Hi, Konstantin, Refer to: https://lore.kernel.org/ntfs3/20240820105342.79788-1-llfamsec@xxxxxxxxx/T/#t. In https://github.com/Paragon-Software-Group/linux-ntfs3/blob/master/fs/ntfs3/record.c#L267. The code did not check the 'non_res' field. If asize is just 8 bytes, it still trigger OOB. So I added "if (asize < SIZEOF_RESIDENT)" before accessing the 'non_res'. Because SIZEOF_RESIDENT is smaller than SIZEOF_NONRESIDENT which seems to be the minimum size of attr. Or maybe we can use "if (off + 9 > used)" directly. Thanks, LL
