l64_setdisklabel accepts internally inconsistent label geometry: d_pbase/d_pstop/d_bbase unvalidated, partitions may overlap the label+boot area, and d_bbase directly becomes ds_reserved (0 disables the label-area EROFS guard)

Summary

Beyond the known DF-0135 wraparound, l64_setdisklabel's sanity block never bounds d_bbase or d_pstop, never requires d_pbase <= d_total_size, and never requires partitions to start at/after d_bbase — so an installed label may (a) define partitions overlapping the label and boot area (only p_boffset >= d_pbase is enforced, and d_pbase itself may be 0), and (b) carry an arbitrary d_bbase which l64_adjust_label_reserved converts directly into sp->ds_reserved: d_bbase=0 disables the EROFS label-area protection for that slice, while a huge d_bbase makes the whole slice read-only (EROFS DoS). Reachable via DIOCSDINFO64/DIOCWDINFO64 which require FWRITE on the slice device (root/operator) — consistency/self-inflicted rather than a privilege boundary. Fix: validate d_bbase <= d_total_size, d_pbase >= d_bbase, d_pbase <= d_pstop <= d_total_size, and change the partition lower bound from d_pbase to d_bbase.

Timeline

• 2026-09-02 Discovered during pass-2 audit of subr_disklabel64.c (GLM 5.3).