DF-3099 VERDICT

Verdict: REPRODUCED (deterministic unkillable kernel livelock / local DoS), with the OOB-write primitive honestly characterized as unmanifested on the stock build.

What was run (stock INVARIANTS kernel #0, guest 6.5-DEVELOPMENT)

1. whang — pwrite(fd, 1 byte, offset 0) as uid 1001 on the crafted image (alleaf{0, 0x800000, 0x50}, fn_size=0x1000), mounted RW via mount_rw on a uid-1001-owned mountpoint. * Trace: hpfs_write → uio_offset(0)+resid(1) ≤ fn_size → no extend → hpfs_hpbmap(0) matches alleaf[0] → runl = 0x7FFFFF → (runl+1)*512 = 0x800000*512 = 2^32 ≡ 0 (int32) → towrite = szmin(1, umin(65536, 0)) = 0, xfersz = 0 → off==0 && towrite==xfersz → getblk(devvp, bn, 0) + clrbuf + uiomove(b_data+0, 0, uio) — no progress → while (uio->uio_resid) loops forever holding the vnode lock (hpfs_vnops.c:385-430). * Observed: RUN_EXIT=124 (pwrite never returned); guest load rose to 11.99; subsequent ls /tmp/hpfsmp hung; ssh went to Connection timed out during banner exchange; VM management paths starved. The triggering thread never sleeps → unkillable. * Console: whang_console.txt. Run log: run.whang.log.

2. wprobe — 13× pwrite(1 byte, off ∈ {1..511}) (only lbn 0 triggers): all returned -1 EFAULT. * Trace: towrite = szmin(off+1, 0) = 0, xfersz = 0, off != 0 → bread(devvp, bn, 0) → zero-byte buffer → uiomove(b_data+off, (size_t)(0-off) ≈ 2^64, uio) with uio_rw=UIO_WRITE → copyin(user_byte, b_data+off, 1). * The EFAULT proves the kernel aimed a controlled 1-byte copyin at b_data+off of a size-0 buffer — an OOB-write destination. On this kernel build the data kva of a size-0 getblk buffer is unmapped, so the access faults cleanly instead of corrupting (13/13 deterministic). The memory-safety defect is real (length/destination computed from an uninitialized-by-size buffer region), but no heap corruption could be landed on the stock build, so impact is recorded as dos, not memcorrupt. * Run log: run.wprobe.2.log.

3. readpanic (read-side sibling, negative result worth recording): the original hypothesis — xfersz > MAXBSIZE reaching panic("getblk: size > MAXBSIZE") from hpfs_read — is impossible on DragonFly: min is a u_int static inline (sys/sys/libkern.h:76), so the inner min(64*1024, (runl+1)*DEV_BSIZE) converts the wrapped (negative) product to a huge u_int that never wins; toread is always ≤ 65536 = MAXBSIZE, and toread==0 breaks out (vnops.c:331). Empirically read(fd, buf, 1MiB) on an al_len=0x400000 extent returned EINVAL from a benign 64 KB device read past EOF (run.readpanic.2.log, first attempt with al_len=0x80100000 in run.readpanic.log).

Preconditions (honest)

• Crafted HPFS image (mount by root — vfs.usermount=0).
• RW mount required: stock mount_hpfs(8) forces MNT_RDONLY (sbin/mount_hpfs/mount_hpfs.c:106); the pack's mount_rw.c helper mounts via mount(2) directly, mirroring the DF-0859 precedent.
• Trigger itself is fully unprivileged (uid 1001 pwrite), with file ownership handed over via the RW mount's uid.

Impact ceiling

Unprivileged local DoS: permanent kernel livelock with vnode lock held (system-wide degradation, mountpoint unresponsive, management starvation). The uiomove size underflow additionally constitutes a latent attacker-controlled OOB-write primitive that manifests only where a zero-size buffer's b_data is mapped kva; on the audited build it is a clean EFAULT.

Fix validation

fix.diff (run-hint clamp in hpfs_hpbmap + towrite==0 progress guard in hpfs_write), applied to the guest's /usr/src, make nativekernel, rebooted: whang returns immediately (pwrite = 1), wprobe/wleak perform normal in-bounds writes (pwrite = 512), benign control image reads unchanged. No regression. See fix_run.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.