DF-3062 VERDICT

Reproduced? YES — first attempt, deterministic

• Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, INVARIANTS), stock ext2fs.ko.
• Image: craft3062.py — mke2fs base (ext2, -b 4096, -I 1024, 4MB) patched to s_inodes_per_group=4 (>= ipb=4 → passes sys/vfs/ext2fs/ext2_vfsops.c:583), s_free_inodes_count=4, ro_compat|=GDT_CSUM(0x10) (inside EXT2F_ROCOMPAT_SUPP → RW mount allowed), gd0: nifree=4, flags|=EXT2_BG_INODE_UNINIT(0x1), gd crc16 recomputed with the kernel's ext2_crc16 (uuid || cg || gd[0:30]).
• Run: sh /root/trigger3062.sh → kldload ext2fs; vn attach; RW mount OK; ls OK; touch /mnt/e2/x → Fatal trap 12: page fault while in kernel mode, supervisor WRITE data, page not present, RIP = memset+0xd5 (repe stosq) — panic.txt lines 1-20. The write-faulting RIP is the memset itself: it walked off the end of bp->b_data writing zeroes until it hit an unmapped kernel page. Guest dead in ddb.

Root cause (path:line)

• sys/vfs/ext2fs/ext2_alloc.c:1319 ibytes = fs->e2fs_ipg / 8; — integer division; 0 for ipg ∈ [1,7].
• sys/vfs/ext2fs/ext2_alloc.c:1320 memset(bp->b_data, 0, ibytes - 1); — ibytes - 1 is int −1 → converted to size_t SIZE_MAX → unbounded kernel heap memset with byte value 0.
• Geometry gate that makes ipg<8 mount-legal: sys/vfs/ext2fs/ext2_vfsops.c:582-587 checks only ipg >= ipb(=bsize/isize) and ipg <= bsize*8; e.g. bsize=4096, inode_size=1024 → ipb=4 → ipg=4 accepted.
• Reachability: ext2_valloc (ext2_alloc.c:385) → ext2_hashalloc → ext2_nodealloccg (ext2_alloc.c:1291) — feature gate at 1315-1316 (GDT_CSUM || METADATA_CKSUM), INODE_UNINIT branch at 1317.

Exploitability assessment (primary objective: uid=0?)

Primitive: unbounded-length, fixed-value(0) kernel heap write starting at a buffer-cache buffer of attacker-chosen population context. The length (SIZE_MAX) guarantees the store sequence runs past every mapped region in its path and faults — observed deterministically. There is no attacker control over the length or the written value, and the fault occurs before any scheduled code can observe the corruption in a useful way. A uid=0 chain from this primitive alone is therefore judged infeasible (hard blocker: unbounded, uncontrolled write terminates in an inevitable fatal fault). The value of the finding is: certain kernel-memory corruption / guaranteed panic from a mounted crafted image by an unprivileged create(). Same threat bar as DF-0811 (High). The related reserved-inode allocation consequences that do lead to further state confusion are filed separately (DF-3066).

Fix validation (mandatory for memcorrupt)

fix.diff:

-           ibytes = fs->e2fs_ipg / 8;
-           memset(bp->b_data, 0, ibytes - 1);
+           ibytes = howmany(fs->e2fs_ipg, NBBY);
+           memset(bp->b_data, 0, ibytes);

• Baseline reproduced on stock (panic.txt).
• Applied with patch -p0 in guest /usr/src, rebuilt (cd /usr/src/sys/vfs/ext2fs && make), installed to /boot/kernel/ext2fs.ko.
• Re-ran the EXACT trigger: AFTER-TRIGGER-NO-PANIC, TRIGGER-RC=0, guest up (run.2.log / fix_run.txt). The memset fault is GONE.
• Follow-up regression on the same (still inconsistent) crafted image hit the separate pre-existing reserved-inode chain (bgetvp - overlapping buffer, panic.bgetvp-followup.txt) — that chain is the DF-3066 class (also reachable without fix.diff whenever INODE_UNINIT bitmap regeneration frees reserved-inode bits, e.g. ipg in 8..15 where the stock memset(…, ibytes−1==0) leaves garbage byte 0 in force); it is not caused by the fix. Recommended companion hardening (not in fix.diff): after regenerating an uninit inode bitmap, set bits for reserved inodes [1, EXT2_FIRST_INO(fs)) and all bits >= ipg, and reject creates that resolve to reserved inode numbers.

impact=panic (memcorrupt class; primitive = unbounded zero-fill kernel heap write); confidence=certain; attempts=1 (decisive first run).