DF-3137 — unvalidated ab_freeoff used as insertion offset: controlled 12-byte kernel-heap OOB write (hpfs_addextent:452 / hpfs_addextentr:643 / hpfs_concatalsec:278)

Build

./build.sh            # crafts df3137.img on the host (VARIANT/FREEOFF
                      # env vars), pushes image + poc.c + mount_rw.c to
                      # the guest, compiles there with cc

Run

./run.sh              # mounts /dev/vn0 (RW via /root/mount_rw) on
                      # /tmp/hpfsmp (owned by uid 1001), runs the PoC
                      # as the unprivileged user `maxx` (uid 1001)

VARIANT=alsec FREEOFF= ./build.sh # re-craft with a different target # offset before ./run.sh

Expected

• FREEOFF=500 (write exactly at bp->b_data[512..524)): pwrite returns 32768, guest stays up — SILENT corruption of the adjacent 512-byte kernel heap chunk with {al_off=1, al_len=0x41, al_lsn=0x200}.
• FREEOFF=0x1000 (write 4 KB past the 512-byte AlSec buffer): kernel panic — Fatal trap 12: page fault while in kernel mode, supervisor write data, page not present at hpfs_addextentr+0xed: movl %edx,(%r12,%rax,1) (= the AL_SET store at sys/vfs/hpfs/hpfs_alsubr.c:643).

Root cause: ab_freeoff (u_int16_t) is raw on-disk data, never validated (hpfs_vfsops.c:535 checks only fn_magic; hpfs_breadalsec only AS_MAGIC), and AB_FREEALP(abp) = (alleaf_t *)((caddr_t)abp + abp->ab_freeoff) (hpfs.h:154) uses it directly as the write offset for new allocation entries. Trigger: one unprivileged pwrite(2) that extends the file by one extent.

Files: craft_img.py (image generator), poc.c (trigger), mount_rw.c (RW-mount helper, DF-0859 precedent), fix.diff (validated fix), run.alsec.500.log / run.alsec.1000.log (runs), panic.txt (captured panic), fix_run.log (patched-kernel rerun).

DF-3137 VERDICT — REPRODUCED (kernel-heap OOB write, panic + silent-neighbor variants)

What was run

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC (stock INVARIANTS kernel), single-tenant QEMU/KVM. Crafted HPFS image (craft_img.py), mounted RW on /dev/vn0 via direct mount(2) (mount_rw.c; stock mount_hpfs forces RO — DF-0859 precedent), mountpoint owned by uid 1001. Trigger executed as uid 1001 (dfbsd-maxx).

Run 1 — adjacent-chunk silent corruption (FREEOFF=500)

pwrite(fd, 32768 bytes, offset 512) as uid 1001 returned 32768; guest stayed alive (run.alsec.500.log). Analysis: the new alleaf {al_off=1, al_len=0x41, al_lsn=0x200} was written at C.b_data + 12 + 500 = b_data[512..524) — 12 fully attacker-chosen bytes (al_len/al_lsn crafted via the bitmap free-run layout, al_off via fn_size) starting exactly at the end of the 512-byte buffer-cache chunk. No kernel object complained → silent corruption of the neighboring heap chunk (another 512-byte buffer data area in the same kmalloc zone).

Run 2 — panic (FREEOFF=0x1000)

Same trigger with the write aimed 4 KB past the 512-byte AlSec buffer: the unprivileged pwrite never returned; the kernel took

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xfffff80065b4700c
fault code = supervisor write data, page not present
instruction pointer = hpfs_addextentr+0xed:  movl %edx,(%r12,%rax,1)

hpfs_addextentr+0xed is exactly the AL_SET(AB_FREEALP(rabp), ...) store at sys/vfs/hpfs/hpfs_alsubr.c:643 (AL_SET writes al_off/al_len/ al_lsn with three movl stores; this one is the al_len store at abp + freeoff + 4). The fault VA is in the kernel heap (kmem map) — the write reached unmapped kernel VA 0xfffff80065b4700c = the buffer chunk + 0x1000 + 12. Guest died at db> (panic.txt).

Primitive characterization (uid0 assessment)

• 12-byte write, contents = three u32s the attacker chooses when crafting the image (al_off <= 0x7FFFFF via fn_size; al_len/al_lsn via bitmap free-run geometry), at a fully chosen 16-bit offset (freeoff) from the start of a kmalloc'd 512-byte buffer (AlSec variant) or from &hpfsnode->h_fn.fn_ab (fnode variant — writes past the ~850-byte kmalloc(1024-class) hpfsnode).
• Repeatable and MARCHING: each additional extent insert in the same addextent loop writes another 12 bytes at freeoff+=12 — a contiguous structured heap overwrite of up to ~60 KB per pwrite (freecnt-bounded).
• On this no-KASLR/no-SMAP guest the write is kernel-heap-relative; a reliable uid0 chain additionally needs the absolute address of the AlSec data chunk (deterministic on a fresh boot but not directly observable from userspace) and a same-zone target at +0..+64K (neighbors are other 512-byte buffer-data chunks — the DF-3138 run demonstrates such adjacency is real and observable). Cross-zone targets (e.g. a neighboring hpfsnode's h_uid/h_gid/h_mode = exactly 12 bytes) require zone-adjacency grooming that was not demonstrated within budget — documented as the hard blocker for the uid0 chain; both silent-neighbor corruption and unmapped-VA panic are proven.

Fix validation

fix.diff adds hpfs_alblk_sane() (packed-array invariant: busycnt <= capacity, freeoff == sizeof(alblk_t)+busycnt*sz, freecnt <= capacity-busycnt) enforced at fnode load (hpfs_vfsops.c) and at every AlSec read in hpbmap/addextentr/truncatealblk, plus the two missing brelse()s (DF-3140) and the al_len==0 hole fix (DF-3139). Applied to the guest's /usr/src, make nativekernel, rebooted: the identical FREEOFF=0x1000 trigger returns EINVAL from pwrite ("hpfs_addextentr: INSANE ALBLK" on console), no panic, guest stays up (fix_run.log). Baseline reproduced / patched not reproduced.

Verdict

REPRODUCED: unprivileged controlled-offset 12-byte kernel heap OOB write with attacker-chosen contents; panic at +4 KB, silent neighbor corruption at +0. Fix validated. Kernel refs: sys/vfs/hpfs/hpfs_alsubr.c:427-456 (root insert), :610-653 (AlSec insert), :278 (concat dest), hpfs.h:152-171 (macros), sys/vfs/hpfs/hpfs_vfsops.c:529-544 (no validation at load).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.