nfs_statfs/nfs_statvfs apply server-claimed filesystem geometry unvalidated: v3 f_blocks/f_bfree/f_bavail cast (long)(u_quad/1024) can go negative, v2 f_bsize is an arbitrary server int, statvfs 64-bit fields unclamped

Summary

A malicious NFS server controls sf_tbytes/sf_fbytes/sf_abytes (64-bit) and the v2 sf_bsize/sf_blocks fields; nfs_statfs casts tquad/1024 to (long) (:360-364) so a claimed total > 2^63*1024 yields negative f_blocks (userland df/quotas see nonsense), v2 f_bsize applied raw (:370), nfs_statvfs copies unclamped 64-bit values (:446-454). Purely userland-visible display/ceiling metadata - no kernel allocation or bound derives from these values (f_iosize deliberately frozen, :378-387). Not verified (Info). Fix: clamp to sane ranges.