dirfs_node_stat computes nanosecond timestamp fields as tv_sec * 1000000000 (wrong field, int32 overflow) — guest-visible garbage nanoseconds on every dirfs stat
Summary
dirfs_node_stat stores dn_atimensec = st.st_atime * 1000000000L (:357, same mtime/ctime :359/:361) - multiplies the SECONDS field instead of reading st.st_atim.tv_nsec, then truncates the ~1.7e18 product into an int32_t. dirfs_getattr copies the garbage into vap->va_atime.tv_nsec (vnops:407-412), so every stat(2) inside the vkernel reports pseudo-random nanoseconds. Metadata-correctness only (breaks make/rsync/tar-style tooling inside the vkernel); no memory safety. Fix: read st_*tim.tv_nsec. [VERIFIED pass2: DEAD CODE per DF-3058 precedent; tv_sec 1e9 nsec defect confirmed; fix unbuildable]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3136 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 238 B | ↓ raw | |
| fix.diff | — | 678 B | view raw | |
| manifest.json | — | 356 B | view raw | |
| verdict.json | — | 1.5 KB | view raw |
DF-3136 evidence pack
What
dirfs_node_stat multiplies tv_sec by 1e9 into tv_nsec (dead code)
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testabledirfs is dead code in this tree (no Makefile, absent from conf/files, vkernel-only) - fix.diff authored but not compilable in any configuration
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - dead code
Verified recommended fix
read st_atim.tv_nsec/st_mtim.tv_nsec/st_ctim.tv_nsec
Verdict
DEAD CODE - closed per the DF-3058 precedent: sys/vfs/dirfs/ has no Makefile, is not referenced by sys/conf/files (verified: grep dirfs conf/files empty), is in no kernel config, and mount_dirfs refuses to run on non-vkernel platforms. Line-accurate confirmation of the defect: dirfs_subr.c:357/359/361 store st.st_atime * 1000000000L into the int32 nsec fields (wrong source field + truncation), copied to userland via dirfs_getattr. Fix (read st_*tim.tv_nsec) authored; compile validation not possible (dirfs is not buildable in any configuration of this tree).
No comments yet.