DF-2999 VERDICT (updated after verification)

Baseline (stock kernel): REPRODUCED — unprivileged permanent kernel livelock

Guest: DragonFly 6.5-DEVELOPMENT #0 (INVARIANTS), HAMMER1 on /dev/vn0 at /mnt/h1 (vn-backed image), run as unprivileged user maxx:

/tmp/op2999 /mnt/h1/maxx2999.bin
  extend  to 0x7ffffffffffff000: OK     <- hammer_vop_setattr:2276 nvextendbuf
  pwrite top byte: OK                  <- hammer_vop_write:670 nvextendbuf
  <-- ftruncate(0x7fffffffffff8000) never returns
                                         <- hammer_vop_setattr:2269 nvtruncbuf
                                            vfs_vm.c:149  truncloffset = INT64_MIN
                                            vfs_vm.c:464  nobjsize ~0xFFF8000000000000
                                            vfs_vm.c:486  unmap loop ~2^63 iterations

ps: 1047 R4 (spinning in-kernel), kill -9 ×2 ineffective,
concurrent `rm` of the file parks in D5 state,
`ls -la /mnt/h1` shows directory total corrupted by the 2^63-scale size
("total 18014398509543426"), one cpu 100% until guest reset.

Identical signature to DF-2921 (hammer2 trigger), confirming HAMMER1 has the same missing va_size clamp at hammer_vnops.c:2261-2286 (setattr) and :664-677 (write-path nvextendbuf).

Root cause chain (path:line)

1. sys/kern/vfs_vfsops? no — ftruncate passes any 0 < len < 2^63 through VOP_SETATTR (kern_utimensat-style pre-checks only for utimes; for ftruncate: sys/kern/vfs_syscalls.c kern_ftruncate -> VOP_SETATTR).
2. sys/vfs/hammer/hammer_vnops.c:2261-2286 — no va_size bound check for VREG; blksize = hammer_blocksize(va_size) = HAMMER_XBUFSIZE (64K) for any offset >= HAMMER_XDEMARC (1MB); calls nvtruncbuf()/nvextendbuf() with the raw 64-bit length.
3. sys/kern/vfs_vm.c:145-153 — info.truncloffset = length + (blksize-boff) wraps to INT64_MIN for length = 0x7fffffffffff8000, boff = 0x8000.
4. sys/kern/vfs_vm.c:459-495 — signed OFF_TO_IDX overflow -> nobjsize ~0xFFF8000000000000; shrink branch unmap loop from pi≈2^51 to 2^63.9 with lwkt_yield() each iteration while holding vp->v_token and the vm_object lock: unkillable (thread never returns to userland), vnode poisoned, shutdown hangs.

Impact

Unprivileged local permanent denial of service on every HAMMER1 mount (one wedge per triggered file/cpu; guest recoverable only by hard reset). No memory-safety impact (pure livelock). Same severity class as DF-2921.

Fix validation

fix.diff (in this pack) clamps va_size in hammer_vop_setattr and the write end-offset in hammer_vop_write to OFF_MAX - HAMMER_XBUFSIZE and rejects negative va_size. Built with make nativekernel in-guest and re-tested: see "Fix validation" section appended below after the patched run.

Fix validation (kernel #2, Sat Sep 5 01:44:36 UTC 2026)

fix.diff applied in-guest, make nativekernel + make installkernel, guest rebooted into the patched kernel:

$ time /tmp/op2999 /mnt/h1/maxx2999.bin
extend-> File too large
        0.00 real         0.00 user  0.00 sys
EXIT=1

The wrap-prone ftruncate(0x7ffffffffffff000) is now rejected at hammer_vnops.c (clamp) with EFBIG before nvextendbuf()/nvtruncbuf() are ever reached. No wedge, no R4 thread, second ftruncate not attempted, guest fully healthy afterwards (smoke test: create/write/truncate/read/ unlink on HAMMER1 all normal — see build.log).

fix_status: fixed (baseline reproduced wedge + unkillable R4; patched kernel returns EFBIG instantly; behavior change is exactly the intended one). Note: kernel #2 also carried a non-semantic kprintf probe for the DF-3000 investigation in the same file (verified present via strings on kernel.stripped); it does not affect this validation.