This file has an approx 48 MB ADS: ><fs> ll /Temp/ total 13 drwxrwxrwx 1 root root 0 May 28 17:28 . drwxrwxrwx 1 root root 4096 Nov 1 2011 .. -rwxrwxrwx 1 root root 13 Oct 5 2011 ADS_test.txt ><fs> getxattrs /Temp/ADS_test.txt libguestfs: error: getxattrs: getxattr: Argument list too long The code in libguestfs tries to allocate enough space to store the return value using malloc. There is a correct check on the return from malloc, so I don't believe there is any possible DoS here. It also frees the buffer along the return path. [However through an abundance of caution I'm going to modify this code to add an upper limit, see below.] In any case what actually fails is the kernel call: vlen = getxattr (path, /* name of xattr */, /* return pointer */, /* ~ 48 MB */); because I was wrong before when I said there was no limit at all. In fact the limit in the kernel is XATTR_SIZE_MAX == 65536. So essentially there is no chance of returning ADSes using the standard way. You'll have to use the ntfs-3g streams_interface=windows mount option. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-p2v converts physical machines to virtual machines. Boot with a live CD or over the network (PXE) and turn machines into Xen guests. http://et.redhat.com/~rjones/virt-p2v