shadow1ng/fscan · error

accept status: %d

Error message

accept status: %d

What it means

The RPC accept status must be SUCCESS (0); nonzero values are RPC protocol errors such as PROG_UNAVAIL, PROG_MISMATCH, PROC_UNAVAIL, GARBAGE_ARGS, or AUTH_ERROR. getExports surfaces the numeric status verbatim. The server received the call but refused it at the RPC program level — the export list was never produced.

Source

Thrown at plugins/services/nfs.go:166

	verifierLen := binary.BigEndian.Uint32(reply[offset+4 : offset+8])
	if verifierLen > uint32(len(reply)-offset-8) {
		return nil, fmt.Errorf("truncated verifier")
	}
	offset += 8 + int(verifierLen)
	if pad := (4 - verifierLen%4) % 4; pad > 0 {
		if int(pad) > len(reply)-offset {
			return nil, fmt.Errorf("truncated verifier padding")
		}
		offset += int(pad)
	}

	// Accept status
	if offset+4 > len(reply) {
		return nil, fmt.Errorf("truncated")
	}
	acceptStatus := binary.BigEndian.Uint32(reply[offset : offset+4])
	if acceptStatus != 0 { // SUCCESS
		return nil, fmt.Errorf("accept status: %d", acceptStatus)
	}
	offset += 4

	return p.parseExportList(reply[offset:]), nil
}

func (p *NFSPlugin) parseExportList(data []byte) []string {
	var exports []string
	offset := 0
	for offset+4 <= len(data) {
		valueFollows := binary.BigEndian.Uint32(data[offset : offset+4])
		offset += 4
		if valueFollows == 0 {
			break
		}
		if offset+4 > len(data) {
			break
		}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Log/decode the status: 1=PROG_UNAVAIL, 2=PROG_MISMATCH, 3=PROC_UNAVAIL, 4=GARBAGE_ARGS, 5=AUTH_ERROR and fix accordingly
2. For PROG_MISMATCH, query portmapper for the supported mount protocol version and use it
3. For GARBAGE_ARGS, verify the EXPORT request body XDR encoding (procedure number 5, null args)
4. Confirm with `showmount -e <host>` whether a standard client succeeds

Example fix

// before
// hardcoded: prog 100005, vers 1
// after
// negotiate version via portmapper GETPORT which returns the server's mountd version
port, vers := portmapperGetPort(host, 100005)

null

null

exports, err := getExports(conn, xid)
if err != nil {
    var statusErr *AcceptStatusError
    if errors.As(err, &statusErr) {
        switch statusErr.Code {
        case 2: return retryWithVersion(host, statusErr.LowVers)
        case 4: return fmt.Errorf("GARBAGE_ARGS: check request encoding")
        default: return err
        }
    }
}

When it happens

Trigger: Calling Scan or TestNFSGetExportsHandlesVerifierPadding against a host whose mountd replies with a nonzero accept status — e.g. wrong mount program number/version in the request, or GARBAGE_ARGS from a malformed procedure payload.

Common situations: Requesting mount program 100005 v1 against a server that only supports v3; calling the wrong procedure number for EXPORT; server-side GSS-only configuration; GARBAGE_ARGS after a client encoding bug.

Related errors

• invalid reply
• reply rejected
• truncated
• invalid fragment size: %d
• short fragment payload: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/17ebc9ba675b26f4. Report an issue: GitHub.