mounted (or made mountable via vfs.usermount + a root-created image chowned to the user) an attacker-crafted NTFS image; the trigger is a normal read(2) the unprivileged user issues. Same threat model as DF-0871/0873/0878/0932 (admin-mount of attacker FS — acceptable per the realistic-threat-model table).

PoC changes

Created findings/poc/DF-0933/ from scratch (the folder previously held only a shared README.md). Added: - harness.c — deterministic line-for-line transcription of ntfs_uncompblock with a poisoned output buffer; proves the tail is untouched. (Independent of mount/heap state.) - craft_img.py — builds a complete mountable NTFS image (boot sector, $MFT with records 0/4/5/6/10/32, $AttrDef, $INDEX_ROOT, $Bitmap, $UpCase) whose record-32 file "F" is a compressed file whose 16-cluster unit starts with the 3-byte DF-0933 trigger (01 80 00) zero-padded to 4096. Adapted from DF-0932's crafter; only the trigger payload differs. - build.sh / run.sh — exact build + run (harness + image + mount + read). - fix.diff — the verified one-line fix. - Full logs: build.log, run.log, leak_sample.txt, fix_baseline.log, fix_build.log, fix_run.log, env.txt.

Fix (validated)

fix.diff adds the missing tail-zeroing to the compressed branch, mirroring the uncompressed branch at :65:

--- a/sys/vfs/ntfs/ntfs_compr.c
+++ b/sys/vfs/ntfs/ntfs_compr.c
@@ -89,6 +89,8 @@
            ctag >>= 1;
        }
    }
+   if (pos < NTFS_COMPBLOCK_SIZE)
+       bzero(buf + pos, NTFS_COMPBLOCK_SIZE - pos);
    return len + 3;
 }

Validation (Phase 8): - Baseline #0 (unpatched, with-src): same PoC + same heap warming → 1358 non-zero bytes, kernel pointers 0x0008006934c0 etc. in the tail. - Applied fix.diff → make -j6 nativekernel → rc=0. - Installed kernel.stripped → rebooted → #1: Sun Jul 12 11:40:33 UTC 2026. - Same PoC + same warming on #1: 0 non-zero bytes across 3 reads.

Matches the finding markdown's ## Recommended fix proposal (same bzero(buf+pos, ...) insertion at the same site).