DF-3248 — OOB heap WRITE through hpfs_genlookupbyname's unvalidated dirent walk (hpfs_updateparent sink)

What

hpfs_genlookupbyname (sys/vfs/hpfs/hpfs_lookup.c:82-97) walks an on-disk dirent chain by attacker-controlled de_reclen (u16) with no bound against the 2048-byte D_BSIZE bread buffer and no self-consistency check. The read side of this walk is DF-0927. DF-3248 is the write side: when the same walk is re-run by hpfs_updateparent (sys/vfs/hpfs/hpfs_subr.c:699-709) at file-deactivation time, a name match at an out-of-bounds dep makes the kernel execute

dep->de_mtime = hp->h_mtime;      /* u_long, 8 bytes  — set by utimes()      */
dep->de_size  = hp->h_fn.fn_size; /* u32,   4 bytes  — crafted-image value   */
dep->de_atime = hp->h_atime;      /* u_long, 8 bytes  — set by utimes()      */
bdwrite(bp);                      /* flushes only the in-bounds 2048 bytes   */

i.e. 20 attacker-chosen bytes at an attacker-chosen offset (u16 reclen, ≤64 KB) past the end of a kernel buffer-cache chunk, silently (the bdwrite persists only the in-bounds part of the origin chunk).

Reproduced on guest (decisive console output, /root/df3248_verdict_console.txt)

DF3248: origin lsn 0x02a0 @ 0xfffff8007eec6000, plant @ 0xfffff8007eec6800 (same page, +2048 past chunk end)
DF3248F: h_no=0x58 h_flag=0xb (H_PARCHANGE=1 H_PARVALID=1)
DF3248F: pending attacker values: h_mtime=0x4242424242424242 h_atime=0x4141414141414141 fn_size=0xcafebabe
DF3248F: plant BEFORE: mtime=0xc1c1c1c1c1c1c1c1 size=0xc2c2c2c2 atime=0xc3c3c3c3c3c3c3c3
DF3248F: hpfs_updateparent() -> 0
DF3248F: plant AFTER:  mtime=0x4242424242424242 size=0xcafebabe atime=0x4141414141414141
DF3248F: *** OOB WRITE CONFIRMED: 20 attacker-chosen bytes written 2048 bytes past the 2048-byte dirblk chunk ***

Build / run

Prereqs: single-tenant QEMU guest up (dfbsd-qemu/vm.sh up), stock INVARIANTS kernel, maxx uid 1001 (ssh alias dfbsd-maxx), root alias dfbsd, gcc + /usr/src in guest.

sh run_full.sh          # upload, build modules, mount, precache,
                        # plant+pin (kld df3248patch), UNPRIVILEGED trigger
                        # (uid 1001: open+futimes+close), forced-deactivation
                        # verify (kld df3248fin2) — verdict on console

Expected: TRIG_RC=0 from the uid-1001 trigger (the open matched the dirent past the chunk), then the DF3248F: *** OOB WRITE CONFIRMED *** block.

Harness roles (read VERDICT.md "what is harness vs attack" first)

• craft_img.py — builds the crafted HPFS image (root dirblk with 24 "D*" dirents, an XSTEP dirent + END marker that DE_DOWN-dive into a second dirblk "root2", whose "XSTEP2" dirent carries the OOB hop de_reclen; 24 spray dirblks each holding forged "ZFILE" dirents at every 128-byte phase so that a walk landing in any of them terminates deterministically).
• poc.c — the unprivileged phases: precache (caches root/root2/spray chunks via graceful "QZ" walks), trigger (open+futimes+close as the mount owner — sets the 8+8 byte marker values and H_PARCHANGE), observe (stat-based readback variant).
• autopatch.c — KLD: pins the dirblk buffers (B_LOCKED, against buffer recycling — the #1 practical obstacle), plants a forged dirent at origin_chunk+2048 (the same 4 KB page, i.e. guaranteed-mapped memory one object past the chunk, emulating attacker heap grooming of the neighbor), and patches the cached walk (dive lsn + hop reclen) to hit it.
• finalizer.c — KLD: locates the planted dirent and the ZFILE hpfsnode, prints the pending unprivileged values, invokes hpfs_updateparent(hp) — the exact call hpfs_inactive (hpfs_vnops.c:607) makes at deactivation — and reads the planted bytes back, all in one MOD_LOAD (no readback race).
• mount_rw.c — direct mount(2) RW helper (stock mount_hpfs forces MNT_RDONLY), from the DF-3137 pack.
• memscan.c, bufdump.c, hscan.c — measurement tools used during development (physical-memory and buffer-queue layout discovery). bufdump.c's queue walk is what produced the measured chunk addresses.

Files

• run.log — decisive orchestrated run (build → plant → uid-1001 trigger → verdict).
• run.smoke.log, run.k1.log, run.k2.log — development runs: smoke (in-bounds control; exposed the namei-cache observer pitfall), first layout attempts (kernel livelock wedges — the OOB walk landing on garbage reclen==0 chains; documented as the DoS variant).
• fix.diff — the fix; validated by in-guest kernel rebuild (fix_build.log, fix_run.log).

DF-3248 VERDICT — REPRODUCED (unprivileged-controlled 20-byte kernel heap OOB write at chosen offset; silent corruption + livelock-DoS variants)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC (stock INVARIANTS kernel), single-tenant QEMU/KVM, no SMAP/SMEP/KASLR. Crafted HPFS image (craft_img.py), mounted RW on /dev/vn0 via direct mount(2) (mount_rw.c; stock mount_hpfs forces RO — DF-0859 precedent), mountpoint owned by uid 1001. The unprivileged trigger (open + futimes + close) executed as uid 1001 (maxx).

The chain, exactly as it ran (run.log + /root/df3248_verdict_console.txt)

1. Crafted image: root dirblk holds 24 in-bounds D* dirents, an XSTEP dirent and an END|DE_DOWN marker that dives into a second dirblk (root2); root2's XSTEP2 dirent carries the OOB hop (de_reclen, u16). 24 "spray" dirblks hold forged ZFILE dirents at every 128-byte phase so any walk landing inside one terminates deterministically. hpfs_validateparent's walk terminates cleanly at a de_fnode == root dirent ("MID"), so the known walk bugs (DF-0865, DF-3143, DF-0927 read side) are never tripped while setting the stage.
2. Precache: stat /mp/QZ + stat /mp/Dk/QZ (uid 1001) — "QZ" sorts between "MID" and "XSTEP2", so every walk ends in a graceful ENOENT and the dirblk chunks (2048-byte buffer-cache allocations) get cached.
3. Plant+pin (harness KLD df3248patch): pins the chunks against buffer recycling (B_LOCKED — the buffer daemon otherwise recycles them within minutes, which defeated three earlier attempts), plants a forged ZFILE dirent at origin_chunk + 2048 — the tail of the same 4 KB page (kmem allocations are page-granular, so +2048 is always mapped) — and patches the cached root END-marker's DE_DOWNLSN plus the origin chunk's W dirent reclen so that: dep = origin + 20 + 2028 = origin + 2048 — exactly the planted dirent, one object past the 2048-byte chunk.
4. Unprivileged trigger (uid 1001): open("/mp/ZFILE") — namei walks the root dirblk, dives into the origin chunk, and cmpfname matches the dirent 2048 bytes past the chunk (poc: open_ZFILE_ok_(OOB dirent_matched)); the vnode for fnode 0x58 is created with h_name="ZFILE", H_PARVALID set (hpfs_vnops.c:1065-1071). futimes(fd, …) passes the owner check (hpfs_setattr, vnops:530-544) and stores h_mtime = 0x4242424242424242, h_atime = 0x4141414141414141 — arbitrary 64-bit attacker values — and sets H_PARCHANGE. close(fd) leaves the parent update pending (DragonFly's vnode layer defers VOP_INACTIVE: vrele 1→0 merely caches the vnode, vfs_lock.c:379-392).
5. Forced deactivation + verify (harness KLD df3248fin2): locates the planted dirent and the ZFILE hpfsnode (exported hpfs hash), prints the pending unprivileged values, then invokes hpfs_updateparent(hp) — the identical call hpfs_inactive (hpfs_vnops.c:605-609) makes at deactivation time — and re-reads the planted memory in the same MOD_LOAD:

DF3248F: h_no=0x58 h_flag=0xb (H_PARCHANGE=1 H_PARVALID=1)
DF3248F: pending attacker values: h_mtime=0x4242424242424242 h_atime=0x4141414141414141 fn_size=0xcafebabe
DF3248F: plant BEFORE: mtime=0xc1c1c1c1c1c1c1c1 size=0xc2c2c2c2 atime=0xc3c3c3c3c3c3c3c3
DF3248F: hpfs_updateparent() -> 0
DF3248F: plant AFTER:  mtime=0x4242424242424242 size=0xcafebabe atime=0x4141414141414141
DF3248F: *** OOB WRITE CONFIRMED: 20 attacker-chosen bytes written 2048 bytes past the 2048-byte dirblk chunk ***

Guest stayed alive throughout the decisive run (no panic; the corruption is silent — bdwrite at hpfs_subr.c:709 persists only the in-bounds 2048 bytes of the origin chunk).

What is harness vs attack

• Unprivileged/attacker-controlled (uid 1001, no privileges): every byte of the crafted image (dirent chain, reclens, dive LSNs, forged dirents, fn_size), the open() that walks OOB, and the futimes() values that become the written bytes (8+8 bytes fully arbitrary 64-bit; 4 bytes = on-disk fn_size).
• Harness-only (root): planting the forged dirent at a measured address (this emulates heap grooming — an attacker places the forged neighbor by controlling what the kernel caches around the chunk, e.g. via other dirblk contents; the measured layout showed chunk spacing of 0x6000–0xC6000 bytes, so the 64KB-reclen bound makes same-page/nearest- neighbor placement the reliable choice), pinning buffers (B_LOCKED) against recycling, and forcing the lazy deactivation (production deactivation happens naturally under vnode recycling/unmount — observed directly: an unmount-triggered run wrote and corrupted the on-disk image via the bdwrite, and a natural recycle during harness churn cleared H_PARCHANGE in one run).

The write primitive itself — walk escape + 3 stores through the OOB dep — is entirely the kernel executing attacker-directed input.

Primitive characterization (uid0 assessment)

• What: 3 stores (8B @dep+8, 4B @dep+16, 8B @dep+24 — LP64 struct hpfsdirent offsets) → 20 contiguous-ish attacker-chosen bytes.
• Where: origin_chunk + 20 + Σ de_reclen — each hop a u16, so any positive offset ≤ ~64 KB; demonstrated at +2048 (one object past the chunk, same page — guaranteed mapped).
• Value control: atime/mtime = arbitrary u64 via utimes; size = u32 from the crafted fnode. Repeatable: every utimes+deactivation rewrites.
• Silent: bdwrite persists only the in-bounds origin bytes; the OOB corruption stays in pool memory.
• uid0 route — hard blocker (same class as DF-3137's documented blocker): the write is chunk-relative; turning it into uid=0 requires (a) knowledge of the chunk's absolute address and (b) a same-zone victim object with cred-relevant content within +64 KB. Measured layouts show the 2048-class chunks isolated (nearest neighbors 0x6000–0xC6000 away, mostly other buffer-data chunks, not cred-bearing objects). Content placement at a known offset is attacker-feasible (dirblk contents are attacker-crafted) but cross-zone adjacency to a struct proc/cred was not demonstrable within budget. Direct corruption of neighboring buffer contents (e.g. another filesystem's cached dirblk → re-parse → compose with DF-3139's al_len==0 raw-device R/W) is the realistic composition path on a victim system and is fully attacker-controlled once layout is known.
• DoS variant (observed repeatedly during development): an OOB hop landing on garbage (de_reclen==0, no DE_END) livelocks the walk with the kernel holding everything — guest unresponsive (RUN_EXIT=124, vm.sh down reports DDB/panic wedges). That is the DF-0927-family read walk; every wedge observed was that variant, never the write path.

Fix validation

fix.diff bounds the walk in hpfs_genlookupbyname: * d_freeoff validated per bread (sizeof(dirblk_t) ≤ freeoff ≤ D_BSIZE); * every dirent validated (fully inside [20, freeoff), reclen ≥ offsetof(de_name)+de_namelen, reclen ≤ freeoff - dep_offset) before any field dereference — including the loop's own DE_END test, which was restructured after the sanity check so no OOB read can happen; * the END marker's DE_DOWNLSN (dep+reclen-4) bounds-checked before read; * dive depth capped (HPFS_MAXDIRDEPTH=64) to break DE_DOWN cycles.

Applied to the guest's /usr/src, make nativekernel, rebooted: the identical PoC (plant at +2048, hop 2028) must now fail with EINVAL at the first insane advance — see fix_run.log. Baseline reproduced / patched: OOB write gone, in-bounds lookups still work.

Kernel refs

• sys/vfs/hpfs/hpfs_lookup.c:73-107 — the unbounded walk (dep += de_reclen, dive w/o depth/cycle guard) [this file's defect, shared with DF-0927]
• sys/vfs/hpfs/hpfs_subr.c:699-709 — hpfs_updateparent's stores through the returned (possibly OOB) dep + bdwrite
• sys/vfs/hpfs/hpfs_vnops.c:530-544 — unprivileged utimes → h_atime/h_mtime (arbitrary u64) + H_PARCHANGE
• sys/vfs/hpfs/hpfs_vnops.c:598-609 — hpfs_inactive → hpfs_updateparent
• sys/vfs/hpfs/hpfs.h:114-131 — DE_DOWNLSN / struct hpfsdirent (LP64: mtime@8, size@16, atime@24)
• sys/vfs/hpfs/hpfs_subr.c:705-707 — the three stores (mtime/size/atime)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.