dirfs_open_helper tests the vnode type with a bitwise AND ('dnp->dn_type & VDIR') instead of equality — VBLK/VSOCK/VFIFO nodes are always opened with O_DIRECTORY and can never be opened at all; VLNK/VCHR take the plain-file path
Summary
dirfs_open_helper (:583) does 'if (dnp->dn_type & VDIR) flags |= O_DIRECTORY;'. dn_type is an enum vtype (VREG=1, VDIR=2, VBLK=3, VCHR=4, VLNK=5, VSOCK=6, VFIFO=7), so VBLK&VDIR=2, VSOCK&VDIR=2, VFIFO&VDIR=2 all nonzero: block devices, sockets and FIFOs on a dirfs mount are opened with O_DIRECTORY and the host openat() always fails ENOTDIR - permanently un-openable through dirfs (local functional DoS; FIFOs the common case). VCHR&VDIR=0 and VLNK&VDIR=0 take the else branch (plain-file path). Intended test is == VDIR. Trivial local check (not executed - Low). Fix: the operator. [VERIFIED pass2: not reproduced by construction - dirfs dead code per DF-3058 precedent; operator defect line-certain]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3135 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 283 B | view raw | |
| README.md | — | 424 B | ↓ raw | |
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| build.sh | — | 153 B | view raw | |
| run.sh | — | 88 B | view raw | |
| manifest.json | — | 450 B | view raw | |
| verdict.json | — | 1.3 KB | view raw | |
| fix.diff | — | 283 B | view raw | |
| env.txt | — | 272 B | view raw |
DF-3135 -- verification pack
Finding: dirfs_open_helper bitwise AND vtype test makes special nodes unopenable
Status: not_reproduced / impact denial_of_service / confidence certain
What was run
n/a (dead code: no Makefile, not in sys/conf/files)
How to reproduce
n/a
Expected
n/a
See VERDICT.md for the full narrative and verdict.json for the persisted machine verdict. Artifacts: fix.diff.
DF-3135 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Bottom line
Not reproducible by construction: dirfs is dead code in this tree. Per the DF-3058 precedent (verified again on this snapshot): sys/vfs/dirfs/ has no Makefile, is not referenced by sys/conf/files, appears in no kernel config, and the filesystem cannot be instantiated on this non-vkernel guest. The defect itself is line-certain from source: dirfs_open_helper tests dn_type & VDIR bitwise, so VBLK(3)/VSOCK(6)/VFIFO(7) nodes (3&2, 6&2, 7&2 all nonzero) get O_DIRECTORY and can never be opened, while VCHR/VLNK take the plain-file path; intended test is equality. Fix authored; compile validation not possible for dead code.
Kernel references
Exploit chain
(none: availability/correctness finding; no privilege chain)
Fix
operator: dn_type & VDIR -> dn_type == VDIR
See fix.diff in this directory (git-apply-able against the read-only sys/ tree; applied only inside the disposable verification guest).
Reproduction
build: n/a (dead code: no Makefile, not in sys/conf/files)
run: n/a
expected: n/a
Notes on the PoC (what changed vs the finding sketch)
(none)
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md quoting the DF-3058 dead-code analysis; source line dirfs_subr.c:583
Verified recommended fix
operator: dn_type & VDIR -> dn_type == VDIR
Verdict
Not reproducible by construction: dirfs is dead code in this tree. Per the DF-3058 precedent (verified again on this snapshot): sys/vfs/dirfs/ has no Makefile, is not referenced by sys/conf/files, appears in no kernel config, and the filesystem cannot be instantiated on this non-vkernel guest. The defect itself is line-certain from source: dirfs_open_helper tests dn_type & VDIR bitwise, so VBLK(3)/VSOCK(6)/VFIFO(7) nodes (3&2, 6&2, 7&2 all nonzero) get O_DIRECTORY and can never be opened, while VCHR/VLNK take the plain-file path; intended test is equality. Fix authored; compile validation not possible for dead code.
No comments yet.