DF-3200 — u_char length truncation in struct devfs_rule. See VERDICT.md. Build: cc -static -O -o trunc_namlen trunc_namlen.c ; Run as root.

DF-3200 — u_char length truncation in struct devfs_rule (namlen/mntpointlen/linknamlen)

Root cause

struct devfs_rule (sys/sys/devfs_rules.h:53-59) stores the three string lengths as u_char, but devfs_rule_alloc() (devfs_rules.c:91-124) assigns len = strlen(...) with no bound — lengths >= 256 wrap:

1. rule->namlen == 0 for a 256-char name → devfs_rule_create_link() evaluates rule->name[rule->namlen - 1] == rule->name[-1] (devfs_rules.c:243) — a one-byte heap OVER-READ before the kstrdup'd name, and the wildcard branch decision is taken on a byte that is not part of the rule. With groomed heap content (0x2a before the chunk) the wildcard path then strips 255 bytes from a short node name — a large over-read feeding the DF-3199 disclosure.
2. devfs_rule_clear() (devfs_rules.c:200-204) compares mntpointlen == rule1->mntpointlen where the ioctl side is a full size_t strlen and the stored side is the truncated u_char — a rule with a 300-char mntpoint (stored 44) is matched by a 44-char clear request whose first 44 bytes agree: rules for one "mount" removed by a clear intended for another (cross-mount confusion).
3. Rules whose mntpoint length is an exact multiple of 256 store mntpointlen == 0 and can never be matched by CLEAR (clear rejects len==0) — permanent rule leak.

Verification status

The truncation itself is arithmetic certainty from source. Runtime isolation of the name[-1] read is entangled with DF-3202: any 256-char NAME pattern that still matches a node needs >= 250 '*'s, which blows the devfs core thread stack in wildCaseCmp before create_link runs — the first crash of this audit session (252-star pattern, double fault) is that interaction. Verdict: inconclusive at runtime on the stock kernel; the fix (u_int16_t fields + PATH_MAX bound + star cap) removes the class and is validated as part of the fixed-kernel run.

Fix

fix.diff: u_char -> u_int16_t length fields (kernel-internal struct) plus len >= sizeof(field) rejection in devfs_rule_alloc().

Files

trunc_namlen.c, build.sh, run.sh, fix.diff, verdict.json, manifest.json

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.