DF-3221

dirfs_statfs/dirfs_statvfs bcopy the host statfs/statvfs over mnt_stat, clobbering the per-mount f_fsid assigned by vfs_getnewfsid — all dirfs mounts over one host filesystem share a fsid

Summary

dirfs_mount calls vfs_getnewfsid(mp) (:156), which assigns a per-mount fsid into mp->mnt_stat.f_fsid. Every subsequent dirfs_statfs (:297-301) and dirfs_statvfs (:316-319) runs the HOST statfs/statvfs on dm_path and bcopy()s the entire struct over sbp - replacing the unique fsid with the underlying host filesystem's fsid. Two dirfs mounts over subtrees of the same host filesystem (the intended vkernel use) report identical f_fsid, defeating the mount identity that statfs(2) consumers rely on; the same bcopy also carries host f_mntonname/f_type fields that misdescribe the vkernel mount. Informational/correctness (no in-vkernel-kernel fsid consumer reachable for dirfs; NFS fhtovp EOPNOTSUPP). Fix: preserve f_fsid and set names from the vkernel mount. [VERIFIED pass2: DEAD CODE per DF-3058; statfs bcopy clobbers per-mount fsid confirmed; fsid-preserving fix authored]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-130
File: sys/vfs/dirfs/dirfs_vfsops.c
Lines: 156-319
Area: vfs
Discovered: 2026-09-08
Updated: 2026-09-08

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:04
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:04
Runtime: —
Kernel: per-fix-DF-3221
fix.diff: findings/poc/DF-3221/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3221 · 4 files

File	Type	Size
README.md	—	234 B	↓ raw
fix.diff	—	1.6 KB	view raw
manifest.json	—	398 B	view raw
verdict.json	—	1.5 KB	view raw

README.md

↓ download raw

DF-3221 evidence pack

What

dirfs statfs/statvfs clobber the per-mount f_fsid (dead code)

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

dirfs is dead code in this tree (no Makefile, absent from conf/files, vkernel-only) - fix.diff authored but not compilable in any configuration

↓ fix.diffper-fix-DF-3221

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - dead code

Verified recommended fix

restore mp->mnt_stat.f_fsid after the host-struct bcopy in statfs/statvfs

Verdict

DEAD CODE - closed per the DF-3058 precedent. Line-accurate confirmation: dirfs_mount calls vfs_getnewfsid (dirfs_vfsops.c:156) but every dirfs_statfs (:297-301) and dirfs_statvfs (:316-319) bcopy()s the entire HOST statfs/statvfs struct over sbp, replacing the unique fsid with the host filesystems - two dirfs mounts over the same host fs share an fsid and the mounts also misreport f_type/f_mntonname. Fix preserves mp->mnt_stat.f_fsid across the bcopy at both sites.