DF-3190 — VERDICT

status: reproduced / impact: panic (deterministic) / confidence: certain primitive: kernel buffer undersized by superblock-controlled arithmetic, then overwritten with an attacker-sized, attacker-contented copy — plus a deliberate consistency panic on the error-cleanup path. Fix validated: crafted image rejected at mount on the patched kernel; stock image unaffected.

Root cause (line-accurate)

1. sys/vfs/ufs/ffs_vfsops.c:641-646 — mount checks only fs_magic and fs_bsize ∈ [sizeof(struct fs), MAXBSIZE]. fs_fmask/fs_qfmask (and fs_bmask/fs_qbmask/shifts) are copied into the live struct fs verbatim (fs_qfmask via bcopy of the superblock, ffs_vfsops.c:667-674).
2. sys/vfs/ufs/ffs_vfsops.c:812-815 — ffs_oldfscompat recomputes the masks only when fs_inodefmt < FS_44INODEFMT; any image newfs(8) produces today keeps the crafted values.
3. sys/vfs/ufs/fs.h:506 — fragroundup(fs,size) = ((size)+fs_qfmask) & fs_fmask is pure attacker arithmetic with those two fields.
4. sys/vfs/ufs/ffs_balloc.c:193-202 — fresh direct block: nsize = fragroundup(fs, size) (size == fs_bsize for the PoC write) → ffs_alloc(nsize) allocates numfrags(nsize) frags → getblk(vp, lbn, nsize) — buffer nsize bytes for a size-byte write. Sibling sinks: :168-171 (osize/bread path), :119/:129 (blksize()/ffs_realloccg), ffs_fragextend's cg_frsum store (ffs_alloc.c, secondary).
5. sys/vfs/ufs/ufs_readwrite.c:346-354 — uiomovebp(bp, bp->b_data + blkoffset, xfersize, uio) with xfersize == fs_bsize >> buffer size.

What was run (guest DragonFly dfbsd 6.5-DEVELOPMENT #0,

X86_64_GENERIC, INVARIANTS on, DIAGNOSTIC off)

Craft: fs_fmask = 0x1fff, fs_qfmask = 0x800 on a stock newfs image (bsize 16384, fsize 2048, frag 8) ⇒ fragroundup(16384) = 2048.

Panic chain (why it panics in ffs_blkfree and not in uiomove)

The oversized copy is attempted: uiomove → copyin(user, b_data, 16384) (sys/kern/kern_subr.c:136). The buffer is VMIO with one page mapped; bytes 2048..4095 overflow into that page's tail, and at b_data+4096 the copy faults. DragonFly's copyin has an on-fault window (returns EFAULT on any fault during the copy) so the wild write is converted to EFAULT instead of trapping. ffs_write then runs its IO_UNIT error path (ufs_readwrite.c:404-410) → ffs_truncate(vp, osize=0); but ip->i_size was already advanced to 16384 (ufs_readwrite.c:348-350) before the failed copy, so the truncate frees i_db[0] = 1041 as a full block (size = 16384), and ffs_blkfree_cg (ffs_alloc.c:1504-1507) panics on fragoff(fs, 16384) = 16384 & 0x800 ≠ 0 under the poisoned fs_qfmask:

dev=vn0, bno = 1041, bsize = 16384, size = 16384, fs = /mnt
panic: ffs_blkfree: bad size
ffs_blkfree_cg → ffs_blkfree → ffs_truncate → ffs_write → vop_write

Exploitability ceiling (documented hard blockers for uid=0 via this sink)

The primitive is a genuine attacker-sized/-contented write directed at kernel KVA (b_data + [0, fs_bsize), buffer of nsize bytes). Two mechanisms, verified in source, cap it at EFAULT/panic on this kernel:

1. Per-buffer KVA reservation — every VMIO buffer owns a MAXBSIZE (64 KB) KVA reservation (sys/kern/vfs_bio.c:640), and allocbuf maps only desiredpages = pages(bufsize) (vfs_bio.c:3038-3057, pmap_qenter only for the buffer's own pages). Writes past the buffer's last mapped page land in its own unmapped reservation, never in a neighbour buffer — cross-buffer grooming is structurally impossible via this overflow. The only silent-overflow window is bufsize → roundup(bufsize, PAGE_SIZE) (≤ 4095 B into the buffer's own last page) — same vm_page as the buffer itself, no cross-object effect.
2. copyin on-fault window (sys/kern/kern_subr.c:136 with DFBSD's copyin fault handler) — every user→kernel copy through uiomove is fault-tolerant, so the out-of-mapping portion returns EFAULT rather than Fatal trap 12. (Kernel-internal stores like DF-0894's bap[in_off] have no such window — different finding, different sink.)

Secondary sink (same root cause, cross-file): ffs_fragextend cgp->cg_frsum[i - numfrags(fs, osize)]-- — with stock fs_fshift the index stays within ±fs_frag of the array (intra-struct cg corruption, silent allocator-metadata corruption); crafting fs_fshift to widen the index is gated by the early cs_nffree < numfrags(bsize-osize) bail-out (ffs_alloc.c fragextend entry), which rejects the enlarged request before the store. Capped at intra-buffer corruption / DoS on this kernel.

Net: reliable unprivileged-triggered kernel panic (DoS) once the crafted image is mounted, with a demonstrated buffer-size-decoupling memory-safety violation whose silent-corruption routes are individually blocked and documented above. uid=0 not achieved from this sink on this guest — blocked by (1)+(2), not by lack of primitives.

Fix validation

fix.diff (authored against the read-only sys/ tree; applied only inside the guest's /usr/src copy): validates in ffs_mountfs that fs_fsize/fs_frag/fs_bmask/fs_fmask/fs_qbmask/fs_qfmask/ fs_bshift/fs_fshift/fs_fragshift are exactly the values recomputed from fs_bsize/fs_fsize (power-of-two chain, fs_frag ≤ MAXFRAG), else EINVAL.

• make nativekernel KERNCONF=X86_64_GENERIC — clean (-Werror), RC=0 (build.log); installed as kernel #1 Tue Sep 8 05:12:48 UTC 2026.
• Crafted image → mount_ufs: /dev/vn0 on /mnt: incorrect super block, dmesg ffs_mountfs: inconsistent fragment geometry, no panic, trigger unreachable (run.patched.log).
• Stock image → mounts, uid=1001 write(16384) succeeds, 16384-byte file (run.patched.baseline.log). No regression.

Notes

• DF-0894 (crafted fs_nindir, bap[indirs[i].in_off] OOB in this same function) is not fixed in this tree — fs_nindir is still copied unvalidated (ffs_vfsops.c:729) — and is not re-reported here; the fs_nindir companion check belongs to DF-0894's fix.
• The fs_maxbpg==0 divide-by-zero in ffs_blkpref:805 (reachable from ffs_balloc on every allocation) is the DF-0820 umbrella family and is not re-filed.
• Guest reset to the clean-source snapshot after validation.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.