DF-3218 VERDICT

status: reproduced / impact: panic (vkernel-wide DoS) / confidence: certain

Environment

• QEMU guest: DragonFly 6.5-DEVELOPMENT #0 (native X86_64_GENERIC, 2026-07-02), 6 vCPUs, cc 8.3. dirfs is vkernel64-only, so the PoC runs a vkernel built inside the guest (nativekernel KERNCONF=VKDIRFS, VKERNEL64 + options DIRFS), booted on a 160MB FFS image with a minimal userland, vm.vkernel_enable=1.
• Build prerequisites (bit-rot fixes, guest tree only — the audit repo sys/ is untouched): missing <sys/malloc.h> in dirfs_vnops.c and dirfs_subr.c, missing <sys/uio.h> in dirfs_vnops.c, and __build_id_* undefined at the vkernel link (script-less SYSTEM_LD) — without these dirfs does not compile/link at all on the current tree.

Chain (what was run)

1. Guest: mkdir /dirfs-host (a real directory).
2. vkernel boots to /bin/sh (via /sbin/vkinit wrapper) on a fifo console.
3. Inside vkernel (root): /bin/vkmount /dirfs-host /hostroot → mount("dirfs", "/hostroot", 0, "/dirfs-host") → dirfs_mount: copyinstr OK, stat("/dirfs-host") S_ISDIR OK, mount succeeds. dmp->dm_root still NULL (no VFS_ROOT yet).
4. Guest: mv /dirfs-host /dirfs-host.real && ln -s /nonexistent-xyz /dirfs-host → the mount's host path is now a dangling symlink.
5. Inside vkernel: ls /hostroot → namei crosses the mountpoint → VFS_ROOT → dirfs_root → dm_root==NULL → lstat("/dirfs-host") SUCCEEDS (the symlink itself; AT_SYMLINK_NOFOLLOW) → dmp->dm_root = dnp (:250), DIRFS_ROOT set → open("/dirfs-host", O_DIRECTORY) FOLLOWS the symlink → ENOENT → fd==-1 → dirfs_free_vp(dmp, dnp) (dirfs_vfsops.c:261) → vp = dnp->dn_vnode == NULL (dirfs_subr.c:300) → vp->v_data = NULL (dirfs_subr.c:305) → kernel-mode write to 0x128.

Observed (baseline, run.baseline.log)

# ls /hostroot
Fatal trap 12: page fault while in kernel mode
fault virtual address      = 0x128
instruction pointer        = 0x2b:0x72080b
current process            = 3 (ls)
Stopped at 0x72080b:       movq $0,0x128(%r13)

Symbolization on the vkernel binary: - nm -n: dirfs_free_vp at 0x7207d0. - objdump -d: 7207fd: movq $0x0,0x48(%rbx) = dnp->dn_vnode = NULL; 72080b: movq $0x0,0x128(%r13) = vp->v_data = NULL (vp==NULL) — byte-identical to the faulting instruction; the next instruction is jmpq 7204d0 <dirfs_node_drop> (the path that would drive the double-free if the store did not fault).

0x128 is offsetof(struct vnode, v_data) in this build. The vkernel OS is dead at this point (ddb); every process in the vkernel dies with it.

Fix validation (run.fixed.log)

fix.diff applied to the guest tree, vkernel relinked, identical PoC re-run: - /bin/vkmount /dirfs-host /hostroot → mounted - symlink swap → ls /hostroot → ls: /hostroot: No such file or directory (VFS_ROOT returns the host ENOENT cleanly), echo TRAVERSED runs, vkernel stays alive.

fix_status: fixed (baseline reproduced → patched behavior correct).

Why not uid0

The bug is a NULL-pointer write of the constant 0 at a fixed offset — deterministic fatal trap, not a controllable corruption primitive; there is no attacker-influenced data in the store. dirfs runs only inside a vkernel (a userland process on the host), so even a controllable corruption would execute inside the vkernel process, whose "kernel memory" is the process's own memory owned by the same host uid. Realistic ceiling: whole-vkernel panic from a mount-traversal by any vkernel user — hence Medium, not higher.

Residual notes

• The dm_root dangling (defect 3) and the double-free (defect 2) are latent behind the NULL-write in this exact build; the fix removes all three.
• The dm_root lazy-init race (filed separately as DF-3219) is a different defect on the same lines.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.