DF-3101 VERDICT

Verdict: REPRODUCED — deterministic kernel stack exhaustion ("DOUBLE FAULT - KERNEL STACK GUARD HIT!", panic) from an unprivileged ftruncate(2) on a crafted HPFS image.

How it was proven

Stock INVARIANTS kernel DragonFly dfbsd 6.5-DEVELOPMENT #0 (guest uname in env.txt). craft_img.py builds a 2.5 MB image whose regular-file fnode carries an AB_NODES root alblk pointing at a chain of 5000 AB_NODES AlSec sectors (each an_nextoff=0xFFFFFFFF, an_lsn → next), terminating in an empty leaf. Root mounts it RW via the mount_rw helper (stock mount_hpfs(8) forces MNT_RDONLY at sbin/mount_hpfs/mount_hpfs.c:106 — the write path needs a direct mount(2), DF-0859 precedent) on a mountpoint owned by uid 1001, making /tmp/hpfsmp/FILE owned by the unprivileged user.

Unprivileged trigger (uid 1001):

/tmp/df3101_run /tmp/hpfsmp/FILE    #  open(O_WRONLY); ftruncate(fd, 0)

Result (run.3.log, panic.txt): the syscall never returned (RUN_EXIT=124 via ssh timeout), the guest dropped to DDB:

DOUBLE FAULT - KERNEL STACK GUARD HIT!
Fatal double fault
rip = 0xffffffff80665009
rsp = 0xfffff801182dd000
panic: double fault
Trace: dblfault_handler() at dblfault_handler+0x10c ...

rsp is exactly the kernel-stack guard page: hpfs_truncatealblk recursed ~5000 levels (alsubr.c:764 → :770-775) until the frame push hit unmapped guard memory and the CPU double-faulted. One clean, deterministic panic — no heap corruption, nothing speculative.

Why the recursion is unbounded (path:line)

• hpfs_alsubr.c:760 while (abp->ab_busycnt && (bn <= anp->an_nextoff)) — bn = new length in blocks = 0 for ftruncate(fd,0); an_nextoff is an on-disk u32, so 0 <= u32 is always true.
• hpfs_alsubr.c:764 hpfs_breadalsec() checks only AS_MAGIC.
• hpfs_alsubr.c:770-775 recursion into &asp->as_ab — no depth argument, no visited set, no budget.
• Entry: hpfs_vnops.c:559-569 (hpfs_setattr truncate branch) → hpfs_subr.c:774 (hpfs_truncate).

Distinct from DF-0858 (unbounded goto dive in hpfs_hpbmap — an infinite loop, no stack growth): this is a different function, a different control-flow defect (recursion), and a different failure mode (guard-page double fault). The cyclic variant of the same defect instead self-deadlocks on the per-level held buffer lock (unkillable hang) — noted, not separately verified.

Preconditions (honest)

Root mounts the crafted image RW (custom mounter; stock mount_hpfs cannot produce an RW mount). With the mountpoint uid handed to the user, the trigger itself is fully unprivileged. Crafted-image threat model — same gating as DF-0859 (pass 1) for the write path.

Fix validation

fix.diff adds a depth argument (HPFS_MAXALSECDEPTH 32, EINVAL when exceeded) to hpfs_truncatealblk and its two callers. Applied to the guest's /usr/src, make nativekernel (X86_64_GENERIC), rebooted into the patched kernel: the identical unprivileged trigger returns ftruncate rc=-1 errno=22 Invalid argument, no panic, guest stays up (fix_run.log). Baseline (unpatched): panic as above.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.