KKASSERT(radix != 0) in h2_bulkfree_callback — deterministic unprivileged kernel panic from a radix-0 on-disk data_off

Summary

h2_bulkfree_callback computes bytes = 1 << radix from the blockref data_off radix field and asserts radix != 0 (bulkfree.c:847-849). The only earlier filter (:179) skips brefs whose data_off is entirely zero; a bref with a non-zero base but radix == 0 passes it and, on INVARIANTS kernels (the stock X86_64_GENERIC guest is one), trips the KKASSERT. On non-INVARIANTS kernels the record is misaccounted as a 1-byte fragment (one 16K block marked allocated, avail -= 16384) — no memory corruption.

Threat model & preconditions

Any local user on a machine with a mounted hammer2 filesystem whose media contains a radix-0 data_off (crafted image via mount privilege / vfs.usermount, or bit corruption): deterministic panic on INVARIANTS kernels, freemap misaccounting on production kernels. Unprivileged reachability piggybacks DF-0815's ungated BULKFREE ioctls (the ioctl dispatcher ignores the caps_priv_check failure).

Proof of concept

VERIFIED end-to-end on the stock guest (findings/poc/DF-2650/): forge_2650.py plants a radix-0 DATA bref (data_off 0x1800800) key-sorted into the mounted PFS's root-inode blockset (CHECK_NONE ancestors, volhdr CRC32C recompute); mount survives (mount never walks it); then su -m nobody trigger /mnt/h2x/f1 (HAMMER2IOC_BULKFREE_SCAN, _IOWR('h',92,64), bfi.size=8MB) → panic: assertion "radix != 0" failed in h2_bulkfree_callback at hammer2_bulkfree.c:848, guest down at db>. Fix (kprintf + graceful skip) validated on a rebuilt kernel: same PoC prints illegal radix-0 data_off 0000000001800800 e000000000000003/64 and completes (r=0, no panic) — fix_run.log. No user→root route (panic-only class).

Recommended fix

--- a/sys/vfs/hammer2/hammer2_bulkfree.c
+++ b/sys/vfs/hammer2/hammer2_bulkfree.c
@@ -845,7 +845,20 @@
     radix = (int)(bref->data_off & HAMMER2_OFF_MASK_RADIX);
-    KKASSERT(radix != 0);
+    /*
+    * DF-2650: a radix of 0 means a 1-byte allocation, which cannot
+    * exist on media.  On-disk corruption or a crafted image must not
+    * panic an INVARIANTS kernel; skip the record instead of marking
+    * a bogus fragment.
+    */
+    if (radix == 0) {
+        kprintf("hammer2_bulkfree_scan: illegal radix-0 data_off "
+            "%016jx %016jx/%d\n",
+            (intmax_t)bref->data_off,
+            (intmax_t)bref->key,
+            bref->keybits);
+        return 0;
+    }
     bytes = (size_t)1 << radix;

References

• DF-0815 (the ungated ioctl that makes this unprivileged-reachable), DF-2616 family (data_off geometry trust)

Timeline

• 2026-08-29 Discovered during pass-2 audit of hammer2_bulkfree.c (GLM 5.3); verified reproduced (panic as nobody) + fix validated.