DF-3118 verdict — full narrative

The defect (certain)

hmp->flusher.{done,next} (sys/vfs/hammer/hammer.h:772-781), flush-group seq (hammer.h:292) and reservation flg_no (hammer.h:740) are signed 32-bit sequence numbers used as a BSD-style ring: every consumer computes a - b > 0 to ask "is a ahead of b":

• hammer_flusher_wait() sys/vfs/hammer/hammer_flusher.c:166
• hammer_flusher_flush() KKASSERT + mis-sequencing branch :338-357
• delay-list release check :447-451 (with hammer_blockmap.c:730,736)
• hammer_flusher_running() :178-181

The compiled module uses sub; test; jle (see disasm.txt) — a wrapping 32-bit subtraction whose result is then read as signed. Ring arithmetic with a signed difference test is only correct while the distance between allocator and consumer stays below 2^31; past that every comparison flips.

The allocating side is attacker-influenceable without privilege: HAMMERIOC_SYNCTID with op=HAMMER_SYNCTID_ASYNC is unprivileged (hammer_ioctl.c:72 computes caps_priv_check into error, but the case HAMMERIOC_SYNCTID: handler at hammer_ioctl.c:117-120 overwrites error unconditionally), and each call bumps hmp->flusher.next once with no waiting when no flush groups are pending (hammer_flusher.c:114-122). Measured: ~65k seq/s per process, ~780k/s with 12 processes (run.log).

What was demonstrated on the guest

Mechanism (reproduced from an injected wrapped state)

seqshift.ko (root, setup-phase; findings/poc/DF-3118/seqshift.c) set next = done + 2^31 - 200000, i.e. next negative while done positive — the exact field-value state that a successful 2^31-lap would produce. The running unprivileged burners kept allocating; the grouper's flush group was created at the wrapped frontier. The master then executed hammer_flusher.c:338-357 with flg->seq negative and seq = done+1 positive:

• seq == flg->seq fails,
• KKASSERT(flg->seq - seq > 0 ...): the difference underflows INT_MIN and wraps positive, so the assert passes (no panic text — consistent with the silent serial console in wedge_boot.log),
• flg = NULL: the pending group is permanently unreachable,
• hammer_flusher_haswork() is true forever (group list non-empty), so the master executes a synchronous finalize (volume-header + undo flush + disk cache flush) for every dummy sequence number — a self-sustaining fsync storm.

Observed: guest wedged within ~2 minutes; ssh connections timed out during banner exchange on 25 s and 30 s retries five minutes apart; serial console silent; QEMU still running; only a hard reset (vm.sh reset with-src) recovered the machine. That is a full system denial of service from the wrapped-counter state, with no kernel memory corruption involved.

Organic reachability (not demonstrated; refuted on this configuration)

Two organic attempts were run:

1. 12 unpriv burners, 22 minutes, 914,588,507 sequence numbers allocated (~780k/s). Probe (wedge_boot.log): done=914583800 next=914588507 gap=4707. The single master flusher thread consumed 99.9995% of the allocations.
2. 12 burners + 1 grouper + 4 writers dirtying 11.3 GB in 7 minutes (43k/s per burner, ~520k/s aggregate). Gap stayed 5.5k-9k (gapseries.txt), and 2 seconds after the burners were killed the gap had drained to 2.

Conclusion: on this guest (6 vCPU, fast qcow2 disk) the master's per-sequence consumption capacity exceeds the fs_token-serialized unpriv allocation ceiling, so the ring distance cannot accumulate toward 2^31 — it returns to ~5k after every master I/O stall. Reaching the lap organically would require ~2^31 net allocations during cumulative master stalls (~2000 s at the measured 430k/s with the master continuously pinned in synchronous finalizes), plausible only on configurations where the frontend vastly outpaces the flusher's disk (very slow/network storage with many fast frontend cores) — not demonstrated here.

Bottom line

The arithmetic defect is real and its post-condition (wrapped ring) is a hard, self-sustaining system wedge, demonstrated by driving the kernel through the exact wrapped state. The unprivileged trigger, while cheap per operation, could not out-race the master flusher on the test configuration, so end-to-end unprivileged reproduction is inconclusive. If any future change (or a slow-storage deployment) lets the frontend allocate faster than the master consumes for a sustained period, this becomes an unprivileged system DoS plus, at the wrap seam, flush-group mis-sequencing (silent on non-INVARIANTS builds) and premature delay-list reservation release.

Fix

fix.diff (git-apply-able, verified against the read-only tree): make done/next, flg->seq, resv->flg_no and the local seq variables unsigned. Modular 2^32 arithmetic then keeps every difference comparison correct for distances < 2^31 and the compiler emits proper ring codegen (cmp/je + unsigned branches — fix_build.log, module compiled clean with -Werror against the patched headers in the guest's /usr/src copy).

Full kernel A/B validation was not performed (no organic reproduction to A/B against); the fix compile-checks and the codegen change is verified.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.