MNT_RELOAD adopts new group geometry without resizing the cluster-summary arrays — heap OOB write, bzero()/free() of OOB-read pointers, and per-reload gd leak

Summary

ext2_reload() re-reads the superblock and ext2_compute_sb_data() mutates the live m_ext2fs: e2fs_gcount is re-derived from the new sb and e2fs_gd/e2fs_contigdirs are re-malloc'd (leaking the previous allocations), but e2fs_maxcluster/e2fs_clustersum — sized in ext2_mountfs() for the OLD group count — are never resized. Reload step 3 then loops ics_init, and bzero(sump->cs_sum, contigsumsize+1) with cs_sum read OOB; ext2_unmount() later free()s those OOB pointers. Failed reloads poison the mount identically because gcount is committed before the checks. mount(2) MNT_UPDATE|MNT_RELOAD on a read-only ext2 mount is permitted to root OR the user who performed the original mount — fully unprivileged with vfs.usermount=1 and a user-owned vn device whose backing file is rewritten between mount and reload. VERIFIED: fatal supervisor WRITE at heap-junk address (0x28bf) inside memset — an OOB-read→arbitrary-address 33-byte zero-write plus int32 OOB writes and arbitrary free at unmount; repeated reloads leak gdbcount_allocbsize+gcount4 bytes each. Fix validated in-guest (geometry gate on reload + free-before-realloc): EINVAL instead of panic; unchanged-geometry reload still works; pristine RW mount regression-passes.

Timeline

• 2026-09-02 Discovered during pass-2 audit of ext2_vfsops.c (GLM 5.3); unpriv OOB write reproduced + fix validated. DF-0803 re-verified, not re-reported.