DF-2955 — DAY * day 32-bit multiply wraps: valid FAT dates 2106-02-08..2107-12-31 decode as 1970/1971

Where

sys/kern/subr_fattime.c:251 (fattime2timespec):

tsp->tv_sec += DAY * day;

DAY is an int (86400) and day is unsigned (32-bit), so the product is computed in 32-bit unsigned arithmetic and wraps modulo 2^32 before being added to the 64-bit tv_sec. day (days since 1970) reaches 49711 on 2106-02-08, and 49711 * 86400 = 4,295,030,400 > 2^32-1, so every FAT timestamp from 2106-02-08 through the end of the representable range (2107-12-31) is decoded ~2^32 seconds (~55.7 years) in the past.

This is not the known DF-0199 day-0 underflow: the input date is a fully valid, correctly encoded FAT date; the encoder (timespec2fattime) stores it correctly on disk (verified: MDate=0xfc48 / 0xff9f) and only the decoder's multiply wraps.

Impact

Any msdosfs file dated 2106-02-08..2107-12-31 — whether written by a future/ misdated system (a user can set this today with utimes(); there is no upper bound on tv_sec in itimespecfix, kern_time.c:1047) or present on crafted media mounted by root (the DF-2902 crafted-attach threat model) — stats with an mtime in 1970/1971: e.g. 2107-12-31 05:00 UTC reads back as 1971-11-23 22:31:44. Timestamp-integrity only: the produced timespec is always canonical (tv_nsec in [0,1e9)), no memory-safety effect.

Reproduce (guest, root)

dd if=/dev/zero of=/tmp/fat.img bs=1m count=8
vnconfig -c /dev/vn0 /tmp/fat.img
newfs_msdos /dev/vn0
mount_msdos /dev/vn0 /mnt
touch /mnt/W1 /mnt/W2
./fattime_poc /mnt/W1 4295030400     # 2106-02-08 -> 1970-01-01 17:31:44
./fattime_poc /mnt/W2 4354750800     # 2107-12-31 -> 1971-11-23 22:31:44
umount /mnt && ./findentry /tmp/fat.img W2   # MDate=0xff9f = valid 2107-12-31

Unprivileged variant (owner-mounted media, see run.sh): mount_msdos -u 1001 + run as uid 1001 → same MISMATCH (poc_unpriv.log).

Expected: MISMATCH, stat mtime = requested − 2^32 s. Fixed kernel: both cases MATCH exactly (poc_fixed.log).

Fix

fix.diff (line 259 after patch): tsp->tv_sec += (time_t)DAY * day; Validated on a rebuilt X86_64_GENERIC kernel (#1, 2026-09-04): baseline bad behavior gone, 2106/2107 dates decode exactly.

DF-2955 VERDICT

status: reproduced (impact: timestamp-integrity / correctness — no memory corruption; per the honest-impact enum this maps to impact: none)

What was run

Guest: DragonFly 6.5-DEVELOPMENT, stock INVARIANTS X86_64_GENERIC #0 (Thu Jul 2 06:02:54 UTC 2026), x86_64, 64-bit time_t.

1. Math harness (fattime_host.c, verbatim function bodies, compiled with the guest cc): round-trips every day 1980-01-01..2107-12-31 through timespec2fattime → fattime2timespec. First failure: 2106-02-08 (tv_sec 4295030400). Total failing days: 692 (exactly the days 2106-02-08..2107-12-31, i.e. the failure is purely the read path; the encoder is exact through 2107-12-31). See harness_guest.log section A.

2. End-to-end kernel PoC (fattime_poc.c + real msdosfs mount): - dd+vnconfig+newfs_msdos+mount_msdos /dev/vn0 /mnt (FAT12). - utimes("/mnt/W1", 4295030400) → stat: 1970-01-01 17:31:44 (= 4295030400 − 2^32 = 63104 s). utimes("/mnt/W2", 4354750800) → stat: 1971-11-23 22:31:44 (= 4354750800 − 2^32). Control 2025 date MATCHes. (poc_root.log) - Unprivileged: remount mount_msdos -u 1001, run as uid 1001 on own file → identical MISMATCH, no root involved. (poc_unpriv.log) - On-disk proof (findentry.c): W1 entry has MDate = 0xfc48 (year 126 = 2106, month 2, day 8), W2 has MDate = 0xff9f (2107-12-31) — i.e. the on-disk dates are valid; only fattime2timespec's tsp->tv_sec += DAY * day (subr_fattime.c:251, int × unsigned = 32-bit unsigned multiply) wraps. (findentry.log)

Root cause chain

fattime2timespec (sys/kern/subr_fattime.c:219) ← msdosfs_getattr (sys/vfs/msdosfs/msdosfs_vnops.c:251,253-254) ← stat(2) on any msdosfs file whose on-disk date ≥ 2106-02-08 (crafted media at mount — DF-2902 threat model — or utimes() today, since itimespecfix (kern_time.c:1047) has no upper bound on tv_sec).

day(2107-12-31) = 50403 (days since 1970); 50403 × 86400 = 4,354,819,200 > 2^32−1 → product mod 2^32 = 59,851,904 → 1971-11-14..23 depending on time-of-day. tv_nsec is unaffected ((dh%100)×1e7 ≤ 9.9e8, always canonical).

Why not higher severity

The wrapped value is a valid timespec; no kernel consumer performs unsafe arithmetic on it (stat/cache/NFS-attr only). This is silent timestamp corruption (integrity), same class as the known DF-0199/DF-0200 (Low).

Fix validation

fix.diff: tsp->tv_sec += (time_t)DAY * day; (+ unrelated DF-2956 hunk in the same file, one build validates both).

• Baseline kernel #0: W1/W2 MISMATCH as above.
• Patched kernel (rebuilt make nativekernel KERNCONF=X86_64_GENERIC, #1 Fri Sep 4 04:56:16 UTC 2026, BUILD_RC=0/INSTALL_RC=0): W1 → 4295030400 MATCH, W2 → 4354750800 MATCH (poc_fixed.log). Control unchanged. fix_status: fixed.

Guest was reset (vm.sh reset with-src) after validation.