Audit Dashboard

DragonFlyBSD Kernel Audit — adversarial file-by-file kernel review of sys/. 5800 findings across 2809 tracked files. 5757 PoCs verified (3413 reproduced, 2568 fix-verified).

Critical

3211

pass 2 · new

uid=0 privesc

Findings by severity

Critical

High

700

Medium

1684

Low

2560

Info

838

Total valid: 5800

Audit progress by area

2809/2809 files reviewed (100.0%)

kern

174/174

net

309/309

vfs

175/175

22/22

crypto

27/27

250/250

dev

1407/1407

libs

81/81

contrib

364/364

All findings

Click a column header (ID / Sev / CVSS / Impact) to sort. Default order: CVSS descending.

Privilege escalations (uid=0) 13

The headline result. These findings were not only reproduced — the bug was driven all the way to a root shell as an unprivileged user (or a jail/sandbox escape). Each carries a full exploit chain in its evidence pack. Sorted by CVSS, most severe first (click any column header to re-sort).

ID	Sev	CVSS	Title	Impact	PoC
DF-3156	Critical	8.8	Dangling RRIP NM-CONTINUE chain: cd9660_rrip_defname fallback writes the ISO name at the un-reset advanced ana->outbuf — OOB write past altname[NAME_MAX] (kernel stack, lookup) and past the isoreaddir d_name area (kernel heap, readdir); verified unprivileged uid=0 Kernel memory corruption (UAF / OOB write) · sys/vfs/isofs/cd9660/cd9660_rrip.c:276 · pass 2 · new	uid0 → root	reproduced fixed
DF-3978	Critical	8.8	NVMM SVM: host IA32_SYSENTER_CS/ESP/EIP MSRs left guest-controlled after every vmrun — any process pivots to ring 0 via 2-byte `sysenter` Privilege escalation (general use) · sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1514 · pass 2 · new	uid0 → root	reproduced fixed
DF-5845	Critical	8.8	FW_ASYREQ bcopy writes to address-of-pointer xfer->send.payload - user-controlled kernel heap overwrite Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:560 · pass 2 · new	uid0 → root	reproduced fixed
DF-3197	High	8.8	devfs rule ioctls have no privilege/jail check: jailed root rewrites host-wide devfs visibility and permissions (jail escape) Privilege escalation (general use) · sys/vfs/devfs/devfs_rules.c:419 · pass 2 · new	uid0 → root	reproduced fixed
DF-4147	High	8.2	Arbitrary kernel read/write from the CUSE server: proc_rwmem_dfly uses the server-controlled peer_ptr as the raw kernel side of copyin()/copyout() Kernel memory corruption (UAF / OOB write) · sys/dev/misc/cuse/cuse.c:881 · pass 2 · new	uid0 → root	reproduced fixed
DF-3017	Critical	7.8	devfs node/cdev lifetime hole: nresolve→devfs_allocv drops devfs_lock on a raw devfs_node; concurrent unpriv pty teardown frees node+cdev → UAF write + sysref_get on freed cdev (proven panic 2/2) Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new	uid0 → root	reproduced
DF-5413	High	7.8	FW_SSTBUF -> 32-bit nchunk*npacket wrap in fwdev_allocbuf -> 0-segment fwdma buffer -> fwdma_v_addr() OOB seg[0] -> controlled kernel write (and read) via production fw_write/fw_read Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:504 · pass 2 · new	uid0 → root	reproduced fixed
DF-2769	High	7.0	Stale unix98 pty master re-open admitted by ptcopen (ptcclose disarms all gates): cross-user session takeover with root command injection when /dev/ptm is exposed by devfs rules Privilege escalation (general use) · sys/kern/tty_pty.c:585 · pass 2 · new	uid0 → root	reproduced fixed
DF-1326	Critical	7.8	Stack buffer overflow in mpr_user_pass_thru: copyin of user-controlled RequestSize into 12-byte MPI2_REQUEST_HEADER before bounds check Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_user.c:742	uid0 → root	reproduced fixed
DF-1359	Critical	7.8	Stack buffer overflow in mps_user_pass_thru via unbounded copyin into 12-byte tmphdr Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_user.c:747	uid0 → root	reproduced fixed
DF-0785	High	7.8	Heap buffer overflow in ntfs_ntlookupfile: rdbuf allocated to ir_size but filled with va_datalen bytes Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:867	uid0 → root	reproduced fixed
DF-0873	High	7.8	Stack buffer overflow in ntfs_readdir convname via double-wide NTFS_U28 expansion of crafted ie_fnamelen Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vnops.c:517	uid0 → root	reproduced fixed
DF-0931	Medium	7.1	setuid/setgid bit bypass in ffs_write via int truncation of size_t uio_resid Privilege escalation (general use) · sys/vfs/ufs/ufs_readwrite.c:220	uid0 → root	reproduced fixed

Reproduced + fix verified 2555

These findings have a working PoC that reproduced the bug, and the proposed fix was then validated the hard way: the patch was applied to a fresh kernel, the kernel rebuilt, and the exact same PoC re-run to confirm the bad behavior is gone (baseline reproduced, patched kernel clean). The fix closes the hole.

ID	Sev	CVSS	Title	Impact	PoC
DF-5799	High	8.8	hammer2_cleanup_devvp() unconditionally clears dev->si_mountpoint, stripping the kernel's raw-device write gate and double-mount protection from live hammer2 devices and from other filesystems' devices Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:1096	dos	reproduced fixed
DF-5825	High	8.8	kdmsg_state_msgrx() rxcmd REPLY-direction injection unlinks transaction state from the wrong red-black tree — peer-triggered UAF with fully controlled kernel pointer dereference Kernel memory corruption (UAF / OOB write) · sys/kern/kern_dmsg.c:810	panic	reproduced fixed
DF-5831	High	7.5	nlookup() retry path NULL-dereferences nd->nl_basench for nlookup_init_raw()/_root()-initialized nd — every NFS-server name lookup that hits a retry (concurrent rename, ESTALE, destroyed parent) panics the kernel in nfsd Base system — kernel core (kern) · sys/kern/vfs_nlookup.c:1380	panic	reproduced fixed
DF-5844	Medium	5.8	sysctl_sysctl_next_ls(): unbounded recursion level writes past newoid[CTL_MAXNAME] — value-controlled kernel stack smash from an unprivileged MIB walk Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sysctl.c:727	panic	reproduced fixed
DF-5836	Medium	5.7	hammer2_inode_create_normal stomps a live inode when the media-seeded inum allocator collides — only a compiled-out KKASSERT guards it (panic on INVARIANTS; meta clobber + duplicate on-media chain insertion on production kernels) Hammer2 · sys/vfs/hammer2/hammer2_inode.c:1156	panic	reproduced fixed
DF-5839	Medium	5.7	lwkt_alloc_thread() gd_freetd rebirth wipes live td_refs: foreign-cpu lwkt_hold() in the lwkt_exit() publication window turns a stale lwkt_rele() into refcount write-after-reuse and permanent exit livelock Base system — kernel core (kern) · sys/kern/lwkt_thread.c:365	panic	reproduced fixed
DF-5787	Low	5.7	Stale b_bio1.bio_flags survive buffer-cache recycling: vfs_bio.c performs no BIO_DONE/BIO_WANT hygiene when a buffer header is released and reacquired, so one forgetful/abandoning completion path permanently poisons the header — next bread() panics at vn_strategy's KKASSERT, or (without that guard) biowait() returns before device DMA completes Base system — kernel core (kern) · sys/kern/vfs_bio.c:747	panic	reproduced fixed
DF-5784	High	5.5	hammer2_chain_cmp key-range end overflow: crafted bref with key + (1<<keybits) > 2^64 wraps the comparator range, mis-ordering the in-memory rbtree (pruned by RB_SCAN, duplicated by every lookup) and regressing iteration keys — unkillable getdents live-lock, hung umount, and unbounded kernel chain leak from a mounted crafted image Hammer2 · sys/vfs/hammer2/hammer2_chain.c:109	dos	reproduced fixed
DF-5785	Medium	5.5	Unvalidated on-disk blockref type byte: any media array slot with type outside 1..6 selected by lookup reaches hammer2_chain_alloc's raw panic() — deterministic kernel panic (mount + one directory read) on production kernels Hammer2 · sys/vfs/hammer2/hammer2_chain.c:207	panic	reproduced fixed
DF-5806	Medium	5.5	soreceive() zero-progress restart with MSG_PEEK: recv() on a zero-byte AF_UNIX record spins forever in kernel mode — unprivileged, unkillable, permanent whole-system DoS Base system — kernel core (kern) · sys/kern/uipc_socket.c:1596	dos	reproduced fixed
DF-5808	Medium	5.5	HAMMER mountctl(MOUNTCTL_MOUNTFLAGS) double-counts the result length — unprivileged OOB kernel heap read via unchecked copyout Kernel memory leaks / uninitialized disclosure · sys/kern/vfs_subr.c:1281	leak	reproduced fixed
DF-5816	Medium	5.5	unp_pcblist sysctl exports raw kernel pointers (unpcb/socket/sockaddr/vnode addresses + the AF_UNIX connection graph) to unprivileged users Privilege escalation (general use) · sys/kern/uipc_usrreq.c:1476	leak	reproduced fixed
DF-5829	Medium	5.5	vm_object_page_clean() partial-range clean is a silent no-op — msync(MS_SYNC) performs no writeback for any partial range on UFS and for EVERY range on hammer2 (default fs) Base system — virtual memory · sys/vm/vm_object.c:981	dos	reproduced fixed
DF-5830	Medium	5.5	sys_sendmsg() leaks the MT_CONTROL mbuf when kern_sendmsg() early-returns at holdsock() failure — unprivileged, unbounded, permanent kernel mbuf-pool exhaustion (reboot-only local DoS) Base system — kernel core (kern) · sys/kern/uipc_syscalls.c:799	dos	reproduced fixed
DF-5792	High	5.3	closef() filedesc_to_leader chain walk vs fdfree() unlink+kfree: cross-lock use-after-free (unprivileged kernel fatal trap at closef+0x80) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_descrip.c:3071	panic	reproduced fixed
DF-5812	Medium	5.3	swaponvp() rounds swap size UP to the stripe boundary, publishing up to 63 pages of phantom swap per device: OOB swap I/O past device EOF and an unkillable pageout retry livelock under swap pressure Kernel memory corruption (UAF / OOB write) · sys/vm/swap_pager.c:537	dos	reproduced fixed
DF-5807	Medium	5.1	vop_write_dirent() performs an unbounded source bcopy; UFS OFSFMT readdir passes an unvalidated namlen — crafted old-format FFS image reads up to 255 bytes past the buffer-cache buffer Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_subr.c:2566	panic	reproduced fixed
DF-5802	Low	5.1	vm_fault_unwire() UKSMAP fictitious asymmetry: munlock/exit-unwire of mlock()ed /dev/upmap or /dev/mem UKSMAP ranges runs vm_page_unwire() on never-wired pages and an unchecked PHYS_TO_VM_PAGE() array index Base system — virtual memory · sys/vm/vm_fault.c:2614	panic	reproduced fixed
DF-5822	Medium	4.7	sysctl_kern_proc() uses an unreferenced curproc->p_ucred (cr1) across blocking copyouts — ucred UAF read defeats ps_showallprocs=0 visibility filtering (unprivileged info disclosure) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_proc.c:1669	leak	reproduced fixed
DF-5843	Medium	4.4	hammer2_xop_inode_chain_sync: KKASSERT(0) kernel panic on INODE/DIRENT-typed child during file truncation — crafted/corrupted-image local DoS Hammer2 · sys/vfs/hammer2/hammer2_xops.c:1570	panic	reproduced fixed
DF-5789	Medium	4.1	devclass_delete_driver() is non-transactional: the first detach veto irreversibly kills every already-detached unit of the driver while the module unload wedges (in-file root of the DF-5544/5562/5635 detach-veto family) Base system — kernel core (kern) · sys/kern/subr_bus.c:888	dos	reproduced fixed
DF-5818	Medium	3.3	hammer2_write_file never enforces the append-only chflag (uappnd/sappnd): writable descriptors can overwrite arbitrary offsets of append-only files Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:997	dos	reproduced fixed
DF-5793	Low	3.3	kern_dup() dup2/dup3 onto an in-flight reserved descriptor: unbounded uninterruptible retry loop + unrate-limited kprintf console/msgbuf flood Base system — kernel core (kern) · sys/kern/kern_descrip.c:1143	dos	reproduced fixed
DF-5794	Low	3.3	ttyflush(FREAD\|FWRITE) queues the IXOFF resume character via ttyunblock() and then discards it with the trailing output flush — the peer that honoured XOFF is permanently stopped while the kernel believes it is unblocked Base system — kernel core (kern) · sys/kern/tty.c:1453	dos	reproduced fixed
DF-5817	Low	3.3	hammer2_vop_write checks RLIMIT_FSIZE against the pre-append offset, so O_APPEND writes bypass the file-size rlimit entirely (no EFBIG, no SIGXFSZ) Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:869	dos	reproduced fixed
DF-5790	Low	2.5	device_delete_child() on a probed-but-unattached (DS_ALIVE) device leaks the driver softc: device_detach()'s state short-circuit skips device_set_driver(dev, NULL) and kobj_delete frees only the device object Base system — kernel core (kern) · sys/kern/subr_bus.c:1306	leak	reproduced fixed
DF-5801	Info	0.5	vm_page_bits() and the valid/dirty setter family have no bounds validation in release kernels: KASSERT-only guard, shift UB, and silent uint8_t over-validation of m->valid/m->dirty Kernel memory leaks / uninitialized disclosure · sys/vm/vm_page.c:3905	none	reproduced fixed
DF-2748	High	9.1	Full-duplex journal ack-path loss permanently wedges all writers in uninterruptible, SIGKILL-immune kernel sleep — and mountctl -d frees the journal out from under the sleepers (demonstrated wake-through-reuse UAF) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_journal.c:330 · pass 2 · new	dos	reproduced fixed
DF-3422	High	9.1	gre(4) decapsulation keeps the outer packet's M_LENCHECKED and computes the GRE header length from attacker flag bits with no presence check (m_len/m_pkthdr.len int underflow) — one unauthenticated GRE packet panics the default INVARIANTS kernel; lying-length/negative-m_len state flows on production kernels (DF-3321's fix covered gif+mpls+ip_mroute but missed gre) Base system — network stack · sys/net/gre/if_gre.c:148 · pass 2 · new	panic	reproduced fixed
DF-3423	High	9.1	gre_mobile_input(): neither M_HASH nor M_LENCHECKED cleared, inner ip_len double-counts the outer IP header (ANY valid mobile-GRE packet panics INVARIANTS kernels), and a truncated datagram yields a negative-length bcopy — reproduced as an unbounded kernel-heap overwrite (mbuf-metadata smash, secondary panic in m_free) Kernel memory corruption (UAF / OOB write) · sys/net/gre/if_gre.c:237 · pass 2 · new	panic	reproduced fixed
DF-3398	High	9.0	Outbound-ICMP NAT heap OOB write: byte-swapped alias_port used as icmp_in[] index (distinct generator from DF-0569/0570) Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_nat/ip_fw3_nat.c:310 · pass 2 · new	panic	reproduced fixed
DF-2675	Critical	8.8	allocbuf() maps 17 pages into the 16-page MAXBSIZE per-header KVA slot when (loffset & PAGE_MASK)+size > MAXBSIZE — PTE written into the next buffer header's slot, aliasing one page between two live kernel buffers (cross-buffer R/W, info leak, panic) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_bio.c:3039 · pass 2 · new	panic	reproduced fixed
DF-3879	Critical	8.8	dsp_mmap_single 64-bit offset-overflow bounds bypass + 32-bit truncation in sndbuf_getbufofs maps arbitrary kernel memory (b->buf + attacker-chosen ofs) read/write into user PTEs Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/dsp.c:2342 · pass 2 · new	panic	reproduced fixed
DF-2707	High	8.8	Duplicate transmitted DELETE re-runs the state close sequence: double RB_REMOVE on a stale node plus phantom rbtree refcount drop — state-tree corruption and premature kdmsg_state_free (UAF), peer-driven on production kernels Kernel memory corruption (UAF / OOB write) · sys/kern/kern_dmsg.c:1667 · pass 2 · new	panic	reproduced fixed
DF-2755	High	8.8	TIOCSCTTY reassignment performs unsynchronized read-modify-write of session->s_ttyvp in vn_ioctl/devfs_fo_ioctl: racing twins double-vrele() the old controlling-tty vnode → v_refcnt underflow → premature vnode destruction → use-after-free Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_vnops.c:1049 · pass 2 · new	panic	reproduced fixed
DF-2922	High	8.8	proplib type confusion: unvalidated "arguments" object mtx_lock()ed as an array before type check → unprivileged kernel corruption / panic / livelock Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_quota.c:242 · pass 2 · new	panic	reproduced fixed
DF-2929	High	8.8	systimer_init_oneshot() bzero of a queued timer silently corrupts gd_systimerq; reached via DRM hrtimer_start re-arm on every i915 auto-forcewake register access Privilege escalation (general use) · sys/kern/kern_systimer.c:360 · pass 2 · new	panic	reproduced fixed
DF-3015	High	8.8	ufs_symlink controlled kernel heap overflow via unvalidated on-disk fs_maxsymlinklen — bcopy of up to 1023 attacker bytes into the 60-byte i_shortlink, ~919 bytes past the struct inode slab chunk Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_vnops.c:1562 · pass 2 · new	panic	reproduced fixed
DF-3137	High	8.8	Unvalidated on-disk ab_freeoff used as insertion offset: controlled 12-byte kernel-heap OOB write at attacker-chosen offset (hpfs_addextent:452 / hpfs_addextentr:643 / hpfs_concatalsec:278) Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_alsubr.c:278 · pass 2 · new	panic	reproduced fixed
DF-3138	High	8.8	AE_SPLIT parent-fixup bcopy(ranp, AB_LASTANP(rabp), 16) writes one alnode past the entry array; split source bcopy reads past the buffer (hpfs_addextent:410 / hpfs_addextentr:599 / hpfs_splitalsec:229) Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_alsubr.c:229 · pass 2 · new	panic	reproduced fixed
DF-4475	High	8.8	IOCATAREQUEST unclamped timeout: 1-tick completion-wait fallback completes and frees a channel-owned ata_request (UAF -> Fatal trap 12 in ata_start) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-all.c:486 · pass 2 · new	panic	reproduced fixed
DF-4515	High	8.8	drm_prime fd_to_handle: port's dma_buf_get() drops its file reference before returning, making drm_prime.c's trailing dma_buf_put() an unbalanced fdrop — refcount underflow, premature free of dma_buf+GEM object while the prime fd and rb-tree handle are still live, and an unreference'd dma_buf* used across the whole ioctl (racing-close UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_prime.c:802 · pass 2 · new	panic	reproduced fixed
DF-5308	High	8.8	usb_filter_detach() error path leaves the destroyed knote linked in the live usb_fifo klist — KNOTE() then walks freed memory and dispatches kn->kn_fop->f_event through attacker-reclaimed heap (unprivileged kernel UAF with controlled indirect call) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_dev.c:1239 · pass 2 · new	panic	reproduced fixed
DF-5741	High	8.8	Every raw HCI socket is created HCI_PRIVILEGED: the privilege check runs on the netmsg port where curproc==NULL and caps_priv_check_self() evaluates the lwp-less netisr thread — the unprivileged opcode/event security filter is dead code Privilege escalation (general use) · sys/netbt/hci_socket.c:644 · pass 2 · new	privesc	reproduced fixed
DF-5752	High	8.8	netbt hands rx mbufs to netisr_queue() (embedded netmsg) and frees them while still port-queued: the lwkt netisr port queue is operated through freed mbuf memory and corrupts (deterministic panic; same-node double-link on chunk reuse) Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_unit.c:437 · pass 2 · new	panic	reproduced fixed
DF-3062	High	8.4	ext2_nodealloccg INODE_UNINIT: memset(b_data, 0, ipg/8 - 1) underflows size_t for mount-legal ipg < 8 — unbounded kernel-heap memset on first create Base system — filesystems · sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new	panic	reproduced fixed
DF-5427	High	8.4	Signed/unsigned index confusion in VIDIOC_ENUM_FRAMEINTERVALS: unprivileged OOB read of kernel heap at attacker-controlled negative offset (info leak + fatal-trap DoS) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/uvc/uvc_v4l2.c:562 · pass 2 · new	leak	reproduced fixed
DF-3323	Medium	8.3	Shared-key 802.11 auth accepts cleartext challenge response: full authentication bypass without the WEP key Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hostap.c:851 · pass 2 · new	auth_bypass (remote RF-adjacent, no key: authorized+associated, AID, EAPOL passthrough; cleartext data when DROPUNENC off)	reproduced fixed
DF-2647	High	8.2	hammer2_ioctl_pfs_get trusts on-media uint16 name_len past a KKASSERT — production kernels get a controlled kernel heap OOB write up to ~64KB Hammer2 · sys/vfs/hammer2/hammer2_ioctl.c:494 · pass 2 · new	panic	reproduced fixed
DF-3003	High	8.2	hammer_update_itimes() in-place atime/mtime update writes past the inode record's 16KB block on crafted HAMMER1 images — no data_len validation at extraction and hammer_crc_test_leaf() accepts any wrong-length INODE record via the 0-return CRC bypass Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_inode.c:1446 · pass 2 · new	panic	reproduced fixed
DF-3078	High	8.2	ffs_reload (MNT_RELOAD) adopts the re-read superblock's geometry without validating it against the mount-time allocations — heap OOB write with attacker-controlled length and content, divide-by-zero, and heap OOB read disclosed to the media Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_vfsops.c:484 · pass 2 · new	panic	reproduced fixed
DF-3091	High	8.2	pcbmap() accepts cluster numbers beyond pm_maxcluster (fatmask + reserved-range checks only) — crafted FAT chain yields cross-volume kernel-mediated read/write anywhere on the backing device beyond the mounted volume Kernel memory leaks / uninitialized disclosure · sys/vfs/msdosfs/msdosfs_fat.c:184 · pass 2 · new	cross-volume read+write: kernel-mediated out-of-volume disclosure and persistent tampering of device sectors beyond the mounted FAT volume (crafted media; root mount or vfs.usermount=1)	reproduced fixed
DF-3106	High	8.2	ufs_direnter compaction loop heap OOB write via crafted d_namlen (DIRSIZ >> d_reclen) with debug.dircheck=0 — attacker-controlled kernel heap corruption past directory fragment buffers Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_lookup.c:808 · pass 2 · new	panic	reproduced fixed
DF-3164	High	8.2	Failed MNT_UPDATE remount leaves mp->mnt_data dangling: use-after-free of struct udf_mnt on the live mount (double free at unmount) Kernel memory corruption (UAF / OOB write) · sys/vfs/udf/udf_vfsops.c:153 · pass 2 · new	panic	reproduced fixed
DF-3167	High	8.2	hammer_reblock_data() bcopy OOB kernel write/read: unvalidated on-disk leaf data_len/data_offset plus >16KB allocations that are not buffer-contained Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_reblock.c:464 · pass 2 · new	panic	reproduced fixed
DF-3168	High	8.2	rebalance_node trusts unvalidated on-disk B-Tree node counts: avg_elms pack loop writes past the 63-element elms[] array of the kmalloc'd 4096-byte node copies — attacker-controlled heap overflow (observed slab-metadata smash), OOB reads, and count>63 persisted to disk Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_rebalance.c:330 · pass 2 · new	panic	reproduced fixed
DF-3321	High	8.2	gif(4) decapsulation keeps the outer packet's M_LENCHECKED — inner IPv4 header never length-validated on requeue into ip_input(): one-packet unauthenticated panic on default INVARIANTS kernels, lying-length corruption on production kernels (mpls label-0 and ip_mroute X_ipip_input decaps clear neither flag) Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_input.c:489 · pass 2 · new	panic	reproduced fixed
DF-3381	High	8.2	catchpacket() bh_caplen unsigned underflow: BPF_MINBUFSIZE(32) < bif_hdrlen(34/36) on x86-64 gives a ~4GiB copy into kmalloc(32) (heap overflow, deterministic panic) Kernel memory corruption (UAF / OOB write) · sys/net/bpf.c:794 · pass 2 · new	panic	reproduced fixed
DF-3382	High	8.2	Stale undersized store buffers: BIOCSBLEN after bpfdetach (bd_bif==NULL, bd_sbuf allocated) desynchronizes bd_bufsize from the kmalloc'd buffers -> ~512KiB controlled overflow past kmalloc(4096) Kernel memory corruption (UAF / OOB write) · sys/net/bpf.c:795 · pass 2 · new	panic	reproduced fixed
DF-3439	High	8.2	ipfw3 skipto stale next_rule cache: rule deletion leaves a dangling cached target; packet matching executes the freed rule (deny-all blackhole, wild filter_funcs dispatch, deterministic panic) Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_basic.c:181 · pass 2 · new	panic	reproduced fixed
DF-3444	High	8.2	bpf_filter() executes unvalidated BPF programs via ipfw3_layer4 check_bpf: BPF_LD\|BPF_MEM/BPF_ST/BPF_STX with unchecked pc->k give arbitrary-offset kernel stack read/write and full RIP control Kernel memory corruption (UAF / OOB write) · sys/net/bpf_filter.c:365 · pass 2 · new	panic	reproduced fixed
DF-4132	High	8.2	tokenize() writes one pointer per token into the fixed 64-entry static token[] with no bound: kernel static-data overflow → control-flow hijack (kernel executes attacker bytes) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:78 · pass 2 · new	panic	reproduced fixed
DF-4133	High	8.2	vinum_scandisk() copies on-disk config lines into config_line[2048] with no length bound: ~129 KB kernel heap overflow from crafted media, before any validation Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:1621 · pass 2 · new	panic	reproduced fixed
DF-4466	High	8.2	dm-crypt: use-after-free of target config - async completions race table destroy (suspend/reload/resume and remove paths have no in-flight drain) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/crypt/dm_target_crypt.c:698 · pass 2 · new	panic	reproduced fixed
DF-4842	High	8.2	kthread_stop() sleeps a fixed 1 second then lwkt_free_thread()s a struct thread DragonFly kthreads reclaim themselves — free of a live TDF_RUNNING thread (panic) or thread_cache double-entry (same struct thread handed to two owners) on every drm_sched_fini Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_kthread.c:89 · pass 2 · new	panic	reproduced fixed
DF-2739	Medium	8.2	linker_file_unload() veto path drops the caller's reference on a failed unload — refcount underflow on a live linker_file → premature teardown under a live dependent → use-after-free Kernel memory corruption (UAF / OOB write) · sys/kern/kern_linker.c:514 · pass 2 · new	panic	reproduced fixed
DF-2910	Medium	8.2	disklabel64 read-path trust: crafted-media partition fields yield OOB absolute-media-offset I/O — cross-slice access, mod-2^64 wraparound slice escape, and ds_reserved EROFS label-area write bypass (concrete impact upgrade of DF-0134) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_disklabel64.c:183 · pass 2 · new	dos	reproduced fixed
DF-3255	Medium	8.2	nfs_clientd() use-after-free and double-free of the nfsmount on non-KERB NFS mounts: nfs_unmount() frees nmp (and the EINTR path's own dounmount frees both nmp and mp) while the clientd loop keeps executing against the freed memory — reproduced kernel double-free panic 2/2 Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_kerb.c:106 · pass 2 · new	panic	reproduced fixed
DF-4063	Medium	8.2	fdformat() 20 s timeout double-completes its bio and recycles the pbuf under the fdc driver -> double-linked bio in fdc->bio_queue -> kernel panic (queue corruption / UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/fd/fd.c:2276 · pass 2 · new	panic	reproduced fixed
DF-4623	Medium	8.2	virtqueue: used-ring completion ownership never validated at runtime — duplicate/foreign (in-bounds) id underflows ndescs, cycles the descriptor free list, aliases in-flight descriptors and mis-attributes driver completion cookies Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/virtio/virtio/virtqueue.c:544 · pass 2 · new	panic	reproduced fixed
DF-4741	Medium	8.2	drm_sched_fini returns without cancelling the armed work_tdr or draining ring_mirror_list → delayed-work/callout executes on the freed scheduler after driver teardown (softclock panic) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/scheduler/sched_main.c:652 · pass 2 · new	panic	reproduced fixed
DF-4754	Medium	8.2	ena_com_rx_pkt propagates the device-controlled RX completion req_id with no bounds check → driver indexes rx_buffer_info[req_id] far out of bounds (OOB read → wild mbuf* writes + kernel-memory disclosure) Kernel memory leaks / uninitialized disclosure · sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:536 · pass 2 · new	panic	reproduced fixed
DF-5443	Medium	8.2	pnp_read_bytes() error path abandons the grown buffer — caller frees the stale pre-growth pointer: kernel heap double free + leak of the replacement Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnp.c:506 · pass 2 · new	panic	reproduced fixed
DF-5710	Medium	8.2	smbfs_mount: strncpy budget 'pe - pc - 2' can be -1, wrapping to (size_t)-1 — unbounded kernel heap copy during smbfs mount Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_vfsops.c:170 · pass 2 · new	panic	reproduced fixed
DF-3035	High	8.1	FFS allocator uses unvalidated on-disk cylinder-group header fields as kernel-memory offsets/indexes — crafted image gives attacker-offset OOB read/write on first allocation Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_alloc.c:1010 · pass 2 · new	panic	reproduced fixed
DF-3192	High	8.1	fuse_mount() never cross-checks args.fd with the looked-up /dev/fuse name: devfs_get_cdevpriv() returns ANY driver's per-fd private data, so a foreign fd (cuse/netmap/evdev/ipmi/nvmm) is type-confused with struct fuse_mount and a fuse_mount layout is written into the foreign live object Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vfsops.c:140 · pass 2 · new	panic	reproduced fixed
DF-3272	High	8.1	Remote peer heap out-of-bounds write via IPCP VJ Max-Slot-Id: sl_compress_init(sp->pp_comp, p[4]) unclamped, tstate[16] loop runs to peer-chosen 255 Kernel memory corruption (UAF / OOB write) · sys/net/sppp/if_spppsubr.c:2976 · pass 2 · new	memcorrupt	reproduced fixed
DF-4634	High	8.1	snd_clone_gc()/snd_clone_destroy() free pending-INVOKE clone entries under stalled openers: UAF write/read in snd_clone_acquire/ref plus a persistent unprivileged cdev+devfs-node leak that pins sound.ko unloadable Kernel memory corruption (UAF / OOB write) · sys/dev/sound/clone.c:381 · pass 2 · new	dos	reproduced fixed
DF-5403	High	8.1	sg(4) SG_IO submits CCBs with data_ptr=NULL and dxfer_len>0: deterministic NULL-page-write kernel panic in nata/ahci transports and bus_dmamap_load(NULL) PRDT at physical address 0 Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:543 · pass 2 · new	panic	reproduced fixed
DF-2875	High	8.0	Pipelined BLK_WRITE in one transaction: single-slot iost->data aux tracking frees the most-recent aux while its bio is still in flight (deterministic UAF on bp->b_data) and leaks all earlier aux Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskiocom.c:440 · pass 2 · new	leak	reproduced fixed
DF-4106	High	8.0	vge_rxeof SOF branch ignores vge_newbuf() failure: the mbuf is left referenced by BOTH the head chain and vge_rx_mbuf[]/descriptor -> double-free in vge_stop, use-after-free via if_input, NIC DMA into live/freed cluster, and RX-ring wedge -> serializer-held vge_intr livelock Kernel memory corruption (UAF / OOB write) · sys/dev/netif/vge/if_vge.c:1294 · pass 2 · new	panic	reproduced fixed
DF-2687	High	7.9	TIOCSCTTY reassignment orphans the old tty's t_session, yielding an unprivileged use-after-free of struct session (deterministic panic; ctty hijack of recycled sessions) Kernel memory corruption (UAF / OOB write) · sys/kern/tty.c:1190 · pass 2 · new	panic	reproduced fixed
DF-2857	High	7.9	shm_deallocate_segment keeps the segment findable during its own blocking teardown: racing IPC_RMID double-deallocates the vm_object (guaranteed panic; kfree double-free door) Kernel memory corruption (UAF / OOB write) · sys/kern/sysv_shm.c:180 · pass 2 · new	panic	reproduced fixed
DF-3027	High	7.9	fuse_vop_getattr returns success without initializing *a_vap (dead mount / ENOSYS-latched GETATTR) — unprivileged kernel-stack info leak incl. kernel pointers via stat()/fstat() Kernel memory leaks / uninitialized disclosure · sys/vfs/fuse/fuse_vnops.c:312 · pass 2 · new	leak	reproduced fixed
DF-5688	High	7.9	idr_remove()/idr_get_node() conflate per-leaf state with the cumulative Fenwick counter: phantom decrement yields duplicate-id issuance with silent kernel-object pointer overwrite and a deterministic KKASSERT panic Kernel memory corruption (UAF / OOB write) · sys/libkern/linux_idr.c:187 · pass 2 · new	panic	reproduced fixed
DF-2950	Medium	7.9	Jailed uid-0 passes the sysctl write gate and can write every host-global RW MIB defined here — kern.securelevel raised irreversibly from inside a jail (host root gets EPERM lowering it), plus kern.hostid/domainname/bootfile/maxprocperuid/maxposixlocksperuid/tls_extra corruption; CTLFLAG_PRISON is dead Privilege escalation (general use) · sys/kern/kern_mib.c:142 · pass 2 · new	dos	reproduced fixed
DF-5746	Medium	7.9	kern.iconv.add accepts unvalidated converter table sizes: ia_datalen=0 yields a deterministic NULL-deref panic in iconv_xlat16_open, and short tables yield attacker-directed kernel heap OOB reads disclosed to userspace through converted filenames Kernel memory leaks / uninitialized disclosure · sys/libiconv/iconv.c:410 · pass 2 · new	leak	reproduced fixed
DF-2878	Low	7.9	l32_setdisklabel installs partition tables with no slice-bounds validation — DIOCSDINFO32/DIOCWDINFO32 partition devices read/write OUTSIDE the slice (label64 twin validates the same fields) Base system — kernel core (kern) · sys/kern/subr_disklabel32.c:306 · pass 2 · new	leak	reproduced fixed
DF-3996	Critical	7.8	Unclamped phase offset in the envy24 DMA emulators: second-channel start writes/reads up to ~2x past the shared play/record DMA buffers — controlled 32-bit kernel heap write (S32_LE) and kernel heap disclosure to userspace Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/envy24.c:1414 · pass 2 · new	panic	reproduced fixed
DF-4012	Critical	7.8	mps MPTIOCTL_REG_ACCESS: unvalidated u32 RegOffset gives operator-group users arbitrary kernel read/write in the 4 GiB window above the register BAR Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_user.c:1958 · pass 2 · new	panic	reproduced fixed
DF-4020	Critical	7.8	mpr MPTIOCTL_REG_ACCESS: unvalidated u32 RegOffset gives operator-group users arbitrary kernel read/write in the 4 GiB window above the register BAR (twin of DF-4012) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_user.c:2194 · pass 2 · new	panic	reproduced fixed
DF-2616	High	7.8	No radix-alignment/64KB-window validation of on-disk data_off — chain->data + chain->bytes overruns the DIO buffer (OOB read/write) Hammer2 · sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new	panic	reproduced fixed
DF-2620	High	7.8	Crafted on-disk pfs_nmasters drives OOB thread-array access and arbitrary kfree in hammer2 unmount (xop_helper_cleanup) Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:527 · pass 2 · new	panic	reproduced fixed
DF-2691	High	7.8	EVFILT_SIGNAL knote use-after-free: knote stays linked into struct proc after the target is reaped; kqueue teardown runs SLIST_REMOVE on freed kernel memory Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sig.c:2667 · pass 2 · new	panic	reproduced fixed
DF-2747	High	7.8	Journal memfifo reservation protocol is not MP-safe: concurrent VOPs on a journaled mount overlap reservations and corrupt the raw record chain (unprivileged reproducible panic; release-kernel OOB-read/livelock) Base system — kernel core (kern) · sys/kern/vfs_journal.c:527 · pass 2 · new	panic	reproduced fixed
DF-2778	High	7.8	mq_notify_proc is an unreferenced struct proc *: registrant exit with an inherited descriptor leaves a dangling pointer consumed by mq_send1 (PHOLD + ksignal on freed kernel heap) — deterministic UAF with cross-process signal injection Kernel memory corruption (UAF / OOB write) · sys/kern/sys_mqueue.c:988 · pass 2 · new	dos	reproduced fixed
DF-2826	High	7.8	elf_getfiles() drops an unowned reference on the checkpoint file when fdalloc() fails: struct file refcount underflow, premature fo_close/vrele/ffree, UAF, success-masking, tempfp leak Kernel memory corruption (UAF / OOB write) · sys/kern/kern_checkpoint.c:664 · pass 2 · new	panic	reproduced fixed
DF-2851	High	7.8	netmsg_so_notify abort path derives lock, list and reply identity from nm_so, which soaccept_predicate mutates mid-flight on a foreign CPU: unserialized abort → wrong-list TAILQ_REMOVE, illegal pool-token release, double reply Base system — kernel core (kern) · sys/kern/uipc_msg.c:744 · pass 2 · new	panic	reproduced fixed
DF-2869	High	7.8	tq_running single-slot with unlocked clear breaks taskqueue_cancel/drain under concurrent runners → premature-free UAF Kernel memory corruption (UAF / OOB write) · sys/kern/subr_taskqueue.c:407 · pass 2 · new	panic	reproduced fixed
DF-3139	High	7.8	hpfs_hpbmap treats al_len==0 alleaf as an infinite extent: unprivileged arbitrary raw-device sector read/write via ordinary pread/pwrite Base system — filesystems · sys/vfs/hpfs/hpfs_alsubr.c:118 · pass 2 · new	dos	reproduced fixed
DF-3216	High	7.8	ext2 MNT_RELOAD adopts a new block size without re-deriving um_nindir/um_bptrtodb/um_seqinc/f_iosize — mis-mapped I/O (deterministic panic), OOB read, and 4-byte-granular OOB heap write in the indirect-block walks of ext2_bmaparray/ext2_getlbns/ext2_balloc Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_bmap.c:126 · pass 2 · new	panic	reproduced fixed
DF-3232	High	7.8	Unvalidated fs_fragshift scales ffs_subr.c block-bitmap byte indexes up to 8x past the cylinder-group bitmap — OOB read plus single-byte 0x00/0xff OOB write at attacker-chosen offset, from one unprivileged ftruncate() on a crafted mount (silent write persisted to media) Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_subr.c:195 · pass 2 · new	panic	reproduced fixed
DF-3233	High	7.8	ffs_blkatoff hands directory code an out-of-bounds *res pointer on crafted-geometry mounts (blkoff via unvalidated fs_qbmask vs blksize-derived buffer) — unprivileged creat/touch reads and writes directory-entry data tens of KB past the buffer; deterministic fatal supervisor-write trap Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_subr.c:80 · pass 2 · new	panic	reproduced fixed
DF-3250	High	7.8	ext2_alloc_vnode EBUSY-collision handler double-frees the inode (kernel heap double-free/UAF, deterministic panic) — v_data published before ext2_ihashins, synchronous reclaim frees the handler's inode first; plus permanent lost-wakeup D-state hang in the same hand-rolled ext2fs_inode_hash_lock Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_ihash.c:1313 · pass 2 · new	panic	reproduced fixed
DF-3368	High	7.8	nm_bdg_preflush: unbounded NS_MOREFRAG fragment chains overrun the nkr_ft forwarding table — linear heap OOB write with attacker-chosen pointer values, u_int-wrap wild write ~4GiB above the object, and uint8 ft_frags truncation livelock Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_vale.c:984 · pass 2 · new	panic	reproduced fixed
DF-3797	High	7.8	Device-supplied register offsets from CREATE_SQ/CREATE_CQ replies cached unvalidated — every doorbell/unmask becomes an arbitrary-offset kernel write by the guest CPU Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena.c:1049 · pass 2 · new	panic	reproduced fixed
DF-4363	High	7.8	mps_config_get_man_pg10 allocates a fixed 0x5C-byte buffer but DMAs firmware PageLength*4 bytes into it - kernel heap overflow (the file's only fixed-size page allocation) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_config.c:249 · pass 2 · new	panic	reproduced fixed
DF-4451	High	7.8	Heap out-of-bounds write (4 sites) from temporal divergence of _CRS/_PRS evaluations — pl_links sized by one evaluation, indexed by a later one Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_pci_link.c:235 · pass 2 · new	dos	reproduced fixed
DF-4506	High	7.8	i915_gem_context unlocked handle lookups race idr_grow's synchronous kfree of the IDR node array (DragonFly shim has no RCU) -> use-after-free read returns attacker-groomed contents as struct i915_gem_context * Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_context.c:831 · pass 2 · new	panic	reproduced fixed
DF-4521	High	7.8	drm_mm_for_each_node_in_range leaks the unallocated head_node sentinel into the caller's body and never terminates when end > mm end; i915_gem_evict_for_node's unclamped end += 4K turns it into a livelock or fake-i915_vma unbind Base system — drivers · sys/dev/drm/drm_mm.c:171 · pass 2 · new	dos	reproduced fixed
DF-4559	High	7.8	sassc->targets[] sized facts->MaxTargets but IR volume mapping IDs run to MaxTargets+MaxVolumes-1: mpssas_volume_add and the IR-config REMOVED branch write out of bounds (fw-controlled u64 at fixed offset) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas_lsi.c:847 · pass 2 · new	panic	reproduced fixed
DF-4631	High	7.8	radeon MST destroy_connector frees a kref-counted drm_connector raw (drm_connector_cleanup+kfree from the topology worker): UAF for in-flight ioctls, double kfree via the kref release path, and an unbounded per-flap fake-encoder leak Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_dp_mst.c:288 · pass 2 · new	panic	reproduced fixed
DF-4646	High	7.8	nvme(4) device teardown vs in-flight data-path I/O: use-after-free of the namespace softc and I/O queues -> kernel divide-by-zero panic (Fatal trap 18 in nvme_get_request) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nvme/nvme_disk.c:115 · pass 2 · new	panic	reproduced fixed
DF-4665	High	7.8	smu_get_voltage_dependency_table_ppt_v1 copies VBIOS-controlled count records into callers' fixed entries[8] ODN tables — heap OOB write of struct smu7_hwmgr (up to 6916 attacker-controlled bytes) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:675 · pass 2 · new	dos	reproduced fixed
DF-4740	High	7.8	drm_sched_job_recovery re-runs completed jobs across its unlocked run_job() window racing drm_sched_job_finish → UAF (job + drm_sched_fence freed, parent write and cb armed inside freed heap, panic on signal) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/scheduler/sched_main.c:368 · pass 2 · new	panic	reproduced fixed
DF-4748	High	7.8	Use-after-free of amdgpu_dm_connector via stale dc_sink->priv in the dm MST payload/DPCD helpers (connector kfree'd while an enabled stream's dc_sink keeps the back-pointer alive) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:197 · pass 2 · new	memcorrupt	reproduced fixed
DF-5008	High	7.8	amdgpu_vram_mgr_new: non-power-of-two pages_per_node breaks the num_nodes bound — one-struct heap OOB write past the kvmalloc_array node array, unprivileged via GEM_CREATE in.alignment Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vram_mgr.c:183 · pass 2 · new	heap-oob-write (kernel-space primitive reproduced: verbatim amdgpu_vram_mgr_new loop + real in-kernel drm_mm wrote a live drm_mm_node 184 bytes past a 1-element kvmalloc_array and clobbered a neighboring heap object; full unpriv-ioctl entry point hardware-gated - amdgpu binds only on AMD ASICs, QEMU guest has none, amdgpu.ko confirmed buildable+loadable module on DF)	reproduced fixed
DF-5169	High	7.8	i915_clflush_work() self-frees its container inside the work callback; DFly LinuxKPI process_all_work() then UAF-reads/writes the freed struct (work->worker=NULL 8-byte NULL write, work->running=false 1-byte zero write, wakeup on dangling channel) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_clflush.c:89 · pass 2 · new	kernel heap UAF write (memory corruption): 8-byte NULL write at freed-object +16 (work->worker) and 1-byte zero at +25 (work->running) into attacker-reclaimable M_DRM-class memory, plus wakeup() on a dangling wait channel; deterministic primitive proof without panic; reliable uid=0 chain not developed (trigger needs pre-LLC Intel GPU, not emulatable in QEMU)	reproduced fixed
DF-5200	High	7.8	kthread_park() provides no quiescence: returns without waiting for the target to park while kthread_parkme() never deschedules - the park/unpark contract drm_sched_entity_fini() and amdgpu GPU-reset rely on is void, giving a deterministic use-after-free on entity teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_kthread.c:103 · pass 2 · new	panic	reproduced fixed
DF-5271	High	7.8	cdgetpage/find_mode_page_* trust device-controlled mode-header blk_desc_len: heap OOB read+write in all CD audio ioctls Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_cd.c:3437 · pass 2 · new	device-directed kernel heap OOB write + OOB read (4 fully user-chosen bytes per ioctl at any offset up to ~64KB past a 32-byte kmalloc chunk, device-chosen offset via 16-bit blk_desc_len, unlimited repetitions; OOB read returns 4 heap bytes per ioctl to userland). Root-gated entry (caps_priv_check_self SYSCAP_RESTRICTEDROOT at cdopen) with attacker-controlled SCSI/USB 'CD-ROM' hardware - same threat model as known DF-0987/DF-2268.	reproduced fixed
DF-5434	High	7.8	REQBUFS-while-streaming frees bq->mem without draining product/consumer queues or resetting descriptors: USB completion engine writes frame data into freed kernel memory (UAF write) and, after a frame-size shrink, stale vbuf.bytesused underflows the bulk maxlen giving a controlled-offset heap OOB write Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_buf.c:517 · pass 2 · new	panic	reproduced fixed
DF-5740	High	7.8	hci_socket.c mutates socket buffers from the NETISR thread with no synchronization (hci_mtap sbappendaddr vs soreceive, hci_drop sbdroprecord vs sbappendrecord) and hands the TX-completion callback a reference-free socket pointer that survives teardown (cmdwait ctx TOCTOU → post-detach hci_drop UAF) Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_socket.c:1004 · pass 2 · new	panic	reproduced fixed
DF-5780	High	7.8	hci_memo_find/hci_memo_new/hci_memo_free operate on unit->hci_memos with zero synchronization while concurrently reachable from unprivileged user context, netisr-0 and softclock — double-free and write-after-free of 48-byte hci_memo records Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_misc.c:124 · pass 2 · new	panic	reproduced fixed
DF-2815	Medium	7.8	Unserialized global dumper: set_dumper() EBUSY-check TOCTOU / torn struct copy, and clear-or-swap landing during an active dumpsys() → NULL di->priv dereferenced by dev_ddump() (kernel page fault while dumping) and torn-geometry dump misdirection to the wrong device Privilege escalation (general use) · sys/kern/kern_shutdown.c:948 · pass 2 · new	panic	reproduced fixed
DF-5128	Medium	7.8	for_each_sg_page/_sg_iter_next entry-budget underflow: iteration runs past caller-declared nents across chained chunks; real sg_pcopy_to_buffer processes out-of-budget entries (guest-proven fatal OOB entry deref) Base system — drivers · sys/dev/drm/linux_scatterlist.c:261 · pass 2 · new	panic	reproduced fixed
DF-5337	Medium	7.8	userenter() ucred cache race — vkernel twin missing pc64's p_spin interlock: unlocked crhold races cratom_proc's swap+crfree, giving crhold-on-freed (M_CRED UAF) from unprivileged in-vkernel userland Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/x86_64/trap.c:167 · pass 2 · new	panic	reproduced fixed
DF-5370	Medium	7.8	bus_dmamap_destroy() frees a map still queued for a deferred load (EINPROGRESS) -> write-after-free with attacker-followed map->dmat pointer and permanent zone wedge (vkernel twin of pc64 DF-5347) Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/platform/busdma_machdep.c:383 · pass 2 · new	dos	reproduced fixed
DF-4697	High	7.7	nvme(4): duplicate nsid in the device-supplied ACTIVE NAMESPACE LIST re-attaches a live namespace — second nvme_disk_attach() bzeroes the live struct disk inside the global disklist (self-loop), double-inserts devstat, creates duplicate /dev/nvmeN cdevs → deterministic kernel panic on any later disklist walk Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:636 · pass 2 · new	panic	reproduced fixed
DF-2902	High	7.6	mbrinit/mbr_extended trust device-reported d_media_blksize — up to 2 GiB synchronous read into a MAXPHYS (128 KB) pbuf: assertion-cast bypass (all kernels) or INVARIANTS panic; proven OOB write with attacker-controlled content/length Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskmbr.c:127 · pass 2 · new	panic	reproduced fixed
DF-5276	High	7.6	pci_read_vpd(): zero-length VPD identifier string causes unbounded sequential kernel heap overflow (device-controlled content and length) Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci.c:1108 · pass 2 · new	memcorrupt	reproduced fixed
DF-5392	High	7.6	PnP isa_config count fields trusted unvalidated at the ISA_ADD_CONFIG boundary; pnp_check_quirks' unbounded ic_nport++ defeats pnpparse's == clamps → attacker-indexed OOB kernel-heap writes at boot (persisted by isa_add_config, panic via count consumer) Kernel memory corruption (UAF / OOB write) · sys/bus/isa/isa_common.c:938 · pass 2 · new	panic	reproduced fixed
DF-5396	High	7.6	urndis(4) bulk RX: device-controlled rm_datalen up to MCLBYTES copied after m_adj(ETHER_ALIGN) — 2-byte kernel heap overflow past a 2048-byte slab chunk (fixed upstream in FreeBSD 11 years ago, never synced) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/if_urndis.c:859 · pass 2 · new	memcorrupt	reproduced fixed
DF-5406	High	7.6	HID report-descriptor Push/Pop items drive the parser's pushlevel out of range; hid_get_item() re-derives c = &s->cur[pushlevel] out of bounds on the next call → kernel heap read/write with device-chosen offset and content Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_hid.c:248 · pass 2 · new	panic	reproduced fixed
DF-3326	Medium	7.6	hostap association granted without completed authentication (assoc gate tests node-table existence, and a single auth REQUEST creates the node) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hostap.c:1953 · pass 2 · new	auth_bypass (association without authentication: AID assignment, powersave eligibility, EAPOL passthrough, assoc-flood DoS)	reproduced fixed
DF-2993	High	7.5	NFS READDIR/READDIRPLUS with count=0 from the wire infinite-loops the nfsd kernel thread (remote DoS, host starvation) Base system — filesystems · sys/vfs/nfs/nfs_serv.c:2977 · pass 2 · new	dos	reproduced fixed
DF-2998	High	7.5	Server attributes freely retype live vnodes in nfs_loadattrcache (VREG→VDIR observed live; VCHR/VBLK with server-chosen rdev via addaliasu + v_ops switch) — device-node injection and buffer-cache type confusion through every attribute load in this file Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_vnops.c:2903 · pass 2 · new	kernel type confusion -> deterministic panics (two new independent memory-corruption sinks) + server-driven device-node injection into the local namespace	reproduced fixed
DF-3009	High	7.5	Zero-length SunRPC record mark from an NFS/TCP server returns a NULL reply mbuf — nfs_reply() dereferences mtod(NULL), deterministic client kernel panic Privilege escalation (general use) · sys/vfs/nfs/nfs_socket.c:648 · pass 2 · new	panic	reproduced fixed
DF-3061	High	7.5	nfs_namei() retry protocol leaks locked namecache state and nfsrv_rename()'s retry drives double-releases — remote NFS client can panic the kernel Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_subs.c:1003 · pass 2 · new	panic	reproduced fixed
DF-3293	High	7.5	tcp_input(): TCP data offset (th_off) validated only by KASSERT — one-packet unauthenticated remote panic on default INVARIANTS kernels; negative-tlen protocol-state corruption on production kernels Base system — network stack · sys/netinet/tcp_input.c:764 · pass 2 · new	panic	reproduced fixed
DF-3340	High	7.5	pf synproxy PROXY:DST state purge emits spoofed RST from non-netisr context (purge thread / pfctl ioctls / module unload) -> guaranteed ip_output ASSERT_NETISR_NCPUS panic; default-config, remotely unauthenticated trigger Base system — network stack · sys/net/pf/pf.c:1487 · pass 2 · new	panic	reproduced fixed
DF-4381	High	7.5	Duplicate transaction DELETE double-dispatches xdisk state callbacks: kernel panic (KKASSERT on stock kernels; NULL deref at xaio_rcvdmsg:538 / xa_sync_completion:1127 otherwise) Base system — drivers · sys/dev/disk/xdisk/xdisk.c:535 · pass 2 · new	panic	reproduced fixed
DF-5288	High	7.5	USB_FS_UNINIT racing USB_FS_START/STOP/COMPLETE on a shared ugen fd: f->fs_xfer array kfree'd/NULLed without priv_lock while consumers snapshot f->fs_xfer[ep_index] unlocked — kernel page-fault/GPF panic (groomable use-after-free) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_transfer.c:972 · pass 2 · new	panic	reproduced fixed
DF-5314	High	7.5	USB_FS_CLOSE is unserialized: concurrent closes double-run usbd_transfer_unsetup() on one xfer (kernel panic via setup_refcount assert; refcount_alloc underflow → permanent endpoint lockout on no-assert kernels) and CLOSE×START leaves stale-xfer UAF writes into freed memory Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_generic.c:1558 · pass 2 · new	panic	reproduced fixed
DF-3295	Medium	7.5	Signed sr_ssid[i].len in ieee80211_scanreq passes the >NWID_LEN check; -1 reaches memcpy as (size_t)-1 → unbounded kernel-heap copy through the vap (fatal write fault) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ioctl.c:2496 · pass 2 · new	panic	reproduced fixed
DF-3377	Medium	7.5	PIM6 REGISTER decap panics: fake multicast_register_if is never if_attach()ed — if_simloop() writes through NULL if_data_pcpu (3 stacked NULL derefs: if_simloop stats, in6_ifawithifp if_addrheads, in6_addr2zoneid scope6) Base system — network stack · sys/netinet6/ip6_mroute.c:585 · pass 2 · new	panic	reproduced fixed
DF-4053	Medium	7.5	Sense-data memcpy has dst/src swapped vs FreeBSD: autosense never delivered (all-zero sense + CAM_AUTOSNS_VALID) and device-controlled copy length overflows struct vtscsi_request when a pass CCB carries sense_len > 96 Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/virtio/scsi/virtio_scsi.c:1383 · pass 2 · new	none	reproduced fixed
DF-4454	Medium	7.5	evdev driver teardown frees evdev_dev under open clients and in-flight writes: use-after-free with cross-object event injection and kernel wedge Kernel memory corruption (UAF / OOB write) · sys/dev/misc/evdev/evdev.c:98 · pass 2 · new	dos	reproduced fixed
DF-3362	Low	7.5	pf_fragcache overlap-chop path: INVARIANTS KASSERT panics on multi-mbuf fragments (m_adj tail-trim leaves zero-length mbufs chained) Base system — network stack · sys/net/pf/pf_norm.c:661 · pass 2 · new	panic	reproduced fixed
DF-3337	High	7.4	pfr_insert_kentry() mutates the table radix tree (rn_addroute + pfrkt_cnt++) on the packet path, which holds pf_token only SHARED: multi-CPU overload floods race and corrupt the tree Base system — network stack · sys/net/pf/pf_table.c:861 · pass 2 · new	dos	reproduced fixed
DF-3344	High	7.4	lagg port-detach handler registered on never-fired ifnet_departure_event: persistent kernel UAF after member interface destroy Kernel memory corruption (UAF / OOB write) · sys/net/lagg/if_lagg.c:218 · pass 2 · new	panic	reproduced fixed
DF-3525	High	7.4	ng_l2cap_lp_receive trusts the ACL payload-length claim: zero-byte fragments inflate m_pkthdr.len up to 65539 over ~8 real bytes -> lying ACL header on TX -> driver heap over-read disclosed over the air (DF-0508 sink, distinct llpi reassembly entry) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/l2cap/ng_l2cap_llpi.c:702 · pass 2 · new	leak	reproduced fixed
DF-4797	High	7.4	nata ad(4) teardown race: ad_strategy/ad_done (and the disk-layer close path) vs ad_detach — use-after-free of the ad_softc/struct disk and near-NULL writes; reproduced fatal trap 12 Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-disk.c:167 · pass 2 · new	panic	reproduced fixed
DF-5240	High	7.4	xpt_scan_bus() create-path failure branch frees the in-flight XPT_SCAN_LUN CCB and scan_info (kernel UAF, deterministic panic) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:5394 · pass 2 · new	panic	reproduced fixed
DF-5734	High	7.4	Num_Compl_Pkts completion credit wedges hci_acl_complete() in a no-progress infinite loop: NETISR thread (holding the mplock) spins forever -> total system hang from one 8-byte event Base system — network stack · sys/netbt/hci_event.c:380 · pass 2 · new	dos	reproduced fixed
DF-5738	High	7.4	hci_link_free() ignores the SCO->ACL anchor reference: anchored ACL teardown leaves hl_refcnt==1 -> KKASSERT panic on INVARIANTS kernels, silent kfree + dangling SCO->hl_link (fatal UAF demonstrated) on production GENERIC kernels Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_link.c:810 · pass 2 · new	panic	reproduced fixed
DF-5735	Medium	7.4	READ_BUFFER_SIZE completion with max_acl_size=0 poisons the unit ACL MTU (DF-5733 lens): hci_acl_send() fragmentation loop is structurally infinite and drains the global mbuf pool; link tx blackholed Base system — network stack · sys/netbt/hci_event.c:884 · pass 2 · new	dos	reproduced fixed
DF-3146	High	7.3	RRIP NM length underflow in cd9660_rrip_altname: u_short wrap rewinds the name output pointer by 65536*N → controlled OOB write at a wild kernel address (heap via readdir, kstack via lookup) or bcopy((size_t)-1) panic Kernel memory corruption (UAF / OOB write) · sys/vfs/isofs/cd9660/cd9660_vnops.c:542 · pass 2 · new	panic	reproduced fixed
DF-3195	High	7.3	nfs_inactive/nfs_reclaim discriminate the n_un3 union (sillyrename vs dir-cookie list) by the runtime-mutable v_type — a server-side VREG→VDIR retype of a sillyrenamed file makes reclaim walk the struct sillyrename as an nfsdmap list: kfree(M_NFSREQ block as M_NFSDIROFF), then kfree of the live s_cred ucred, then wild-pointer deref — deterministic kernel panic (verified 2/2), fix validated on rebuilt kernel Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_node.c:392 · pass 2 · new	panic	reproduced fixed
DF-3690	High	7.3	Adaptec parser: unbounded 16-bit total_disks zeroing loop — massive deterministic kernel heap OOB write at first metadata parse Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:1685 · pass 2 · new	panic	reproduced fixed
DF-3691	High	7.3	No parser validates array width — RAID0/5 strategy indexes disks[] OOB via user-chosen LBA (wild device_t deref); RAID1/01 paths OOB-write disks[width].last_lba and composite->request[] Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:3248 · pass 2 · new	panic	reproduced fixed
DF-4330	High	7.3	mr_update_span_set writes firmware-indexed strip_offset[count] OOB - linear kernel-heap overflow past sc->log_to_span[] (last softc member) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_fp.c:949 · pass 2 · new	dos	reproduced fixed
DF-4846	High	7.3	feed_format_feed sizes its byte window with the inexact generated SND_FXROUND/SND_FXDIV table: misround-up within the claimed [1,65536] domain writes up to oalign-1 bytes past the destination window (or before it via the ialign path) and over-reports the return into sndbuf_acquire (ring overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_format.c:220 · pass 2 · new	none	reproduced fixed
DF-4847	High	7.3	feed_matrix_feed FXROUND misrounds: entry rounding sizes the matrixing pass past the destination window and the ialign>oalign path computes a source window that starts before the buffer Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_matrix.c:479 · pass 2 · new	none	reproduced fixed
DF-4848	High	7.3	feed_volume_feed divides the USER-PACED source return with inexact SND_FXDIV: frame overcount writes past the window and count -= j*align underflows to ~4GiB, re-arming the loop to pull a directed, user-length-controlled write past the window end Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_volume.c:277 · pass 2 · new	none	reproduced fixed
DF-4849	High	7.3	feed_mixer_feed FXROUND past the caller's free space (persistent sndbuf ring overflow) and mcnt = count - rcnt unsigned underflow arming a ~4GiB memset at b+rcnt when any child feeder over-returns Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_mixer.c:299 · pass 2 · new	none	reproduced fixed
DF-5315	High	7.3	USB_FS_OPEN double-entry: two racing opens both pass the unlocked slot check and both run usbd_transfer_setup() — the second NULLs/overwrites the first's pointer, orphaning its usb_xfer (permanent M_USB leak + endpoint refcount_alloc exhaustion → endpoint dead for ALL consumers) Base system — bus / platform / cpu · sys/bus/u4b/usb_generic.c:1458 · pass 2 · new	dos	reproduced fixed
DF-3175	Medium	7.3	ftruncate()/unlink on special-file inodes (FIFO/device/socket) runs the ext2 truncate engine over their i_db[] overlay — kernel panic or silent free of live blocks (cross-file aliasing) Base system — filesystems · sys/vfs/ext2fs/ext2_inode.c:458 · pass 2 · new	panic	reproduced fixed
DF-3392	Medium	7.3	IPv6 firewall fully controllable by unprivileged local users: IPV6_FW_ADD/DEL/FLUSH/ZERO/GET setsockopt on any IPv6 datagram socket has no privilege check Privilege escalation (general use) · sys/net/ip6fw/ip6_fw.c:1119 · pass 2 · new	dos	reproduced fixed
DF-5472	Medium	7.3	Backtracer frame walk trusts stack content — INKERNEL() defined but never used AND semantically wrong for the vkernel; walk escapes into guest-user VAs (guaranteed fault on this platform) and prints attacker-chosen kernel symbols (DF-5470 twin, vkernel-amplified) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/db_trace.c:227 · pass 2 · new	panic	reproduced fixed
DF-5297	High	7.2	umass autosense REQUEST SENSE uses user-controlled csio.sense_len (up to 255) as the DMA length into the fixed 32-byte csio.sense_data inside the kernel CCB — malicious USB disk overwrites the rest of ccb_scsiio with device-controlled bytes Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/storage/umass.c:2602 · pass 2 · new	kernel memory corruption (device-controlled intra-object write into live kernel CCB; trigger gated on root-only /dev/pass* for the >32 length, content fully device-controlled)	reproduced fixed
DF-2619	High	7.1	Dirent namlen unbounded by chain->bytes: OOB read past 64KB DIO buffer in dirent_test AND 127-byte kernel-memory disclosure to userspace via getdents Hammer2 · sys/vfs/hammer2/hammer2_chain.c:5781 · pass 2 · new	leak	reproduced fixed
DF-2685	High	7.1	mlock()/mlockall()/wiring faults zero-fill non-resident (swapped-out) pages instead of paging them in — silent memory destruction in privileged processes Base system — virtual memory · sys/vm/vm_fault.c:383 · pass 2 · new	dos	reproduced fixed
DF-2716	High	7.1	nlookup() misclassifies a leaf component followed by a trailing slash as an intermediate directory, dropping NLC_STICKY/NLC_APPENDONLY feedback — sticky-bit and append-only-directory deletion/rename restriction bypass Privilege escalation (general use) · sys/kern/vfs_nlookup.c:653 · pass 2 · new	authz_bypass (sticky-bit / append-only-dir deletion+rename restriction bypass; not uid0/panic/leak class)	reproduced fixed
DF-2920	High	7.1	Beyond-EOF VM pages retained for the last buffer remain faultable: nvnode_pager_setsize()'s unmap is the only EOF enforcement, so mmap reads/writes past EOF succeed on every filesystem, pre-truncate content (incl. recycled disk-block residue) is served during the truncate zero-fill window, and on tmpfs beyond-EOF writes become file data Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_vm.c:42 · pass 2 · new	leak	reproduced fixed
DF-2940	High	7.1	mpipe_done() tears down the malloc pipeline with no synchronization against in-flight users — its only teardown caller (dm-crypt) destroys tables while bios still hold mpipe buffers: KKASSERT panic / UAF write on production kernels / reproduced permanent kernel wedge Kernel memory corruption (UAF / OOB write) · sys/kern/kern_mpipe.c:122 · pass 2 · new	dos	reproduced fixed
DF-3011	High	7.1	btree_remove() unbounded recursion — kernel stack overflow from crafted deep B-trees with all-valid counts/types/CRCs (bypasses DF-0776 hardening) Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_btree.c:1979 · pass 2 · new	panic	reproduced fixed
DF-3082	High	7.1	ext2 create in an htree-indexed directory truncates the directory mid-tree — mass silent data loss on valid Linux-created images, then kernel panic Base system — filesystems · sys/vfs/ext2fs/ext2_lookup.c:377 · pass 2 · new	panic	reproduced fixed
DF-3141	High	7.1	sizeof(struct fnode)=520 > FNODESIZE=512: unconditional 8-byte out-of-bounds write past the buffer in hpfs_update, mirror OOB read in hpfs_vget — cross-file page-cache corruption with attacker-crafted content, or deterministic kernel page-fault panic Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_subr.c:735 · pass 2 · new	panic	reproduced fixed
DF-3190	High	7.1	Unvalidated superblock fragment-mask fields (fs_fmask/fs_qfmask) let fragroundup() round DOWN in ffs_balloc — undersized kernel buffer handed to ffs_write for an attacker-sized/-contented overrun copy, and deterministic unprivileged-triggered kernel panic Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_balloc.c:119 · pass 2 · new	panic	reproduced fixed
DF-3459	Medium	7.1	rssadapt_rate returns/stores rix=-1 (fresh node RSSI=0 or converged thresholds): rs_rates[-1] read, iwm_setrates KASSERT panic on INVARIANTS kernels, and u_int-indexed ~+8GiB wild read+write in rssadapt_lower_rate — the negative-side residual of DF-0730 Base system — network stack · sys/netproto/802_11/wlan/ieee80211_rssadapt.c:253 · pass 2 · new	panic	reproduced fixed
DF-2779	High	7.0	mq_send1 re-reads mq_sig_notify.sigev_signo after releasing mq_mtx: concurrent mq_notify re-registration (SIGEV_NONE bypasses signo validation) smuggles an attacker-chosen int into ksignal — panic on INVARIANTS, OOB atomic sigset write on production kernels Base system — kernel core (kern) · sys/kern/sys_mqueue.c:877 · pass 2 · new	panic	reproduced fixed
DF-2853	High	7.0	rman_reserve_resource alignment-roundup unsigned wrap grants resources outside the scanned free fragment — overlapping allocations with live owners and free-fragment inflation across neighbors Kernel memory corruption (UAF / OOB write) · sys/kern/subr_rman.c:247 · pass 2 · new	dos	reproduced fixed
DF-2938	High	7.0	OBJT_DEVICE pager objects never reference the cdev: device teardown while a mapping persists leaves a dangling object->handle → cdev use-after-free in old_dev_pager_fault (indirect call via freed si_ops) and old_dev_pager_dtor (assert + NULL write) Kernel memory corruption (UAF / OOB write) · sys/vm/device_pager.c:124 · pass 2 · new	panic	reproduced fixed
DF-3248	High	7.0	hpfs_genlookupbyname's unvalidated dirent walk drives hpfs_updateparent into a 20-byte OOB heap write past a 2048-byte dirblk chunk — attacker-chosen bytes (utimes mtime/atime u64 + crafted fn_size u32) at attacker-chosen offset (<=64KB of u16 reclen hops), unprivileged trigger on a crafted HPFS mount; silent corruption + livelock-DoS variants (write side of DF-0927's read walk) Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_lookup.c:73 · pass 2 · new	high	reproduced fixed
DF-3727	High	7.0	ciss_disable_adapter: uninitialized STAILQ head qh -> wild kernel write/read (missing STAILQ_INIT) Base system — drivers · sys/dev/raid/ciss/ciss.c:3465 · pass 2 · new	corruption	reproduced fixed
DF-3728	High	7.0	ciss_notify_complete: fatal-error path leaves ciss_periodic_notify dangling -> double-ownership, double post, xpt_done twice (CAM UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3619 · pass 2 · new	corruption	reproduced fixed
DF-3729	High	7.0	ciss_notify_rescan_logical: unbounded ndrives + unchecked LUN_TO_BUS/TARGET -> OOB heap read and write Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3866 · pass 2 · new	corruption	reproduced fixed
DF-3995	High	7.0	dc_link_is_dp_sink_present frees a BORROWED struct ddc on DDC-open failure: use-after-free on every later DDC/AUX transaction plus stale-pointer double free at connector teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_link.c:348 · pass 2 · new	panic	reproduced fixed
DF-4026	High	7.0	/dev/dsp mmap vs chn_resizebuf use-after-free: dsp_mmap_single maps bufsoft inside chn_resizebuf's lock-drop windows and the resize then kfrees the mapped buffer — persistent userland RW over freed M_DEVBUF kernel heap Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/channel.c:1762 · pass 2 · new	leak	reproduced fixed
DF-4165	High	7.0	VBIOS retimer HdmiRegNum/Hdmi6GRegNum (u8, unclamped) drive heap OOB write past kzalloc'd struct integrated_info in get_integrated_info_v11 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1441 · pass 2 · new	dos	reproduced fixed
DF-4834	High	7.0	mrsas_passthru operates on the raw userland ioctl pointer: validation→use TOCTOU on sge_count walks past the 16-entry stack arrays (kernel stack OOB write + OOB stack reads); unmapped arg panics the kernel Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:150 · pass 2 · new	panic	reproduced fixed
DF-4840	High	7.0	Use-after-free race on non-refcounted DRM_MODE_OBJECT_MODE objects in drm_mode_obj_set_property_ioctl — freed mode reclaimed with attacker data drives a fully controlled properties/property/dispatch chain ending in a controlled indirect call (plane->funcs->set_property) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_mode_object.c:515 · pass 2 · new	panic	reproduced fixed
DF-4919	High	7.0	cancel_work_sync()/flush_work() decide 'work is idle' from lockless flag reads — premature return while the work is between dequeue and start (or while an insert is publishing), violating the free-after-cancel contract → UAF/arbitrary-call ceiling Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_workqueue.c:331 · pass 2 · new	panic	reproduced fixed
DF-5016	High	7.0	syscons history ring UAF: scroll-path appends (syscons_lock) are not serialized against ring realloc/free (vga_token) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/schistory.c:94 · pass 2 · new	panic	reproduced fixed
DF-5059	High	7.0	drm_clients_info walks dev->filelist under struct_mutex instead of filelist_mutex: count/copy TOCTOU heap overflow (write) and close-race UAF (read) via hw.dri.N.clients Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_sysctl.c:268 · pass 2 · new	heap-overflow-write + UAF-read (kernel-space primitive reproduced with the verbatim drm_sysctl.c:260-301 walk/copy body, real M_DRM allocator and real struct drm_file[544B]: opens landing between the count walk (:271) and copy walk (:281) made the copy write 544B-elem structs past the exact-size kmalloc; 138 organic hits per 100k unprivileged sysctl reads with no forced interleave; a groomed exact-size allocation clobbered an adjacent kernel heap object (guard[9]) - real cross-object corruption; end-to-end hw.dri path hardware-gated: QEMU guest has no GPU/device, so no real drm clients exist and a uid0 chain on the live path was not exercisable)	reproduced fixed
DF-5106	High	7.0	emu_midi_detach() ignores mpu401_uninit() failure: with the 0666 MIDI cdev open, detach reports success while newbus kfrees the softc the still-live cdev/mpu401/callout keep using (UAF + deterministic kldunload panic) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/emu10kx-midi.c:229 · pass 2 · new	panic	reproduced fixed
DF-5125	High	7.0	synchronize_rcu() expands to zero instructions — zero-length grace period lets drm callers kfree objects under live readers (UAF → kernel RIP control, demonstrated) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_rcu.c:94 · pass 2 · new	panic	reproduced fixed
DF-5126	High	7.0	rcu_read_lock() is cpu_ccfence() (no exclusion) and reclaim is a fixed 1s delay line — __kfree_rcu/call_rcu free objects while readers are still inside their critical sections (deterministic 3/3 UAF + RIP control, demonstrated) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_rcu.c:81 · pass 2 · new	panic	reproduced fixed
DF-5177	High	7.0	hrtimer_cancel() is not atomic against concurrent hrtimer_start(): releases timer_token before the delete/drain and start() falsifies running/gd — cancel returns while the callback is still executing, so the caller's kfree turns the __hrtimer_task epilogue into a deterministic use-after-free write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_hrtimer.c:112 · pass 2 · new	kernel use-after-free write (memory corruption), deterministic: hrtimer_cancel() returns while timer->function is still executing (Linux requires exclusion), so the caller's kfree() is followed by __hrtimer_task epilogue writes (lwkt token ops + running/active byte clears) into freed-then-reallocated memory; same interleave with a RESTART-returning callback reaches systimer_init_oneshot() on the freed chunk (bzero + insertion into a live per-cpu systimer queue, ending in a timer->function call from attacker-reclaimed memory); uid=0 chain not completed (drm hrtimer callers are GPU-gated on this guest)	reproduced fixed
DF-5321	High	7.0	fw_xfer/tlabel use-after-free and double completion: firewire_xfer_timeout() vs fw_rcv() + FW_ASYREQ waiter — no cross-CPU serialization of the completion/tlabel lifetime Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/firewire.c:336 · pass 2 · new	panic	reproduced fixed
DF-5347	High	7.0	bus_dmamap_destroy() frees a map still queued for deferred load (EINPROGRESS) -> UAF with arbitrary-call/RIP control from freed memory Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/busdma_machdep.c:440 · pass 2 · new	panic	reproduced fixed
DF-5378	High	7.0	Use-after-free of the UVC control graph in uvc_query_v4l2_ctrl()/uvc_query_v4l2_menu(): detach frees sc->ctrl before destroy_dev, giving a racing unprivileged VIDIOC_QUERYCTRL/QUERYMENU a 1-byte write into freed kernel heap plus a 31-byte-per-query kernel-heap disclosure Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_ctrls.c:1065 · pass 2 · new	leak	reproduced fixed
DF-5414	High	7.0	fw_read frees the FWACT_CH xfer while it stays linked in ir->q (dequeue is #if 0) -> use-after-free + double free on every subsequent read Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:304 · pass 2 · new	panic	reproduced fixed
DF-5467	High	7.0	vga_pci_unmap_bios() re-evaluates vga_pci_is_boot_display() and tears down a ROM-BAR mapping with the 128K shadow size: kernel page-table teardown + kernel_map VA free beyond the mapping, plus a leaked live ROM resource Kernel memory corruption (UAF / OOB write) · sys/bus/pci/vga_pci.c:288 · pass 2 · new	panic	reproduced fixed
DF-5548	High	7.0	Unsynchronized si_drv1/refcount lifecycle in fwmem open/close/ioctl/strategy — live-race kernel panic, post-race NULL write, and an 8-byte controlled UAF write over the slab freelist pointer (arbitrary-address allocation / double allocation) Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwmem.c:266 · pass 2 · new	unsynchronized si_drv1/refcount lifecycle: live open/close race -> Fatal trap 12 (NULL+offsetof(refcount) deref in production fwmem_close, fwmem.c:292); post-race NULL-si_drv1 state -> supervisor WRITE at 0x0 in fwmem_ioctl (fwmem.c:410); racing ioctl/close -> 8 fully attacker-controlled bytes at offset 0 of a freed 16-byte-zone chunk == DragonFly SLAB freelist next pointer -> kmalloc hands out the attacker-chosen address / silently duplicates a live chunk (on this INVARIANTS kernel: deterministic allocator-assert panics; on production builds: silent double allocation)	reproduced fixed
DF-5550	High	7.0	camq_resize() shrink-below-entries: heap OOB write + persistent entries>array_size queue corruption — guard is #ifdef DIAGNOSTIC only (compiled out of stock kernels); in-tree trigger via xpt_remove_periph shrinking a drvq whose periph is still queued Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_queue.c:116 · pass 2 · new	panic	reproduced fixed
DF-5613	High	7.0	Unsynchronized iso-xferq claim (FW_STSTREAM/FW_SRSTREAM) and teardown (fw_close -> fwdma_free_multiseg) → shared queue, bulkxfer heap overflow with chosen ints, and in-flight fw_write/fw_read UAF write/read on freed fwdma buffers Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdma.c:100 · pass 2 · new	memcorrupt: controlled kernel UAF write (attacker iso payload into fwdma segment pages freed by the concurrent teardown) + linear heap overflow past the bulkxfer kmalloc with chosen poffset ints; fatal supervisor-write variant on >=4GB-RAM hosts (panic.txt)	reproduced fixed
DF-2872	Medium	7.0	taskqueue_free() ignores the write-only tq_callouts counter: armed timeout callout fires into freed/reallocated queue (UAF) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_taskqueue.c:150 · pass 2 · new	dos	reproduced fixed
DF-3755	Medium	7.0	Dangling rdev->pm.dpm.ps after alloc-failure kfree in ni_parse_power_table: ignored-error UAF publication, ps_priv leak, and teardown double free (use-after-free kfree of a live foreign object) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ni_dpm.c:4020 · pass 2 · new	dos	reproduced fixed
DF-4792	Medium	7.0	Signed int16_t table_id passes the only bounds check in vega20_copy_table_from/to_smc: uint16 API values 0x8000..0xFFFF index smu_tables.entry[] out of bounds (heap OOB read AND write) — DF-2021/DF-2034/DF-2072 family twin pass 1 missed for vega20 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/vega20_smumgr.c:164 · pass 2 · new	none	reproduced fixed
DF-5324	Medium	7.0	ukbd unplug vs kbd_switch consumer lifetime race: kbd_unregister frees the keyboard under in-flight console consumers -> lockmgr on freed lock and kbdsw[NULL]->ioctl NULL-deref panic (reproduced) Base system — bus / platform / cpu · sys/bus/u4b/input/ukbd.c:1370 · pass 2 · new	panic	reproduced fixed
DF-4207	High	6.8	Wild OOB heap write in eepromExpandPower5112(): 0xDEAD sentinel xgainList[0] used as pDataPerXPD[] index when device EEPROM xpdMask has no set bits Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:195 · pass 2 · new	none	reproduced fixed
DF-3491	Medium	6.8	PRIMED branch of ng_pppoe_rcvdata: ph->length never validated against the actual packet length — get_tag/scan_tags walk ~900 bytes past a 32-byte mbuf and the OOB heap bytes are disclosed in the emitted PADO (v1 live-stack twin of DF-3487; third sink distinct from DF-0457) Kernel memory leaks / uninitialized disclosure · sys/netgraph/pppoe/ng_pppoe.c:1304 · pass 2 · new	leak	reproduced fixed
DF-2741	High	6.7	DIOCGSLICEINFO: dsioctl bcopy uses runtime dss_nslices (GPT disks: up to 130) against the 16-record ioctl type — 29,184-byte kernel heap OOB write per ioctl Kernel memory corruption (UAF / OOB write) · sys/kern/subr_disk.c:1196 · pass 2 · new	panic	reproduced fixed
DF-3229	High	6.7	fuse_ipc_tx() error paths free a still-linked fuse_ipc: fuse_ipc_wait returns ENOTCONN without fuse_ipc_remove at :163-167 (dead-at-entry, fip linked on BOTH queues) and :198-201 (dead-after-blind-reply, fip still on request_head) Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_ipc.c:163 · pass 2 · new	panic	reproduced fixed
DF-3426	High	6.7	Generic netmap TX pool mbufs are dispatched with no retained reference: tx_pool slots alias driver-owned and then freed memory (controlled UAF write + double free) Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_generic.c:504 · pass 2 · new	panic	reproduced fixed
DF-5376	High	6.7	targwrite() forwards raw user abort_ccb pointer when targusermerge() returns ESRCH ('!= EFAULT' check): fake-CCB arbitrary-address kernel write and kernel-global cam_simq corruption → RIP-control chain Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_target.c:626 · pass 2 · new	panic	reproduced fixed
DF-2800	Medium	6.7	prison_priv_check allows SYSCAP_NOSETTIME in jails — jailed uid-0 sets the HOST system clock (settimeofday/clock_settime/adjtime/ntp_adjtime) Privilege escalation (general use) · sys/kern/kern_jail.c:858 · pass 2 · new	dos	reproduced fixed
DF-2808	Medium	6.7	Cross-segment mapsize under-sizing: mapsize derives only from segs[0]'s start and segs[1]'s end, so segs[0]'s extent is never covered → file-controlled kernel heap overflow (DF-2771 analogue in the EXEC loader) Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf.c:541 · pass 2 · new	panic	reproduced fixed
DF-2832	Medium	6.7	Syncer-trigger API (trigger_syncer*/speedup_syncer) has no lifetime interlock against vn_syncer_thr_stop — UAF atomic-write on freed syncer ctx (and NULL-ctx / freed-mount reads) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_sync.c:561 · pass 2 · new	panic	reproduced fixed
DF-2894	Medium	6.7	kenv_init() ingests unbounded bootloader env strings; kgetenv() strcpy() overflows a 258-byte kernel stack buffer, detonable by any unprivileged user via kenv(2) KENV_GET Kernel memory corruption (UAF / OOB write) · sys/kern/kern_environment.c:580 · pass 2 · new	panic	reproduced fixed
DF-2984	Medium	6.7	syscall_deregister() writes sysent[*offset] through an unvalidated index with an unvalidated value: MOD_LOAD-failure rollback destroys a live syscall slot (EEXIST) → any unprivileged user's syscall(N) is a kernel NULL function call — deterministic persistent panic; EINVAL variant = arbitrary-index 24-byte kernel zero-write; ENFILE variant = sysent[-1] OOB write Kernel memory corruption (UAF / OOB write) · sys/kern/kern_syscalls.c:72 · pass 2 · new	panic	reproduced fixed
DF-3260	Medium	6.7	Unvalidated rule act_ofs escalates DF-0261's OOB read to a 4-byte heap OOB write, a deterministic packet-triggered kernel panic, and an F_LEN==0 netisr infinite loop Kernel memory corruption (UAF / OOB write) · sys/net/ipfw/ip_fw2.c:4515 · pass 2 · new	panic	reproduced fixed
DF-3314	Medium	6.7	Node teardown dereferences the freed ieee80211vap when the last node reference outlives vap destruction: _ieee80211_free_node AID_CLR wild write + node_free ratectl/cleanup UAF Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_node.c:1786 · pass 2 · new	panic	reproduced fixed
DF-3462	Medium	6.7	IP_FW_SET_TOGGLE/IP_FW_SET_GET operate only on CPU0's per-CPU sets bitmap — ipfw3 set enable/disable silently ineffective for all flows hashed to CPUs 1..N-1 (deterministic per-flow firewall policy divergence on SMP) Base system — network stack · sys/net/ipfw3/ip_fw3_set.c:192 · pass 2 · new	firewall-policy divergence: IP_FW_SET_TOGGLE flips only CPU0's per-CPU sets bitmap, so ipfw3 set disable/enable is silently ineffective for every flow hashed to CPUs 1..N-1 (deny/allow/count/skipto rules in the toggled set keep their old state on 5/6 of traffic on a 6-CPU box, while `ipfw3 set show` reports the operator-facing state as changed)	reproduced fixed
DF-3708	Medium	6.7	arcmsr_action() invalid kfree() of bus_dmamem SRB-pool interior pointer on CAM SG error path Base system — drivers · sys/dev/raid/arcmsr/arcmsr.c:3053 · pass 2 · new	corruption	reproduced fixed
DF-4862	Medium	6.7	amdgpu_cgs_get_firmware_info CP_MEC branch: info->image_size = jt_offset << 2 from an unvalidated firmware-header dword — SMU-side OOB DMA read of up to ~4 GB from the staged fw_buf window (DF-4774 shape on the CP branch, kernel-side fully in-bounds) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:221 · pass 2 · new	dos	reproduced fixed
DF-5289	Medium	6.7	pmap_enter/pmap_unwire UKSMAP wire-accounting corruption: mlock() of /dev/upmap wires a transient stack-fictitious page with no vm_page wire, pmap_unwire() then returns the real kmalloc'd slab page which vm_fault_unwire unwires — slab page loses its only wire (silent corruption) and panics deterministically on the second cycle Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/platform/pmap.c:2429 · pass 2 · new	panic	reproduced fixed
DF-4535	Low	6.7	lptwrite() ignores uiomove() failure: stale kernel-heap bytes transmitted out the parallel port and a non-terminating write (unkillable, mplock-starvation system DoS in polled mode) Base system — drivers · sys/dev/misc/lpt/lpt.c:657 · pass 2 · new	dos	reproduced fixed
DF-2745	High	6.6	exit1() p_peers unlink race: lost unlink leaves leader permanently wedged in uninterruptible exit (pre-fdfree, pinning fds+vmspace) and members freed while still linked — kernel heap UAF read/write Kernel memory corruption (UAF / OOB write) · sys/kern/kern_exit.c:384 · pass 2 · new	dos	reproduced fixed
DF-3047	High	6.6	MNT_RELOAD adopts new group geometry without resizing the cluster-summary arrays — heap OOB write, bzero()/free() of OOB-read pointers, and per-reload gd leak Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_vfsops.c:620 · pass 2 · new	panic	reproduced fixed
DF-3998	High	6.6	Unclamped phase offset in the envy24ht DMA emulators: second record channel START reads up to ~32 KB past the shared record DMA buffer into the user's /dev/dsp stream (kernel heap disclosure); play-direction twin carries an attacker-controlled 32-bit write ~130 KB past the play DMA buffer but is latent behind the 1-play-channel registration (DF-3996 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/envy24ht.c:1324 · pass 2 · new	leak	reproduced fixed
DF-2618	Medium	6.6	Overlapping key ranges in on-disk blockref arrays unvalidated — chain-insert collision panic or RB_REMOVE wipes the parent's rbtree root Hammer2 · sys/vfs/hammer2/hammer2_chain.c:313 · pass 2 · new	panic	reproduced fixed
DF-2905	High	6.5	md_done() leaks every pending m_nextpkt record of an mdchain — remote mbuf-pool exhaustion DoS by a malicious SMB server Kernel memory corruption (UAF / OOB write) · sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new	dos	reproduced fixed
DF-3286	High	6.5	mesh_decap stack OOB write: reserved AE=11 mesh control grows the header copy to 56 bytes into the 50-byte stack buffer b[] Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_mesh.c:1281 · pass 2 · new	none	reproduced fixed
DF-3287	High	6.5	Remote kernel panic via AE=01 unicast mesh data frame: route for addr4 never ensured, KASSERT/NULL-deref in to_fwrd/to_me Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:1441 · pass 2 · new	panic	reproduced fixed
DF-3327	High	6.5	Remote kernel panic: hwmp_send_action KASSERT/NULL-deref when a proactive/propagated/intermediate PREP is sent along a never-validated zero nexthop Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1090 · pass 2 · new	panic	reproduced fixed
DF-3331	High	6.5	nd6: ND6_LLINFO_NOSTATE neighbor-cache entries are never garbage-collected — unauthenticated peer pins unbounded kernel memory (~444 B per ND packet) on gif-class outputs Base system — network stack · sys/netinet6/nd6.c:496 · pass 2 · new	dos	reproduced fixed
DF-3523	High	6.5	ng7 ng_uncallout() permanently leaks the pptpgre rack/sack timer ng_item + node/hook references (DF-3521 ng7 twin, two stacked defects; escalates to the DF-3514 panic) Privilege escalation (general use) · sys/netgraph7/pptpgre/ng_pptpgre.c:968 · pass 2 · new	dos	reproduced fixed
DF-3524	High	6.5	ng_l2cap untimeout misreads cancelled-armed timers as ETIMEDOUT (DF-3515): every LP_ConnectCfm/DisconInd/signaling response is discarded -> L2CAP permanently broken, stuck-timeout con, deterministic teardown panic Base system — network stack · sys/netgraph7/bluetooth/l2cap/ng_l2cap_llpi.c:180 · pass 2 · new	panic	reproduced fixed
DF-4266	High	6.5	Inverted RX descriptor-ownership test in wb_rxeof(): receive path completely broken, per-packet chip reset/reinit storm from interrupt context Base system — drivers · sys/dev/netif/wb/if_wb.c:973 · pass 2 · new	dos	reproduced fixed
DF-5015	High	6.5	syscons history ring: stale-geometry ring after ignored sc_alloc_history_buffer() failure → negative ring tail → controlled heap OOB write (underflow) + OOB read Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/schistory.c:147 · pass 2 · new	dos	reproduced fixed
DF-5134	High	6.5	dma_buf_fd() never drops the caller's file reference after fsetfd(): every PRIME export orphans one reference — struct file + dma_buf + GEM object (+ pinned user-sized pages) + drm_device immortal, nfiles walks to system-wide ENFILE Base system — drivers · sys/dev/drm/linux_dma-buf.c:139 · pass 2 · new	leak	reproduced fixed
DF-2672	Medium	6.5	vm_object reference leak on fork() of wired (mlock'd) map entries — permanent swap/kernel-memory exhaustion by unprivileged users Base system — virtual memory · sys/vm/vm_map.c:3627 · pass 2 · new	dos	reproduced fixed
DF-2898	Medium	6.5	sysent[0]/sysent[198] indirect-syscall gateway dispatches itself: unprivileged one-line syscall(SYS_syscall,0) deterministically panics the kernel (double fault on the kernel-stack guard) Privilege escalation (general use) · sys/kern/init_sysent.c:17 · pass 2 · new	panic	reproduced fixed
DF-2963	Medium	6.5	GPT entry #127 maps to slice index 128, which dkmakeminor() silently truncates to 7 bits: duplicate major:minor cdevs and s127<->s0 cross-slice data aliasing (reads AND writes) Privilege escalation (general use) · sys/kern/subr_diskgpt.c:175 · pass 2 · new	data_integrity_aliasing	reproduced fixed
DF-3028	Medium	6.5	Daemon LOOKUP reply with S_IFMT-clear mode yields vtyp=VBAD → fuse_node_vn KKASSERT(0) panic (INVARIANTS force-enabled module-wide) Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vnops.c:554 · pass 2 · new	panic	reproduced fixed
DF-3030	Medium	6.5	fuse_vop_nrename leaks a kmalloc'd M_TEMP buffer on every effective rename — unprivileged unbounded kernel heap exhaustion Base system — filesystems · sys/vfs/fuse/fuse_vnops.c:1219 · pass 2 · new	dos	reproduced fixed
DF-3273	Medium	6.5	One-frame remote kernel panic: CONF-NAK/CONF-REJ with h->len < 4 reaches RCN handlers that kmalloc() a negative (size_t-wrapped) length Base system — network stack · sys/net/sppp/if_spppsubr.c:1541 · pass 2 · new	panic	reproduced fixed
DF-3288	Medium	6.5	ms_known_gates gate entries are never freed: unauthenticated GANN spam exhausts kernel heap and leaks across vap destroy Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:646 · pass 2 · new	dos	reproduced fixed
DF-3312	Medium	6.5	ieee80211_ht_wds_init never assigns tap->txa_ni: guaranteed NULL-deref panic in addba_timeout/ampdu_tx_stop/bar_timeout for legacy WDS nodes with HT Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ht.c:1206 · pass 2 · new	panic	reproduced fixed
DF-3466	Medium	6.5	ieee80211_ageq_append trusts non-monotonic caller ages: attacker-controlled (re)association listen-interval drives the relative age negative — KASSERT panic on INVARIANTS kernels ('panic: age -781' reproduced) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ageq.c:114 · pass 2 · new	panic	reproduced fixed
DF-3468	Medium	6.5	mpls_forward() permanently leaks the packet mbuf+cluster on every AF_MPLS route miss — unauthenticated on-link memory-exhaustion DoS on options-MPLS kernels Base system — network stack · sys/netproto/mpls/mpls_input.c:200 · pass 2 · new	leak	reproduced fixed
DF-3479	Medium	6.5	ng_btsocket_l2cap_attach() never takes the implied pcb reference (soreference): KKASSERT panic in sonewconn on every inbound L2CAP connection; child socket refcount runs one low on production kernels (latent pcb->so UAF) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1961 · pass 2 · new	panic	reproduced fixed
DF-3710	Medium	6.5	arcmsr_srb_timeout vs interrupt completion: unsynchronized srb_state check-then-act double-completes one CCB (double xpt_done, srboutstandingcount underflow) Base system — drivers · sys/dev/raid/arcmsr/arcmsr.c:856 · pass 2 · new	dos	reproduced fixed
DF-4188	Medium	6.5	Dangling rdev->pm.dpm.ps after kfree-without-NULL on the ENOMEM path of sumo_parse_power_table + swallowed init error -> double free in sumo_dpm_fini at unload/reboot; ps_priv[0..i-1] leaked — sumo twin of DF-4117/4144/4125/4023/3973/3755/3955 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/sumo_dpm.c:1500 · pass 2 · new	panic	reproduced fixed
DF-4192	Medium	6.5	pcm-core chn_trigger() trigger-flag/busy-list race (reached via es137x /dev/dsp): unprivileged kernel panic and unrecoverable system-wide hang Base system — drivers · sys/dev/sound/pci/es137x.c:755 · pass 2 · new	panic	reproduced fixed
DF-4250	Medium	6.5	Stale sassc->maxtargets after mprsas_realloc_targets desynchronizes every targets[] bounds check from the real array size (heap OOB read/write window \|attach_facts - reset_facts\| structs) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_sas_lsi.c:890 · pass 2 · new	dos	reproduced fixed
DF-4267	Medium	6.5	RX ring collapse: constant-condition ternary links all 64 RX descriptors (software and hardware next pointers) to descriptor 0 Base system — drivers · sys/dev/netif/wb/if_wb.c:909 · pass 2 · new	dos	reproduced fixed
DF-4279	Medium	6.5	CCDIOCSET accepts a negative interleave: negative component transfer size drives an unbounded dispatch loop and a guaranteed kernel panic Base system — drivers · sys/dev/disk/ccd/ccd.c:1326 · pass 2 · new	panic	reproduced fixed
DF-4494	Medium	6.5	rs780_dpm: swallowed-init lifetime bugs — dangling rdev->pm.dpm.ps after kfree-without-NULL and self-radeon_dpm_fini in rs780_dpm_init -> double free in rs780_dpm_fini and UAF read+write in rs780_dpm_enable Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rs780_dpm.c:830 · pass 2 · new	panic	reproduced fixed
DF-5473	Medium	6.5	Backtrace fault outside an established DDB session longjmps into the BSS-zeroed global db_jmpbuf — on the vkernel the longjmp is host libc's from inside the SIGSEGV handler: restores rsp=0/rbp=0, vkernel process dies of SIGILL inside longjmp+115, core dumped, zero further diagnostics (DF-5471 twin) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/db_trace.c:231 · pass 2 · new	panic	reproduced fixed
DF-5655	Medium	6.5	vkernel sys_set_tls_area accepts a non-canonical TLS base that crosses to the host kernel via go_user()/vmspace_ctl() and panics the HOST in wrmsr(MSR_KGSBASE) — unprivileged in-vkernel user → host kernel panic (DF-5639 vkernel twin, boundary-crossing) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/tls.c:96 · pass 2 · new	panic	reproduced fixed
DF-5753	Medium	6.5	hci_intr()'s scodone completion dispatch (membership walk + hci_sco_complete) is unlocked and unreferenced against syscall-context SCO teardown: sco_disconnect NULLs hl_sco then frees the link while still listed -> NULL-pointer kernel write (sp_pending--) / UAF in netisr context Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_unit.c:390 · pass 2 · new	panic	reproduced fixed
DF-5287	High	6.4	Concurrent read()/write() on a shared ugen endpoint fd double-enters ugen_transfer_setup(): orphaned usb_xfer blocks (permanent kernel memory leak + endpoint refcount exhaustion locking the endpoint for all drivers) plus unlocked usb_fifo_free_buffer() UAF window against live callbacks Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_transfer.c:145 · pass 2 · new	dos	reproduced fixed
DF-5592	High	6.4	cam_sim freed while still pending in the camisr completion softint — UAF write plus function-pointer dispatch from freed object (cam_sim_release has no synchronization against xpt_done/camisr) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_sim.c:241 · pass 2 · new	panic	reproduced fixed
DF-2845	Medium	6.4	sbuf_drain() does not validate the drain callback's return value — a drain returning 0 yields a silent, unbounded, content-controlled linear kernel-heap overflow on production kernels Kernel memory corruption (UAF / OOB write) · sys/kern/subr_sbuf.c:324 · pass 2 · new	panic	reproduced fixed
DF-3277	Medium	6.4	bridge_delete_span() TAILQ_REMOVEs span bif from the per-cpu MEMBER list head — list-tail corruption cross-links span and member lists, leading to KASSERT panic / member-bif UAF and double-free Kernel memory corruption (UAF / OOB write) · sys/net/bridge/if_bridge.c:1155 · pass 2 · new	panic	reproduced fixed
DF-3709	Medium	6.4	Firmware completion tokens consumed unvalidated: psrb_pool[SMID] OOB read (ARC1884) and wild vir2phy SRB dereference (types A-D) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/arcmsr/arcmsr.c:821 · pass 2 · new	corruption	reproduced fixed
DF-4349	Medium	6.4	adv_run_doneq completes ccb_infos entries without ACCB_ACTIVE validation: in-bounds stale-slot double completion (double xpt_done/LIST_REMOVE/recycled-dmamap unload) and never-allocated-slot write through uninitialized cinfo->ccb Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/advansys.c:1106 · pass 2 · new	panic	reproduced fixed
DF-5773	Medium	6.4	handle_term() inherited by reforked vkernel children runs kill(0, SIGTERM): process-group-wide TERM splash plus a self-re-arming, unstoppable signal storm Base system — bus / platform / cpu · sys/platform/vkernel64/platform/init.c:217 · pass 2 · new	dos	reproduced fixed
DF-3283	Low	6.4	ieee80211_fragment: fragment size can exceed MCLBYTES (FRAG_MAX=2346 default) -> m_align() computes negative offset -> packet-controlled heap underflow write before the mbuf cluster (release) / KASSERT panic (INVARIANTS) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_output.c:1703 · pass 2 · new	panic	reproduced fixed
DF-5372	Low	6.4	_bus_dmamap_sync() switches on a bitmask op: combined BUS_DMASYNC_PREWRITE\|BUS_DMASYNC_POSTREAD matches no case and silently performs no bounce copy in either direction Base system — bus / platform / cpu · sys/platform/vkernel64/platform/busdma_machdep.c:903 · pass 2 · new	dos	reproduced fixed
DF-5521	Low	6.4	iicsmb_detach has no quiesce: kldunload during an in-flight SMBus transaction resumes the sleeper in freed module text (UAF) and leaves iicbus_softc->owner dangling Kernel memory corruption (UAF / OOB write) · sys/bus/iicbus/iicsmb.c:164 · pass 2 · new	panic	reproduced fixed
DF-2621	High	6.3	hammer2_xop_helper_create() re-kmallocs pmp->xop_groups unconditionally — leaked thread array and orphaned threads that use-after-free the pmp Hammer2 · sys/vfs/hammer2/hammer2_admin.c:431 · pass 2 · new	dos	reproduced fixed
DF-3170	High	6.3	MFS bio queue shared between BGL-holding producers and a BGL-free consumer: unsynchronized cross-CPU TAILQ corruption (kernel panic; latent heap corruption on non-INVARIANTS builds) from unprivileged file I/O on a mounted MFS Privilege escalation (general use) · sys/vfs/mfs/mfs_vfsops.c:184 · pass 2 · new	panic	reproduced fixed
DF-3427	High	6.3	SET_MBUF_DESTRUCTOR/generic_mbuf_destructor is ABI-incompatible with DragonFly mbufs: ext_free receives the 16-byte mbcluster, not the mbuf (OOB read -> wild ifp deref + permanent cluster leak) Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_generic.c:101 · pass 2 · new	panic	reproduced fixed
DF-4473	High	6.3	dm_table_load_ioctl mutates the inactive-table TAILQ under a SHARED table lock — concurrent reload ioctls race TAILQ_INSERT_TAIL (kernel list corruption -> panic / permanent orphan leaks) Base system — drivers · sys/dev/disk/dm/dm_ioctl.c:722 · pass 2 · new	panic	reproduced fixed
DF-4529	High	6.3	Device teardown vs in-flight NVMEIOCGETLOG/open: use-after-free of the admin queue and softns -> kernel divide-by-zero panic in nvme_get_request (reproduced 2/2) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nvme/nvme.c:273 · pass 2 · new	panic	reproduced fixed
DF-4952	High	6.3	feed_mixer_rec: no free-space clamp — one feeder over-return wraps sndbuf_getfree to ~4G and the acquire loop re-arms maxfeed (~64KB) requests into the fixed-size bufsoft->tmpbuf: linear heap OOB write by the real converter (REC-path sink of the FXROUND family, distinct from DF-4849's PLAY path) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_mixer.c:195 · pass 2 · new	none	reproduced fixed
DF-3318	Medium	6.3	in6_update_ifa() accepts arbitrary ifra_dstaddr.sin6_len — unprivileged SIOCGLIFADDR kernel-heap pointer leak and privileged SIOCDLIFADDR kernel stack buffer overflow Kernel memory corruption (UAF / OOB write) · sys/netinet6/in6.c:901 · pass 2 · new	leak	reproduced fixed
DF-3692	Medium	6.3	RAID ioctls index ata_raid_arrays[lun] with an unvalidated int: OOB pointer-table read -> wild ar_softc (panic; DELETE = kfree of wild pointer, STATUS = kernel-memory copyout) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:249 · pass 2 · new	panic	reproduced fixed
DF-4203	Medium	6.3	ahci_xpt_action() XPT_SCSI_IO re-entrant probe runs without the port lock — concurrent probe/state-machine race corrupts port state Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:989 · pass 2 · new	panic	reproduced fixed
DF-4364	Medium	6.3	All mps_config.c getters free the mps_command while the IOC still owns it after mps_request_polled timeout - late completion UAF / cross-request completion confusion / reply-queue corruption Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_config.c:167 · pass 2 · new	panic	reproduced fixed
DF-4714	Medium	6.3	bre5() second-bad-subdisk guard requires checksdstate() to fail: badsdno silently overwritten for reviving/reborn data subdisks -> parityless-write conversion defeated and two-bad-column writes accepted (silent data loss, parity scribbled onto down subdisk) Base system — drivers · sys/dev/raid/vinum/vinumraid5.c:404 · pass 2 · new	dos	reproduced fixed
DF-4837	Medium	6.3	ida bio path never sets DMA direction flags: bounced READ data never copied back (silent disk corruption) and dmamap_unload/bounce pages leak on >4GB hosts Base system — drivers · sys/dev/raid/ida/ida.c:391 · pass 2 · new	dos	reproduced fixed
DF-5674	Medium	6.3	Keysym free mutates the global interned-key rb-tree without the tree mutex — unsynchronized rb-tree rebalancing → UAF/heap corruption Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_dictionary.c:148 · pass 2 · new	none	reproduced fixed
DF-5678	Medium	6.3	prop_array_set/prop_array_remove enforce index bounds only via INVARIANTS-gated assert: stock-kernel panic (reproduced live), silent heap OOB write + prop_object_release of an OOB-read pointer on non-INVARIANTS kernels Base system — libkern / libprop / ddb · sys/libprop/prop_array.c:648 · pass 2 · new	dos	reproduced fixed
DF-2789	Low	6.3	Dead terminator guard in blst_meta_free/blst_meta_fill checks parent's bm_bighint instead of child's scan[i] — out-of-range free/fill walks uninitialized terminator slots and can index past bl_rootblks Base system — kernel core (kern) · sys/kern/subr_blist.c:660 · pass 2 · new	corruption	reproduced fixed
DF-2798	Low	6.3	Out-of-domain free discipline: production kernels silently accept a full-child free beyond bl_blocks (unbounded full-cover branch) and poison parent meta bits to ALL-FREE; the likewise-unbounded direct-allocation path then returns block numbers >= bl_blocks (wild PHYS_TO_VM_PAGE precursor); bl_root allocated without M_ZERO Base system — kernel core (kern) · sys/kern/subr_alist.c:286 · pass 2 · new	panic	reproduced fixed
DF-4129	Low	6.3	seq_sync() kernel stack overflow: sync[16] vs midi_number up to 32 — unprivileged kernel control-flow corruption (RIP=0) via SNDCTL_SEQ_SYNC/close on the 0666 sequencer Kernel memory corruption (UAF / OOB write) · sys/dev/sound/midi/sequencer.c:2063 · pass 2 · new	panic	reproduced fixed
DF-5052	Low	6.3	dal_vector_destruct() leaves container dangling — second destruct is a double kfree (latent; double-free reproduced at runtime, fix semantics runtime-validated) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/basics/vector.c:131 · pass 2 · new	panic	reproduced fixed
DF-5701	Low	6.3	bcmp.c:58 `int len = length` size_t-to-int truncation: bcmp(a,b,2^32)==0 false-equal with zero bytes compared; prefix-only compare at 2^32+k; signed-overflow unbounded forward walk at 2^31 Base system — libkern / libprop / ddb · sys/libkern/bcmp.c:58 · pass 2 · new	none	reproduced fixed
DF-5762	Low	6.3	RFCOMM_CHANNEL() mask 0x2f is missing bit 4: inbound server channels 16..30 remap onto 0..14 — incoming connections match the WRONG listening service and channel 16 is permanently unreachable Base system — network stack · sys/netbt/rfcomm.h:217 · pass 2 · new	dos	reproduced fixed
DF-4827	High	6.2	get_hw_supported_ddc_line validates DDC line against GPIO_DDC_LINE_COUNT(8) but sw_i2cs[] is sized MAX_PIPES(6): OOB read of scalar-overlay garbage pointer, then wild kernel write engine->ddc = ddc Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce/dce_i2c_sw.c:91 · pass 2 · new	panic	reproduced fixed
DF-4961	Medium	6.2	amdgpu bit-bang i2c adapters registered without lock_ops → NULL function-pointer call in i2c_transfer() → kernel panic on first DDC/EDID access Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:193 · pass 2 · new	panic	reproduced fixed
DF-5306	Medium	6.2	NULL-deref kernel panic at attach: VC header declaring zero streaming interfaces leaves sc->data NULL and uvc_drv_init_video() dereferences it Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_drv.c:2109 · pass 2 · new	panic	reproduced fixed
DF-3048	High	6.1	s_inodes_count never validated against gcount*ipg — dirent inode numbers beyond the group-descriptor table OOB-read fs->e2fs_gd in ext2_vget Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_vfsops.c:606 · pass 2 · new	panic	reproduced fixed
DF-3103	High	6.1	Embedded-ICB read path trusts unvalidated l_ea/l_ad: udf_vget's wrapping int allocation plus udf_readatoffset's &fentry->data[l_ea] with sign-extended negative *size yields a wild OOB kernel-heap read Kernel memory corruption (UAF / OOB write) · sys/vfs/udf/udf_vnops.c:1037 · pass 2 · new	leak	reproduced fixed
DF-3373	High	6.1	connect(2)/listen(2) TOCTOU on one TCP socket: handler-side state guards absent, same inpcb linked into both wildcard and connection hash — reliable unprivileged panic (INVARIANTS) / dangling connhash entry + UAF on 4-tuple lookup (production) Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_usrreq.c:481 · pass 2 · new	panic	reproduced fixed
DF-4542	High	6.1	syscons CONS_SET mode change (sc_set_text_mode) vs tty output (scstart/sc_puts): no common lock across scp->vtb/history teardown - reproducible kernel panic and heap double-free window Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/scvidctl.c:54 · pass 2 · new	panic	reproduced fixed
DF-4891	High	6.1	DragonFly DIV_ROUND_DOWN_ULL compat shim corrupts drm_rect_clip_scaled(): post-validation source-rectangle corruption feeds OOB display-engine scanout on i915 sprite paths Base system — drivers · sys/dev/drm/drm_rect.c:64 · pass 2 · new	leak	reproduced fixed
DF-5335	High	6.1	doreti_iret fault state machine is espfix64-class broken: sigreturn with %ss resolving to the null GDT descriptor or an absent LDT descriptor hard-crashes the machine from unprivileged userland (silent CPU reset or SMP livelock, no panic); subclasses that do reach C code get their frame rebuilt from PCB padding/stale stack Base system — bus / platform / cpu · sys/platform/pc64/x86_64/trap.c:679 · pass 2 · new	panic	reproduced fixed
DF-3111	Medium	6.1	hammer_direntry_namekey ALG1 iteration-range overflow: crafted filenames make dirents permanently unfindable and unremovable (durable fs poisoning + unremovable space leak) Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_subs.c:943 · pass 2 · new	dos	reproduced fixed
DF-3122	Medium	6.1	ext2_htree_check_next() loads dx nodes during the miss-walk with zero validation — attacker-driven directory-block walk and OOB heap read past the index buffer (kernel panic from crafted ext2 image) Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_htree.c:127 · pass 2 · new	panic	reproduced fixed
DF-3561	Medium	6.1	Software XTS (aes/twofish/serpent) mutates the shared per-session tweak: concurrent cryptoapi_cipher_crypt on one session tears the tweak and silently corrupts dm-crypt data at rest Base system — crypto · sys/crypto/cryptoapi/cryptoapi.c:370 · pass 2 · new	dos	reproduced fixed
DF-4686	Medium	6.1	ar2425: FillVpdTable/interpolate span never clamped — descending curve → (uint16_t)(Pmax−Pmin) wrap → ~131 KB sequential OOB write past the function-static VpdTable_* block in kernel static storage; valid curve spanning >63 half-dB → OOB write with no wrap (ar2425 twin of DF-4683, flagged at ar2425.c:311) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:311 · pass 2 · new	dos	reproduced fixed
DF-4772	Medium	6.1	amdgpu_pasid_free_delayed leaks one exclusive-fence reference per call — the DFly reservation_object_get_fences_rcu shim drops upstream's else-put; unbounded unprivileged kernel heap leak via drm fd open/close churn Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_ids.c:111 · pass 2 · new	leak	reproduced fixed
DF-4900	Medium	6.1	dm unit allocation is unbounded while the dev_t minor encoding holds only 512 units — the 513th live dm device aliases a live device's minor and KKASSERT-panics dm_dev_insert deterministically (race-free); dkunit() truncation on destroy also frees live devices' clone-bitmap bits Base system — drivers · sys/dev/disk/dm/dm_dev.c:234 · pass 2 · new	panic	reproduced fixed
DF-5588	Medium	6.1	sdt_probe() accepts hint.acpi.0.rsdp with zero validation: total-acceptance injection vector for the crafted-ACPI family (DF-5430..5433/5583) and one-line boot brick Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_sdt.c:71 · pass 2 · new	panic	reproduced fixed
DF-5754	Medium	6.1	hci_detach() frees struct hci_unit with no lifetime protection for in-flight kernel processing: btintr()'s unit-list walk and hci_intr()'s devlock loop (and in-flight driver rx, and hci_unit_lookup's unreferenced pointers) operate on the freed unit -> UAF through hci_devlock Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_unit.c:123 · pass 2 · new	panic	reproduced fixed
DF-4964	Low	6.1	sili(4): attach maps BAR(2) and carves per-port subregions with no size validation — undersized port-register window on a crafted/malfunctioning SiI 3124/3132 drives OOB MMIO writes/reads past the pmap-mapped window (kernel panic at boot/kldload, or silent corruption of the adjacent mapping) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili_attach.c:170 · pass 2 · new	panic	reproduced fixed
DF-3169	High	6.0	umount -f frees autofs nodes/mount under in-flight triggers and mkdirs — use-after-free (read+write, dangling requests, armed callout in freed memory) and a guaranteed NULL-deref panic variant Kernel memory corruption (UAF / OOB write) · sys/vfs/autofs/autofs_vnops.c:209 · pass 2 · new	panic	reproduced fixed
DF-3191	High	6.0	fuse_mount() lacks a double-mount guard: one /dev/fuse fd mounted at two mount points shares one struct fuse_mount — second mount re-initializes the live object (locks/IPC lists/RB tree/rfnp) and the first unmount frees the second mount's root and splices stale nodes into its tree (root-clobber UAF; guaranteed panic) Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vfsops.c:168 · pass 2 · new	panic	reproduced fixed
DF-3198	High	6.0	Use-after-free in DEVFS_RULE_RESET: devfs_gc() frees nodes under the topology walker's saved cursors Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_rules.c:222 · pass 2 · new	panic	reproduced fixed
DF-3227	High	6.0	FUSE blind reply completes and frees a fuse_ipc still linked on request_head — deterministic stale-queue-head corruption, 'Bad tailq' kernel panic Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_device.c:192 · pass 2 · new	panic	reproduced fixed
DF-2658	Medium	6.0	hammer2_sync_replace() resize is a guaranteed no-op (radix of chain->bytes instead of focus->bytes): heap OOB read persisted to media / silent truncation / NULL-source bcopy for embedded dirents Hammer2 · sys/vfs/hammer2/hammer2_synchro.c:939 · pass 2 · new	leak	reproduced fixed
DF-2668	Medium	6.0	fhstatfs(2)/fhstatvfs(2) overwrite the vfs_getvfs()-held mount with vp->v_mount: nullfs pass-through FHTOVP causes mnt_hold underflow — KKASSERT panic on INVARIANTS, kfree() of a live struct mount (UAF) on release kernels Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_syscalls.c:5074 · pass 2 · new	panic	reproduced fixed
DF-3120	Medium	6.0	Unsynchronized UFS quotaon/quotaoff mount-state machine: concurrent Q_QUOTAOFF double-executes the teardown — double vn_close(qvp) (vnode opencount/refcount corruption, UAF), crfree(NOCRED) NULL-deref, and dqsync-against-closed-quota-file panic Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_quota.c:503 · pass 2 · new	panic	reproduced fixed
DF-3319	Medium	6.0	v4 SIOCDLIFADDR kernel stack buffer overflow: in_lifaddr_ioctl bcopy uses unvalidated ia_sockmask/ia_dstaddr sin_len as length into 64-byte on-stack in_aliasreq — deterministic on stock lo0 (::1 /128) via the DF-0490 confusion, and via root-poisoned sin_len once the filter is fixed Kernel memory corruption (UAF / OOB write) · sys/netinet/in.c:911 · pass 2 · new	panic	reproduced fixed
DF-3350	Medium	6.0	config_pipe accepts negative bandwidth: NULL-deref panic (TAILQ_LAST on empty delay line) or permanent netisr wedge in the drain loop Privilege escalation (general use) · sys/net/dummynet/ip_dummynet.c:621 · pass 2 · new	panic	reproduced fixed
DF-3354	Medium	6.0	config_pipe accepts negative bandwidth: TAILQ_LAST NULL-deref write in ready_event_wfq (delay=0) or t==0 wfq_ready_heap self-loop netisr wedge (delay>0) — DF-3350 family confirmed in v3 Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:641 · pass 2 · new	panic	reproduced fixed
DF-3408	Medium	6.0	tunwrite() leaks one mbuf per EFAULTing write: spare MGET allocated before the loop recheck is never freed (tap DF-3406 twin) — verified, deterministic Base system — network stack · sys/net/tun/if_tun.c:875 · pass 2 · new	dos	reproduced fixed
DF-3474	Medium	6.0	netgraph7 item+message leak: NG_FREE_ITEM() only sets a flag, so ng_address_hook/path/ID() error paths permanently leak the queue item and its entire control message; ~4096 leaked items permanently exhaust the netgraph objcache and wedge the system (objcache_get M_WAITOK sleeps forever) Base system — network stack · sys/netgraph7/netgraph/ng_base.c:3062 · pass 2 · new	dos	reproduced fixed
DF-3483	Medium	6.0	ng_generic_msg() leaks the entire control message on NGM_MKPEER/NGM_CONNECT/NGM_NAME/NGM_RMHOOK arglen mismatch: permanent, unbounded kernel heap leak per failing generic control send (v1 sibling of netgraph7's DF-3474) Kernel memory leaks / uninitialized disclosure · sys/netgraph/netgraph/ng_base.c:1263 · pass 2 · new	dos	reproduced fixed
DF-4478	Medium	6.0	State-machine ioctls run without lock_config and race config frees: setstate()/set_sd_state()/update_plex_state() walk SD[]/plex->sdnos that unlocked VINUM_DETACH/ATTACH and locked VINUM_CREATE free/reallocate (UAF-class; guest killed 2/3 runs) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumstate.c:104 · pass 2 · new	panic	reproduced fixed
DF-4669	Medium	6.0	snp: SNPSTTY re-attach cleanup is dead code — old target tty left poisoned with dangling t_sc → deterministic snplclose UAF / slab double free Kernel memory corruption (UAF / OOB write) · sys/dev/misc/snp/snp.c:557 · pass 2 · new	panic	reproduced fixed
DF-4758	Medium	6.0	vinumsize() serves d_psize for every device type and indexes VOL[] with the subdisk/plex number — wrong-object swap sizing (deterministic) and heap OOB read for sdno/plexno >= volumes_allocated Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinum.c:558 · pass 2 · new	dos	reproduced fixed
DF-4760	Medium	6.0	free_vinum()'s daemon-stop loop wedges kldunload for the holder's chosen duration, permanently leaks one struct daemonq kmalloc per tick, and blocks kldload/kldstat system-wide via the linker lock Base system — drivers · sys/dev/raid/vinum/vinum.c:215 · pass 2 · new	dos	reproduced fixed
DF-4907	Medium	6.0	dm_target_delay _destroy() drains queued bios asynchronously; their completion path writes through stale &dmv->stats into the freed-and-reallocated dm_dev (deterministic write-after-free → cross-object devstat corruption → panic) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/delay/dm_target_delay.c:267 · pass 2 · new	panic	reproduced fixed
DF-5062	Medium	6.0	vinum volume-minor aliasing: volume #256 wraps into VOL[0] — every access to /dev/vinum/vol/v256 is served by volume v0 (deterministic cross-volume data corruption + wrong-object sizing) Base system — drivers · sys/dev/raid/vinum/vinumutil.c:241 · pass 2 · new	dos	reproduced fixed
DF-5065	Medium	6.0	dm_target_uninit() tears down the target registry unconditionally: frees still-registered/still-referenced dm_target_t objects and lockuninit's the global lock — deterministic freed-module-text execution (Fatal trap 12), plus heap UAF of busied targets in the DF-4751 race window Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_target.c:277 · pass 2 · new	panic	reproduced fixed
DF-5327	Medium	6.0	chopen() publishes CH_FLAG_OPEN / drops the secondary opener's acquire BEFORE cam_periph_hold(PCATCH): a signal-interrupted open burns one periph reference (refcount desync -> 0-with-open-fd -> premature free / silent unsigned underflow) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ch.c:415 · pass 2 · new	peripheral refcount desync (deterministic 2->1->0 with the ch device OPEN, then close 0->0xFFFFFFFF silent underflow) plus premature free: cam_periph_invalidate() at refcount==0 runs camperiphfree()/chcleanup() and kfrees softc+periph while the descriptor is still open (dmesg 'removing device entry' + postmortem of the freed chunk) -- same memcorrupt class and privilege gate as DF-5273, but via chopen()'s flag-before-hold ordering in a driver DF-5273 did not cover	reproduced fixed
DF-5444	Medium	6.0	pnp_set_config() panics on card-supplied misaligned memory base (MEMORY32_RANGE/FIXED descriptors have no 256-byte granularity clamp) Base system — bus / platform / cpu · sys/bus/isa/pnp.c:260 · pass 2 · new	panic	reproduced fixed
DF-5502	Medium	6.0	ioapic_add() accepts unvalidated firmware GSI base/npin: negative-GSI chain OOB-reads ioc_intsrc[] (ioapic.c:372), forwards negative IRQs to ioapic_set_legacy_irqmap() for silent OOB writes on production kernels, and aliases the int_gsi==-1 sentinel for a deterministic production panic (ioapic.c:520) Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/apic/ioapic.c:229 · pass 2 · new	panic	reproduced fixed
DF-5519	Medium	6.0	ISA DMA channel validation is DIAGNOSTIC-only: OOB static-array writes forge another channel's bounce pointer (wild kernel write), and 1<<chan wraps to free/corrupt live channels Base system — bus / platform / cpu · sys/bus/isa/x86_64/isa_dma.c:95 · pass 2 · new	panic	reproduced fixed
DF-5632	Medium	6.0	iicbus_add_child registered with a 4-arg/int prototype against DragonFly's 5-arg/device_t bus_add_child interface — argument+return skew causes an out-of-bounds kernel write in devclass_add_device Base system — bus / platform / cpu · sys/bus/iicbus/iicbus.c:57 · pass 2 · new	panic	reproduced fixed
DF-5662	Medium	6.0	cam_extend_set() has no lower-bound index validation: controlled kernel-pointer OOB write before the ps[] array (incl. cross-object corruption), NULL-page fatal trap on fresh arrays, and signed-overflow panic in the growth size math Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_extend.c:56 · pass 2 · new	panic	reproduced fixed
DF-5663	Medium	6.0	Unsynchronized cam_extend growth frees ea->ps under lockless readers: use-after-free read returned to CAM drivers as struct cam_periph * (root cause of the DF-5462 class; first conclusive reproduction — consumption panics the kernel) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_extend.c:64 · pass 2 · new	panic	reproduced fixed
DF-5668	Medium	6.0	AcpiOsGetRootPointer() accepts hint.acpi.0.rsdp with zero validation — second kenv RSDP consumer feeding ACPICA; FADT-less crafted chain panics boot at AcpiTbLoadNamespace+0x36 (OOB read of Tables[0xFFFFFFFF]) Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/acpica/OsdEnvironment.c:72 · pass 2 · new	panic	reproduced fixed
DF-5680	Medium	6.0	Unbounded kmalloc(len+1, M_PROP_DATA, M_WAIT) from the attacker-controlled <data size="N"> plist attribute in _prop_data_internalize: deterministic kernel panic (size beyond kernel_map KVA) and non-interruptible system-wide vm_wait wedge (size > RAM); strtoul ERANGE guard compiled out in-kernel Base system — libkern / libprop / ddb · sys/libprop/prop_data.c:572 · pass 2 · new	panic	reproduced fixed
DF-5724	Medium	6.0	Unvalidated $tabstops DDB variable: rounddown(x,0) divide-by-zero trap cascade bricks the kernel; negative tabstops spin db_force_whitespace forever with all CPUs stopped Base system — libkern / libprop / ddb · sys/ddb/db_output.c:65 · pass 2 · new	panic	reproduced fixed
DF-2771	Low	6.0	mapsize 64-bit accumulation overflow in link_elf_obj_load_file sizes the KVA mapping below the per-section bzero/read lengths → wild zero-fill past the mapping Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf_obj.c:621 · pass 2 · new	panic	reproduced fixed
DF-2973	Low	6.0	eventhandler_deregister() performs no tag/list validation — wrong-list or stale tag deterministically corrupts both lists' tail sentinels (write-after-free, cross-list handler aliasing, double free); tag==NULL silently frees an entire shared list Kernel memory corruption (UAF / OOB write) · sys/kern/subr_eventhandler.c:123 · pass 2 · new	panic	reproduced fixed
DF-3443	Low	6.0	altq_priq: dangling pif_ifq use-after-free - interface destroyed mid-pf-transaction leaves PRIQ_LOCK operating on freed ifnet/altq_subq (slab freelist corruption panic / permanent pf_token wedge) Kernel memory corruption (UAF / OOB write) · sys/net/altq/altq_priq.c:114 · pass 2 · new	dos	reproduced fixed
DF-4929	Low	6.0	tpmcrb_detach/tpm20_release tear down the TPM device with no dev_lock and no draining while transmit is in flight: softc/buf use-after-free, discard callout fires into freed memory → deterministic kernel panic Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm_crb.c:230 · pass 2 · new	panic	reproduced fixed
DF-5358	Low	6.0	kvm_access_check()'s /dev/kmem residency gate is built on pc64 pmap_kextract(), which validates no paging level: a pread at any ungrown kernel VA page-faults the validator itself (Fatal trap 12 -> panic), and PTE-empty queries return (va & PAGE_MASK) garbage instead of 0 Base system — bus / platform / cpu · sys/platform/pc64/x86_64/vm_machdep.c:1276 · pass 2 · new	panic	reproduced fixed
DF-5445	Low	6.0	Unbounded resource-data ingestion: no-END stream wedges the kernel with unbounded kmalloc growth; endless logical-device tags amplify ~164× into permanent kernel memory Base system — bus / platform / cpu · sys/bus/isa/pnp.c:428 · pass 2 · new	dos	reproduced fixed
DF-5579	Low	6.0	vkernel64 kvm_access_check() /dev/kmem validator faults on ungrown KVA: pmap_kextract()'s vtopde() assert() SIGABRTs the whole vkernel from inside the residency check (DF-5358 pc64 twin) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/vm_machdep.c:310 · pass 2 · new	panic	reproduced fixed
DF-5725	Low	6.0	DDB db_set_breakpoints() fault-abort orphans live INT3s and poisons the saved original byte — permanent kernel-text corruption at an unrelated address plus unrecoverable crit-section panic Base system — libkern / libprop / ddb · sys/ddb/db_break.c:161 · pass 2 · new	panic	reproduced fixed
DF-3456	High	5.9	Global pf_anchor_stack[64] shared by concurrent shared-pf_token rule walkers: cross-CPU anchor-walk frame tearing silently skips rules and bypasses pf block rules Base system — network stack · sys/net/pf/pf.c:143 · pass 2 · new	pf-policy-bypass	reproduced fixed
DF-2994	Medium	5.9	WebNFS public-filehandle LOOKUP with configured-but-missing index file: vput() on an unlocked vnode → guaranteed kernel panic Base system — filesystems · sys/vfs/nfs/nfs_serv.c:565 · pass 2 · new	panic	reproduced fixed
DF-3148	Medium	5.9	HAMMER1 mirror-write: unvalidated wire leaf.base.btype panics hammer_btree_insert (and defers panics to every later delete-through) Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:575 · pass 2 · new	panic	reproduced fixed
DF-3149	Medium	5.9	HAMMER1 mirror-write: wire delete_tid == create_tid panics hammer_delete_at_cursor via hammer_mirror_update (duplicate-record state on production kernels) Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:777 · pass 2 · new	panic	reproduced fixed
DF-3317	Medium	5.9	tcp6_ctlinput dispatches ICMPv6 Packet-Too-Big to tcp_mtudisc with no sequence validation and no IPv6 minimum-MTU floor: blind off-path t_maxseg corruption up to a kernel divide-by-zero panic Base system — network stack · sys/netinet/tcp_subr.c:1584 · pass 2 · new	panic	reproduced fixed
DF-2995	Low	5.9	nfsrv_writegather leaks a reply mbuf chain per malformed-fh v3 WRITE when vfs.nfs.gatherdelay_v3 > 0 (remote mbuf exhaustion) Base system — filesystems · sys/vfs/nfs/nfs_serv.c:1263 · pass 2 · new	leak	reproduced fixed
DF-2694	High	5.8	sorflush() frees the receive sockbuf underneath sleeping sorecvtcp()/soreceive() copiers — UAF race, unprivileged kernel panic on both TCP and AF_UNIX/UDP paths Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_socket.c:1953 · pass 2 · new	leak	reproduced fixed
DF-3173	High	5.8	autofs request timeout task is armed on the creator CPU's taskqueue but cancelled/drained on the last releaser CPU's queue — foreign-list STAILQ_REMOVE NULL-deref panic and wrong-queue-drain use-after-free (read+write after objcache_put) Kernel memory corruption (UAF / OOB write) · sys/vfs/autofs/autofs.c:303 · pass 2 · new	panic	reproduced fixed
DF-3253	Medium	5.8	hpfs_hphashvget hands out half-initialized H_INVAL hpfsnodes published by hpfs_vget's error paths — unprivileged race returns vnodes the kernel itself rejected (utimes()=0 successes on always-rejected fnodes) and leaves the mount un-unmountable ('panic: unmount: dangling vnode'); DF-3251 ext2 twin Base system — filesystems · sys/vfs/hpfs/hpfs_hash.c:116 · pass 2 · new	dos	reproduced fixed
DF-4482	Medium	5.8	Revive-conflict waitlist/relaunch machinery launches and walks freed requests (UAF cluster) — reliable kernel panic under concurrent conflicting I/O during subdisk revive Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrequest.c:327 · pass 2 · new	panic	reproduced fixed
DF-4484	Medium	5.8	acpi_video_vo_bind leaves dangling vo->vo_levels when _BCL re-evaluation fails -> UAF read via sysctl and double-free panic in vo_destroy Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_video/acpi_video.c:597 · pass 2 · new	panic	reproduced fixed
DF-4525	Medium	5.8	amdgpu_dpm: error-path double/triple free of all dyn_state power-table pointers - amdgpu_free_extended_power_table() frees without NULLing and every caller teardown frees the dangling pointers again Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:775 · pass 2 · new	panic	reproduced fixed
DF-5348	Medium	5.8	bus_dmamap_unload() of an EINPROGRESS-queued map is a silent no-op: phantom deferred load + callback on stale buffer state, reservation leak Base system — bus / platform / cpu · sys/platform/pc64/x86_64/busdma_machdep.c:1022 · pass 2 · new	dos	reproduced fixed
DF-5394	Medium	5.8	usb_detach() races the asynchronous usb_bus_attach(): NULL-softc guard bypassed with a wild softc (-8) → supervisor write fault in usb_callout_drain; the teardown-skip variant frees the whole usb_bus under 4 live USB kthreads Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/usb_controller.c:191 · pass 2 · new	panic	reproduced fixed
DF-5551	Medium	5.8	camq_insert() into a full queue writes a kernel pointer one slot past the array (full-queue guard is DIAGNOSTIC-only) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_queue.c:148 · pass 2 · new	corruption	reproduced fixed
DF-5684	Medium	5.8	sys_vquotactl() performs no privilege check — unprivileged users set/wipe quota limits for any uid/gid/mount, denying ALL writes (including root's) filesystem-wide Privilege escalation (general use) · sys/kern/vfs_quota.c:328 · pass 2 · new	dos	reproduced fixed
DF-5689	Medium	5.8	idr_find()/idr_for_each() read the node array without the idr token while idr_grow() kfree()s the old array — use-after-free read returns a stale kernel object pointer (and idr_for_each walks OOB past the freed array) Kernel memory corruption (UAF / OOB write) · sys/libkern/linux_idr.c:449 · pass 2 · new	leak	reproduced fixed
DF-5779	Low	5.8	seq_puts() shim passes its data string as the ksnprintf format — kernel format-string trap with live %n write conversion (latent for ported code) Base system — drivers · sys/dev/drm/include/linux/seq_file.h:44 · pass 2 · new	panic	reproduced fixed
DF-5381	Info	5.8	USB copy engine enforces no bounds: usbd_get_page + usbd_copy_in/out/_user/frame_zero/usb_uiomove memcpy across the loaded extent with no clamp — single chokepoint for ~120 call sites (cross-object heap OOB read/write/zero + wild KVA/UINT32_MAX span + instant panic demonstrated via root KLD; in-tree precedent DF-0998/DF-2357) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_busdma.c:79 · pass 2 · new	leak	reproduced fixed
DF-2802	Medium	5.7	jail(2) id >= 100000 shares per-prison sysctl nodes (DF-0054 truncation at scale): silent loss of all per-jail capability controls + sysctl_oid freed-under-reference UAF at teardown Kernel memory corruption (UAF / OOB write) · sys/kern/kern_jail.c:992 · pass 2 · new	dos	reproduced fixed
DF-2876	Medium	5.7	BLK_READ replies disclose stale shared pbuf-mem contents on EOF/error/short reads (cross-process, cross-device kernel-mediated info leak) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_diskiocom.c:594 · pass 2 · new	leak	reproduced fixed
DF-3539	Medium	5.7	v1 ng_async: unserialized SET_CONFIG realloc races rcvdata decode/encode - write-after-free cascades into runaway unbounded kernel heap overflow (silent hard lockup) Kernel memory corruption (UAF / OOB write) · sys/netgraph/async/ng_async.c:317 · pass 2 · new	panic	reproduced fixed
DF-4055	Medium	5.7	et_rxeof trusts the NIC-DMA'd rxstat length field: m_len/pkthdr.len set to up to 65535 with no bound against the actual buffer size (MHLEN/MCLBYTES/ET_JUMBO_FRAMELEN) — heap OOB read of up to ~64KB handed to if_input/BPF (DF-3604 family instance) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/et/if_et.c:1863 · pass 2 · new	leak	reproduced fixed
DF-4144	Medium	5.7	Dangling rdev->pm.dpm.ps after kfree-without-NULL in trinity_parse_power_table (:1781) + swallowed trinity_dpm_init error -> double free in trinity_dpm_fini (:2086-2089) and UAF via boot_ps at enable; ps_priv[0..i-1] leaked — Trinity twin of DF-4023/DF-3973/DF-4117/DF-4125 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/trinity_dpm.c:1766 · pass 2 · new	panic	reproduced fixed
DF-4240	Medium	5.7	dpt_init/dpt_attach: device-fed MAX_CHAN (up to 8 channels) never clamped to MAX_CHANNELS=3 — OOB writes of sims[3..7]/paths[3..7] over live softc members incl. bus_dma_tag_t/bus_dmamap_t (type confusion) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/dpt/dpt_scsi.c:1313 · pass 2 · new	panic	reproduced fixed
DF-4241	Medium	5.7	dpt_intr never validates the status packet's target CCB is in flight: duplicate/unsolicited device-fed ccb_busaddr -> double free-list insertion of dccb + double xpt_done of stale/recycled ccb (UAF family) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/dpt/dpt_scsi.c:1518 · pass 2 · new	panic	reproduced fixed
DF-4599	Medium	5.7	VINUM_RESETCONFIG calls free_vinum() without lock_config(): frees all DRIVE/SD/PLEX/VOL arrays racing even the lock-holding VINUM_CREATE writer and every unlocked *CONFIG reader → kernel heap UAF (read proven: panic; write/double-free windows on same interleaving) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumioctl.c:214 · pass 2 · new	panic	reproduced fixed
DF-4679	Medium	5.7	Stolen reserved-base above stolen_top u64-wraps g4x/bdw reserved size, bypasses resource_contains and inflates stolen_usable_size up to 96x → OOB physical allocations beyond stolen Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_stolen.c:472 · pass 2 · new	dos	reproduced fixed
DF-4683	Medium	5.7	FillVpdTable/interpolate span never clamped: descending EEPROM curve → (uint16_t)(Pmax-Pmin) wrap → ~131 KB sequential OOB heap WRITE past ar2317State; valid curve spanning >63 half-dB → OOB write past object end with NO wrap (not covered by any family twin) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:289 · pass 2 · new	dos	reproduced fixed
DF-5268	Medium	5.7	xhci_init latches unmasked device-controlled register offsets (CAPLENGTH/RTSOFF/DBOFF): every later XREAD/XWRITE is an unbounded OOB MMIO access past the mapped BAR Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/xhci.c:626 · pass 2 · new	panic	reproduced fixed
DF-5733	Medium	5.7	Remote kernel panic via RFCOMM PN response with MTU=0: missing lower bound poisons dlc->rd_mtu, divide-by-zero in rfcomm_dlc_start Base system — network stack · sys/netbt/rfcomm_session.c:1374 · pass 2 · new	panic	reproduced fixed
DF-3405	Low	5.7	tap(4) softc use-after-free: clone-destroy/create paths race open() with no common lock (kfree'd tap_softc used by tapopen/tapwrite/tapclose) Kernel memory corruption (UAF / OOB write) · sys/net/tap/if_tap.c:223 · pass 2 · new	panic	reproduced fixed
DF-3562	Low	5.7	serpent_set_key() one-sided key-length validation: negative lengths wrap through u_int32_t i/lk into ~16 GiB runaway/wild OOB writes; non-byte lengths read past the key buffer Kernel memory corruption (UAF / OOB write) · sys/crypto/serpent/serpent.c:453 · pass 2 · new	none	reproduced fixed
DF-4835	Low	5.7	create_frame_pool failure path frees frames and destroys the tag while leaving every pointer dangling: attach unwind mrsas_free_mem() double-frees all frames and the tag Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:422 · pass 2 · new	panic	reproduced fixed
DF-5022	Low	5.7	feed_volume_init() publishes f->data before validation completes and frees it on both error branches without clearing it — feeder_create()'s error unwind double-frees the info block Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_volume.c:165 · pass 2 · new	panic	reproduced fixed
DF-5141	Low	5.7	mlx_pci_attach() double mlx_free() on mlx_attach() failure — kernel heap double-free/UAF (mlx_enq2 kfree'd twice, DMA tags/s/g/IRQ resources released twice) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mlx/mlx_pci.c:202 · pass 2 · new	panic	reproduced fixed
DF-5536	Low	5.7	Dump walk trusts kernel page-table frames at panic time: unguarded dump_add_page(PTE frame) plus missing bitmap bounds check gives an uncontrolled OOB kernel write / double-panic instead of a crash dump Base system — bus / platform / cpu · sys/platform/pc64/x86_64/minidump_machdep.c:260 · pass 2 · new	panic	reproduced fixed
DF-5563	Low	5.7	iicbus_request_bus parks requesters on the softc with timeout-0 tsleep and no detach drain — kldunload under a parked waiter frees the softc and unmaps iicbus.ko text under it: freed-text execution (UAF) on resume, plus sc->owner write into freed memory on colliding wakeup Kernel memory corruption (UAF / OOB write) · sys/bus/iicbus/iiconf.c:63 · pass 2 · new	panic	reproduced fixed
DF-5582	Low	5.7	smbus_acpi_detach does not quiesce in-flight GSBUS address-space handler dispatches: AcpiRemoveAddressSpaceHandler frees the handler object and its held ContextMutex, and newbus frees the softc/parent device underneath the running handler (UAF, panic/heap corruption) Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/smbacpi/smbacpi.c:268 · pass 2 · new	panic	reproduced fixed
DF-5643	Low	5.7	smbus_detach never checks sc->owner: the bus detaches (and device_detach frees the softc) underneath the owning client and parked requesters — the owner's release (the smbioctl exit path) takes Fatal trap 12, and a parked SMB_WAIT requester woken on the freed softc performs a post-free read+write and returns success Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/smbus.c:105 · pass 2 · new	panic	reproduced fixed
DF-5664	Low	5.7	usb_alloc_mbufs() truncates the 64-bit (block_size + sizeof(struct usb_mbuf)) * nblocks product into usb_size_t before kmalloc — undersized heap allocation whose data pointers are constructed fully out of bounds (latent CWE-190-to-CWE-787; no unprivileged in-tree path reaches it today) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_mbuf.c:62 · pass 2 · new	panic	reproduced fixed
DF-5696	Low	5.7	kqsort keeps partition byte-distances in int: truncation plus signed/unsigned promotion through '(r = pd - pc) > es' corrupts the partition state at >=2.16 GiB — array pointer restarts 2.13 GiB past the end (OOB comparator reads, OOB swap writes); med3 'd=(n/8)*es' wraps at >=16 GiB Kernel memory leaks / uninitialized disclosure · sys/libkern/qsort.c:109 · pass 2 · new	none	reproduced fixed
DF-5765	Low	5.7	Unsynchronized cspair lifetime handoff: iconv_xlat_open/iconv_xlat_close manipulate cp_refcount lockless against under-lock cspair teardown, and iconv_sysctl_add's error path frees referenced pairs unconditionally — UAF writes into freed cspairs, dangling d_table, kernel heap corruption (reproduced panic:BADFREE2) Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv_xlat.c:60 · pass 2 · new	panic	reproduced fixed
DF-5375	High	5.6	No func_code whitelist in targwrite(): arbitrary queued XPT opcode injected by the daemon → deterministic targdone() panic (and raw kernel pointers forwarded to SIMs) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_target.c:584 · pass 2 · new	panic	reproduced fixed
DF-5660	High	5.6	vkernel shutdown fallback calls the HOST libc reboot(2): a SIGTERM landing in the boot SYSINIT sliver asks the host kernel to reboot/power off the physical machine Base system — bus / platform / cpu · sys/platform/vkernel64/platform/shutdown.c:61 · pass 2 · new	dos	reproduced fixed
DF-5766	High	5.6	BSP's Fortuna state permanently stops reseeding: first-boot ratecheck() stores garbage getmicrouptime() (~1.8e11 s) into last_reseed; all later deltas negative → csprng_reseed() never runs again on that CPU for the whole uptime despite eligible pools Base system — kernel core (kern) · sys/kern/subr_csprng.c:134 · pass 2 · new	leak	reproduced fixed
DF-2799	Medium	5.6	AB-BA kernel deadlock: jail_lock vs per-CPU gd_sysctllock — unprivileged `sysctl jail.list` readers vs root jail(2) permanently wedge the kernel Privilege escalation (general use) · sys/kern/kern_jail.c:275 · pass 2 · new	dos	reproduced fixed
DF-3095	Medium	5.6	Unvalidated vol0_next_tid at mount: deterministic kernel panic on first write (TID exhaustion) and silent TID wraparound that leaks new records into every historical snapshot Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_vfsops.c:683 · pass 2 · new	panic	reproduced fixed
DF-3501	Medium	5.6	ng_fec_addport arpcom type confusion: writes a node pointer at +sizeof(ifnet)+16 and 6 known MAC bytes at +sizeof(ifnet) past ANY non-arpcom ifnet allocation (lo0), reads 6 bytes OOB disclosed as the fec MAC (kernel pointer leak via gif), and corrupts live gif_softc fields -> kernel GPF Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:378 · pass 2 · new	panic	reproduced fixed
DF-5230	Low	5.6	NULL rdev->uvd_fw dereference in uvd_v4_2_resume via the unguarded KV DPM ungate path (kv_dpm.c:1628) — kernel panic on suspend/pm-fini of a DPM-enabled CIK APU without UVD firmware Base system — drivers · sys/dev/drm/radeon/uvd_v4_2.c:51 · pass 2 · new	panic	reproduced fixed
DF-3102	High	5.5	Unaligned-offset read() on UDF files copies up to bsize-1 bytes past the buffer-cache buf into userspace (udf_readatoffset missing in-block size clamp) Kernel memory leaks / uninitialized disclosure · sys/vfs/udf/udf_vnops.c:1046 · pass 2 · new	leak	reproduced fixed
DF-4918	High	5.5	drain_workqueue() tsleep()s holding worker_lock — permanent kernel-thread/workqueue deadlock (drain never returns; worker starved; queue_work callers cascade-wedge) Base system — drivers · sys/dev/drm/linux_workqueue.c:265 · pass 2 · new	dos	reproduced fixed
DF-5675	High	5.5	Recursive proplib externalize vs. iterative internalize: DM ioctl plist echo exhausts the 16KB kernel thread stack (Fatal double fault at ~192 nesting levels) Base system — libkern / libprop / ddb · sys/libprop/prop_object.c:617 · pass 2 · new	panic	reproduced fixed
DF-2617	Medium	5.5	Zero-offset data_off on data-requiring bref types silently yields chain->data==NULL with error==0 — NULL panic or unkillable while(1) tsleep hang Hammer2 · sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new	dos	reproduced fixed
DF-2626	Medium	5.5	hammer2_read_file ignores uiomovebp() error: user-triggered unkillable in-kernel infinite loop (read/readlink EFAULT livelock) Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:983 · pass 2 · new	dos	reproduced fixed
DF-2630	Medium	5.5	hammer2 VFS_ROOT quorum wedge: pfs_nmasters > nchains pins mount forever and holds the namecache lock Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:1966 · pass 2 · new	dos	reproduced fixed
DF-2633	Medium	5.5	hammer2 write() silently succeeds while backend allocation fails on full PFS (ENOSPC never reaches the writer) Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:1310 · pass 2 · new	dos	reproduced fixed
DF-2640	Medium	5.5	Unguarded hammer2_chain_dirent_test() calls in the xop backend lookup loops are the first dereference of a NULL-data chain — unprivileged post-mount kernel panic (survives DF-2617's fix) Hammer2 · sys/vfs/hammer2/hammer2_xops.c:282 · pass 2 · new	panic	reproduced fixed
DF-2651	Medium	5.5	NULL-pointer dereference in hammer2_freemap_adjust() when the freemap leaf is absent — mount-time panic from crafted image Hammer2 · sys/vfs/hammer2/hammer2_freemap.c:1013 · pass 2 · new	panic	reproduced fixed
DF-2655	Medium	5.5	hammer2 ZLIB decompression failure returns zero-filled SUCCESS (b_error never set) — silent data substitution on malformed compressed blocks Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:258 · pass 2 · new	panic	reproduced fixed
DF-2657	Medium	5.5	Sync-thread xop quorum counts the excluded node: hammer2_xop_collect() can never reach quorum, permanently parking every sync thread (h2coll) — precise fixable root cause of the DF-2631 umount -f wedge family Hammer2 · sys/vfs/hammer2/hammer2_synchro.c:411 · pass 2 · new	dos	reproduced fixed
DF-2662	Medium	5.5	hammer2_update_spans() dereferences chain->data of an EIO-failed inode chain (NULL deref panic, unmasked by DF-2661's fix) Hammer2 · sys/vfs/hammer2/hammer2_iocom.c:313 · pass 2 · new	panic	reproduced fixed
DF-2667	Medium	5.5	Unprivileged kernel NULL-pointer panic via mountctl(2) MOUNTCTL_MOUNTFLAGS with buflen=0: vfs_flagstostr() strlens a NULL buffer before its degenerate-length guard Privilege escalation (general use) · sys/kern/vfs_syscalls.c:1281 · pass 2 · new	panic	reproduced fixed
DF-2698	Medium	5.5	hammer(1) MOUNTCTL_MOUNTFLAGS result-length double-count: unprivileged copyout reads up to ~U bytes past a kmalloc'd M_TEMP buffer (kernel heap pointer disclosure) Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_vnops.c:2577 · pass 2 · new	leak	reproduced fixed
DF-2702	Medium	5.5	AF_UNIX SCM_RIGHTS raw kernel file-pointer leak via recvmsg(MSG_PEEK) — soreceive skips unp_externalize on the peek path Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_usrreq.c:1543 · pass 2 · new	leak	reproduced fixed
DF-2713	Medium	5.5	recvmsg(2) copies out uninitialized CMSG_SPACE tail padding of every kernel-built control message — unprivileged, groomable kernel heap disclosure Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_syscalls.c:1175 · pass 2 · new	leak	reproduced fixed
DF-2714	Medium	5.5	sendfile(2) marshals hdtr headers into an unbounded M_WAITOK mbuf chain before any socket validation — attacker-chosen kernel memory exhaustion and uninterruptible full mbuf-pool wedge (unkillable, reboot required) Base system — kernel core (kern) · sys/kern/uipc_syscalls.c:1617 · pass 2 · new	dos	reproduced fixed
DF-2718	Medium	5.5	PT_INTERP interpreter string never NUL-terminated: kernel heap OOB read disclosed to unprivileged users via uprintf("ELF interpreter %s not found") Kernel memory leaks / uninitialized disclosure · sys/kern/imgact_elf.c:668 · pass 2 · new	leak	reproduced fixed
DF-2753	Medium	5.5	fork1() publishes the embryonic SIDL child to the pid hash/allproc list before p_pgrp/p_ucred initialization; pfind()/allproc_scan() don't filter SIDL — unprivileged NULL-pointer-deref kernel panic via kill(-1), sched_*(pid), getsid(pid), ptrace/sysctl Base system — kernel core (kern) · sys/kern/kern_fork.c:491 · pass 2 · new	panic	reproduced fixed
DF-2759	Medium	5.5	Unprivileged kernel-log/kernel-pointer disclosure channel: default-config UCONSOLE lets any user's pty become constty and subr_prf.c streams all kernel messages to it, bypassing security.unprivileged_read_msgbuf and nullifying ptr_restrict against the %p leak population Privilege escalation (general use) · sys/kern/subr_prf.c:396 · pass 2 · new	leak	reproduced fixed
DF-2781	Medium	5.5	No system-wide or per-user POSIX mqueue accounting: queues and their queued messages persist after the last close with no enumeration — unprivileged, unbounded, permanent-until-reboot kernel heap exhaustion Base system — kernel core (kern) · sys/kern/sys_mqueue.c:391 · pass 2 · new	dos	reproduced fixed
DF-2785	Medium	5.5	Reachable panic("semop - can't undo undos") in sys_semop SEM_UNDO rollback via same-process thread race — unprivileged local kernel DoS Base system — kernel core (kern) · sys/kern/sysv_sem.c:998 · pass 2 · new	panic	reproduced fixed
DF-2813	Medium	5.5	objcache_get() M_WAITOK lost wakeup: objects stranded in remote CPUs' partially-filled magazines cause a permanent, unkillable sleep Base system — kernel core (kern) · sys/kern/kern_objcache.c:547 · pass 2 · new	dos	reproduced fixed
DF-2839	Medium	5.5	/dev/lpmap fault races lwp teardown: orphaned lpmap allocation leaks 4KB M_UPMAP kernel heap per hit (unprivileged kmem exhaustion) Base system — kernel core (kern) · sys/kern/kern_memio.c:801 · pass 2 · new	dos	reproduced fixed
DF-2870	Medium	5.5	taskqueue_free() terminate lost-wakeup: worker parks without re-checking TQ_FLAGS_ACTIVE → permanent deadlock with in-flight task Base system — kernel core (kern) · sys/kern/subr_taskqueue.c:141 · pass 2 · new	dos	reproduced fixed
DF-2921	Medium	5.5	Signed integer overflow in nvtruncbuf()/nvnode_pager_setsize() at file lengths within blksize of 2^63 → ~2^63-iteration unmap loop holding the vnode token and object lock: unprivileged, unkillable, permanent kernel livelock on HAMMER2 (guest becomes unshut-downable) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_vm.c:145 · pass 2 · new	dos	reproduced fixed
DF-2952	Medium	5.5	Resident-exec stack remap silently fails (vm_map_stack KERN_NO_SPACE swallowed at imgact_resident.c:185): every exec of a registered binary runs on the registration snapshot's COW stack, disclosing the registering root process's stack contents to unprivileged exec'ers Kernel memory leaks / uninitialized disclosure · sys/kern/imgact_resident.c:185 · pass 2 · new	leak	reproduced fixed
DF-2999	Medium	5.5	hammer(1) setattr/write have no va_size clamp: DF-2921-class nvtruncbuf/nvnode_pager_setsize signed-overflow → unprivileged permanent kernel livelock on any HAMMER1 mount Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_vnops.c:670 · pass 2 · new	dos	reproduced fixed
DF-3023	Medium	5.5	tmpfs_write accepts negative pwrite offsets: unsigned-wrap of the EFBIG/RLIMIT/growth checks drives tmpfs_reg_resize(negative) → unprivileged kernel panic Base system — filesystems · sys/vfs/tmpfs/tmpfs_vnops.c:691 · pass 2 · new	panic	reproduced fixed
DF-3050	Medium	5.5	s_blocks_count never checked against the device size — crafted superblock drives a ~256GB M_WAITOK kmalloc before any group-descriptor read, wedging the whole system Base system — filesystems · sys/vfs/ext2fs/ext2_vfsops.c:591 · pass 2 · new	dos	reproduced fixed
DF-3083	Medium	5.5	ext2_dirbad panic()s a writable-mounted ext2 on any mangled directory entry — one flipped byte = reboot-loopable local DoS Base system — filesystems · sys/vfs/ext2fs/ext2_lookup.c:701 · pass 2 · new	panic	reproduced fixed
DF-3179	Medium	5.5	tmpfs dirent zone keeps the default malloc limit (RAM/10) and tmpfs_alloc_dirent allocates without M_NULLOK: unprivileged link(2) flood on the default /tmp panics the kernel ("tmpfs dirent: malloc limit exceeded") Base system — filesystems · sys/vfs/tmpfs/tmpfs_vfsops.c:200 · pass 2 · new	panic	reproduced fixed
DF-3187	Medium	5.5	hammer_ioc_scan_pseudofs feeds forged on-disk data_offset/data_len through hammer_btree_extract into the CRC engine and copyout — unprivileged kernel panic (wild kernel-memory read walk) Privilege escalation (general use) · sys/vfs/hammer/hammer_pfs.c:358 · pass 2 · new	panic	reproduced fixed
DF-3218	Medium	5.5	dirfs_root open-failure teardown: dirfs_free_vp NULL-pointer write (vp->v_data at NULL), latent double-free, and never-cleared dangling dmp->dm_root Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vfsops.c:246 · pass 2 · new	panic	reproduced fixed
DF-3225	Medium	5.5	procfs ATTACH lacks ptrace's tracer-cycle check: two unprivileged processes build a p_pptr cycle; ptrace(PT_ATTACH)'s ancestor walk then spins forever in-kernel holding the target's p_token — permanent progressive kernel livelock Base system — filesystems · sys/vfs/procfs/procfs_ctl.c:134 · pass 2 · new	dos	reproduced fixed
DF-3230	Medium	5.5	Post-unmount fstatfs(2) on a still-open fd NULL-derefs in fuse_statfs: unguarded VFSTOFUSE(mp) after fuse_unmount clears mnt_data feeds fuse_ipc_get(NULL) -> fetch-add at 0x160 -> fatal trap 12 (deterministic panic) Base system — filesystems · sys/vfs/fuse/fuse_ipc.c:100 · pass 2 · new	panic	reproduced fixed
DF-3235	Medium	5.5	procfs_docmdline() use-after-free read of freed pargs / lwp_lpmap / p_upmap across a blocking uiomove — cross-process argv disclosure past the CHECKIO gate Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_status.c:236 · pass 2 · new	leak	reproduced fixed
DF-3238	Medium	5.5	NULL-deref kernel panic: procfs_domap() ignores vm_map_lookup_entry() failure and feeds NULL to RB_NEXT() during /proc/pid/map revalidation Privilege escalation (general use) · sys/vfs/procfs/procfs_map.c:236 · pass 2 · new	panic	reproduced fixed
DF-3258	Medium	5.5	Uninitialized kernel-stack disclosure of dr[8..15] (64 bytes) via /proc/<pid>/dbregs and ptrace(PT_GETDBREGS) Kernel memory leaks / uninitialized disclosure · sys/vfs/procfs/procfs_dbregs.c:57 · pass 2 · new	leak	reproduced fixed
DF-3332	Medium	5.5	Unbounded kernel loop in netmap_grab_packets via unvalidated ring->reserved: unkillable thread + console flood + mbuf-exhaustion DoS (DF-0358 sign error escalated) Base system — network stack · sys/net/netmap/netmap.c:740 · pass 2 · new	dos	reproduced fixed
DF-3358	Medium	5.5	Unprivileged permanent kernel memory consumption and routing-plane exhaustion via RTM_GET + RTA_GENMASK (rtmask_add_global pollution) Privilege escalation (general use) · sys/net/rtsock.c:738 · pass 2 · new	dos	reproduced fixed
DF-3366	Medium	5.5	Unprivileged kernel heap info leak via route(4) sockaddr alignment padding: route keys/gateways stored RT_ROUNDUP-sized but only sa_len initialized, copied out rounded to any local user via RTM_GET Privilege escalation (general use) · sys/net/route.c:920 · pass 2 · new	leak	reproduced fixed
DF-3369	Medium	5.5	bdg_netmap_rxsync: uint32 wrap of (reserved + avail) defeats the only sanity check on ring->reserved — k escapes the ring index space and the release loop never terminates while holding the kring q_lock exclusively Base system — network stack · sys/net/netmap/netmap_vale.c:1502 · pass 2 · new	dos	reproduced fixed
DF-3478	Medium	5.5	listen(2) on an L2CAP SEQPACKET socket recurses solisten()↔so_pru_listen() without bound → kernel stack overflow → CPU double fault (unprivileged, 100% reproducible panic) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2460 · pass 2 · new	panic	reproduced fixed
DF-3610	Medium	5.5	NULL-pointer dereference in si_dpm_enable when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state (boot_ps unvalidated) — radeon twin of amdgpu DF-3586 Base system — drivers · sys/dev/drm/radeon/si_dpm.c:6354 · pass 2 · new	panic	reproduced fixed
DF-3612	Medium	5.5	Integer divide-by-zero in spread-spectrum programming when VBIOS usSpreadRateInKhz == 0 (si_calculate_sclk_params:4831 and si_populate_mclk_value:4931) — distinct sink from DF-1137 Base system — drivers · sys/dev/drm/radeon/si_dpm.c:4831 · pass 2 · new	panic	reproduced fixed
DF-3613	Medium	5.5	Integer divide-by-zero on zero PLL reference clock from VBIOS FirmwareInfo (do_div at si_calculate_sclk_params:4811; mpll divide at si_populate_mclk_value:4927) Base system — drivers · sys/dev/drm/radeon/si_dpm.c:4811 · pass 2 · new	panic	reproduced fixed
DF-3614	Medium	5.5	Heap OOB write past SISLANDS_SMC_STATETABLE.lowSMIO[32] via untrimmed SVI2 VDDCI voltage-table count in si_populate_smc_voltage_table — radeon twin of the lowSMIO half of amdgpu DF-3585 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/si_dpm.c:4046 · pass 2 · new	dos	reproduced fixed
DF-3696	Medium	5.5	Degraded RAID5 I/O: per-chunk ata_request leaked and bio never completed — boot wedge / unkillable hangs Base system — drivers · sys/dev/disk/nata/ata-raid.c:386 · pass 2 · new	dos	reproduced fixed
DF-4242	Medium	5.5	panic("DPT Rebooted") on device-fed register signature — a rebooting or hostile HBA takes down the kernel (DF-4042/4098 hostile-input family) Base system — drivers · sys/dev/raid/dpt/dpt_scsi.c:1551 · pass 2 · new	panic	reproduced fixed
DF-4251	Medium	5.5	mprsas_SSU_to_SATA_devices leaks mpr_lock on two error-path returns — permanent adapter deadlock at shutdown Base system — drivers · sys/dev/raid/mpr/mpr_sas_lsi.c:1497 · pass 2 · new	dos	reproduced fixed
DF-4283	Medium	5.5	midi(4) kqueue filter detach removes knote from BOTH klists — unguarded SLIST_REMOVE walks off the foreign list and dereferences NULL → deterministic kernel panic Base system — drivers · sys/dev/sound/midi/midi.c:932 · pass 2 · new	dos	reproduced fixed
DF-4331	Medium	5.5	Spanset code divides by firmware fields that can be zero: mr_update_span_set quad->diff (map load) and get_arm/mr_spanset_get_phy_params spanRowSize (first FP IO) - kernel #DE panic Base system — drivers · sys/dev/raid/mrsas/mrsas_fp.c:969 · pass 2 · new	panic	reproduced fixed
DF-4472	Medium	5.5	dm_table_load_ioctl dereferences uninitialized stack pointer `type` as a C string (strcmp/ksnprintf wild read -> kernel panic) Base system — drivers · sys/dev/disk/dm/dm_ioctl.c:684 · pass 2 · new	panic	reproduced fixed
DF-4474	Medium	5.5	Kernel heap leak on dm ioctl error paths: unreleased prop_array_iterator (retaining the entire inbound cmd_data tree) in dm_table_load_ioctl; unreleased cmd_array in deps/status ENOENT paths Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/dm_ioctl.c:602 · pass 2 · new	dos	reproduced fixed
DF-4505	Medium	5.5	ipmi(4): IPMICTL_SEND_COMMAND flood parks an unbounded in-flight request backlog — kernel memory exhaustion, panic "ipmi: malloc limit exceeded" (operator-group local kernel DoS) Base system — drivers · sys/dev/misc/ipmi/ipmi.c:401 · pass 2 · new	panic	reproduced fixed
DF-4657	Medium	5.5	plip: lpoutput/lp_intr spin on the parallel port inside crit_enter() with unbounded aggregate time — unprivileged CPU-pinning DoS Base system — drivers · sys/dev/netif/plip/if_plip.c:606 · pass 2 · new	dos	reproduced fixed
DF-4666	Medium	5.5	phm_find_closest_vddci has no empty-table guard — count==0 indexes entries[0xFFFFFFFF]: wild kernel read ~32 GiB past the heap object (panic) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:426 · pass 2 · new	dos	reproduced fixed
DF-4668	Medium	5.5	snp: snoop line discipline installable via unprivileged TIOCSETD; snplclose NULL-derefs t_sc on tty close (kernel panic) Privilege escalation (general use) · sys/dev/misc/snp/snp.c:129 · pass 2 · new	panic	reproduced fixed
DF-4672	Medium	5.5	METEORSETGEO grow path frees the contigmalloc'd frame buffer with bare kmem_free() — wired vm_pages are never returned: permanent unprivileged wired-memory leak (plus stale kernel PTEs / mistabulated resident_count) Base system — drivers · sys/dev/video/bktr/bktr_os.c:399 · pass 2 · new	dos	reproduced fixed
DF-4673	Medium	5.5	METEORSETGEO grow path installs an unzeroed frame buffer — contigmalloc pages recycled from PQ_FREE/PQ_CACHE disclose stale kernel memory via mmap()/read() (attach path bzero's; grow path doesn't) Kernel memory leaks / uninitialized disclosure · sys/dev/video/bktr/bktr_os.c:399 · pass 2 · new	leak	reproduced fixed
DF-4721	Medium	5.5	launch_requests() keeps walking the request group after an inline completion freed it (trailing XFR_BAD_SUBDISK rqe) - kernel panic on the ORDINARY degraded RAID-5 write (new, waitlist-independent arm of the DF-4482 UAF cluster) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrequest.c:395 · pass 2 · new	panic	reproduced fixed
DF-5024	Medium	5.5	ath_ioctl_phyerr() copies out the UNINITIALIZED M_TEMP result buffer on its error paths — attacker-sized kernel heap disclosure to unprivileged users Privilege escalation (general use) · sys/dev/netif/ath/ath_dfs/null/dfs_null.c:253 · pass 2 · new	leak	reproduced fixed
DF-5026	Medium	5.5	Bios queued to an IPS_OFFLINE adapter are never biodone'd — ips_start_io_request swallows ips_get_free_cmd's EIO; every issuer parks in an unkillable D-state and bio_queue grows unbounded Base system — drivers · sys/dev/raid/ips/ips_disk.c:128 · pass 2 · new	dos	reproduced fixed
DF-5070	Medium	5.5	SPECTRAL_CONTROL_SET_PARAMS dereferences indata without checking the ATH_DIAG_IN flag — unprivileged NULL-pointer-deref panic (DFS_SET_THRESH twin of DF-2052, missed in pass 1) Base system — drivers · sys/dev/netif/ath/ath/if_ath_spectral.c:233 · pass 2 · new	panic	reproduced fixed
DF-5133	Medium	5.5	dmabuf_fileops leaves fo_shutdown NULL: shutdown(2) on any dma-buf fd is an unprivileged kernel NULL function-pointer call (panic) Base system — drivers · sys/dev/drm/linux_dma-buf.c:107 · pass 2 · new	panic	reproduced fixed
DF-5272	Medium	5.5	CDIOCREADSUBCHANNEL: non-zeroed kmalloc + short device transfer + device-inflated data_len clamp = uninitialized kernel heap disclosure Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_cd.c:2141 · pass 2 · new	leak:20 bytes/call of uninitialized kernel heap to a privileged reader, unlimited calls; demonstrated disclosure of a live kernel sysctl OID name string fragment ('...ilcd\0spray_leak\0') and of stable allocator/object remnants (ffffffff...01000000) across 64/64 ioctls x 3 rounds; evil-device-gated (same model as DF-0989, distinct path and mechanism: short transfer + device-inflated data_len clamp on a non-M_ZERO kmalloc).	reproduced fixed
DF-5285	Medium	5.5	sastrategy integer divide-by-zero panic from device-driven min_blk==0 with non-power-of-2 fixed blocksize Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sa.c:756 · pass 2 · new	dos	reproduced fixed
DF-5302	Medium	5.5	NULL-pointer write panic in fwohci_db_init() via zero ndb from unvalidated FW_SSTBUF bnpacket*bnchunk (RX and TX enable paths) Base system — bus / platform / cpu · sys/bus/firewire/fwohci.c:1229 · pass 2 · new	panic	reproduced fixed
DF-5332	Medium	5.5	chgetelemstatus() allocates READ ELEMENT STATUS buffers without M_ZERO and ignores resid: short-but-GOOD device transfers disclose stale kernel heap through CHIOGSTATUS copyout (DF-5272 class) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:1089 · pass 2 · new	leak	reproduced fixed
DF-5415	Medium	5.5	fw_kqfilter dereferences d->ir with no NULL check: knote_insert on NULL+offsetof(fw_xferq,rkq) -> kernel panic (EVFILT_WRITE also hooked to the receive queue) Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:721 · pass 2 · new	panic	reproduced fixed
DF-5416	Medium	5.5	FW_CBINDADDR unbinds a foreign bind via the global fw_bindlookup and STAILQ_REMOVEs it from the wrong xferq's (empty) bind list -- unguarded walk-off-NULL -> kernel panic; cross-node bind theft Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:593 · pass 2 · new	panic	reproduced fixed
DF-5532	Medium	5.5	usb_proc_mwait() wakeup is gated on the whole queue becoming empty, not on the waited-for messages completing: any continuously refilled usb_process queue holds waiters in uninterruptible (PCATCH-less) sleep indefinitely — the root mechanism beneath the DF-5367..5504 cfg-stall family's uninterruptible-occupancy measurements Base system — bus / platform / cpu · sys/bus/u4b/usb_process.c:163 · pass 2 · new	dos	reproduced fixed
DF-5629	Medium	5.5	Kernel heap info leak to unprivileged user's tty via unterminated PT_INTERP path (uprintf %s) Privilege escalation (general use) · sys/cpu/x86_64/misc/elf_machdep.c:58 · pass 2 · new	leak	reproduced fixed
DF-5639	Medium	5.5	Unprivileged kernel panic: unvalidated non-canonical TLS base reaches wrmsr(MSR_FSBASE/MSR_KGSBASE) in set_user_TLS() Base system — bus / platform / cpu · sys/platform/pc64/x86_64/tls.c:100 · pass 2 · new	panic	reproduced fixed
DF-5657	Medium	5.5	set_dbregs() stores DR7 with architecturally-reserved bits 63:32 unvalidated; the value is loaded by cpu_heavy_restore during a context switch, raising a ring-0 #GP (fatal trap, panic) from an unprivileged ptrace() of the attacker's own child Base system — bus / platform / cpu · sys/platform/pc64/x86_64/procfs_machdep.c:98 · pass 2 · new	panic	reproduced fixed
DF-5757	Medium	5.5	l2cap_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — unprivileged permanent mbuf-pool exhaustion DoS (l2cap sibling of DF-0709; not the DF-0682 panic path) Base system — network stack · sys/netbt/l2cap_socket.c:120 · pass 2 · new	dos	reproduced fixed
DF-5758	Medium	5.5	rfcomm_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — unprivileged permanent mbuf-pool exhaustion DoS (rfcomm sibling of DF-0709/5757; not the DF-0680 panic path) Base system — network stack · sys/netbt/rfcomm_socket.c:117 · pass 2 · new	dos	reproduced fixed
DF-2827	Low	5.5	ckpt_thaw_proc(): e_phnum == 0 makes kmalloc(0) return ZERO_LENGTH_PTR; phdr->p_filesz reads kernel VA 0x18 (unconditional fatal kernel page fault) Base system — kernel core (kern) · sys/kern/kern_checkpoint.c:232 · pass 2 · new	panic	reproduced fixed
DF-5611	Low	5.5	SIGXCPU omitted from cpu_disable_intr()/cpu_mask_all_signals() while stopsig() dereferences mycpu — one process-directed host signal silently kills the entire vkernel via the DF-5587 recursion Base system — bus / platform / cpu · sys/platform/vkernel64/platform/machintr.c:194 · pass 2 · new	dos	reproduced fixed
DF-5760	Medium	5.4	RFCOMM PN-command direction-validation hole in rfcomm_dlc_newconn: peer fabricates DLCs in the local stack's DLCI space, permanently locking local outbound connects (EBUSY) Base system — network stack · sys/netbt/rfcomm_session.c:1322 · pass 2 · new	dos	reproduced fixed
DF-5761	Medium	5.4	sco_pcb newconn-matching walk UAF: hci_sco_newconn() (netisr) holds a listening pcb across the sonewconn callback while sco_detach() (syscall) unlinks and kfrees it — deterministic kernel panic, indirect-call primitive through freed memory Kernel memory corruption (UAF / OOB write) · sys/netbt/sco_upper.c:240 · pass 2 · new	panic	reproduced fixed
DF-5426	Info	5.4	usb_handle_request(): unguarded 'max_len -= off' offset subtraction relies on provider-length immutability — latent uint16 wrap yields an out-of-object DMA window (up to ~4 KiB/fragment OOB read on IN, mirror OOB write on OUT via a lying sub-driver); hardening Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/usb_handle_request.c:746 · pass 2 · new	leak	reproduced fixed
DF-2652	High	5.3	Wrong bitmap-pair index (& 15 instead of 5-bit mask) in hammer2_freemap_adjust() DORECOVER — live blocks left marked free, overlapping allocations and silent cross-file data corruption Hammer2 · sys/vfs/hammer2/hammer2_freemap.c:1073 · pass 2 · new	dos	reproduced fixed
DF-3212	High	5.3	ffs_read OOB read into adjacent buffer-cache KVA: dead 'xfersize <= 0' guard lets a crafted fs_qbmask drive uiomovebp past the buffer (kernel .text/.rodata + other files' cached pages disclosed to an unprivileged reader) Privilege escalation (general use) · sys/vfs/ufs/ufs_readwrite.c:141 · pass 2 · new	leak	reproduced fixed
DF-2882	Medium	5.3	kvsscanf %*Nc suppress short-input branch leaves inr stale → conversions read past the input string's NUL (cross-object kernel heap disclosure into caller buffers) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_scanf.c:292 · pass 2 · new	leak	reproduced fixed
DF-2903	Medium	5.3	Ontrack (DOSPTYP_ONTRACK 0x54) re-read path releases a getpbuf_mem() pbuf via brelse() — guaranteed kernel panic from one crafted MBR sector (INVARIANTS) / cross-subsystem pbuf corruption + leak and latent infinite re-read wedge holding ds_token (production) Base system — kernel core (kern) · sys/kern/subr_diskmbr.c:174 · pass 2 · new	panic	reproduced fixed
DF-2918	Medium	5.3	Unsynchronized vfsconf registry: sys_mount vs kldunload TOCTOU — UAF write/call through unloaded module (reproduced as irrecoverable kernel deadlock of the mount/linker subsystem) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_init.c:264 · pass 2 · new	dos	reproduced fixed
DF-2979	Medium	5.3	physio consumes stale/uninitialized b_resid from the shared pbuf_mem pool and copyouts stale bounce-buffer contents before the B_ERROR check — failed raw reads disclose other contexts' kernel-resident I/O data Privilege escalation (general use) · sys/kern/kern_physio.c:98 · pass 2 · new	leak	reproduced fixed
DF-2997	Medium	5.3	nfs_lookup/nfs_mkdir error paths vrele() vnodes that nfs_nget returned LK_EXCLUSIVE-locked — permanent vnode-lock leak, mount wedge / vnode exhaustion DoS from malformed server replies Base system — filesystems · sys/vfs/nfs/nfs_vnops.c:1270 · pass 2 · new	dos	reproduced fixed
DF-3099	Medium	5.3	hpfs_write consumes unvalidated on-disk extent length: (runl+1)*DEV_BSIZE int overflow → towrite==0 → zero-size getblk/bread + size_t underflow in uiomove → unkillable kernel livelock (and latent OOB copyin) Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_vnops.c:394 · pass 2 · new	dos	reproduced fixed
DF-3213	Medium	5.3	Stale RC_REPSTATUS survives dup-reply-cache slot reuse: rc_status aliases the cached rc_reply mbuf pointer (union type confusion) — kernel heap-pointer material and wrong status-only replies served to unauthenticated remote clients on retransmission Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_srvcache.c:212 · pass 2 · new	leak	reproduced fixed
DF-3363	Medium	5.3	maxrate() heap out-of-bounds read via unvalidated htcap_ie from the verbatim-saved beacon IE blob: attacker-controlled AP selection Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:775 · pass 2 · new	leak	reproduced fixed
DF-3457	Medium	5.3	gif(4) clone-destroy tears down softc state with no ifnet serializer while in-flight gif_output()/in_gif_output() dereferences it — use-after-free, reproduced kernel panic Kernel memory corruption (UAF / OOB write) · sys/netinet/in_gif.c:101 · pass 2 · new	panic	reproduced fixed
DF-4079	Medium	5.3	oce_rx builds mbuf chain with m_pkthdr.len from the CQE 14-bit pkt_size unclamped to num_fragments x frag_size: chain up to 2047 bytes shorter than claimed, handed to if_input — stack offset-walkers (m_copydata KASSERT) panic, TCP desynchronizes Base system — drivers · sys/dev/netif/oce/oce_if.c:1260 · pass 2 · new	panic	reproduced fixed
DF-4168	Medium	5.3	DC bounds all VBIOS walks by the image's self-declared size byte (bios[2]*512) instead of the allocated buffer length Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1930 · pass 2 · new	leak	reproduced fixed
DF-4184	Medium	5.3	acd_fixate() sizes MODE SELECT data-out from device-fed write-param page_length: 265-byte transfer out of a 64-byte stack struct discloses ~201 bytes of kernel stack to the device Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/atapi-cd.c:1140 · pass 2 · new	leak	reproduced fixed
DF-4208	Medium	5.3	legacyEepromDiag() HAL_DIAG_EEPROM_EXP_* union type confusion: returns EEPROM-derived wild pointer/size that ath_ioctl_diag copyout()s (non-canonical -> panic), plus HAL_DIAG_EEPROM full-struct dump leaking 6 kernel heap pointers Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:1725 · pass 2 · new	none	reproduced fixed
DF-4382	Medium	5.3	Peer-initiated BLK_OPEN termination strands the open tag on tag_pendq forever: silent tag exhaustion (stale sc->last_error masks it), device wedge, softc/module unload permanently blocked Base system — drivers · sys/dev/disk/xdisk/xdisk.c:1126 · pass 2 · new	dos	reproduced fixed
DF-4764	Medium	5.3	Type confusion in hpt_get_info: goto is_array passes RAID-1 member disk to hpt_copy_array_info -> punned union fields (bArnMember=df_on_line=1, bit21/22 of disk capacity as rf_rebuilding/rf_verifying, pMember[0]=Device.mv) cause kernel SIGFPE panic on unprivileged sysctl hptmv.status read Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/hptproc.c:523 · pass 2 · new	panic	reproduced fixed
DF-5235	Medium	5.3	wait_for_completion()/wait_for_completion_interruptible(): MAX_SCHEDULE_TIMEOUT (LONG_MAX) truncates to int -1 in lksleep() — every 'infinite' completion wait expires after one tick with spurious success Base system — drivers · sys/dev/drm/linux_completion.c:33 · pass 2 · new	none	reproduced fixed
DF-5382	Medium	5.3	umcs7840_intr_callback issues synchronous 500ms EP0 control reads on the shared per-bus USB callback thread: an evil MCS7840 device freezes ALL USB transfer callbacks on the bus indefinitely (2.25 s per crafted 13-byte interrupt packet) Base system — bus / platform / cpu · sys/bus/u4b/serial/umcs.c:745 · pass 2 · new	dos	reproduced fixed
DF-5397	Medium	5.3	urndis(4) attach-failure paths call urndis_detach() on a never-attached usb_ether → deterministic kernel panic (lockmgr of NULL, fault VA 0) from plugging a malicious RNDIS device Base system — bus / platform / cpu · sys/bus/u4b/net/if_urndis.c:309 · pass 2 · new	panic	reproduced fixed
DF-5399	Medium	5.3	mos_attach() failure paths call mos_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch) Base system — bus / platform / cpu · sys/bus/u4b/net/if_mos.c:706 · pass 2 · new	panic	reproduced fixed
DF-5411	Medium	5.3	udav_attach() failure paths call udav_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch) Base system — bus / platform / cpu · sys/bus/u4b/net/if_udav.c:263 · pass 2 · new	panic	reproduced fixed
DF-5493	Medium	5.3	uether_ifdetach() performs no never-attached state validation — class-wide owner of the 8-instance DF-5334 goto-detach panic family (lockmgr through NULL ue_lock; ether_ifdetach() on a never-if_attach()ed ifnet) Base system — bus / platform / cpu · sys/bus/u4b/net/usb_ethernet.c:267 · pass 2 · new	panic	reproduced fixed
DF-5547	Medium	5.3	fwmem_read_block() advertises a quadlet-rounded receive length for a shorter destination buffer — 1-3 responder-controlled bytes written past the end of the caller's buffer (kernel OOB write) Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwmem.c:197 · pass 2 · new	kernel out-of-bounds WRITE of 1-3 fully responder-controlled bytes past the RPC destination buffer (proven cross-chunk into the adjacent 32-byte heap chunk via production fwmem_strategy->fwmem_read_block->fw_rcv/fw_rcv_copy); on current DFly physio the plain user read(2) path absorbs it into bounce-buffer slack, kernel-originated (UIO_SYSSPACE) reads / direct bio issuers get the full heap overrun	reproduced fixed
DF-5636	Medium	5.3	smbus_request_bus returns success without acquiring ownership: wake-path break skips the ownership re-check and the EWOULDBLOCK->0 fixup converts the SMB_DONTWAIT refusal into a grant (phantom grants / double grants) Base system — bus / platform / cpu · sys/bus/smbus/smbconf.c:126 · pass 2 · new	dos	reproduced fixed
DF-2609	Low	5.3	Default-enabled ICMPv6 Node Information responder discloses hostname and full IPv6 address inventory to unauthenticated remote peers Kernel memory leaks / uninitialized disclosure · sys/netinet6/icmp6.c:628 · pass 2 · new	leak	reproduced fixed
DF-3364	Low	5.3	tdma_isfull()/match_bss() heap out-of-bounds read via unvalidated tdma_ie slot count (up to ~30 bytes past the blob allocation) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:959 · pass 2 · new	leak	reproduced fixed
DF-3434	Low	5.3	ipfw3 keep-state limit rules skip the duplicate check: one leaked state + one kprintf('oops') console line per packet (RB_INSERT duplicate never freed) Base system — network stack · sys/net/ipfw3_basic/ip_fw3_state.c:296 · pass 2 · new	dos	reproduced fixed
DF-4560	Low	5.3	mpssas_fw_work dereferences fixed-offset event members without checking EventDataLength covers the struct: pre-loop ConfigElement[0].VolDevHandle at +0x0A and LOG_ENTRY LogData[0] at +0x14 read past the kmalloc'd event copy Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_sas_lsi.c:273 · pass 2 · new	panic	reproduced fixed
DF-4715	Low	5.3	Second-bad-subdisk stale-marking loop indexes plex->sdnos[] by subdisk COUNT instead of the participating ordinals -> healthy subdisks force-marked stale Base system — drivers · sys/dev/raid/vinum/vinumraid5.c:413 · pass 2 · new	dos	reproduced fixed
DF-5699	Low	5.3	prop_dictionary_ingest() runs driver handlers on a borrowed, unpinned object reference after the dictionary lock is dropped — concurrent key removal frees the object underneath the callback (CWE-416) Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_ingest.c:133 · pass 2 · new	dos	reproduced fixed
DF-4247	High	5.2	No central bounds-validation layer for VBIOS PowerPlay parsing: offsets/counts/indices never checked against soft_pp_table_size (central fix for the DF-1468/1469/1470/1472 family) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:61 · pass 2 · new	leak	reproduced fixed
DF-4388	High	5.2	CENTRAL FIX: V1 PowerPlay parser has no bounds-validation layer — every firmware USHORT offset/UCHAR count/UCHAR index is consumed unvalidated (V1 side of DF-4247; count-provenance root of the powerplay count family) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:772 · pass 2 · new	dos	reproduced fixed
DF-4396	High	5.2	CENTRAL FIX: Vega10 PowerPlay parser has no bounds-validation layer — all 22 firmware USHORT offsets, every UCHAR count and every revision dispatch consumed unvalidated against soft_pp_table_size (vega10 side of DF-4388) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:72 · pass 2 · new	dos	reproduced fixed
DF-3433	Medium	5.2	if_stf teardown races its in-flight decap consumers: unguarded MOD_UNLOAD frees the softc under the lock-free encaptab walk and past the async NETISR_IPV6 queue carrying rcvif=&sc->sc_if - use-after-free (DF-3425 gif twin, wider async vector) Kernel memory corruption (UAF / OOB write) · sys/net/stf/if_stf.c:210 · pass 2 · new	panic	reproduced fixed
DF-4059	Medium	5.2	amr_done trusts the controller completion list twice over: completion id 0 yields idx = -1 and reads amr_busycmd[-1] (OOB before the array -> garbage ac pointer deref), and on standard firmware the 8-bit mb_nstatus iterates mb_completed[46] out to 255 entries (stack OOB read past the local mailbox) — distinct from DF-1358 (the WRITE overflow inside amr_quartz_get_work) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/amr/amr.c:1786 · pass 2 · new	panic	reproduced fixed
DF-4080	Medium	5.2	oce_detach frees ifp (if_free) while interrupts are still enabled and EQ0 deliberately re-armed by oce_if_deactivate: async MCC event in the window reaches oce_mq_handler -> if_link_state_change on the freed ifnet (use-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_if.c:322 · pass 2 · new	panic	reproduced fixed
DF-5316	Medium	5.2	USB_SET_CONFIG / USB_SET_ALTINTERFACE ioctls perform privileged device reconfiguration (driver detach/re-attach, re-enumeration) with no privilege check, bypassing the SYSCAP_NODRIVER gate the same file enforces on the equivalent raw control requests Privilege escalation (general use) · sys/bus/u4b/usb_generic.c:2096 · pass 2 · new	dos	reproduced fixed
DF-5363	Medium	5.2	CISTPL_CHECKSUM bounds check ignores tuple.mult: up to 4088 bytes of bus reads past the 4096-byte CIS mapping Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:237 · pass 2 · new	dos	reproduced fixed
DF-5497	Medium	5.2	crom_next() dereferences the peer-derived nested-directory pointer (reg + 24-bit val, forward up to +64 MB) before any bounds check — OOB kernel read and deterministic kernel panic from a malicious FireWire device's Config ROM Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:122 · pass 2 · new	panic	reproduced fixed
DF-5755	Medium	5.2	No overlong (non-shortest) UTF-8 form validation in utf8_to_ucs4 → arbitrary character synthesis into converted filenames (U+002F '/' into FAT LFN and 8.3 metadata via msdosfs KICONV) and encode_surrogate uint32 wrap for 4-byte overlongs Base system — libkern / libprop / ddb · sys/libiconv/iconv_ucs.c:419 · pass 2 · new	dos	reproduced fixed
DF-3425	Low	5.2	gif(4) teardown races the lock-free netisr encaptab walk: encap_detach() LIST_REMOVE+kfree vs encap4_input() walk calling gif_encapcheck() on the softc — use-after-free panic (reproduced) Kernel memory corruption (UAF / OOB write) · sys/net/gif/if_gif.c:176 · pass 2 · new	panic	reproduced fixed
DF-3530	Low	5.2	v1 ng_ether teardown frees priv with no synchronization against data-plane readers (DF-3529 ng7 twin; v1 lacks ng7's cpu0 funnel) Kernel memory corruption (UAF / OOB write) · sys/netgraph/ether/ng_ether.c:321 · pass 2 · new	panic	reproduced fixed
DF-4619	Low	5.2	ar5413: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write corrupting RF bank state Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:495 · pass 2 · new	dos	reproduced fixed
DF-4648	Low	5.2	ar2316: unbounded kk write in getGainBoundariesAndPdadcsForPowers overflows pcdacTable[128] into RF bank scratch (twin of DF-4619/ar5413) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:454 · pass 2 · new	dos	reproduced fixed
DF-4660	Low	5.2	ar2413: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write corrupting RF bank scratch (twin of DF-4619/ar5413, DF-4648/ar2316) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:451 · pass 2 · new	dos	reproduced fixed
DF-4661	Low	5.2	ar2413: numPdGainsUsed==0 (EEPROM xpd_mask==0) → uint32-wrapped wild reads at array+0x1FFFFFFFE (+8.59 GB) + uninitialized Pmin_t2[0] (twin of DF-4620/ar5413, DF-4649/ar2316) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:424 · pass 2 · new	dos	reproduced fixed
DF-4662	Low	5.2	ar2413: flat EEPROM power curve → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/ar5413, DF-4650/ar2316) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:457 · pass 2 · new	dos	reproduced fixed
DF-4749	Low	5.2	nmdm prison guard never initialized: pt_prison never assigned — jail affinity unenforced, jailed reopen degenerates to unconditional EBUSY Base system — drivers · sys/dev/misc/nmdm/nmdm.c:88 · pass 2 · new	none	reproduced fixed
DF-5543	Low	5.2	uep(4) one-remaining-byte stash stores the already-consumed buf[0] instead of the remaining p[0]: fabricated touch reports, dropped stream bytes, and cascade into the permanent stall Base system — bus / platform / cpu · sys/bus/u4b/input/uep.c:230 · pass 2 · new	dos	reproduced fixed
DF-2624	Medium	5.1	hammer2_pfsalloc kstrdup(ripdata->filename) with no NUL bound overreads the 64KB DIO buffer (mount-time panic / silent adjacent-heap overread) Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:495 · pass 2 · new	panic	reproduced fixed
DF-2635	Medium	5.1	iroot meta.inum overwritten from media after inum-hash insertion — hammer2_inode_drop walks off the wrong bucket (NULL-deref panic at unmount plus in-memory inode aliasing) Hammer2 · sys/vfs/hammer2/hammer2_inode.c:617 · pass 2 · new	panic	reproduced fixed
DF-2917	Medium	5.1	sleepq_wait/sleepq_wait_sig/sleepq_timedwait/sleepq_timedwait_sig NEVER sleep: _sleepq_wait_begin() drops the PDOMAIN_FBSD domain from the tsleep() flags, so tsleep's interlock validation always mismatches and returns immediately Base system — kernel core (kern) · sys/kern/subr_sleepqueue.c:275 · pass 2 · new	dos	reproduced fixed
DF-3469	Medium	5.1	sysctl_ifdata IFDATA_LINKSPECIFIC blindly copyouts driver-registered if_linkmib to unprivileged readers — sl(4) registers its ENTIRE sl_softc (5736 bytes: ifnet function pointers, softc/tty/heap addresses) — reproduced unprivileged kernel-pointer disclosure Privilege escalation (general use) · sys/net/if_mib.c:178 · pass 2 · new	leak	reproduced fixed
DF-4060	Medium	5.1	amr_std_poll_command timeout leaks the slot as permanently busy while every caller releases the command: next use of the recycled amr_command panics ('amr: slot %d busy?'), a late completion double-completes the recycled command (bio/UAF confusion), and amr_rescan_drives livelocks spinning on amr_busyslots Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr.c:1348 · pass 2 · new	panic	reproduced fixed
DF-4270	Medium	5.1	wb_start() ignores wb_encap() failure: failure paths leak the dequeued packet chain and leave a half-armed, unterminated OWN-marked descriptor chain for the NIC Base system — drivers · sys/dev/netif/wb/if_wb.c:1327 · pass 2 · new	dos	reproduced fixed
DF-4774	Medium	5.1	smu7 SMC-firmware upload streams ucode payload from unchecked firmware-header offset/size: kernel heap OOB read up to 128 KB from ~4 GB past the blob (powerplay smu7 twin of DF-2065/DF-2096/DF-2104) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/smu7_smumgr.c:461 · pass 2 · new	dos	reproduced fixed
DF-5477	Medium	5.1	efi_get_table(): firmware-fed physical st_cfgtbl stored and dereferenced as a kernel virtual pointer + st_entries walk with no bound — deterministic fatal kernel fault on the first EFIIOC_GET_TABLE ioctl of any conforming EFI boot; unbounded OOB read walk where mapped Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/efirt.c:411 · pass 2 · new	panic	reproduced fixed
DF-5507	Medium	5.1	/dev/smb SMB_BREAD hands amdsmb_bread an UNINITIALIZED kernel-stack count (smb.c:317/323): SMB_BREAD dead for 224/256 stack bytes, and for garbage in [1,32) the driver reports a larger count than it stored -> kernel-stack disclosure via smbioctl copyout; bwrite transmits the garbage length on the wire (DF-5458 twin) Kernel memory leaks / uninitialized disclosure · sys/bus/smbus/amdsmb/amdsmb.c:524 · pass 2 · new	leak	reproduced fixed
DF-5624	Medium	5.1	hard_sniff() flame-graph frame walk reads 8 bytes past the interrupted thread's kernel stack (fatal trap 12 / kernel-heap qword disclosure) Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/mp_flame.c:136 · pass 2 · new	panic	reproduced fixed
DF-5650	Medium	5.1	SRAT walk performs no entry-extent or per-type length validation: affinity fields read (and printed) past the declared table end — console/dmesg disclosure of adjacent physical memory, and kernel page fault when the read crosses the mapdev page Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/acpica/acpi_srat.c:94 · pass 2 · new	leak	reproduced fixed
DF-5694	Medium	5.1	karc4random64() upper 32 bits pinned to 0xffffffff on half of all draws — int-overflow left shift sign-extends into the 64-bit accumulator (UB), collapsing the exported kernel CSPRNG word from 64 bits of entropy to ~32.5 Base system — libkern / libprop / ddb · sys/libkern/arc4random.c:129 · pass 2 · new	rng_bias_aslr_entropy_loss	reproduced fixed
DF-2811	Low	5.1	SHT_SYMTAB/SHT_STRTAB sh_size truncated into signed int symcnt/strcnt → negative kmalloc()/vn_rdwr() lengths → kmem_slab_alloc panic; modulo-wrap and short-read/uninitialized-buffer variants Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf.c:590 · pass 2 · new	panic	reproduced fixed
DF-2975	Low	5.1	Accept-filter registry has no refcount: kldunload under unloadable=1 deregisters a filter still attached to live listeners — next connection dispatches a NULL (or freed-module-text) accf_callback, guaranteed fatal trap; reload also strands stale accf_create/accf_destroy Base system — kernel core (kern) · sys/kern/uipc_accf.c:59 · pass 2 · new	panic	reproduced fixed
DF-3222	Low	5.1	dirfs_mount copyinstr fallback re-interprets a failed user data pointer as a kernel address — wild vkernel-kernel read / fatal trap from mount(2) Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vfsops.c:126 · pass 2 · new	panic	reproduced fixed
DF-4297	Low	5.1	kbd_detach frees the live genkbd_softc under open /dev/kbdN descriptors: blocked reader never woken, write-after-free at :757, fatal KNOTE-on-freed-memory trap via stale kb_callback.kc_arg at :905 Kernel memory corruption (UAF / OOB write) · sys/dev/misc/kbd/kbd.c:597 · pass 2 · new	panic	reproduced fixed
DF-4311	Low	5.1	vga_switcheroo MOD_UNLOAD/MOD_SHUTDOWN frees module state and lets the module unload while DRM modules hold live symbol relocations and (on hybrid hardware) registered clients — use-after-unload panic / heap UAF Kernel memory corruption (UAF / OOB write) · sys/dev/video/vga/vga_switcheroo.c:1022 · pass 2 · new	panic	reproduced fixed
DF-4735	Low	5.1	coretemp: raw rdmsr(MSR_THERM_STATUS/MSR_PKG_THERM_STATUS) in the 2s-periodic sensor task turns a CPUID-lying platform (VMM advertising DTS without the MSR) into an unrecoverable kernel #GP panic — guest-reproduced consequence Base system — drivers · sys/dev/powermng/coretemp/coretemp.c:592 · pass 2 · new	panic	reproduced fixed
DF-4812	Low	5.1	hci_call() leaks the ACPI_ALLOCATE_BUFFER result buffer on a malformed GHCI return package: early 'return (ENXIO)' skips the AcpiOsFree that every other exit performs — unbounded M_ACPICA kernel heap leak per unprivileged sysctl read Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:437 · pass 2 · new	leak	reproduced fixed
DF-5041	Low	5.1	_PRT Source device used as a PCI interrupt link device with no NULL/driver validation: type-confused softc read (and NULL device deref) panic at boot Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_pcib.c:111 · pass 2 · new	panic	reproduced fixed
DF-5053	Low	5.1	qsphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (5th leaf of the DF-4930/4957/4981/5003 family, hub DF-5001) Base system — drivers · sys/dev/netif/mii_layer/qsphy.c:166 · pass 2 · new	panic	reproduced fixed
DF-5454	Low	5.1	Config bridges forward unvalidated reg/width into the PCIe MMIO backend whose reg-only bound allows OOB read/write past the MMCFG kernel_map mapping Kernel memory corruption (UAF / OOB write) · sys/bus/pci/x86_64/pci_bus.c:61 · pass 2 · new	panic	reproduced fixed
DF-5464	Low	5.1	icu_abi MSI/MSI-X allocation count validated only by INVARIANTS-only KASSERTs — OOB write past caller's 32-int array, negative-index scan-walk panic, and count==0 livelock holding icu_irqmap_tok on production kernels Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/icu/icu_abi.c:460 · pass 2 · new	panic	reproduced fixed
DF-5465	Low	5.1	icu_abi_legacy_intr_config(): driver-facing ABI with KKASSERT-only irq bounds — silent OOB read-modify-write into icu_irqmaps on production kernels plus wild-index kernel page fault; returns void, no error path Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/icu/icu_abi.c:373 · pass 2 · new	panic	reproduced fixed
DF-5466	Low	5.1	Unvalidated hw.icu.msi_start boot tunable: negative value -> negative-index OOB scan/write in icu_abi_msi_alloc_intern() + msi_intr[] negative OOB read + setidt() overwrite of exception gates 0..31 -> triple-fault cold reset (ICU twin of DF-1037) Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/icu/icu_abi.c:323 · pass 2 · new	panic	reproduced fixed
DF-5475	Low	5.1	gdb_handle_exception runs with gdb_tab == NULL: getDebugChar()'s -1 sentinel is masked into data by every wait loop, and the shipped gcc8 constprop clone drops the accessor NULL guards - first putpacket() NULL-derefs at consdev+0x68 and the trap_fatal->kdb_trap(db_active)->stub re-entry loop floods Fatal trap 12 forever: permanent all-CPU hang, no ddb fallback, no dump, no reboot Base system — bus / platform / cpu · sys/cpu/x86_64/misc/x86_64-gdbstub.c:148 · pass 2 · new	dos	reproduced fixed
DF-5490	Low	5.1	Missing DRIVER_MODULE(iicbus, pcf): the iicbus child never attaches, so pcf->iicbus has a NULL softc forever and the first chip interrupt panics the kernel via iicbus_intr()->sc->owner Base system — bus / platform / cpu · sys/bus/iicbus/pcf/pcf.c:193 · pass 2 · new	panic	reproduced fixed
DF-5509	Low	5.1	ehci_pci_attach arms ehci_interrupt before controller takeover/init: the pre-init handler is mute (reads USBSTS from the HCSPARAMS capability register, sc_eintrs==0 forces exit WITHOUT acknowledging) — a level-INTx IRQ storm runs for the entire window, including the up-to-5-second BIOS-handoff park, with no code touching USBINTR/USBSTS until ehci_init's hcreset Base system — bus / platform / cpu · sys/bus/u4b/controller/ehci_pci.c:390 · pass 2 · new	dos	reproduced fixed
DF-4926	Medium	5.0	nvmm MOD_UNLOAD tears down the hypervisor (nvmm_fini: all machine/vcpu locks lockuninit'd, impl freed, nvmm_impl=NULL) while /dev/nvmm is still dispatching ioctls — destroy_dev() runs last; unprivileged ioctl storm races kldunload into NULL-deref panic (UAF paths code-proven) Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/nvmm/nvmm_dragonfly.c:366 · pass 2 · new	panic	reproduced fixed
DF-5691	Low	5.0	prop_dictionary _nocopy twins export borrowed-pointer lifetime hazards into _KERNEL with 26 live dm/tbridge callers — dm_dev_status_ioctl:409 and dm_table_deps_ioctl:619-620 actively dangle the borrowed name/uuid pointers mid-function (latent kernel UAF-read; set twin: frozen-size UAF/leak/overflow, zero callers) Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_dictionary_util.c:183 · pass 2 · new	none	reproduced fixed
DF-3263	Medium	4.9	RDR reversed translation port range → kernel divide-by-zero panic (unauthenticated packet trigger) Base system — network stack · sys/net/pf/pf.c:3306 · pass 2 · new	panic	reproduced fixed
DF-4777	Medium	4.8	ipmi_kcs: BMC-controlled reply byte count stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi_kcs.c:411 · pass 2 · new	leak	reproduced fixed
DF-4948	Medium	4.8	ipmi_smic: BMC-controlled reply byte count stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout (DF-4777 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi_smic.c:320 · pass 2 · new	leak	reproduced fixed
DF-5356	Medium	4.8	pccard_attach_card re-entry on card-detect bounce: previous function list orphaned (unbounded kernel memory leak) and duplicate children stacked over live drivers Base system — bus / platform / cpu · sys/bus/pccard/pccard.c:189 · pass 2 · new	dos	reproduced fixed
DF-3101	High	4.7	Unbounded recursion in hpfs_truncatealblk via crafted AB_NODES AlSec chain: kernel stack exhaustion (guard-page double fault) from unprivileged ftruncate Base system — filesystems · sys/vfs/hpfs/hpfs_vnops.c:559 · pass 2 · new	panic	reproduced fixed
DF-2627	Medium	4.7	hammer2_vop_readdir reads uninitialized stack (bref) on first-xop-error and discloses it to userspace via the directory cookie/offset Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:745 · pass 2 · new	leak	reproduced fixed
DF-2632	Medium	4.7	hammer2 flusher panics on dense dirent packing: 'insert base overlapping elements' (unprivileged local DoS) Hammer2 · sys/vfs/hammer2/hammer2_chain.c:5308 · pass 2 · new	panic	reproduced fixed
DF-2644	Medium	4.7	hammer2_xop_inode_flush NULL-derefs the PFS-root chain during sync when its media re-read fails (kernel panics on a recoverable I/O error) Hammer2 · sys/vfs/hammer2/hammer2_flush.c:1334 · pass 2 · new	panic	reproduced fixed
DF-2661	Medium	4.7	hammer2 DIO error path leaves stale dio->bp with DIO_GOOD cleared; concurrent accessor trips KKASSERT(dio->bp == NULL) and panics Hammer2 · sys/vfs/hammer2/hammer2_io.c:350 · pass 2 · new	panic	reproduced fixed
DF-2663	Medium	4.7	hammer2 mount-time volume-size containment check silently skipped when DIOCGPART fails; forged volu_size beyond backing media accepted, short-read media-EOF semantics then serve uninitialized kernel memory as file data Hammer2 · sys/vfs/hammer2/hammer2_ondisk.c:283 · pass 2 · new	leak	reproduced fixed
DF-2686	Medium	4.7	vm_fault_object() pager-error tail wakes the wrong object's PIP: double-decrement on the terminal object (u_int wrap) and permanent +1 leak on fs->first_ba->object — unkillable D-state hang in vm_object_terminate Base system — virtual memory · sys/vm/vm_fault.c:2241 · pass 2 · new	dos	reproduced fixed
DF-2721	Medium	4.7	Lost-wakeup race in slab remote-free z_RSignal interlock permanently strands whole zones — unbounded kernel KVA + wired-page leak (local DoS) Base system — kernel core (kern) · sys/kern/kern_slaballoc.c:1508 · pass 2 · new	dos	reproduced fixed
DF-2751	Medium	4.7	funsetown() KKASSERT race: pre-token *sigiop load dereferenced after concurrent fsetown() frees and slab-recycles the sigio — unprivileged kernel panic on INVARIANTS (stock) builds via pipe F_SETOWN/close/exit (DF-2682 sibling) Kernel memory corruption (UAF / OOB write) · sys/kern/sys_pipe.c:1023 · pass 2 · new	dos	reproduced fixed
DF-2782	Medium	4.7	sys_mq_open race-gated NULL-pointer lockmgr panic: the under-lock EMFILE branch jumps to the shared exit label while mq is still NULL, releasing a lock on a NULL-derived address Base system — kernel core (kern) · sys/kern/sys_mqueue.c:577 · pass 2 · new	panic	reproduced fixed
DF-2795	Medium	4.7	msgsnd missing sequence-number revalidation after tsleep: stale sleeper injects into an IPC_RMID'd-and-reallocated queue (cross-user message injection) Privilege escalation (general use) · sys/kern/sysv_msg.c:605 · pass 2 · new	none	reproduced fixed
DF-2831	Medium	4.7	dssize()/diskpsize consume dp->d_slice without ds_token — use-after-free walk of struct diskslices/disklabel during forced reprobe, and DSO_RAWPSIZE fallback silently substitutes whole-disk size for partition devices Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskslice.c:849 · pass 2 · new	panic	reproduced fixed
DF-2873	Medium	4.7	taskqueue_run() wakeup(task) outside TQ_LOCK vs drain's check-then-ssleep: lost wakeup parks taskqueue_drain forever Base system — kernel core (kern) · sys/kern/subr_taskqueue.c:411 · pass 2 · new	dos	reproduced fixed
DF-2908	Medium	4.7	varsymset lifetime race at process exit: sibling LWP uses p_varsymset after final varsymset_clean/lockuninit — permanent unprivileged M_VARSYM kernel-memory leak (plus INVARIANTS panic window in lockuninit) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_varsym.c:437 · pass 2 · new	dos	reproduced fixed
DF-3140	Medium	4.7	Error-path buffer leaks: missing brelse in hpfs_addextent children-reparenting loop (:498-500) and hpfs_truncatealblk sibling read (:798-801) — deterministic kernel panic (lockmgr locking against myself) + B_BUSY buffer accumulation DoS Base system — filesystems · sys/vfs/hpfs/hpfs_alsubr.c:498 · pass 2 · new	panic	reproduced fixed
DF-3215	Medium	4.7	hammer_generate_redo panics on UNDO/REDO FIFO exhaustion — unprivileged local kernel DoS via write()+fsync() (no backpressure on the frontend REDO path) Privilege escalation (general use) · sys/vfs/hammer/hammer_redo.c:90 · pass 2 · new	panic	reproduced fixed
DF-3304	Medium	4.7	Unprivileged NULL-pointer dereference via IP_MULTICAST_VIF selecting a PIM REGISTER vif (ip_mdq rt=NULL -> pim_register_send -> rt->mfc_rp) Privilege escalation (general use) · sys/net/ip_mroute/ip_mroute.c:2826 · pass 2 · new	panic	reproduced fixed
DF-3320	Medium	4.7	IPv4 address-set ioctls persist user-supplied sin_len verbatim into live in_ifaddr (ia_addr/ia_dstaddr/ia_broadaddr/ia_sockmask) — unprivileged kernel heap pointer disclosure via SIOCGIFCONF (ifconf sa_len copyout) and route sockets; the live IPv4 twin of DF-3318 Privilege escalation (general use) · sys/netinet/in.c:602 · pass 2 · new	leak	reproduced fixed
DF-3754	Medium	4.7	NULL-pointer dereference of rdev->pm.dpm.boot_ps (and ps_priv) when the crafted-VBIOS power table has no usable BOOT state — panic at default-enabled DPM Base system — drivers · sys/dev/drm/radeon/ni_dpm.c:3914 · pass 2 · new	panic	reproduced fixed
DF-4057	Medium	4.7	et_stop() calls synchronous callout_stop() while holding the driver serializer; et_tick() must lwkt_serialize_enter() that same serializer before exiting and re-arms unconditionally — AB-BA deadlock of the callout subsystem against the tick (DF-3715/4025/4046/4051 family instance; mechanism already PROVEN on this kernel for em/re/stge/nfe) Base system — drivers · sys/dev/netif/et/if_et.c:553 · pass 2 · new	dos	reproduced fixed
DF-4145	Medium	4.7	ucNumDPMLevels==0 pplib state leaves num_levels==0: levels[-1] window writes 0 into the MSB of pi->requested_rps.ps_priv (non-canonical pointer deref -> panic) and feeds heap-garbage sclk into watermark programming Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/trinity_dpm.c:974 · pass 2 · new	panic	reproduced fixed
DF-4167	Medium	4.7	get_firmware_info_v3_2 can return crystal_frequency == 0 — divide-by-zero (#DE panic) in DCE clock-source PLL math Base system — drivers · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1229 · pass 2 · new	dos	reproduced fixed
DF-4169	Medium	4.7	Unchecked smu8 power-state casts: NULL deref (panic) when VBIOS powerplay table has no Boot-classified state — DF-4143 family twin for smu8 Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1044 · pass 2 · new	panic	reproduced fixed
DF-4171	Medium	4.7	count==0 underflow: ptable->entries[ptable->count - 1] reads index 0xFFFFFFFF in smu8_dpm_update_vce_dpm / smu8_dpm_update_uvd_dpm (smu10_hwmgr.c:851 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1258 · pass 2 · new	leak	reproduced fixed
DF-4190	Medium	4.7	Unchecked nonClockInfoIndex (u8) and clockInfoIndex (u8 x ucEntrySize) in sumo_parse_power_table index past the NonClockInfoArray/ClockInfoArray in the kmalloc'd BIOS image: heap OOB read up to ~6.1 KB / ~65 KB — OOB bytes ingested into rps->class/class2/caps/vclk driving boot_ps/UVD/thermal selection — sumo twin of DF-1401/1306/1140 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/sumo_dpm.c:1495 · pass 2 · new	leak	reproduced fixed
DF-4492	Medium	4.7	rs780_dpm: unchecked VBIOS pplib offsets/indices/strides in rs780_parse_power_table give wild OOB kernel reads past the kmalloc'd BIOS image Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/rs780_dpm.c:812 · pass 2 · new	leak	reproduced fixed
DF-4516	Medium	4.7	Cross-device PRIME import panics unconditionally: dma_buf_attach() stub returns NULL (not ERR_PTR), IS_ERR misses it, and the fail_detach unwind calls dma_buf_detach() which is hardcoded panic() Base system — drivers · sys/dev/drm/drm_prime.c:733 · pass 2 · new	panic	reproduced fixed
DF-4625	Medium	4.7	output_poll_execute's self-rearm structurally survives drm_kms_helper_poll_disable/poll_fini on the DragonFly workqueue shim — poll work executes up to 10s AFTER cancel_delayed_work_sync returned (mid-suspend connector probe on a suspended GPU, or UAF on a torn-down drm_device) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_probe_helper.c:653 · pass 2 · new	dos	reproduced fixed
DF-4796	Medium	4.7	reservation_object_get_fences_rcu leaks the exclusive-fence reference on the GFP_KERNEL slow-path retry (continue) — permanent kernel heap leak under allocation pressure Kernel memory leaks / uninitialized disclosure · sys/dev/drm/linux_reservation.c:356 · pass 2 · new	leak	reproduced fixed
DF-4978	Medium	4.7	ipmi_ssif: BMC-accumulated reply length stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout (DF-4777/DF-4948 shape, third transport) Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi_ssif.c:294 · pass 2 · new	leak	reproduced fixed
DF-5004	Medium	4.7	amdgpu_pll_compute() divide-by-zero via degenerate derived dividers: fb_div under-runs to 0 (DIV_ROUND_UP(nom_min,0) at :56) and ref_div forced to 0 by post_div>=129 (0/0 at :203) — distinct sinks and windows from DF-2037 Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_pll.c:56 · pass 2 · new	panic	reproduced fixed
DF-5176	Medium	4.7	hrtimer shim shares one struct task across per-CPU taskqueue_thread queues — cross-CPU restart while a previous expiry's task is pending panics (KKASSERT) or races unlocked task state Base system — drivers · sys/dev/drm/linux_hrtimer.c:37 · pass 2 · new	kernel panic (local DoS) on INVARIANTS kernels via KKASSERT in taskqueue_enqueue_locked; unlocked cross-CPU task-state race on non-INVARIANTS kernels; triggered from drm hrtimer usage (i915_pmu/intel_uncore/i915_perf/amdgpu cross-CPU restart of a timer whose previous expiry task is still pending)	reproduced fixed
DF-5227	Medium	4.7	dma_alloc_coherent() returns non-zeroed (stale) kernel memory — Linux DMA API contract violation Kernel memory leaks / uninitialized disclosure · sys/dev/drm/linux_dma.c:47 · pass 2 · new	leak	reproduced fixed
DF-5244	Medium	4.7	pmap_unwire() PTE teardown is non-atomic and unsynchronized vs cmpset-based removal → double vm_page_unwire (panic) / PHYS_TO_VM_PAGE(0) = vm_page_array[-1] out-of-bounds Base system — bus / platform / cpu · sys/platform/pc64/x86_64/pmap.c:5598 · pass 2 · new	panic	reproduced fixed
DF-5368	Medium	4.7	ums_detach tears down the USB fifo and evdev before stopping/draining the intr xfer: with an evdev consumer holding the device, a report delivered during detach dereferences a NULL/freed usb_fifo or the freed evdev -> kernel panic (Fault VA 0x0) Base system — bus / platform / cpu · sys/bus/u4b/input/ums.c:773 · pass 2 · new	panic	reproduced fixed
DF-5369	Medium	4.7	Lock-order inversion sc->sc_lock <-> evdev ev_mtx: ums_intr_callback pushes evdev events under sc_lock while evdev open/close/detach call ums_ev_open/ums_ev_close (taking sc_lock) under the evdev lock -> permanent unkillable deadlock Base system — bus / platform / cpu · sys/bus/u4b/input/ums.c:363 · pass 2 · new	dos	reproduced fixed
DF-5471	Medium	4.7	Backtrace fault outside an established DDB session longjmps into the BSS-zeroed (or stale) global db_jmpbuf → double fault → panic: double fault; every stock panic with a garbage frame pointer is upgraded to an undiagnosable crash Base system — bus / platform / cpu · sys/platform/pc64/x86_64/db_trace.c:227 · pass 2 · new	panic	reproduced fixed
DF-5556	Medium	4.7	npxsave() missing FPU security wipe: previous FP owner's XMM0-15 are handed to the next exec'd image — cross-process/cross-exec FP-register info leak inside the vkernel Kernel memory leaks / uninitialized disclosure · sys/platform/vkernel64/x86_64/npx.c:145 · pass 2 · new	leak	reproduced fixed
DF-5683	Medium	4.7	sys_vquotactl() leaks the copyin'd prop_dictionary, command string, output array and result dictionary on every call — unprivileged, linear kernel heap exhaustion Privilege escalation (general use) · sys/kern/vfs_quota.c:346 · pass 2 · new	leak	reproduced fixed
DF-5736	Medium	4.7	Inquiry/RSSI result handlers allocate hci_memo records without bound (lookup-lazy reclamation): remotely-seedable kernel memory exhaustion Base system — network stack · sys/netbt/hci_event.c:463 · pass 2 · new	dos	reproduced fixed
DF-2643	Low	4.7	hammer2_xop_strategy_write dereferences the inode chain without the NULL check the read xop performs — NULL-deref panic if the inode's cluster chain is concurrently gone Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:623 · pass 2 · new	panic	reproduced fixed
DF-2763	Low	4.7	journal_mountctl journal lifecycle is lock-free: concurrent install/remove double-detach panics on INVARIANTS and double-kfrees/UAF-writes mnt_jbitmap on release kernels Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_jops.c:162 · pass 2 · new	panic	reproduced fixed
DF-2797	Low	4.7	alist API performs no release-kernel domain validation: alist_alloc(count==0) silently wipes whole 32-block leaves or spins forever with the caller's lock held; alist_create/init with blocks>2^29 radix-wraps into an infinite loop; count==bl_radix full-capacity allocation off-by-one on leaf-root alists Base system — kernel core (kern) · sys/kern/subr_alist.c:250 · pass 2 · new	panic	reproduced fixed
DF-2849	Low	4.7	taskqgroup_detach() unsynchronized lifecycle tail: gt_taskqueue=NULL window panics racing enqueuers; unlocked TASK_NOENQUEUE clear can lose the TASK_ENQUEUED bit and corrupt the queue list Base system — kernel core (kern) · sys/kern/subr_gtaskqueue.c:746 · pass 2 · new	panic	reproduced fixed
DF-2866	Low	4.7	pagertab[] has 7 slots but enum obj_type has 8 values — an OBJT_MARKER (7) object dispatched to any pager op indexes one struct pagerops* past the array (latent uncontrolled indirect call; DF-0944 family) Base system — virtual memory · sys/vm/vm_pager.c:152 · pass 2 · new	panic	reproduced fixed
DF-2953	Low	4.7	logtimeout() use-after-free read of sc_sigio: pgsigio() on a struct sigio freed by a concurrent FIOSETOWN ioctl Kernel memory corruption (UAF / OOB write) · sys/kern/subr_log.c:247 · pass 2 · new	panic	reproduced fixed
DF-3004	Low	4.7	Unconditional nlinks decrement on unlink wraps a crafted nlinks=0 inode to UINT64_MAX — KKASSERT((int64_t)nlinks >= 0) panic in hammer_sync_inode (INVARIANTS) / poisoned link count persisted to media Base system — filesystems · sys/vfs/hammer/hammer_inode.c:2980 · pass 2 · new	corruption	reproduced fixed
DF-3068	Low	4.7	Undo-walk desync via tail_size/hdr_size inconsistency drives bytes negative — deterministic KKASSERT(error \|\| bytes == 0) panic in hammer_recover_stage1 (INVARIANTS) / silent mis-recovery on production kernels Base system — filesystems · sys/vfs/hammer/hammer_recover.c:393 · pass 2 · new	panic	reproduced fixed
DF-3414	Low	4.7	if_clone_destroy() lookup/act TOCTOU: drops the ifnet lock between ifunit() lookup and teardown — concurrent destroyers double-free the clone unit and UAF the ifnet (framework component of the reproduced DF-3407 panic) Kernel memory corruption (UAF / OOB write) · sys/net/if_clone.c:104 · pass 2 · new	panic	reproduced fixed
DF-3611	Low	4.7	Double free of rdev->pm.dpm.ps (plus leak of parsed ps_priv states) on the allocation-failure path of si_parse_power_table — radeon twin of amdgpu DF-3588 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/si_dpm.c:6855 · pass 2 · new	dos	reproduced fixed
DF-4284	Low	4.7	midi_unload() TAILQ_FOREACH advances through midi_destroy()-freed entries — use-after-free read with groom-controlled pointer consumption Kernel memory corruption (UAF / OOB write) · sys/dev/sound/midi/midi.c:1469 · pass 2 · new	dos	reproduced fixed
DF-4680	Low	4.7	Unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2317=128] — 80-byte intra-object heap OOB write into RF bank scratch (twin of DF-4619/4648/4660) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:429 · pass 2 · new	dos	reproduced fixed
DF-4765	Low	4.7	Divide-by-zero (SIGFPE) in hpt_copy_array_info rebuild/verify percentage for arrays with bArnMember==1 or per-member capacity < 2MB Base system — drivers · sys/dev/raid/hptmv/hptproc.c:457 · pass 2 · new	panic	reproduced fixed
DF-4786	Low	4.7	NULL-pointer write in drm_atomic_normalize_zpos when a zpos-changed plane's CRTC is absent from the atomic transaction — kernel panic via DRM_IOCTL_MODE_OBJ_SETPROPERTY/MODE_ATOMIC on any normalize_zpos driver Base system — drivers · sys/dev/drm/drm_blend.c:502 · pass 2 · new	panic	reproduced fixed
DF-4823	Low	4.7	acpi_dock: deferred AcpiOsExecute(acpi_dock_attach_later) callbacks jump into freed module text after kldunload — OSL has no drain (AcpiOsWaitEventsComplete unimplemented/stubbed) Base system — drivers · sys/dev/acpica/acpi_dock/acpi_dock.c:237 · pass 2 · new	panic	reproduced fixed
DF-4932	Low	4.7	irq_source_info_dce110[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs without a NULL check (DF-4713 family) Base system — drivers · sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:226 · pass 2 · new	panic	reproduced fixed
DF-4933	Low	4.7	dce110_vblank_set underflows pipe_offset for VUPDATE sources (vupdate_int_entry initializes no .src_id) — pipe_ctx[178] far-OOB read feeding a wild arm_vert_intr indirect call Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:195 · pass 2 · new	panic	reproduced fixed
DF-4995	Low	4.7	irq_service_dcn10[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-4713/DF-4932 family tail on the DCN10 (Raven) table Base system — drivers · sys/dev/drm/amd/display/dc/irq/dcn10/irq_service_dcn10.c:245 · pass 2 · new	panic	reproduced fixed
DF-5009	Low	4.7	rlphy_service() entry KASSERT panics stock GENERIC kernels on multi-PHY MII buses (DF-1973 family) Base system — drivers · sys/dev/netif/mii_layer/rlphy.c:200 · pass 2 · new	panic	reproduced fixed
DF-5011	Low	4.7	dimm_mod_unload() drains dimm_softc references owned by still-attached drivers, kfree()ing live objects — victim use-after-free into freed heap/unmapped module text (proven kernel panic) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/dimm/dimm.c:316 · pass 2 · new	panic	reproduced fixed
DF-5054	Low	4.7	irq_source_info_dce80[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-2168/DF-4932/DF-4995 family instance on the DCE80 table Base system — drivers · sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:188 · pass 2 · new	panic	reproduced fixed
DF-5055	Low	4.7	dce80 vupdate entries carry no .src_id, so dce110_vblank_set (wired by dce80's own vblank_irq_info_funcs) re-derives DC_IRQ_SOURCE_INVALID and underflows pipe_offset to 178 → far-OOB pipe_ctx[178] read feeding a wild arm_vert_intr indirect call — the DF-4933 twin on the DCE80 table wiring Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:82 · pass 2 · new	panic	reproduced fixed
DF-5061	Low	4.7	ida_v4_done()'s empty-reply-FIFO sentinel 'completed == -1' is dead code on LP64: bus_addr_t is uint64_t while the register read is 32-bit, so an empty 42xx FIFO is consumed as completion 0xFFFFFFFF → idahwqcbptov() wild kernel dereference (boot-time page fault on <4GB hosts, infinite ISR spin on >=4GB) Base system — drivers · sys/dev/raid/ida/ida_pci.c:101 · pass 2 · new	panic	reproduced fixed
DF-5078	Low	4.7	irq_source_info_dce120[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-2168/4713/4932/4995/5054 NULL-funcs-dispatch family instance on the DCE120 table Base system — drivers · sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177 · pass 2 · new	panic	reproduced fixed
DF-5079	Low	4.7	dce120 vupdate entries carry no .src_id, so dce110_vblank_set (wired by dce120's own vblank_irq_info_funcs) re-derives DC_IRQ_SOURCE_INVALID and underflows pipe_offset to 178 → far-OOB pipe_ctx[178] read feeding a wild arm_vert_intr indirect call — the DF-4933/DF-5055 twin on the DCE120 table wiring Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:138 · pass 2 · new	panic	reproduced fixed
DF-5145	Low	4.7	ipmi_acpi SSIF stub attaches a dead softc (return 0 with nothing initialized); any later detach executes NULL sc->ipmi_enqueue_request → fatal kernel trap Base system — drivers · sys/dev/misc/ipmi/ipmi_acpi.c:104 · pass 2 · new	panic	reproduced fixed
DF-5160	Low	4.7	aperf: raw rdmsr(MSR_IA32_APERF/MSR_IA32_MPERF) in the 1s-periodic per-CPU sensor task turns a CPUID-lying platform (VMM advertising the leaf-6 hooks bit without the MSR) into a fatal kernel #GP ~1s after attach — DF-4735/DF-5155 class, driver-level guest-reproduced Base system — drivers · sys/dev/misc/aperf/aperf.c:159 · pass 2 · new	panic	reproduced fixed
DF-5351	Low	4.7	MSI/MSI-X allocation count validated only by INVARIANTS-only KASSERTs — OOB write past caller's array, irqmap row-crossing writes and IPI IDT-gate smash on production kernels Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/apic/ioapic_abi.c:1256 · pass 2 · new	panic	reproduced fixed
DF-5452	Low	4.7	nexus_alloc_resource() indexes irq_rman[cpuid] with only an INVARIANTS-gated KASSERT; plain bus_alloc_resource() reaches it with cpuid=-1 (panic on INVARIANTS kernels, silent OOB static access on production kernels) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/nexus.c:377 · pass 2 · new	panic	reproduced fixed
DF-5518	Low	4.7	gpio_acpi detach does not quiesce in-flight GPIO address-space handler dispatches: use-after-free of softc/provider state (OpRegion half of the missing-drain defect; complements DF-1094/DF-2307) Kernel memory corruption (UAF / OOB write) · sys/bus/gpio/gpio_acpi/gpio_acpi.c:486 · pass 2 · new	panic	reproduced fixed
DF-5520	Low	4.7	isa_dmadone() bounce-buffer readback has no size clamp (asymmetric with isa_dmastart) and release keeps stale dma_bounced: unbounded OOB kernel read — deterministic panic, info leak into driver buffers Kernel memory leaks / uninitialized disclosure · sys/bus/isa/x86_64/isa_dma.c:351 · pass 2 · new	panic	reproduced fixed
DF-5574	Low	4.7	ppb_MS_microseq() MS_OP_PUT/GET handler recurses with no depth limit — transfer loop containing MS_OP_PUT exhausts the kernel stack (DOUBLE FAULT) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_msq.c:296 · pass 2 · new	panic	reproduced fixed
DF-5576	Low	4.7	Interpreter panics instead of returning errors on unreachable states: MS_OP_GET without an initialized mode loop (ppb_msq.c:292) and mode2xfer() unknown-mode/EPP-protocol (:70/:93/:101, the latter also printing the wrong variable) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_msq.c:70 · pass 2 · new	panic	reproduced fixed
DF-5607	Low	4.7	Cothread signal-mask discipline leaves synchronous fault signals deliverable on %gs=0 threads — the file-owned enabling condition of the DF-5587 silent-recursion death, now proven on a real vkernel Base system — bus / platform / cpu · sys/platform/vkernel64/platform/cothread.c:109 · pass 2 · new	dos	reproduced fixed
DF-5617	Low	4.7	ig4iic_acpi_attach()'s error unwinder re-enters the serializer leaked by ig4iic_attach()'s bus_setup_intr failure: pci_attached=1 set before ig4iic_attach(); on the setup-irq error path (serializer still held) the ACPI detach calls ig4iic_detach() whose first lwkt_serialize_enter re-enters the self-held, explicitly non-recursive serializer — boot/kldload-time kernel panic (INVARIANTS) / hard self-deadlock (release) Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_acpi.c:127 · pass 2 · new	panic	reproduced fixed
DF-5638	Low	4.7	SMB_WAIT-only requesters park unkillably in smbreq: tsleep without PCATCH and without timeout (DF-5563/5564 twins at the smbus layer) Base system — bus / platform / cpu · sys/bus/smbus/smbconf.c:92 · pass 2 · new	dos	reproduced fixed
DF-5744	Low	4.7	apple_gmux: missing I/O-region length validation (GMUX_MIN_IO_LEN dead code) → out-of-bounds x86 port I/O from crafted ACPI _CRS Kernel memory corruption (UAF / OOB write) · sys/gnu/dev/misc/apple_gmux/apple-gmux.c:77 · pass 2 · new	dos	reproduced fixed
DF-5759	Low	4.7	rfcomm_ssend violates the pru_send mbuf-ownership contract: m_copym-failure (ENOMEM) path leaks the caller's entire mbuf chain; l2cap_ssend/sco_ssend comply, rfcomm does not Base system — network stack · sys/netbt/rfcomm_socket.c:443 · pass 2 · new	dos	reproduced fixed
DF-5775	Low	4.7	writepid() opens the -p pidfile without O_NOFOLLOW and truncates the symlink target with the launcher's privileges Base system — bus / platform / cpu · sys/platform/vkernel64/platform/init.c:1390 · pass 2 · new	dos	reproduced fixed
DF-5525	Info	4.7	iicsmb_intr panics the kernel on any iicbus event outside {INTR_GENERAL..INTR_NOACK} — one stray controller status code is a system-down failure Base system — bus / platform / cpu · sys/bus/iicbus/iicsmb.c:242 · pass 2 · new	panic	reproduced fixed
DF-5541	Info	4.7	gpio_intel teardown methods trust the cookie: stale/double GPIO_FREE_INTR reaches gpio_cherryview_unmap_intr with pin == -1, uint16_t-wrapped to 65535 → OOB kernel-KVA read + masked write ~4.5MB past the BAR mapping (deterministic KKASSERT panic on INVARIANTS kernels) Kernel memory corruption (UAF / OOB write) · sys/bus/gpio/gpio_intel/gpio_intel.c:256 · pass 2 · new	panic	reproduced fixed
DF-5277	Medium	4.6	pci_freecfg() panics for any VPD-capable device: kfree(NULL) plus stale vpd_rocnt/vpd_wcnt NULL-derefs after parse-error cleanup Base system — bus / platform / cpu · sys/bus/pci/pci.c:2146 · pass 2 · new	panic	reproduced fixed
DF-5278	Medium	4.6	pci_read_vpd() cannot terminate on hostile input: dead oversize check plus negative remain drive an endless allocation loop Base system — bus / platform / cpu · sys/bus/pci/pci.c:1095 · pass 2 · new	dos	reproduced fixed
DF-5334	Medium	4.6	cdce_attach() failure paths call cdce_detach() on a never-attached usb_ether -> kernel panic at device plug-in (NULL lockmgr, then latent ifindex/ifnetlist corruption) Base system — bus / platform / cpu · sys/bus/u4b/net/if_cdce.c:610 · pass 2 · new	panic	reproduced fixed
DF-5355	Medium	4.6	pccard_function_init partial-allocation retry across CIS config entries panics resource_list_add (crafted evil-card CIS) Base system — bus / platform / cpu · sys/bus/pccard/pccard.c:429 · pass 2 · new	panic	reproduced fixed
DF-5361	Medium	4.6	CISTPL_END MFC reset frees the pf structs but leaks every cfe on their chains (per-insertion kernel heap leak; unbounded with DF-5362) Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:635 · pass 2 · new	leak	reproduced fixed
DF-5362	Medium	4.6	CIS chain-graph cycles never terminate: pccard_scan_cis livelock (CPU burn, wedged socket thread, unreleased CIS window; unbounded leak amplifier) Base system — bus / platform / cpu · sys/bus/pccard/pccard_cis.c:209 · pass 2 · new	dos	reproduced fixed
DF-5384	Medium	4.6	aue_attach() failure paths call aue_detach() on a never-attached usb_ether -> kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption) Base system — bus / platform / cpu · sys/bus/u4b/net/if_aue.c:689 · pass 2 · new	panic	reproduced fixed
DF-5393	Medium	4.6	isa_find_memory unbounded candidate loop: PnP-supplied 32-bit memory window at align=1 grinds rman up to 2^32 allocations per descriptor (measured 757ms per 4MB; ~13 min per 4GB) — boot-time kernel lockup Base system — bus / platform / cpu · sys/bus/isa/isa_common.c:128 · pass 2 · new	dos	reproduced fixed
DF-5395	Medium	4.6	axge_attach() failure paths call axge_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch) Base system — bus / platform / cpu · sys/bus/u4b/net/if_axge.c:557 · pass 2 · new	panic	reproduced fixed
DF-5453	Medium	4.6	kue_attach() failure paths call kue_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the third branch) Base system — bus / platform / cpu · sys/bus/u4b/net/if_kue.c:481 · pass 2 · new	panic	reproduced fixed
DF-5486	Medium	4.6	cue_attach() failure paths call cue_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption) — 8th instance of the DF-5334 uether goto-detach class Base system — bus / platform / cpu · sys/bus/u4b/net/if_cue.c:409 · pass 2 · new	panic	reproduced fixed
DF-5514	Medium	4.6	ipheth_attach() failure paths call ipheth_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock on branches 1-2; ether_ifdetach on never-if_attach()ed embedded ifnet on branches 3-4) — 9th and final instance of the DF-5334 uether goto-detach class Base system — bus / platform / cpu · sys/bus/u4b/net/if_ipheth.c:231 · pass 2 · new	panic	reproduced fixed
DF-5603	Medium	4.6	Card-derived zero CMD6 switch timeout reaches live INVARIANTS KASSERT in mmc_switch()/mmc_switch_status() — guaranteed kernel panic at MMC card enumeration Base system — bus / platform / cpu · sys/bus/mmc/mmc_subr.c:158 · pass 2 · new	panic	reproduced fixed
DF-5768	Medium	4.6	Card-derived erase_sector==0 from CSD WRITE_BL_LEN=0 causes integer divide-by-zero kernel panic in mmcsd_delete() on first TRIM Base system — bus / platform / cpu · sys/bus/mmc/mmc.c:1476 · pass 2 · new	panic	reproduced fixed
DF-5769	Medium	4.6	mmc_discover_cards() has no host-side termination: a card that keeps answering CMD2 loops enumeration forever and (fresh CIDs) allocates mmc_ivars+bus children without bound Base system — bus / platform / cpu · sys/bus/mmc/mmc.c:1413 · pass 2 · new	dos	reproduced fixed
DF-4620	Low	4.6	ar5413: numPdGainsUsed==0 path — uint32 counter underflows make pPdGainBoundaries[ii-1] / pPDADCValues[kk-1] read at array+0x1FFFFFFFE (+8.6 GB wild reads), plus uninitialized Pmin_t2[0] stack read Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:468 · pass 2 · new	dos	reproduced fixed
DF-4622	Low	4.6	ar5413: flat pd-gain curve makes sizeCurrVpdTable-1/-2 wrap uint32 -> VpdTable_I[ii][0xFFFFFFFF] wild read at row+0x1FFFFFFFE (+8.6 GB) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:501 · pass 2 · new	dos	reproduced fixed
DF-4649	Low	4.6	ar2316: numPdGainsUsed==0 (EEPROM xpd_mask==0) -> uint32-wrapped wild reads at array+0x1FFFFFFFE + uninitialized Pmin_t2[0] (twin of DF-4620/ar5413) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:427 · pass 2 · new	dos	reproduced fixed
DF-4650	Low	4.6	ar2316: flat EEPROM power curve -> VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads (twin of DF-4622/ar5413) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:460 · pass 2 · new	dos	reproduced fixed
DF-5542	Low	4.6	uep(4) reassembly state machine wedges permanently: sc->buf_len is never cleared on the bad-header continuation path, and the 1-byte stash that arms it is unvalidated Base system — bus / platform / cpu · sys/bus/u4b/input/uep.c:222 · pass 2 · new	dos	reproduced fixed
DF-2980	Medium	4.5	addupc_task() calls stopprofclock() without p->p_token: non-atomic p->p_flags RMW race annihilating concurrent token-held flag updates (P_TRACED/P_SUGID security gates) Base system — kernel core (kern) · sys/kern/subr_prof.c:145 · pass 2 · new	none	reproduced fixed
DF-3276	Medium	4.5	Span-port mirror path dereferences NULL softc: bridge_enqueue_handler passes span ifp's NULL if_bridge to bridge_handoff — deterministic kernel panic on first mirrored packet Base system — network stack · sys/net/bridge/if_bridge.c:3279 · pass 2 · new	panic	reproduced fixed
DF-3280	Medium	4.5	if_getgroupmembers() walks a stale struct ifg_group pointer across an ifgroup_lock release: SIOCGIFGMEMB use-after-free read reachable by unprivileged users Kernel memory corruption (UAF / OOB write) · sys/net/if.c:1324 · pass 2 · new	leak	reproduced fixed
DF-3387	Medium	4.5	[CROSS-FILE: if_lagg.c via ether_reinput_oncpu] lagg_input() reinputs a consumed NULL mbuf under IFF_MONITOR: deterministic first-packet NULL-deref panic (write to 0xa0) on any IFF_UP\|IFF_MONITOR lagg Base system — network stack · sys/net/if_ethersubr.c:1303 · pass 2 · new	dos	reproduced fixed
DF-2859	Low	4.5	sglist_split() trims `count` entries instead of the surviving remainder — stale/duplicated DMA segments and heap OOB read past the segs array (dead code; identical latent bug in FreeBSD HEAD) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_sglist.c:571 · pass 2 · new	none	reproduced fixed
DF-5573	Low	4.5	ppb_MS_init_msq(): instruction index `ins` never bounds-checked — controlled OOB kernel write up to +8184 bytes from the microsequence array Kernel memory corruption (UAF / OOB write) · sys/bus/ppbus/ppb_msq.c:201 · pass 2 · new	none	reproduced fixed
DF-5690	Info	4.5	prop_array_util _nocopy helpers export borrowed-pointer lifetime hazards into _KERNEL: unpinned get_cstring_nocopy return dangles on slot replace/array release; set_cstring_nocopy references caller-owned kernel memory forever with ps_size frozen at creation while externalize/prop_string_cstring re-read to the current NUL (latent UAF read / plist info leak / heap overflow) Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_array_util.c:205 · pass 2 · new	none	reproduced fixed
DF-2636	Medium	4.4	hammer2_igetv panics on unhandled on-media objtype (0,3,8,10,11..255) — crafted-image kernel DoS at mount/first access Hammer2 · sys/vfs/hammer2/hammer2_inode.c:791 · pass 2 · new	panic	reproduced fixed
DF-2653	Medium	4.4	sub_key-derived bitmap index overflows the 64-bit element in hammer2_bmap_alloc() for non-radix-aligned crafted DATA bref keys — KKASSERT panic (INVARIANTS) / truncated mask with overlapping 64K allocations (noinv) Hammer2 · sys/vfs/hammer2/hammer2_freemap.c:663 · pass 2 · new	panic	reproduced fixed
DF-2697	Medium	4.4	vaccess() grants group file-access permissions from the SAVED gid (cr_svgid): kernel-enforced group privileges survive setegid()/setgid() drops (POSIX mqueue access control fail-open) Privilege escalation (general use) · sys/kern/vfs_subr.c:1752 · pass 2 · new	access_bypass	reproduced fixed
DF-2768	Medium	4.4	Off-by-one in unix98 pty clone limit: unit==MAXPTYS accepted, ptis[MAXPTYS] out-of-bounds read (uninitialized pointer) + out-of-bounds pointer write Kernel memory corruption (UAF / OOB write) · sys/kern/tty_pty.c:176 · pass 2 · new	dos	reproduced fixed
DF-2774	Medium	4.4	mountlist_exists() provides no lifetime guarantee: stale vp->v_pfsmp used after nullfs unmount for VFS accounting and quota enforcement — wrong-mount EDQUOT/negative usage (deterministic), struct mount UAF window (racy) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_mount.c:692 · pass 2 · new	none	reproduced fixed
DF-2879	Medium	4.4	swaponvp() stripe round-up registers up to 63 phantom swap pages per device beyond the real device end, wedging the pageout daemon in an unbounded EINVAL retry loop Base system — virtual memory · sys/vm/vm_swap.c:365 · pass 2 · new	dos	reproduced fixed
DF-2915	Medium	4.4	sleepq_lock() trusts uninitialized objcache memory: first use of the API on any chain panics (INVARIANTS) or corrupts the chain with a garbage wchan entry and live-locks the allocator loop (production) Privilege escalation (general use) · sys/kern/subr_sleepqueue.c:145 · pass 2 · new	panic	reproduced fixed
DF-3040	Medium	4.4	Unbounded HAMMER_UNDO_INDEX indexes vol0_undo_array[128] out of bounds — attacker-aimed kernel heap OOB read (up to ~4GB reach) and deterministic panic at mount of a crafted HAMMER1 image Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_ondisk.c:688 · pass 2 · new	panic	reproduced fixed
DF-3067	Medium	4.4	PAD-only undo FIFO makes hammer_recover_stage1's seqno backscan (and stage2's extended-range scan) unbounded — mount never terminates, unkillable CPU-burning kernel thread (livelock DoS) Base system — filesystems · sys/vfs/hammer/hammer_recover.c:257 · pass 2 · new	dos	reproduced fixed
DF-3073	Medium	4.4	nfs_unmount() continues teardown after vflush(FORCECLOSE) fails on a busy device vnode: frees the nfsmount and destroys the nfsnode objcache with a live nfsnode (UAF condition, allocator-confirmed) and dounmount() then panics deterministically ('unmount: dangling vnode') Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_vfsops.c:1217 · pass 2 · new	panic	reproduced fixed
DF-3128	Medium	4.4	mountmsdosfs() never bounds BPB volume geometry by the backing device size (FreeBSD's mediasize check dropped — in-tree XXX admits it): crafted FAT32 image wires attacker-chosen kernel heap (128 MiB/mount demonstrated, up to 512 MiB) and pins a 38 s non-SIGKILL-able FAT scan per mount Privilege escalation (general use) · sys/vfs/msdosfs/msdosfs_vfsops.c:432 · pass 2 · new	dos	reproduced fixed
DF-3165	Medium	4.4	Unchecked on-disk lengths rootdir_icb.len and pms->st_size flow into bread/getblk: deterministic 'size > MAXBSIZE' panic at mount of a crafted image Base system — filesystems · sys/vfs/udf/udf_vfsops.c:373 · pass 2 · new	panic	reproduced fixed
DF-3201	Medium	4.4	Unbounded rule-application recursion via self-matching LINK rules: kernel stack exhaustion (double fault) Base system — filesystems · sys/vfs/devfs/devfs_rules.c:331 · pass 2 · new	panic	reproduced fixed
DF-3202	Medium	4.4	wildCaseCmp() recurses once per '*': star-heavy rule names exhaust the devfs core thread stack Base system — filesystems · sys/vfs/devfs/devfs_rules.c:306 · pass 2 · new	panic	reproduced fixed
DF-3223	Medium	4.4	prune_check_nlinks() NULL-deref: forged on-disk inode record with data_offset==0 makes HAMMERIOC_PRUNE read cursor->data->inode.nlinks from absolute kernel address 0x48 Privilege escalation (general use) · sys/vfs/hammer/hammer_prune.c:330 · pass 2 · new	panic	reproduced fixed
DF-3224	Medium	4.4	/proc/pid/ctl signal delivery performs no authorization: ksignal() bypasses kill(2)'s CANSIGNAL (p_trespass + reaper_sigtest + pid-1 gate); open-time-only vnode gate is never revalidated across credential changes Privilege escalation (general use) · sys/vfs/procfs/procfs_ctl.c:319 · pass 2 · new	dos	reproduced fixed
DF-3282	Medium	4.4	ieee80211_beacon_update: first app-IE install does pointer arithmetic on NULL bo->bo_appie and memcpy's the IE to near-NULL kernel address (guaranteed panic) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_output.c:3215 · pass 2 · new	panic	reproduced fixed
DF-3296	Medium	4.4	DIOCCHANGEADDR removal of a pool's last address NULL-derefs the kernel (pfioctl + pf_map_addr), deterministic panic Base system — network stack · sys/net/pf/pf_ioctl.c:2313 · pass 2 · new	panic	reproduced fixed
DF-3352	Medium	4.4	config_pipe accepts negative flowset weight: pipe->sum driven to exactly 0 → integer divide-by-zero panic in ready_event_wfq (missed by both v1 and v3 pass-1) Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:574 · pass 2 · new	panic	reproduced fixed
DF-3353	Medium	4.4	fs->backlogged never reset when pipe deletion purges child flowsets: stale counter double-subtracted from p->sum on flowset delete → sum==0 divide-by-zero panic (DF-3351 family confirmed in v3) Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:574 · pass 2 · new	panic	reproduced fixed
DF-3355	Medium	4.4	red_drops divides by fs->lookup_step taken verbatim from config: lookup_step==0 → kernel divide-by-zero panic on first packet to an idle RED flow (DF-0375 family confirmed in v3, missed by pass 1) Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:904 · pass 2 · new	panic	reproduced fixed
DF-3357	Medium	4.4	udp_send() uses the sendto() destination sockaddr unvalidated: a 2-byte sockaddr yields a 6-byte heap OOB read and the packet is emitted to a destination address/port sourced from uninitialized recycled kernel heap Kernel memory leaks / uninitialized disclosure · sys/netinet/udp_usrreq.c:1009 · pass 2 · new	leak	reproduced fixed
DF-3385	Medium	4.4	HFSC init_vf() NULL-pointer dereference: curve-less intermediate class panics kernel on first packet to any descendant Base system — network stack · sys/net/altq/altq_hfsc.c:1003 · pass 2 · new	panic	reproduced fixed
DF-3436	Medium	4.4	ipfw3_basic MOD_UNLOAD is unguarded and unsynchronized: refused unload still tears down state/table contexts, and table fini rn_flush()es never-initialized (NULL) radix heads - deterministic kernel panic Base system — network stack · sys/net/ipfw3_basic/ip_fw3_state.c:542 · pass 2 · new	panic	reproduced fixed
DF-3449	Medium	4.4	dummynet3 MOD_UNLOAD never unregisters its ipfw3 hooks: stale filter_funcs[2][] and module registration make check_body()'s unguarded indirect call execute unmapped module text (deterministic panic) Kernel memory corruption (UAF / OOB write) · sys/net/dummynet3/ip_dummynet3_glue.c:2013 · pass 2 · new	panic	reproduced fixed
DF-3450	Medium	4.4	encap4_input's ipip_input hook: unlocked double-read test-then-call races ip_mroute KLD unload (which performs no netisr drain) — NULL-call and execute-after-unmap panics Base system — network stack · sys/netinet/ip_encap.c:231 · pass 2 · new	panic	reproduced fixed
DF-3499	Medium	4.4	ng_fec_get_unit: bcopy(NULL, newarray, 0) makes the compiler elide the explicit NULL guard -> unconditional kfree(NULL): deterministic kernel panic on the FIRST fec node creation Base system — network stack · sys/netgraph/fec/ng_fec.c:276 · pass 2 · new	dos	reproduced fixed
DF-3502	Medium	4.4	delport/rmnode never clear the member's ac_netgraph (IFP2NG); rmnode clears the shared ng_ether_input_p unconditionally -> dangling node pointer detonates in ng_fec_input on the next RX frame after any later fec node re-arms the global: reproduced page-fault panic at NULL+0x3f8 in interrupt context Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:379 · pass 2 · new	panic	reproduced fixed
DF-3516	Medium	4.4	v1 ng_socket: ngc_send/ng_connect_cntl deref pcbp->sockdata with no NULL check after node shutdown — deterministic kernel panic via connect() on a still-open control socket Base system — network stack · sys/netgraph/socket/ng_socket.c:257 · pass 2 · new	panic	reproduced fixed
DF-3521	Medium	4.4	ng_pptpgre timer-accounting leak: callout_stop() contract violation (DF-3515) makes every cancelled rack/sack timer permanently leak its argument, a node reference, priv->timers, and finally priv and the node itself Base system — network stack · sys/netgraph/pptpgre/ng_pptpgre.c:786 · pass 2 · new	leak	reproduced fixed
DF-3541	Medium	4.4	ng_eiface_rcvdata returns ENETDOWN without freeing the mbuf — permanent 1:1 mbuf+cluster leak per packet delivered to a DOWN interface (unbounded kernel heap exhaustion) Base system — network stack · sys/netgraph/eiface/ng_eiface.c:514 · pass 2 · new	dos	reproduced fixed
DF-3601	Medium	4.4	hdaa_sysctl_reconfig: device-tree mutation inside a sysctl handler self-deadlocks the global sysctllock — permanent kernel freeze from the documented reconfiguration interface Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/hda/hdaa.c:6474 · pass 2 · new	dos	reproduced fixed
DF-3958	Medium	4.4	Mergeable-RX sub-buffer negative device length installs a negative-m_len mbuf chain into the network stack (vtnet_rxeof_merged signed clamp) Base system — drivers · sys/dev/virtual/virtio/net/if_vtnet.c:1663 · pass 2 · new	panic	reproduced fixed
DF-4116	Medium	4.4	Guaranteed kernel panic in sndstat_sysuninit on sound.ko unload: SNDSTAT_FLUSH deletes a never-initialized sbuf (sndstat_buflen=0 static init vs sbuf-only-created-in-open invariant) Base system — drivers · sys/dev/sound/pcm/sndstat.c:68 · pass 2 · new	panic	reproduced fixed
DF-4350	Medium	4.4	adv_run_doneq walks the device-fed done-queue FWD chain with no iteration bound — cyclic chain = interrupt-context livelock / hard system hang (DF-4307 livelock facet, narrow twin) Base system — drivers · sys/dev/disk/advansys/advansys.c:1043 · pass 2 · new	dos	reproduced fixed
DF-4563	Medium	4.4	vn: VNF_DESTROY teardown run from inside the rawdev close path races concurrent last-but-one close — cdev sysref double-put kernel panic (reproduced 2/2) plus minutes-long uninterruptible system-wide devfs stalls and a post-free struct-disk deref in diskclose Base system — drivers · sys/dev/disk/vn/vn.c:169 · pass 2 · new	panic	reproduced fixed
DF-4800	Medium	4.4	Concurrent revive_block() calls race the sd->revived cursor: both advance it, the block between the advances is silently skipped, and the subdisk comes 'up' with never-revived stale data (plus concurrent set_sd_state/save_config races) Base system — drivers · sys/dev/raid/vinum/vinumrevive.c:89 · pass 2 · new	dos	reproduced fixed
DF-4801	Medium	4.4	Revive waitlist is orphaned when a revive stops: queued conflicting writes hang forever in uninterruptible biowait — kill -9-proof, survives 'vinum setstate -f down' abort, leaks the requests Base system — drivers · sys/dev/raid/vinum/vinumrevive.c:198 · pass 2 · new	dos	reproduced fixed
DF-4895	Medium	4.4	complete_raid5_write() launches RAID-4/5 second-phase I/O via vn_strategy(drive->vp) on a teardown-vulnerable vnode — deterministic NULL-vp kernel panic (fatal trap 12 in vn_strategy), closed-vnode UAF window in the mid-flight variant Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinuminterrupt.c:427 · pass 2 · new	panic	reproduced fixed
DF-5017	Medium	4.4	dma_fence_wait_any_timeout: unsigned deadline wrap returns bogus negative error on clean timeout, long→int truncation turns infinite waits into tick-rate poll loops, and an uninterlocked check→tsleep window permanently loses completion wakeups Base system — drivers · sys/dev/drm/linux_fence.c:206 · pass 2 · new	dos	reproduced fixed
DF-5119	Medium	4.4	Unvalidated user-controlled datasize/namesize in EFIIOC_VAR_GET/VAR_NEXT/VAR_SET: kmalloc(M_WAITOK) panics on huge sizes; sizes near SIZE_MAX wrap round_page() to 0 and corrupt kernel_map Base system — drivers · sys/dev/misc/efirt/efidev.c:105 · pass 2 · new	panic	reproduced fixed
DF-5228	Medium	4.4	dma_free_coherent() permanently leaks every physical page (wired, unreclaimable) and orphans the kernel PTE Base system — drivers · sys/dev/drm/linux_dma.c:81 · pass 2 · new	dos	reproduced fixed
DF-5374	Medium	4.4	NULL-periph deref panic: targwrite()/targread() before TARGIOCENABLE call cam_periph_lock(softc->periph) with periph==NULL Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_target.c:566 · pass 2 · new	dos	reproduced fixed
DF-5377	Medium	4.4	Mapped CTIO bounce pbuf leaked forever by targdone()'s not-enabled free path and targdtor(): vm.pbuf_mem_count drain → permanent system-wide raw-I/O wedge (unkillable wswbuf5) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_target.c:541 · pass 2 · new	dos	reproduced fixed
DF-5558	Medium	4.4	I2CRDWR copies out IIC_M_RD buffers after a FAILED transfer — uninitialized kernel heap disclosed to userspace Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/iic.c:360 · pass 2 · new	leak	reproduced fixed
DF-5560	Medium	4.4	iic_attach() never initializes sc->sc_dev — every iicread()/iicwrite()/iicioctl() dereferences NULL and panics the kernel Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:50 · pass 2 · new	panic	reproduced fixed
DF-5561	Medium	4.4	kdb_trap() longjmp re-entry double-increments db_active; the permanent leak routes every subsequent trap into trap_fatal()+kdb_trap() (all-CPU debugger wedge, cascades to panic: stop_cpus() failed) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/db_interface.c:152 · pass 2 · new	dos	reproduced fixed
DF-5661	Medium	4.4	vkernel's only host-SIGTERM shutdown path is a silent no-op whenever pid 1 does not catch SIGUSR2: 'Shutting down...' is printed and nothing stops Base system — bus / platform / cpu · sys/platform/vkernel64/platform/shutdown.c:93 · pass 2 · new	dos	reproduced fixed
DF-5686	Medium	4.4	udev_getdevs_ioctl() leaks the cdevs prop_array — and permanently pins every cdev's si_dict — on each UDEVPROP getdevs ioctl (devd triggers it on default systems) Base system — kernel core (kern) · sys/kern/kern_udev.c:1004 · pass 2 · new	leak	reproduced fixed
DF-2673	Low	4.4	Recursive vm_map_lock in vm_map_growstack() MAP_WIREFUTURE path — deterministic kernel panic (mlockall(MCL_FUTURE) + stack growth) Base system — virtual memory · sys/vm/vm_map.c:4274 · pass 2 · new	panic	reproduced fixed
DF-2772	Low	4.4	REL/RELA sh_info accepted unvalidated → findbase()==0 → panic("lost base for reltab/relatab") on crafted module (also via the boot preload path) Base system — kernel core (kern) · sys/kern/link_elf_obj.c:775 · pass 2 · new	panic	reproduced fixed
DF-2773	Low	4.4	link_elf_obj_unload_file NULL-derefs reltab/relatab when load aborts between the scan and the table allocation (e.g. 'file has no contents') Base system — kernel core (kern) · sys/kern/link_elf_obj.c:887 · pass 2 · new	panic	reproduced fixed
DF-2809	Low	4.4	"Unreadable program headers" check is warning-only: e_phoff/e_phnum bounds and the bytes-actually-read (nbytes) bound are never enforced → unbounded wild kernel read from firstpage+e_phoff and parsing of uninitialized heap for short files Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf.c:489 · pass 2 · new	panic	reproduced fixed
DF-2810	Low	4.4	parse_dynamic accepts DT_REL/DT_RELA/DT_JMPREL/DT_HASH without DT_SYMTAB/DT_STRTAB → NULL-base wild reads in symbol_name()/elf_lookup()/link_elf_lookup_symbol() Base system — kernel core (kern) · sys/kern/link_elf.c:232 · pass 2 · new	panic	reproduced fixed
DF-2816	Low	4.4	boot()/shutdown_cleanup_proc() tears down the live reboot(2)-calling process (all fds closed, fd_ncdir/fd_nrdir/fd_njdir nchandles NULLed, entire user vmspace removed) while its sibling threads still run on other CPUs → sibling path lookups dereference NULL ncp in naccess() → kernel panic and hard machine wedge Base system — kernel core (kern) · sys/kern/kern_shutdown.c:291 · pass 2 · new	panic	reproduced fixed
DF-2877	Low	4.4	kdmsg_iocom_reconnect() kill-wait deadlocks the DIOCRECLUSTER caller unkillably when the old peer socket is idle-but-open (no fp_shutdown escape, unlike iocom_uninit) Base system — kernel core (kern) · sys/kern/subr_diskiocom.c:141 · pass 2 · new	dos	reproduced fixed
DF-2983	Low	4.4	phys_pager_putpages() panics: vm_fault wiring path creates queue-managed pages in OBJT_PHYS objects (SysV shm + mlock + memory pressure → kernel panic) Base system — virtual memory · sys/vm/phys_pager.c:99 · pass 2 · new	panic	reproduced fixed
DF-3002	Low	4.4	Forged btree leaf with data_offset==0: hammer_btree_extract returns cursor->data==NULL with error==0 (CRC skipped) → NULL-deref kernel panics in readdir/readlink/nresolve/dounlink/strategy_read sinks on crafted HAMMER images Base system — filesystems · sys/vfs/hammer/hammer_vnops.c:1254 · pass 2 · new	panic	reproduced fixed
DF-3087	Low	4.4	nfssvc(NFSSVC_AUTHIN) resume of an ENEEDAUTH'd nfsd re-enters the reply loop with nd == NULL — deterministic kernel NULL-deref panic (:671), plus nfsd_nd leak/dangle Base system — filesystems · sys/vfs/nfs/nfs_syscalls.c:448 · pass 2 · new	panic	reproduced fixed
DF-3154	Low	4.4	ext2_ei_csum_verify() memcmp over-reads 32 bytes past the 128-byte inode slot — next-inode bytes / kernel heap decide EIO-vs-accept (1-bit oracle) Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_csum.c:565 · pass 2 · new	leak	reproduced fixed
DF-3236	Low	4.4	devfs_inode_to_vnode() executes vn_lock() on the core worker's NULL result before the caller's NULL check can run — deterministic NULL-deref kernel panic from a crafted-but-root-gated devfs file handle (fhopen/fhstat/fhstatfs), and unauthenticated-remote if a devfs is exported over NFS (VFS_VGET wire path) Base system — filesystems · sys/vfs/devfs/devfs_vfsops.c:214 · pass 2 · new	panic	reproduced fixed
DF-3241	Low	4.4	ufs_check_export/ufs_fhtovp (via ffs_fhtovp) reachable with mnt_data==NULL in the dounmount fsid window: vfs_getvfs() hands out mounts that VFS_UNMOUNT already tore down — deterministic NULL-deref kernel panic (fatal trap 12 @ 0x18 in ffs_fhtovp), unauthenticated via nfsrv_fhtovp on exported UFS, root-gated via fhstat/fhopen Base system — filesystems · sys/vfs/ufs/ufs_vfsops.c:242 · pass 2 · new	panic	reproduced fixed
DF-3284	Low	4.4	ieee80211_output raw-injection path admits 10-byte frames that ieee80211_classify() parses as 802.3: m_copydata() past end of chain -> KASSERT panic / NULL deref Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_output.c:715 · pass 2 · new	none	reproduced fixed
DF-3305	Low	4.4	del_vif() leaves tbf_reprocess_q_ch armed with the dying vif — v_tbf NULL dereference panic in tbf_update_tokens() Base system — network stack · sys/net/ip_mroute/ip_mroute.c:1792 · pass 2 · new	panic	reproduced fixed
DF-3322	Low	4.4	ip_input() dereferences m_pkthdr.rcvif without NULL check on the 127/8 martian test — NULL-deref panic reachable via netgraph ng_ip_input(4) which queues user mbufs with rcvif unset Base system — network stack · sys/netinet/ip_input.c:544 · pass 2 · new	panic	reproduced fixed
DF-3370	Low	4.4	ip_output: NULL rtentry dereference in the DF/EMSGSIZE path when the packet was routed without a route entry (multicast via IP_MULTICAST_IF) — deterministic kernel panic Base system — network stack · sys/netinet/ip_output.c:712 · pass 2 · new	panic	reproduced fixed
DF-3380	Low	4.4	pfsync callout handlers execute in the softclock thread without pf_token: deterministic INVARIANTS panic ~5s after SIOCSETPFSYNC syncdev configuration (ASSERT_LWKT_TOKEN_HELD at pfsync_bulkfail entry) Kernel memory corruption (UAF / OOB write) · sys/net/pf/if_pfsync.c:1168 · pass 2 · new	panic	reproduced fixed
DF-3406	Low	4.4	tapwrite() leaks one mbuf per EFAULTing write: spare MGET allocated before loop-condition recheck is never freed Base system — network stack · sys/net/tap/if_tap.c:955 · pass 2 · new	dos	reproduced fixed
DF-3494	Low	4.4	Error-path kernel heap leaks in v1 ng_parse: ng_get_string_token leaks the token buffer on unterminated quote and ng_string_unparse leaks the ng_encode_string buffer on append-ERANGE (both already fixed in the ng7 copy) Kernel memory leaks / uninitialized disclosure · sys/netgraph/netgraph/ng_parse.c:727 · pass 2 · new	dos	reproduced fixed
DF-3511	Low	4.4	ngc_send MKPEER autoload: `goto done` bypasses every free — msg + path + mbuf leaked per sendto; module autoload via AF_NETGRAPH always ENXIO Base system — network stack · sys/netgraph7/socket/ng_socket.c:285 · pass 2 · new	dos	reproduced fixed
DF-3527	Low	4.4	ng_iface (v1): NGM_IFACE_POINT2POINT/NGM_IFACE_BROADCAST early 'return (EBUSY)' leaks the control message — unbounded, persistent M_NETGRAPH kernel-heap leak Kernel memory leaks / uninitialized disclosure · sys/netgraph/iface/ng_iface.c:666 · pass 2 · new	leak	reproduced fixed
DF-3540	Low	4.4	ng_bpf SET_PROGRAM accepts cyclic match/nomatch forwarding destinations (incl. ifMatch == thisHook); ng7's unbounded synchronous forwarding recurses until the LWKT token array overflows — deterministic kernel panic Base system — network stack · sys/netgraph7/bpf/ng_bpf.c:584 · pass 2 · new	panic	reproduced fixed
DF-3546	Low	4.4	v1 ng_bpf: cyclic ifMatch/ifNotMatch forwarding (incl. ifMatch == thisHook) + v1 core's unbounded synchronous ng_send_data recursion exhausts the kernel thread stack — deterministic panic Privilege escalation (general use) · sys/netgraph/bpf/ng_bpf.c:419 · pass 2 · new	panic	reproduced fixed
DF-3553	Low	4.4	ng7 ng_tee: two cross-connected tees plus a left2right entry hook form a constructible pure-topology forwarding cycle; one injected byte recurses through ng7's unbounded synchronous forwarding until the LWKT token array overflows — deterministic kernel panic (DF-3540 class, tee instance) Base system — network stack · sys/netgraph7/tee/ng_tee.c:293 · pass 2 · new	panic	reproduced fixed
DF-3554	Low	4.4	v1 ng_tee: same constructible tee/tee cycle with left2right entry edge; v1's unbounded synchronous ng_send_data recursion (plus per-hop m_dup churn) deterministically hard-wedges the whole machine — unrecoverable DoS with no panic banner or dump (DF-3546 class, tee instance) Base system — network stack · sys/netgraph/tee/ng_tee.c:277 · pass 2 · new	dos	reproduced fixed
DF-3557	Low	4.4	ng7 ng_UI FLOW-cookie relay in a closed UI<->UI hook cycle: unbounded synchronous control-message forwarding overflows the LWKT token array — deterministic kernel panic (DF-3540 class, ng_UI instance) Base system — network stack · sys/netgraph7/UI/ng_UI.c:145 · pass 2 · new	panic	reproduced fixed
DF-3559	Low	4.4	ng7 ng_hub: two cross-wired hubs plus one entry hook form a config-free forwarding cycle — with the entry hook created last, one injected byte makes the hub's single synchronous NG_FWD_ITEM_HOOK recurse unbounded until the LWKT token array overflows: deterministic kernel panic (DF-3540 class, purest instance; natural hook order instead yields a 10.5k pkt/s packet-multiplication storm from one byte) Base system — network stack · sys/netgraph7/hub/ng_hub.c:61 · pass 2 · new	panic	reproduced fixed
DF-3794	Low	4.4	ACPIIO_DO_MCALL leaks the copied-in argument object list when copyinstr() of the method path faults Base system — drivers · sys/dev/acpica/acpi.c:3353 · pass 2 · new	dos	reproduced fixed
DF-4557	Low	4.4	atapi_action() indexes softc->atadev[tid] with unbounded CAM target_id in XPT_SCSI_IO and XPT_PATH_INQ — tid=5 deterministically reads state_lock.lk_lockholder (curthread, non-NULL while the lock is held) and dereferences it as struct ata_device *, panicking the kernel Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/atapi-cam.c:385 · pass 2 · new	panic	reproduced fixed
DF-4685	Low	4.4	amdgpu_fence_slab_fini: rcu_barrier() is a no-op — kldunload with pending call_rcu entries unmaps module text before the >=1s delay line fires amdgpu_fence_free: fatal trap 12 (reproduced; fix validated on rebuilt kernel) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_fence.c:69 · pass 2 · new	panic	reproduced fixed
DF-4780	Low	4.4	corecstat attach-time kernel panic on original Atom: the chip-representative CPU of any model-0x1c/0x26/0x27/0x35/0x36 system falls into corecstat_init_atom_cpu() with sc_version==0, violating its own KKASSERT — boot/kldload panic on INVARIANTS builds, silently-wrong core-sensor init on production builds Base system — drivers · sys/dev/powermng/corecstat/corecstat.c:355 · pass 2 · new	panic	reproduced fixed
DF-5007	Low	4.4	tpm20_read disarms the discard-buffer callout before the owner check: an EPERM-failing read(2) permanently kills the only recovery that clears pending_data_length, wedging every later write(2) in an unkillable non-PCATCH cv_wait (permanent DoS of the TPM device and the writing process) Base system — drivers · sys/dev/crypto/tpm/tpm20.c:78 · pass 2 · new	dos	reproduced fixed
DF-5019	Low	4.4	TBRIDGE_GETRESULT without a prior TBRIDGE_LOADTEST leaves tbridge_testcase NULL and panics the kernel in tbridge_test_done's KKASSERT on any INVARIANTS build (stock X86_64_GENERIC ships INVARIANTS; all dfregress kernels build tbridge in) Base system — drivers · sys/dev/misc/tbridge/tbridge.c:265 · pass 2 · new	panic	reproduced fixed
DF-5155	Low	4.4	perfbias: raw wrmsr/rdmsr(MSR_IA32_ENERGY_PERF_BIAS=0x1b0) in the cpuhelper path takes a fatal kernel #GP on CPUID-lying platforms (DF-4735 class), root-gated panic Base system — drivers · sys/dev/powermng/perfbias/perfbias.c:178 · pass 2 · new	panic	reproduced fixed
DF-5330	Low	4.4	resettodr() pre-epoch wall clock wraps the unsigned Y/M/D conversion into an unbounded loop under crit_enter() — permanent, silent, dump-less kernel hang Base system — bus / platform / cpu · sys/platform/pc64/isa/clock.c:1158 · pass 2 · new	dos	reproduced fixed
DF-5352	Low	4.4	ioapic_abi_legacy_intr_config(): driver-facing ABI panics production kernels when called with a non-legacy IRQ (KKASSERT-only validation, void return) Base system — bus / platform / cpu · sys/platform/pc64/apic/ioapic_abi.c:999 · pass 2 · new	panic	reproduced fixed
DF-5564	Low	4.4	IIC_NOINTR is 0, so WAIT-only requesters sleep without PCATCH and without timeout — unkillable indefinite park (ipmi_ssif/cyapa via SMB_WAIT passthrough), compounded by a lost-wakeup path that can strand sleepers on a free bus forever Base system — bus / platform / cpu · sys/bus/iicbus/iiconf.c:66 · pass 2 · new	dos	reproduced fixed
DF-5565	Low	4.4	iicbus_request_bus's first do-while spins forever for IIC_DONTWAIT when the bridge callback persistently reports busy — unkillable tight kernel loop with no signal checkpoint (livelock) Base system — bus / platform / cpu · sys/bus/iicbus/iiconf.c:92 · pass 2 · new	dos	reproduced fixed
DF-5619	Low	4.4	acpi_cst_md_cx_setup accepts SystemIO/SystemMemory C-state descriptors with no operational entry method: crafted _CST panics the kernel unattended at boot (KASSERT 'enter is not set' on INVARIANTS kernels; unconditional panic 'startup setup failed' + enter==NULL resident in the idle table on production kernels) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_cstate_machdep.c:81 · pass 2 · new	panic	reproduced fixed
DF-5635	Low	4.4	iicbus_detach swallows bus_generic_detach()'s error: a child that fails to detach leaves the bus marked detached + driverless with its softc freed while the child is still attached — the child's next iicbus_request_bus faults on device_get_softc(bus)==NULL (sc->owner at NULL+8) Base system — bus / platform / cpu · sys/bus/iicbus/iicbus.c:156 · pass 2 · new	panic	reproduced fixed
DF-5646	Low	4.4	Unvalidated hint IRQ passed to machintr_legacy_intr_cpuid(): deterministic boot-time kernel panic (KKASSERT) from one loader.conf line; OOB ioapic_irqmaps[cpuid][irq] read on non-INVARIANTS kernels Kernel memory leaks / uninitialized disclosure · sys/bus/isa/isahint.c:73 · pass 2 · new	panic	reproduced fixed
DF-5649	Low	4.4	SRAT subtable walk advances by firmware Length with no lower bound: zero-length entry wedges srat_probe in an infinite loop (silent boot hang) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_srat.c:93 · pass 2 · new	dos	reproduced fixed
DF-5673	Low	4.4	/dev/io IOPL grant is unaccounted per-LWP trap-frame state: inherited verbatim across fork, never revoked on last fd close (cpu_clr_iopl clears whichever LWP closes, not the grantees), and survives setuid() privilege drop Base system — bus / platform / cpu · sys/platform/pc64/x86_64/sysarch.c:52 · pass 2 · new	none	reproduced fixed
DF-5728	Low	4.4	DDB db_expression unbounded parenthesis recursion overflows the 16 KB kernel stack — deterministic double fault / panic from one console line Base system — libkern / libprop / ddb · sys/ddb/db_expr.c:84 · pass 2 · new	panic	reproduced fixed
DF-3290	Medium	4.3	mesh_parse_meshgate_action ignores the GANN IE's declared length: OOB read of up to 15 bytes re-broadcast to the mesh Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_mesh.c:2583 · pass 2 · new	leak	reproduced fixed
DF-3298	Medium	4.3	Use-after-free in carp_proto_input: IP reassembly holds dangling rcvif into freed carp_softc across ifconfig carpN destroy Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_carp.c:703 · pass 2 · new	leak	reproduced fixed
DF-3001	Low	4.3	hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (VFS-contract divergence vs UFS): NFS SETATTR can forge timestamps on any file in an exported HAMMER1 filesystem Privilege escalation (general use) · sys/vfs/hammer/hammer_vnops.c:2345 · pass 2 · new	corruption	reproduced fixed
DF-3291	Low	4.3	GANN propagation gate uses && where \|\| is required: TTL-exhausted GANNs re-broadcast with TTL wrapping 0 to 255 Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:2690 · pass 2 · new	none	reproduced fixed
DF-3324	Low	4.3	ieee80211_parse_ath heap OOB read: Atheros vendor IE length never validated on the hostap assoc path (SUPERG kernels) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_hostap.c:2007 · pass 2 · new	none	reproduced fixed
DF-3329	Low	4.3	verify_mesh_preq_len/verify_mesh_perr_len/verify_mesh_prep_len read IE fields beyond the end of the frame before validating the declared IE length Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_hwmp.c:317 · pass 2 · new	none	reproduced fixed
DF-3341	Low	4.3	[CROSS-FILE: ieee80211_input.c] parse_beacon accepts TIM IE without length verification; scan_sta consumer reads tim_period past IE end (1-2 byte OOB read) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_proto.c:586 · pass 2 · new	none	reproduced fixed
DF-3342	Low	4.3	[CROSS-FILE: ieee80211_sta.c] sta_input pre-dispatch block reads i_addr2/i_seq/i_qos with only frame_min guaranteed — unfiled mirror of DF-3325 Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_proto.c:601 · pass 2 · new	none	reproduced fixed
DF-3416	Low	4.3	adhoc_input pre-dispatch block reads i_addr2/i_seq/i_qos with only frame_min (10 bytes) guaranteed for dir!=NODS frames — unfiled IBSS mirror of DF-3342 (sta_input) / DF-3325 Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_adhoc.c:356 · pass 2 · new	none	reproduced fixed
DF-5082	Low	4.3	os_map_pci_bar(): unchecked bus_alloc_resource_any() failure → rman_get_virtual(NULL) NULL-deref panic at hptrr device attach (DF-5039 twin) Base system — drivers · sys/dev/raid/hptrr/hptrr_os_bsd.c:101 · pass 2 · new	panic	reproduced fixed
DF-5571	Medium	4.2	kdb_trap() longjmp re-entry double-increments db_active (DF-5561 twin): the permanent leak routes every subsequent trap into trap_fatal()+kdb_trap() — permanent all-CPU ddb wedge of the whole vkernel, surviving even panic Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/db_interface.c:150 · pass 2 · new	dos	reproduced fixed
DF-2848	Low	4.2	taskqgroup_create() heap OOB write: unvalidated cnt writes struct taskqgroup_cpu slots past the fixed tqg_queue[MAXCPU] array Kernel memory corruption (UAF / OOB write) · sys/kern/subr_gtaskqueue.c:788 · pass 2 · new	dos	reproduced fixed
DF-2907	Low	4.2	md_get_mbuf() ignores md_get_mem() failure (silent short copy / INVARIANTS panic) and md_done() leaves md_cur/md_pos dangling Kernel memory corruption (UAF / OOB write) · sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new	panic	reproduced fixed
DF-3374	Low	4.2	ieee80211_parse_csaparams consumes the CSA IE without validating its declared length: 2-3 byte read past IE/frame end drives channel-switch decisions on stale mbuf bytes (DF-3341/DF-0582 family) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_sta.c:1146 · pass 2 · new	none	reproduced fixed
DF-3454	Low	4.2	amrr never revalidates stale amn_rix against the active rateset: HT→legacy flip gives OOB reads of node memory (incl. ni_chan kernel pointer bytes) disclosed via ni_txrate/rate_stats, and hands drivers an unbounded/negative rate index Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_amrr.c:208 · pass 2 · new	leak	reproduced fixed
DF-5586	Low	4.2	exc_segfault() tail splz() is unguarded: deferred IPIs/interrupt work dispatched inside the interrupted context's critical section and inside outer interrupt handlers — protocol divergence from pc64 doreti's explicit TD_CRITCOUNT gate Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/exception.c:269 · pass 2 · new	none	reproduced fixed
DF-5712	Low	4.2	index/rindex omit the ISO C char conversion of the search argument: never match for ch outside [-128,127], diverging from strchr/strrchr (backs every kernel strchr/strrchr via libkern.h) Base system — libkern / libprop / ddb · sys/libkern/index.c:46 · pass 2 · new	none	reproduced fixed
DF-3419	Medium	4.1	pfi_kif_update() walks kif->pfik_dynaddrs under crit_enter() only while pf_rm_rule()/pfi_dynaddr_remove() free the entries under pf_token on another CPU — cross-CPU use-after-free of pfi_dynaddr (kernel panic) Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_if.c:470 · pass 2 · new	panic	reproduced fixed
DF-4056	Medium	4.1	et_rxeof/et_txeof completion walks have no termination bound, and the device-supplied index fields are WIDER than the software rings (RX stat 12-bit vs ET_RX_NSTAT=1024; TX done 10-bit vs ET_TX_NDESC=512): a value in the unreachable range spins forever under the driver serializer / KKASSERT-panics (DF-3761 family instance) Base system — drivers · sys/dev/netif/et/if_et.c:1847 · pass 2 · new	panic	reproduced fixed
DF-4143	Medium	4.1	NULL boot_ps page-fault panic in trinity_dpm_enable (:1129) / trinity_dpm_disable (:1177) when the VBIOS power table has no BOOT-classified state or dpm.init failed — Trinity/Richland twin of DF-4022/DF-4118/DF-4124/DF-3972 Base system — drivers · sys/dev/drm/radeon/trinity_dpm.c:1105 · pass 2 · new	panic	reproduced fixed
DF-4187	Medium	4.1	NULL boot_ps page-fault panic in sumo_dpm_enable (:1235) / sumo_dpm_disable (:1280) when the VBIOS power table has no BOOT-classified state or dpm.init failed — sumo twin of DF-4118/4143/4124/3972/3754/3953 Base system — drivers · sys/dev/drm/radeon/sumo_dpm.c:1205 · pass 2 · new	panic	reproduced fixed
DF-4189	Medium	4.1	ucNumDPMLevels==0 pplib state leaves ps->num_levels==0: levels[num_levels-1] == levels[0xFFFFFFFF] wild read ~96 GB past the kzalloc'd sumo_ps (deterministic page-fault panic) in set_uvd_clock before/after (:847/:865), program_bsp (:350), program_at (:426), get_sclk (:1891) — sumo twin of DF-4145/3954/3888 Base system — drivers · sys/dev/drm/radeon/sumo_dpm.c:1508 · pass 2 · new	panic	reproduced fixed
DF-4493	Medium	4.1	rs780_dpm: NULL boot_ps / skipped state parse (ucStateEntrySize==1 or no BOOT-classified state) -> NULL-pointer page-fault panic in rs780_dpm_enable and print paths Base system — drivers · sys/dev/drm/radeon/rs780_dpm.c:741 · pass 2 · new	panic	reproduced fixed
DF-5037	Medium	4.1	dm_pdev_insert holds dm_pdev_mutex across vn_open/VOP_GETATTR/dev_dioctl which re-enter dm (dmopen→dm_dev_lookup→dm_dev_mutex), inverting against dm_dev_remove/remove_all holding dm_dev_mutex across the ref-drain cv_wait and table destruction (→ dm_pdev_decr → dm_pdev_mutex): permanent AB-BA kernel deadlock of the whole dm subsystem Base system — drivers · sys/dev/disk/dm/dm_pdev.c:128 · pass 2 · new	dos	reproduced fixed
DF-5071	Medium	4.1	amrd_strategy has no AMR_STATE_SHUTDOWN gate and nothing ever drains amr_bioq — bios park forever, issuers wedge in unkillable D-state (DF-2066/DF-5012/DF-5026 systemic class; distinct sink from DF-2082's in-flight UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr_disk.c:166 · pass 2 · new	dos	reproduced fixed
DF-5530	Medium	4.1	usbpf clone create/destroy race: half-published ifnet NULL-derefs in usbpf_clone_destroy (usb_pf.c:191) and bpfdetach (bpf.c:1574) Base system — bus / platform / cpu · sys/bus/u4b/usb_pf.c:157 · pass 2 · new	panic	reproduced fixed
DF-2676	Low	4.1	vm_page_grab() NULL-pointer dereference when the page exists but is busy and VM_ALLOC_RETRY is not set Base system — virtual memory · sys/vm/vm_page.c:3841 · pass 2 · new	panic	reproduced fixed
DF-2752	Low	4.1	pipe_size sysctl lacks power-of-two validation: non-pow2 buffer size silently aliases FIFO slots (in-bounds cross-process data corruption) on misconfigured systems Base system — kernel core (kern) · sys/kern/sys_pipe.c:125 · pass 2 · new	corruption	reproduced fixed
DF-2791	Low	4.1	sys_rtprio() NULL lwp dereference on processes in the fork (SIDL) window — unprivileged EFAULT read of &((struct lwp*)0)->lwp_rtprio; privileged raw kernel write to 0x198 panics the kernel Privilege escalation (general use) · sys/kern/kern_resource.c:704 · pass 2 · new	panic	reproduced fixed
DF-2814	Low	4.1	objcache_destroy() purges remote CPUs' per-cpu magazines under only a local critical section — no cross-CPU exclusion (contract-reliant teardown; KKASSERT panic / magazine UAF if any in-flight get/put exists) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_objcache.c:929 · pass 2 · new	panic	reproduced fixed
DF-2880	Low	4.1	sp->sw_nblks is a 32-bit int but swaponvp() stores a 64-bit block count — swap devices >= 2^31 pages (8 TiB) truncate to negative/garbage bounds while vm_swap_size still counts the full size Base system — virtual memory · sys/vm/vm_swap.c:344 · pass 2 · new	denial_of_service	reproduced fixed
DF-3346	Low	4.1	SIOCSLAGG sets sc_proto before ti_attach: a failed protocol attach leaves sc_proto set with NULL/dead callbacks, next SIOCSLAGG calls a NULL sc_detach Base system — network stack · sys/net/lagg/if_lagg.c:1086 · pass 2 · new	panic	reproduced fixed
DF-3347	Low	4.1	lagg_lacp_attach ignores lacp_port_create failure: ports left with NULL lp_psc are dereferenced by every later LACP operation Base system — network stack · sys/net/lagg/if_lagg.c:2085 · pass 2 · new	panic	reproduced fixed
DF-3407	Low	4.1	tun(4) softc lifetime race: cdev open/close vs clone create/destroy unsynchronized — reproduced kernel panic (UAF family); tap DF-3405 twin Kernel memory corruption (UAF / OOB write) · sys/net/tun/if_tun.c:214 · pass 2 · new	panic	reproduced fixed
DF-3445	Low	4.1	table_append_dispatch strands its netmsg on kmalloc failure: netisr0 blocks forever in lwkt_waitmsg (permanent kernel-networking hang) Base system — network stack · sys/net/ipfw3_basic/ip_fw3_table.c:157 · pass 2 · new	denial_of_service	reproduced fixed
DF-3566	Low	4.1	SipHash24_TestVectors passes len=0 to SipHash_Update for the empty-message vector, panicking INVARIANTS kernels Base system — crypto · sys/crypto/siphash/siphash_test.c:121 · pass 2 · new	dos	reproduced fixed
DF-3959	Low	4.1	vtnet_exec_ctrl_cmd waits for control-queue completion with an unbounded spin loop (virtqueue_poll) under held serializers Base system — drivers · sys/dev/virtual/virtio/net/if_vtnet.c:2407 · pass 2 · new	dos	reproduced fixed
DF-4185	Low	4.1	acd_fixate() integer divide-by-zero panic when all acd_get_cap() capability reads failed at attach (cur_write_speed stays 0) Base system — drivers · sys/dev/disk/nata/atapi-cd.c:1158 · pass 2 · new	panic	reproduced fixed
DF-4681	Low	4.1	numPdGainsUsed==0 (EEPROM xpd_mask==0): uint32-wrapped wild reads at array+0x1FFFFFFFE (+8.59 GB) in the backfill loops + uninitialized Pmin_t2[0] stack read (twin of DF-4620/4649/4661) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:402 · pass 2 · new	dos	reproduced fixed
DF-4682	Low	4.1	Flat pd-gain curve makes sizeCurrVpdTable==0 → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/4650/4662) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:438 · pass 2 · new	dos	reproduced fixed
DF-4806	Low	4.1	ppi: interrupt handler registered with a cdev_t argument but consumed as device_t - wild-pointer deref and instant kernel panic on the first parallel-port IRQ (currently defused by a sibling bug: the legacy IRQ allocation can never succeed, leaving 1284 peripheral mode dead) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/ppi/ppi.c:160 · pass 2 · new	panic	reproduced fixed
DF-4857	Low	4.1	Divide-by-zero kernel panic in rv730_populate_sclk_value: do_div by verbatim VBIOS reference clock (usReferenceClock==0) — rv730 twin of DF-1992 Base system — drivers · sys/dev/drm/radeon/rv730_dpm.c:52 · pass 2 · new	panic	reproduced fixed
DF-4863	Low	4.1	amdgpu_cgs_get_firmware_info indexes adev->firmware.ucode[fw_type_convert(type)] with no bound on the converter's default return (== the array size): one-past-end element whose .fw aliases firmware.fw_buf — type-confused deref of amdgpu_bo internals as struct firmware (latent: no in-tree caller passes an unmapped type) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:214 · pass 2 · new	none	reproduced fixed
DF-5005	Low	4.1	amdgpu_atombios_get_clock_info() accepts usReferenceClock==0 with no fixup (unlike every sibling field) → ppll.reference_freq==0 guarantees amdgpu_pll_compute divide-by-zero at first modeset (the rs400/r100 'reference_freq==0' lead, confirmed) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:592 · pass 2 · new	panic	reproduced fixed
DF-5044	Low	4.1	sili_os_stop_port() waits for the port helper thread with no bound — a wedged helper thread turns kldunload/shutdown into a permanent kernel hang Base system — drivers · sys/dev/disk/sili/sili_dragonfly.c:208 · pass 2 · new	dos	reproduced fixed
DF-5253	Low	4.1	uaudio_mixer_sysctl_handler uses sc->sc_mixer_lock across an unbounded user-copy window; a racing USB-audio detach NULLs and frees the lock before the sysctl OIDs are unregistered, causing lockmgr(NULL) -> kernel panic Base system — bus / platform / cpu · sys/bus/u4b/audio/uaudio.c:2748 · pass 2 · new	panic	reproduced fixed
DF-5459	Low	4.1	Single-caller assumption unenforced: ichsmb_callback no-ops bus request/release, so concurrent /dev/smb ioctls interleave in the transaction state machine and panic KASSERT(sc->ich_cmd == -1) Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb.c:148 · pass 2 · new	panic	reproduced fixed
DF-5478	Low	4.1	efi_create_1t1_map(): md_pages*EFI_PAGE_SIZE wraparound passes the runtime-map guard — multi-petabyte kmalloc(M_WAITOK) fill loop wedges the boot Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/efirt.c:255 · pass 2 · new	dos	reproduced fixed
DF-5533	Low	4.1	usb_proc_drain() cold-path calls suspend_kproc() on a thread that can never acknowledge the stop request — the suspend check is #if 0'd out and its macro calls a function that does not exist in DragonFly — leaving drain asleep forever in suspkp while holding the USB bus lock (boot-time wedge on controller attach failure) Base system — bus / platform / cpu · sys/bus/u4b/usb_process.c:86 · pass 2 · new	dos	reproduced fixed
DF-5562	Low	4.1	ohci_pci_detach() swallows device_delete_children() failure: unconditional controller reset, IRQ/MMIO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/ohci_pci.c:329 · pass 2 · new	panic	reproduced fixed
DF-5577	Low	4.1	ppb_MS_microseq() discards the return values of its recursive self-calls — a mode-transfer loop that aborts on error is skipped and the whole MS_OP_PUT/GET reports success (initxfer's MS_RET(0) zeroes the error channel first) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_msq.c:301 · pass 2 · new	none	reproduced fixed
DF-5583	Low	4.1	acpi_sci_test(): unchecked register_int() return passed to unregister_int() — kernel NULL-deref panic from crafted FADT SciInterrupt Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_fadt.c:198 · pass 2 · new	panic	reproduced fixed
DF-5601	Low	4.1	ig4 PCI attach-error unwinder re-enters the serializer leaked by ig4iic_attach()'s bus_setup_intr error path: ig4_pci.c:195 -> ig4_pci.c:208 -> ig4_iic.c:678 lwkt_serialize_enter on a self-held, explicitly non-recursive serializer — boot-time kernel panic (INVARIANTS) / hard self-deadlock (release) Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_pci.c:193 · pass 2 · new	panic	reproduced fixed
DF-5637	Low	4.1	smbus_release_bus tears down the parent-bridge exclusion BEFORE validating ownership and wakes waiters on the EACCES path (DF-5566 twin) — non-owner release frees the iicbus under the real owner and can wedge the bus permanently Base system — bus / platform / cpu · sys/bus/smbus/smbconf.c:160 · pass 2 · new	dos	reproduced fixed
DF-5640	Low	4.1	TSC cputimer registered with unvalidated tsc_frequency → integer division by zero (boot-time kernel panic) Base system — bus / platform / cpu · sys/cpu/x86_64/misc/cputimer_tsc.c:145 · pass 2 · new	panic	reproduced fixed
DF-5745	Low	4.1	apple_gmux: second-instance attach clobbers the shared apple_gmux_softc_data global → NULL-deref panic in vga_switcheroo dispatch (spontaneous at i915 load) Base system — other · sys/gnu/dev/misc/apple_gmux/apple-gmux.c:511 · pass 2 · new	panic	reproduced fixed
DF-5527	Info	4.1	gpio_cherryview_unmap_intr never masks the IRQ line: GPIO_FREE_INTR without a preceding GPIO_TEARDOWN_INTR leaves an armed orphaned interrupt (latent irq-storm / hard-lockup DoS) Base system — bus / platform / cpu · sys/bus/gpio/gpio_intel/gpio_cherryview.c:380 · pass 2 · new	dos	reproduced fixed
DF-5587	Info	4.1	Any fault in a vkernel cothread dies silently through unbounded exc_segfault recursion: SA_NODEFER + empty sa_mask re-entry on a %gs==0 thread hits kern_trap's mycpu load and recurses ~308k times until the host kills the vkernel — no panic, no dump, no diagnostic Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/exception.c:222 · pass 2 · new	dos	reproduced fixed
DF-5763	Info	4.1	netbt_dispose wired as dom_dispose is a dead-code booby trap: it destroys the three GLOBAL netbt vm_zones per socket flush — one PR_RIGHTS flag bit away from a deterministic global UAF/double-free (rig-proven, 3/3 panics at zdestroy+0x19) Kernel memory corruption (UAF / OOB write) · sys/netbt/bt_proto.c:128 · pass 2 · new	panic	reproduced fixed
DF-5777	Info	4.1	splash() invokes splash_decoder->splash without the NULL guard its sibling callbacks get Base system — drivers · sys/dev/video/fb/splash.c:204 · pass 2 · new	panic	reproduced fixed
DF-2829	Medium	4.0	Uninitialized vm_zone->znalloc discloses stale kernel heap memory to unprivileged users via sysctl vm.zone (REQUESTS column) Base system — virtual memory · sys/vm/vm_zone.c:453 · pass 2 · new	leak	reproduced fixed
DF-2830	Medium	4.0	Off-by-one NUL-terminator clobber in sysctl_vm_zone name padding causes kernel-stack OOB read in unprivileged vm.zone output (13+ char zone names, in-tree trigger rfcomm_credit) Kernel memory corruption (UAF / OOB write) · sys/vm/vm_zone.c:835 · pass 2 · new	leak	reproduced fixed
DF-5344	Medium	3.9	CPUID brand string assembled into cpu_brand[48] without NUL termination → out-of-bounds read in printcpuinfo() (layout-dependent .bss disclosure into world-readable hw.model; potential overflow of cpu_model[128]) Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/identcpu.c:118 · pass 2 · new	leak	reproduced fixed
DF-3537	Medium	3.7	VJ decompression OOB read on the vjcomp hook: short compressed frames make the kernel read past m_len into stale mbuf data that persists in rstate[] and is re-emitted inside reconstructed TCP/IP headers (kernel heap info leak) Kernel memory leaks / uninitialized disclosure · sys/netgraph/vjc/ng_vjc.c:456 · pass 2 · new	leak	reproduced fixed
DF-3538	Medium	3.7	ng7 twin of DF-3537: VJ decompression OOB read on the vjcomp hook leaks stale mbuf bytes via persistent rstate[] into reconstructed TCP/IP headers Kernel memory leaks / uninitialized disclosure · sys/netgraph7/vjc/ng_vjc.c:449 · pass 2 · new	leak	reproduced fixed
DF-3150	Low	3.7	HAMMER1 mirror-write: HAMMER_MREC_TYPE_REC_NODATA case is dead code (mask strips the NODATA bit) — NODATA records installed as holes instead of skipped Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:429 · pass 2 · new	none	reproduced fixed
DF-4592	Medium	3.6	format_config() OOB heap read: vinum_conf.plex[sd->plexno] with plexno==-1 for detached subdisks persists heap bytes into the on-disk config Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumio.c:517 · pass 2 · new	leak	reproduced fixed
DF-5470	Medium	3.6	Backtracer frame walk trusts stack content as frame pointers — INKERNEL() defined but never used; walk escapes into user-space, arbitrary mapped, and unmapped memory (attacker-steerable panic-time trace, msgbuf forensic eviction) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/db_trace.c:227 · pass 2 · new	dos	reproduced fixed
DF-2614	Low	3.6	Debug kprintf's in hammer2 cluster message path leak kernel heap pointer to msgbuf and allow peer-driven console flooding Hammer2 · sys/vfs/hammer2/hammer2_iocom.c:135 · pass 2 · new	leak	reproduced fixed
DF-2674	Low	3.6	vm_map_growstack() maps grown stack pages VM_PROT_ALL (RWX), silently making the grown stack executable (W^X bypass) Base system — virtual memory · sys/vm/vm_map.c:4246 · pass 2 · new	none	reproduced fixed
DF-2855	Low	3.6	rman_reserve_resource window arithmetic wraps when count-1 > end: allocation escapes the caller's [start,end] window (and can produce an inverted r_end < r_start node when start+count-1 overflows) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_rman.c:224 · pass 2 · new	corruption	reproduced fixed
DF-3076	Low	3.6	Unvalidated on-disk B-Tree leaf data_len consumed as `bytes` by hammer_blockmap_free/dedup/finalize with INVARIANTS-only bounds — deterministic panic from unprivileged unlink on crafted nohistory HAMMER; production: int32 layer2 bytes_free wrap and force-free of a still-referenced big-block Base system — filesystems · sys/vfs/hammer/hammer_blockmap.c:785 · pass 2 · new	dos	reproduced fixed
DF-3308	Low	3.6	IPV6_MULTICAST_IF caches an unreferenced ifnet pointer that is never purged for TCP6 pcbs → dangling im6o->im6o_multicast_ifp after interface destruction Kernel memory corruption (UAF / OOB write) · sys/netinet6/ip6_output.c:2253 · pass 2 · new	none	reproduced fixed
DF-3333	Low	3.6	nm_kr_rxpos() single conditional subtract turns DF-0359's corrupted nr_hwcur/nr_hwavail into an out-of-bounds slot write in netmap_transmit() Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap.c:910 · pass 2 · new	dos	reproduced fixed
DF-3460	Low	3.6	rssadapt_sysctl_interval dereferences vap->iv_rs freed by rssadapt_deinit during the vap-teardown window before ieee80211_sysctl_vdetach removes the oid — unprivileged 4-byte kernel-heap UAF read (world-readable sysctl), root 4-byte UAF write; amrr twin is the default ratectl Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_rssadapt.c:151 · pass 2 · new	leak	reproduced fixed
DF-3793	Low	3.6	acpi_GetInteger() reads uninitialized stack ACPI_OBJECT when AML evaluation succeeds but returns no object Base system — drivers · sys/dev/acpica/acpi.c:2166 · pass 2 · new	leak	reproduced fixed
DF-4940	Low	3.6	if_ic: icoutput unconditionally forces IFF_RUNNING, bypassing the up state machine (permanently skipped buffer allocation/bus acquisition, TX over un-owned iicbus, spurious bus release) Base system — drivers · sys/dev/netif/ic/if_ic.c:188 · pass 2 · new	dos	reproduced fixed
DF-5436	Low	3.6	ulpt(4): cross-cdev open/close TOCTOU on sc_fflags breaks exclusive open, kills a reader session, defeats the reset/status-poll guards Base system — bus / platform / cpu · sys/bus/u4b/serial/ulpt.c:411 · pass 2 · new	dos	reproduced fixed
DF-5580	Low	3.6	__udivmodti4 masked-select init performs shift counts outside the 64-bit operand domain (count>=64 and unsigned-wrapped negative counts) at ten sites — formally UB, provably masked today, silent-miscompilation hazard for every in-kernel 128-bit division on any future compiler upgrade Base system — bus / platform / cpu · sys/platform/pc64/x86_64/__udivti3.c:231 · pass 2 · new	none	reproduced fixed
DF-4687	Low	3.5	ar2425: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write into RF bank scratch (twin of DF-4619/4648/4660/4680) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:452 · pass 2 · new	dos	reproduced fixed
DF-4688	Low	3.5	ar2425: numPdGainsUsed==0 (EEPROM xpd_mask==0) — uint32-wrapped [ii-1]/[kk-1] wild reads at array+0x1FFFFFFFE (+8.59 GB) + stale-STATIC Pmin_t2[0] read (twin of DF-4620/4649/4661/4681, with the ar2425 static-storage nuance) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:431 · pass 2 · new	dos	reproduced fixed
DF-4689	Low	3.5	ar2425: flat pd-gain curve (all EEPROM deltas 0 — legal) makes sizeCurrVpdTable==0 → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/4650/4662/4682) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:458 · pass 2 · new	dos	reproduced fixed
DF-4690	Low	3.5	cardbus_cis: decode_tuple_bar keeps the attacker-controlled 32-bit CIS BAR size (truncated to a negative int) and passes it unchecked as the resource count; 1<<(ffs(0x80000000)-1) = 1<<31 signed-overflow UB also yields a negative count — both beyond DF-1811's ffs(0) case Kernel memory corruption (UAF / OOB write) · sys/dev/pccard/cardbus/cardbus_cis.c:308 · pass 2 · new	none	reproduced fixed
DF-3730	Low	3.4	ciss_cam_complete_fixup: padstr writes 16 bytes into the 4-byte inq->revision -> 12-byte heap overflow past short CAM INQUIRY buffers Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3325 · pass 2 · new	corruption	reproduced fixed
DF-4594	Low	3.4	vinum_scandisk() early returns (ENOENT / longjmp) leave VF_READING_CONFIG set and leak drivelist — daemon config saves silently wedged Base system — drivers · sys/dev/raid/vinum/vinumio.c:682 · pass 2 · new	dos	reproduced fixed
DF-5151	Low	3.4	dm pdev dedup key silently truncated to 31 chars: a linear table load binds to the wrong physical device (or to a device whose path was never opened) Base system — drivers · sys/dev/disk/dm/linear/dm_target_linear.c:67 · pass 2 · new	none	reproduced fixed
DF-5336	Low	3.4	db_disasm Grp7 mod==3 dispatch: inner rm-field index OOB-reads past the 2/4/5/7-entry db_Grp7_11_* sub-tables (no REX needed) Kernel memory leaks / uninitialized disclosure · sys/cpu/x86_64/misc/db_disasm.c:1275 · pass 2 · new	leak	reproduced fixed
DF-5458	Low	3.4	ichsmb_bread validates and transmits the caller's *count, but /dev/smb passes an uninitialized stack byte — SMB_BREAD deterministically fails EINVAL and garbage reaches the ICH_D0 device register Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb.c:424 · pass 2 · new	dos	reproduced fixed
DF-5522	Low	3.4	SMBus block count byte is omitted in both directions: every Block Write through iicsmb is malformed on the wire and every Block Read returns one-byte-shifted data Base system — bus / platform / cpu · sys/bus/iicbus/iicsmb.c:471 · pass 2 · new	none	reproduced fixed
DF-5600	Low	3.4	ig4iic_pci_attach()'s bzero() wipes the sc->version stored by ig4iic_pci_probe(): every PCI ig4 controller (all 34 IDs incl. Skylake/Apollo Lake/Cannon Lake) is programmed as a Haswell — HSW-only SWMODE write to offset 0x808 on non-Haswell silicon, wrong LTR offsets, and the HSW/ATOM-only COMP_VER boot gate misapplied to newer generations Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_pci.c:151 · pass 2 · new	dos	reproduced fixed
DF-5633	Low	3.4	iicbus_attach unconditionally re-creates the ic/iic/iicsmb trio on every attach: children survive driver teardown, so each detach+re-attach cycle leaks 3 struct bsd_device and mints duplicate iicN/iicsmbN units (duplicate /dev/iicN nodes on one physical bus) Base system — bus / platform / cpu · sys/bus/iicbus/iicbus.c:144 · pass 2 · new	dos	reproduced fixed
DF-5647	Low	3.4	Negative port/portsize/maddr/msize hints accepted: poisoned resource-list entries (inverted start>end ranges, sign-extended UINT64_MAX bases) and rman double-claims of already-allocated I/O ports Kernel memory corruption (UAF / OOB write) · sys/bus/isa/isahint.c:61 · pass 2 · new	kernel resource bookkeeping corruption (inverted rle/rman ranges, overlapping/double-claimed I/O ports)	reproduced fixed
DF-2695	Medium	3.3	sys_sendfile() copies out 8 bytes of uninitialized kernel stack (off_t sbytes) on every failing sendfile(2) — unprivileged kernel-pointer leak Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_syscalls.c:1594 · pass 2 · new	leak	reproduced fixed
DF-2780	Medium	3.3	p_mqueue_cnt accounting broken across fork(): decrement runs in the last-reference closer (not the opener) while fork zeroes the child's counter — u_int underflow defeats the '== mq_open_max' check, and the open-existing path has no check at all Base system — kernel core (kern) · sys/kern/sys_mqueue.c:384 · pass 2 · new	dos	reproduced fixed
DF-2854	Medium	3.3	sysctl_rman (hw.bus.rman) leaks uninitialized kernel stack beyond DF-0092's padding: r_devname/rm_descr bytes after the NUL (up to 31/entry, incl. live kernel pointers) exported to unprivileged readers Kernel memory leaks / uninitialized disclosure · sys/kern/subr_rman.c:653 · pass 2 · new	leak	reproduced fixed
DF-2867	Medium	3.3	ktrsyscall copies the unfetched argument tail of sysmsg.extargs into the trace file: unprivileged self-tracing leaks stale kernel-stack words (groom-echo + kernel-canonical pointers) from failed stack-argument fetches Privilege escalation (general use) · sys/kern/kern_ktrace.c:111 · pass 2 · new	leak	reproduced fixed
DF-2925	Medium	3.3	Uninitialized kernel stack stored into accounting state and disclosed via "get usage all" (ac_limit/ac_bytes/space) Base system — kernel core (kern) · sys/kern/vfs_quota.c:249 · pass 2 · new	leak	reproduced fixed
DF-3534	Medium	3.3	ng7 ng_tty: ngt_shutdown() never drops the constructor node reference — every ng_tty node ever created leaks Base system — network stack · sys/netgraph7/tty/ng_tty.c:553 · pass 2 · new	leak	reproduced fixed
DF-3999	Medium	3.3	Record channels are bound to PLAY hw numbers by the 1-play-channel registration: slot = (num-5)*2 yields -8/-6/-4/-2 and +8/+10 against the 2-entry rec frame, so every EMLDMARD reads kernel memory from BEFORE and PAST the record DMA buffer — unconditional at offset 0 on the FIRST record channel Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/envy24ht.c:2494 · pass 2 · new	leak	reproduced fixed
DF-5146	Medium	3.3	DRM hash tables collapse to a single bucket on 64-bit: linux-compat hash_64() is identically zero for bits<=32 (O(n²) drm_ht behavior, local DoS) Base system — drivers · sys/dev/drm/drm_hashtab.c:80 · pass 2 · new	dos	reproduced fixed
DF-5305	Medium	3.3	strlcpy() from non-NUL-terminated VS_FORMAT_FRAME_BASED bGuidFmt: kernel heap OOB read past the cdesc allocation, disclosed to unprivileged userspace via VIDIOC_ENUM_FMT Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/uvc/uvc_drv.c:1888 · pass 2 · new	leak	reproduced fixed
DF-2622	Low	3.3	One-byte stack out-of-bounds read in hammer2_vfs_mount label parsing for empty or '@'-only device strings Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:1012 · pass 2 · new	none	reproduced fixed
DF-2629	Low	3.3	hammer2_vop_setattr applies va_mtime with no owner/VA_UTIMES_NULL privilege check (divergence from the VFS contract UFS enforces) Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:561 · pass 2 · new	none	reproduced fixed
DF-2746	Low	3.3	sys_mincore() off-by-one: kernel writes one NUL byte below the user-supplied vec pointer; vecindex/lastvecindex truncate at 8TB ranges Kernel memory corruption (UAF / OOB write) · sys/vm/vm_mmap.c:829 · pass 2 · new	none	reproduced fixed
DF-2756	Low	3.3	vn_read has no VDIR gate: read() on a directory fd is dispatched to VOP_READ, and ffs_read explicitly accepts VDIR, exposing raw directory blocks (deleted-entry residue) instead of returning EISDIR Base system — kernel core (kern) · sys/kern/vfs_vnops.c:749 · pass 2 · new	leak	reproduced fixed
DF-2765	Low	3.3	journal_nrename records both path leaves after cache_rename mutated the namecache: PATH1==PATH2==target and the source path is never journaled Base system — kernel core (kern) · sys/kern/vfs_jops.c:1318 · pass 2 · new	none	reproduced fixed
DF-2783	Low	3.3	IPC_STAT (and dead SEM_STAT) copy out live kernel heap pointer sem_base to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/kern/sysv_sem.c:431 · pass 2 · new	leak	reproduced fixed
DF-2784	Low	3.3	Missing SEMAEM enforcement: un_adjval (short) signed overflow in semundo_adjust flips semexit's clamp branch — deterministic wrong undo application Base system — kernel core (kern) · sys/kern/sysv_sem.c:244 · pass 2 · new	none	reproduced fixed
DF-2836	Low	3.3	sonewconn_faddr() inherits the listener's entire so_state — accepted connections born half-shut (SS_CANTSENDMORE/SS_CANTRCVMORE/SS_ASYNC) after listener shutdown Base system — kernel core (kern) · sys/kern/uipc_socket2.c:383 · pass 2 · new	dos	reproduced fixed
DF-2838	Low	3.3	sotoxsocket()/ssbtoxsockbuf() never initialize structure padding — net.inet.tcp.pcblist leaks 8 uninitialized kernel-stack bytes per record to unprivileged users (incl. kernel-pointer halves) Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_socket2.c:188 · pass 2 · new	leak	reproduced fixed
DF-2883	Low	3.3	kvsscanf 'x'-pushback under-advance at exact end-of-input: stale byte re-consumed (parse divergence from userland scanf, double-counted nread) Base system — kernel core (kern) · sys/kern/subr_scanf.c:487 · pass 2 · new	none	reproduced fixed
DF-2955	Low	3.3	fattime2timespec: 32-bit unsigned DAY*day multiply wraps — every valid FAT date 2106-02-08..2107-12-31 decodes ~55.7 years in the past (2107-12-31 → 1971-11-23) Privilege escalation (general use) · sys/kern/subr_fattime.c:233 · pass 2 · new	none	reproduced fixed
DF-2956	Low	3.3	timespec2fattime: post-2107 timestamps silently wrap the 7-bit FAT year field and truncate t2 64→32 bits — far-future utimes() persisted as arbitrary plausible dates (year-4.4M stored as 2023-11-23) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_fattime.c:157 · pass 2 · new	none	reproduced fixed
DF-3112	Low	3.3	HAMMER1 ioctl dispatcher: 9 commands overwrite the caps_priv_check(SYSCAP_NOVFS_IOCTL) gate result and execute for unprivileged users (DF-0815 class on HAMMER1) Privilege escalation (general use) · sys/vfs/hammer/hammer_ioctl.c:72 · pass 2 · new	none	reproduced fixed
DF-3114	Low	3.3	hammer_ioc_gethistory ATKEY: ++cursor.key_beg.key signed-overflow at HAMMER_MAX_KEY wraps to INT64_MIN (full history disclosed for a past-EOF key); obj_type default EINVAL silently overwritten Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_ioctl.c:296 · pass 2 · new	none	reproduced fixed
DF-3147	Low	3.3	cd9660_readdir returns uninitialized idp->uio_off as the directory offset: 8 bytes of stale kernel heap disclosed to unprivileged users via lseek(SEEK_CUR) after a short getdents Kernel memory leaks / uninitialized disclosure · sys/vfs/isofs/cd9660/cd9660_vnops.c:447 · pass 2 · new	leak	reproduced fixed
DF-3162	Low	3.3	revoke(2) on a FIFO silently does nothing (DTYPE_VNODE vs DTYPE_FIFO mismatch) Base system — filesystems · sys/vfs/fifofs/fifo_vnops.c:442 · pass 2 · new	none	reproduced fixed
DF-3226	Low	3.3	ctl DETACH is exempt from all authorization: any same-euid bystander can rip a victim out of an active tracer's session (clear P_TRACED, delete pending SIGTRAP, reparent, unstop); wakeup(curp) also never wakes a blocked CTL_WAIT tracer Privilege escalation (general use) · sys/vfs/procfs/procfs_ctl.c:122 · pass 2 · new	none	reproduced fixed
DF-3228	Low	3.3	/dev/fuse open/close without mounting leaks struct fuse_mount — cdevpriv dtor skips the free on the ENODEV path Base system — filesystems · sys/vfs/fuse/fuse_device.c:38 · pass 2 · new	dos	reproduced fixed
DF-3731	Low	3.3	XPT_PATH_INQ max_target off-by-one: CAM probes target 15 into the 15-entry ciss_logical rows (recurring OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/ciss/ciss.c:2956 · pass 2 · new	dos	reproduced fixed
DF-4280	Low	3.3	CCDIOCCLR busy-guard is unsatisfiable (permanent make_only_dev reference): a configured ccd unit can never be unconfigured and ccd.ko can never unload Base system — drivers · sys/dev/disk/ccd/ccd.c:1434 · pass 2 · new	dos	reproduced fixed
DF-5029	Low	3.3	Unprivileged unkillable D-state sleep: pcfclock_open() requests the ppbus with bare PPB_WAIT (= PPB_WAIT\|PPB_NOINTR) on world-readable /dev/pcfclock0 Base system — drivers · sys/dev/misc/pcfclock/pcfclock.c:152 · pass 2 · new	dos	reproduced fixed
DF-5322	Low	3.3	struct tlabel leaked on every split-transaction timeout (firewire_xfer_timeout unlinks without kfree) Base system — bus / platform / cpu · sys/bus/firewire/firewire.c:348 · pass 2 · new	leak	reproduced fixed
DF-5451	Low	3.3	nexus_get_resource() leftover debug kprintf discloses kernel stack and heap pointers to unprivileged local users via console log Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/nexus.c:567 · pass 2 · new	leak	reproduced fixed
DF-5534	Low	3.3	nfs_mount() swallows nfs_mountroot() failure: failed diskless NFS-root mount reported as success -> NULL mnt_data deref (Fatal trap 12) in nfs_root instead of clean 'Root mount failed' fallback Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/autoconf.c:279 · pass 2 · new	panic	reproduced fixed
DF-5538	Low	3.3	vkernel64 fuwordadd32()/swapu32() page-tail straddle guard copy-pasted from the 64-bit twins (sizeof(uint64_t)): a 32-bit word at page offset 0xFFC that fits in-page is spuriously failed with the -1 fault sentinel — umtx_sleep(2) futexes at page tail never sleep on matching values and sleep full timeouts on a phantom -1 Base system — bus / platform / cpu · sys/platform/vkernel64/platform/copyio.c:165 · pass 2 · new	dos	reproduced fixed
DF-5630	Low	3.3	4-byte OOB read past PT_NOTE segment/page end in bsd_trans_osrel (note_overflow never bounds the descriptor) Kernel memory leaks / uninitialized disclosure · sys/cpu/x86_64/misc/elf_machdep.c:66 · pass 2 · new	none	reproduced fixed
DF-5676	Low	3.3	MATCH() preamble memcmp in _prop_object_internalize_context_alloc reads past the NUL sentinel (bounded OOB read; userland crash reproduced, kernel read page-contained on current bcmp) Kernel memory leaks / uninitialized disclosure · sys/libprop/prop_object.c:739 · pass 2 · new	dos	reproduced fixed
DF-5756	Low	3.3	Asymmetric unpaired-surrogate validation: lone low surrogates (U+DC00-DFFF) accepted as ordinary characters and re-encoded as CESU-8 (invalid UTF-8) when the output buffer permits; silent '?' substitution instead of EILSEQ-equivalent via msdosfs Base system — libkern / libprop / ddb · sys/libiconv/iconv_ucs.c:255 · pass 2 · new	none	reproduced fixed
DF-5774	Low	3.3	-n ':' / -n '' : strtok() NULL fed to strtol() crashes the vkernel during option parsing Base system — bus / platform / cpu · sys/platform/vkernel64/platform/init.c:394 · pass 2 · new	dos	reproduced fixed
DF-2825	Info	3.3	Negative l_len rejected with EINVAL instead of the POSIX [l_start+l_len, l_start-1] semantics Base system — kernel core (kern) · sys/kern/kern_lockf.c:230 · pass 2 · new	none	reproduced fixed
DF-2895	Info	3.3	sys_kenv KENV_SET ignores ksetenv() failure — variables rejected at limit boundaries (name/value of exactly KENV_M*LEN, full table) silently appear 'set' Base system — kernel core (kern) · sys/kern/kern_environment.c:164 · pass 2 · new	none	reproduced fixed
DF-2957	Info	3.3	fattime2timespec accepts out-of-range month (0, 13-15) and hour>23/minute>59 fields from crafted FAT images — no bounds validation (garbage dates, index safely masked) Base system — kernel core (kern) · sys/kern/subr_fattime.c:226 · pass 2 · new	none	reproduced fixed
DF-3163	Info	3.3	FIONREAD on an O_RDWR fifo descriptor always returns 0 (write-socket pass clobbers the answer) Base system — filesystems · sys/vfs/fifofs/fifo_vnops.c:442 · pass 2 · new	none	reproduced fixed
DF-5682	Info	3.3	prop_number_unsigned() is the only prop_number accessor without a type guard - type-confused 4-byte heap OOB read (bitfield word at +40..43 vs 40-byte prop_string) Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_number.c:379 · pass 2 · new	none	reproduced fixed
DF-5747	Info	3.3	rfcomm_bind() has no DLC state check: a live listening (or connecting) DLC can be re-bound in place, mutating its advertised channel/PSM underneath the session (NetBSD upstream added the check; DF never took it) Base system — network stack · sys/netbt/rfcomm_upper.c:104 · pass 2 · new	none	reproduced fixed
DF-2863	Low	3.2	vfs_mountroot_try ignores the ';' candidate bound when copying into mf: every root-mount candidate except the last gets a device name contaminated with the ';<tail>' of later candidates — fallback lists silently degenerate (valid candidates skipped; boot panic or wrong-device-as-root) Base system — kernel core (kern) · sys/kern/vfs_conf.c:423 · pass 2 · new	dos	reproduced fixed
DF-3300	Low	3.2	SIOCSVH accepts advbase=0 (missing lower-bound validation): advertisement interval collapses to tick rate, master-down timeout to zero Base system — network stack · sys/netinet/ip_carp.c:2463 · pass 2 · new	dos	reproduced fixed
DF-3349	Low	3.2	LACP leaks the slow-protocols multicast membership and ifma refcount on every member-port removal: if_delmulti_ifma is #if 0'd out and no equivalent cleanup exists in the tree Kernel memory corruption (UAF / OOB write) · sys/net/lagg/ieee8023ad_lacp.c:544 · pass 2 · new	none	reproduced fixed
DF-5517	Low	3.2	ubser can never clear a break: VENDOR_CLEAR_BREAK (ubser.c:102) is dead code — ubser_cfg_set_break only sends VENDOR_SET_BREAK inside 'if (onoff)', so TIOCCBRK and port close are silent no-ops and the device's line stays broken until power-cycle Base system — bus / platform / cpu · sys/bus/u4b/serial/ubser.c:102 · pass 2 · new	dos	reproduced fixed
DF-3274	Low	3.1	Use-after-free read in TX accounting: m->m_pkthdr.len read after m_freem(m) when the control queue is full Kernel memory corruption (UAF / OOB write) · sys/net/sppp/if_spppsubr.c:1318 · pass 2 · new	none	reproduced fixed
DF-2936	Low	3.0	module_register_init MOD_LOAD-failure path destroys the module registry entry while kldload(2) reports success — module lifecycle desynchronized from linker-file lifecycle (zombie module, teardown-order inversion) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_module.c:110 · pass 2 · new	none	reproduced fixed
DF-2970	Low	3.0	linesw[] registry accepts conflicting registrations and deregisters in-use disciplines with no validation — dual NETGRAPHDISC(6) registration by netgraph and netgraph7 tty modules silently aliases/strands live ttys Kernel memory corruption (UAF / OOB write) · sys/kern/tty_conf.c:105 · pass 2 · new	denial_of_service	reproduced fixed
DF-3307	Low	3.0	ip6_output(): stale exthdrs[] mbuf pointers across pfil_run_hooks() → use-after-free read+write in the fragmentation path Kernel memory corruption (UAF / OOB write) · sys/netinet6/ip6_output.c:658 · pass 2 · new	dos	reproduced fixed
DF-4624	Low	3.0	ar9285: xpdGain==0 (numXpdGain==0) executes PDADC tail backfill with k==0 — pdadcValues[-1] 1-byte OOB read below the static array replicated into all 128 PHY PDADC values, plus uninitialized minPwrT4[0] stack read Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:666 · pass 2 · new	dos	reproduced fixed
DF-4931	Low	3.0	Spread-spectrum depth clk_v computed with wrapping u32 numerators — silent wrong SS programming (sclk twin of DF-4858's terminal effect, arithmetic class) Base system — drivers · sys/dev/drm/radeon/rv740_dpm.c:166 · pass 2 · new	none	reproduced fixed
DF-5506	Low	3.0	All three amdsmb poll-loop timeouts are dead code (post-decrement off-by-one): wedged EC/SMBus controller is reported as SMB_ENOERR success with the PREVIOUS transaction's data and count after a 5.4s lock-held busy spin; SMB_ETIMEOUT is unreachable Base system — bus / platform / cpu · sys/bus/smbus/amdsmb/amdsmb.c:212 · pass 2 · new	dos	reproduced fixed
DF-5511	Low	3.0	ppb_release_bus() saves the device context after clearing ppb_owner and outside crit: cross-device chipset-mode context corruption race Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:528 · pass 2 · new	none	reproduced fixed
DF-2856	Info	3.0	Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors Kernel memory leaks / uninitialized disclosure · sys/kern/subr_rman.c:257 · pass 2 · new	leak	reproduced fixed
DF-3330	Low	2.9	hwmp_send_action takes two node references for broadcast HWMP frames (DragonFly-specific divergence): iv_bss refcount leak per broadcast PREQ/PERR/RANN Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:616 · pass 2 · new	none	reproduced fixed
DF-5554	Low	2.9	cam_calc_geometry() truncates u64 volume_size into uint32_t math — silent modular wrap of C/H/S geometry for crafted-capacity devices Base system — bus / platform / cpu · sys/bus/cam/cam.c:378 · pass 2 · new	none	reproduced fixed
DF-5284	Medium	2.8	sasetparams transmits 16 bytes of uninitialized kernel heap to the device in MODE SELECT (MTCOMP EINVAL-fallback path) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_sa.c:2757 · pass 2 · new	leak	reproduced fixed
DF-5408	Low	2.8	sys_sigreturn installs raw mc_rflags — the PSL_VM_UNSUPP strip defangs EFL_SECURE (validate-vs-install mismatch; pc64 mirror) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/cpu_regs.c:366 · pass 2 · new	none	reproduced fixed
DF-5409	Low	2.8	cpu_sanitize_frame whitelists PSL_VM_UNSUPP — the gate that blocks the DF-5335 (bad-frame-at-iretq) route is incomplete for EFLAGS.VM Privilege escalation (general use) · sys/platform/vkernel64/x86_64/cpu_regs.c:316 · pass 2 · new	none	reproduced fixed
DF-3049	Medium	2.5	s_desc_size unvalidated without the 64BIT feature — ext2_gd_csum() over-reads the group-descriptor heap allocation; console-printed crc is a kernel-heap disclosure oracle Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_vfsops.c:549 · pass 2 · new	leak	reproduced fixed
DF-4820	Medium	2.5	radeon_ring_restore() leaks the kvmalloc'd ring-backup buffer on radeon_ring_lock() failure in the GPU-reset path (repeatable kernel heap exhaustion) Base system — drivers · sys/dev/drm/radeon/radeon_ring.c:350 · pass 2 · new	dos	reproduced fixed
DF-2750	Low	2.5	lockmgr_release() multi-count blind decrement loses the grant/wakeup transition under concurrent LK_KERNTHREAD release (lost wakeup: waiter sleeps on a free lock) Base system — kernel core (kern) · sys/kern/kern_lock.c:874 · pass 2 · new	dos	reproduced fixed
DF-2865	Low	2.5	pbuf reservation counters (pfreecnt): unsynchronized check-then-decrement in getpbuf/trypbuf drives counters negative and past their caps Base system — virtual memory · sys/vm/vm_pager.c:418 · pass 2 · new	dos	reproduced fixed
DF-2886	Low	2.5	uiomovez() copyouts unbounded cnt from PAGE_SIZE-sized ZeroPage — OOB kernel heap read into userspace (latent: sole in-tree caller passes UIO_SYSSPACE) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_subr.c:241 · pass 2 · new	leak	reproduced fixed
DF-2909	Low	2.5	sys_varsym_set replace is a non-atomic remove-then-insert: concurrent same-name sets create duplicate shadowed varsym entries; invalid level values silently return success Base system — kernel core (kern) · sys/kern/kern_varsym.c:152 · pass 2 · new	corruption	reproduced fixed
DF-2966	Low	2.5	net_add_domain publishes a domain into the global domains list before net_init_domain stubs its NULL pru_* entries — a socket created in the kldload window dispatches a NULL function pointer in the netisr protocol thread (guaranteed panic) Privilege escalation (general use) · sys/kern/uipc_domain.c:137 · pass 2 · new	panic	reproduced fixed
DF-3104	Low	2.5	Unvalidated timestamp month indexes mon_lens out of bounds — kernel static .data past the 2x12 array observable via stat() mtime differences Base system — filesystems · sys/vfs/udf/udf_vnops.c:220 · pass 2 · new	leak	reproduced fixed
DF-3142	Low	2.5	hpfs_bmlookup off-by-one ('lsn > su_btotal' admits lsn == su_btotal): step-1 probe reads exactly one word past the hpm_bitmap kmalloc on exact-band volumes Base system — filesystems · sys/vfs/hpfs/hpfs_subr.c:340 · pass 2 · new	none	reproduced fixed
DF-3359	Low	2.5	rtsock message builders fully trust producer sa_len for source reads — no clamp against sizeof(sockaddr_storage) (DF-3320 residual: OOB heap read leaked to unprivileged route-socket listeners) Kernel memory corruption (UAF / OOB write) · sys/net/rtsock.c:1140 · pass 2 · new	leak	reproduced fixed
DF-3393	Low	2.5	rn_match/rn_insert/rn_delete compare loops bounded by the caller's clen(key) over-read the stored leaf-key allocation — unprivileged via RTM_GET Privilege escalation (general use) · sys/net/radix.c:328 · pass 2 · new	none	reproduced fixed
DF-4766	Low	2.5	Non-NUL-terminated arrayname[16] printed with %s: kernel stack overread disclosed through world-readable sysctl hptmv.status Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptmv/hptproc.c:375 · pass 2 · new	none	reproduced fixed
DF-5138	Low	2.5	ttm_eu_reserve_buffers() duplicate-BO (-EALREADY/dups) handling is dead code on DragonFly: the DFly ww_mutex never returns -EALREADY, so duplicate BOs from an unprivileged CS list are silently recursively double-locked and ww ticket accounting desyncs Base system — drivers · sys/dev/drm/ttm/ttm_execbuf_util.c:113 · pass 2 · new	none	reproduced fixed
DF-5201	Low	2.5	linux_task_alloc() leaks the task_struct of every pure kernel thread that evaluates `current` - no drop path exists on the kthread-exit (lwkt_exit) route Base system — drivers · sys/dev/drm/linux_sched.c:88 · pass 2 · new	leak	reproduced fixed
DF-5333	Low	2.5	chdone() CH_CCB_PROBE reads and prints uninitialized stack announce_buf[80] to console/dmesg when cherror() returns 0 for a non-CAM_REQ_CMP completion (SCSI INTERMED / RECOVERED ERROR) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ch.c:541 · pass 2 · new	leak	reproduced fixed
DF-5418	Low	2.5	ppb_peripheral_negotiate() spin post-decrement off-by-one: Event-4 timeout detection is dead code and a handshake answered on the 10th poll spuriously fails with ENODEV Base system — bus / platform / cpu · sys/bus/ppbus/ppb_1284.c:201 · pass 2 · new	none	reproduced fixed
DF-5437	Low	2.5	ulpt(4): unprivileged open(/dev/ulptN) stalled ~4s uninterruptibly by an evil printer NAKing SOFT_RESET (SIGKILL-immune) Base system — bus / platform / cpu · sys/bus/u4b/serial/ulpt.c:177 · pass 2 · new	dos	reproduced fixed
DF-5513	Low	2.5	ppb_request_bus() is not idempotent for the current owner: an owner re-request sleeps uninterruptibly forever on itself Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:464 · pass 2 · new	none	reproduced fixed
DF-5535	Low	2.5	minidump PDP-walk off-by-one: pages mapped in the last 1GB slot of kernel VA ([0xffffffffc0000000, KvaEnd)) are silently missing from every crash dump Base system — bus / platform / cpu · sys/platform/pc64/x86_64/minidump_machdep.c:238 · pass 2 · new	none	reproduced fixed
DF-5568	Low	2.5	vktimer_intr_reload(): wakeup CAS loop is dead code — unsigned (sysclock_t) delta cast makes the while-condition always false, disabling the atomic vktimer_target-lowering protocol Base system — bus / platform / cpu · sys/platform/vkernel64/platform/systimer.c:301 · pass 2 · new	none	reproduced fixed
DF-5677	Low	2.5	prop_object_release_emergency dispatches pot_emergency_free on a NULL parent when the first walk iteration breaks (CWE-476; kernel-unreachable today, userland malloc-failure edge) Base system — libkern / libprop / ddb · sys/libprop/prop_object.c:1048 · pass 2 · new	dos	reproduced fixed
DF-5695	Low	2.5	Per-CPU RC4 state machine is completely unsynchronized under LWKT preemption — the #if 0'd crit section's premise ('no one calls in ISR/ithread') is false, so syscall-context and netisr/TCP-thread consumers interleave keystream generation, producing values outside any serialized RC4 evolution Base system — libkern / libprop / ddb · sys/libkern/arc4random.c:101 · pass 2 · new	none	reproduced fixed
DF-5700	Low	2.5	libkern/bcmp.c compares with full longword loads that read up to 7 bytes outside [ptr,ptr+len) — by design, page-contained, and latent-only (file not compiled on any DFly platform) Kernel memory leaks / uninitialized disclosure · sys/libkern/bcmp.c:53 · pass 2 · new	none	reproduced fixed
DF-5702	Low	2.5	Kernel strtoq/strtouq take the 0x/0X prefix without a following hex digit, violating the C99 strtol endptr contract and diverging from DragonFly's own userland libc on the same input Base system — libkern / libprop / ddb · sys/libkern/strtoq.c:72 · pass 2 · new	none	reproduced fixed
DF-5764	Low	2.5	l2cap_start() increments lc_pending before the fallible hci_acl_send(): any failure permanently wedges the channel TX path and disables graceful disconnect, and the phantom count compounds on every retry Base system — network stack · sys/netbt/l2cap_lower.c:203 · pass 2 · new	dos	reproduced fixed
DF-2884	Info	2.5	kvsscanf silently accepts unknown conversion specifiers, desynchronizing the varargument list Base system — kernel core (kern) · sys/kern/subr_scanf.c:148 · pass 2 · new	none	reproduced fixed
DF-5407	Medium	2.4	uplcom_attach() pins the per-bus USB explore thread for up to ~70 s per insertion via 14 sequential synchronous 5 s-timeout EP0 vendor requests (uplcom_reset + uplcom_pl2303_init) that an evil PL2303 device stretches by answering each successfully at just-under-timeout Base system — bus / platform / cpu · sys/bus/u4b/serial/uplcom.c:412 · pass 2 · new	dos	reproduced fixed
DF-5367	Low	2.4	ufoma mode-switch ACK waits are uninterruptible (1s link + 15s activate): unplug racing an open/close stalls ufoma_detach()'s usb_proc_drain on the USB hub event thread for up to ~16-18s per cycle Base system — bus / platform / cpu · sys/bus/u4b/serial/ufoma.c:527 · pass 2 · new	dos	reproduced fixed
DF-5383	Low	2.4	umcs7840_cfg_open/cfg_close chain of 28/4 sequential synchronous 500ms EP0 requests: evil device stretches every port open to ~14 s and blocks close(2) and unplug (hub event thread) uninterruptibly for ~16 s per cycle Base system — bus / platform / cpu · sys/bus/u4b/serial/umcs.c:410 · pass 2 · new	dos	reproduced fixed
DF-5421	Low	2.4	uchcom cfg callbacks chain 12+2 sequential 1000ms-timeout EP0 vendor requests with no error propagation: evil CH340/CH341 stretches every tcsetattr to ~12s of ucom-taskqueue occupancy, blocking close(2) uninterruptibly and stalling the USB hub event thread on unplug (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/uchcom.c:369 · pass 2 · new	dos	reproduced fixed
DF-5424	Low	2.4	uftdi cfg callbacks chain 2+3 sequential 1000 ms-timeout EP0 vendor requests with discarded errors: evil FTDI stretches every open(2) to ~5.2 s and every tcsetattr to ~3.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) and stalling the USB hub event thread on unplug (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/uftdi.c:369 · pass 2 · new	dos	reproduced fixed
DF-5425	Low	2.4	uslcom cfg callbacks chain 3+1+1 sequential 1000 ms-timeout EP0 vendor requests with discarded errors: evil CP210x stretches every tcsetattr to ~3.1 s and every open/param/close cycle to ~5.2 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) (~8.2 s with two queued tsetattrs) and stalling the USB hub event thread on unplug (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/uslcom.c:418 · pass 2 · new	dos	reproduced fixed
DF-5455	Low	2.4	umoscom_cfg_read() returns uninitialized kernel stack on failed/short vendor control-IN; umoscom_cfg_get_status maps bits 4-7 of the stale byte into TIOCMGET modem-status bits disclosed to unprivileged userspace (evil or wedged MCS7703) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/umoscom.c:543 · pass 2 · new	leak	reproduced fixed
DF-5487	Low	2.4	uvisor cfg_close: one synchronous 1000 ms-timeout EP0 vendor control-IN with discarded error; an evil Handspring/Palm-VID:PID device stretches every close(2) to ~1 s of uninterruptible ucom-taskqueue occupancy and stalls the unplug (hub event thread) drain Base system — bus / platform / cpu · sys/bus/u4b/serial/uvisor.c:529 · pass 2 · new	dos	reproduced fixed
DF-5488	Low	2.4	uvisor_attach/uvisor_init: up to 2× synchronous 5000 ms-timeout EP0 control requests on the per-bus USB explore thread before the port exists; an evil Visor/Palm/Clie VID:PID adapter pins bus-wide device enumeration for ~5 s (10 s for SONY CLIE_35) per insertion Base system — bus / platform / cpu · sys/bus/u4b/serial/uvisor.c:326 · pass 2 · new	dos	reproduced fixed
DF-5496	Low	2.4	umct cfg callbacks chain sequential synchronous 1000 ms-timeout EP0 vendor requests with discarded errors: an evil MCT/Belkin/Sitecom adapter stretches the first-open cycle to ~4.0 s and every tcsetattr (any rate, incl. B0 — no branch) to ~2.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind the queue (measured 5.95 s with one queued tcsetattr, 8.05 s with a 5-burst; a sustained loop extends without bound) and stalling the USB hub event thread on unplug (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/umct.c:332 · pass 2 · new	dos	reproduced fixed
DF-5504	Low	2.4	ucycom cfg callbacks issue synchronous 1000 ms-timeout EP0 SET_REPORT requests with discarded errors: an evil DeLorme Earthmate stretches every open(2)/tcsetattr to ~1.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind the queue and stalling the USB hub event thread on unplug (user-amplifiable; smallest cfg-stall family member) Base system — bus / platform / cpu · sys/bus/u4b/serial/ucycom.c:438 · pass 2 · new	dos	reproduced fixed
DF-5505	Low	2.4	ucycom_attach pins the per-bus USB explore thread ~5 s per insertion via the HID report-descriptor fetch: an evil Earthmate NAKing (or slowly answering) GET_DESCRIPTOR(REPORT) stalls bus-wide device enumeration for the full USB_DEFAULT_TIMEOUT (family minimum: exactly one request) Base system — bus / platform / cpu · sys/bus/u4b/serial/ucycom.c:231 · pass 2 · new	dos	reproduced fixed
DF-5515	Low	2.4	ubser cfg-path stall: TIOCSBRK's single synchronous 1000 ms EP0 VENDOR_SET_BREAK request with discarded error pins the per-adapter ucom taskqueue 1 s per ioctl; close(2) blocks uninterruptibly behind it and unplug drains the same queue; sustained break loop = unbounded occupancy Base system — bus / platform / cpu · sys/bus/u4b/serial/ubser.c:480 · pass 2 · new	dos	reproduced fixed
DF-5516	Low	2.4	ubser_attach GET_NUMSER: first bus transaction is a synchronous 5000 ms-timeout vendor control read on the per-bus USB explore thread — an evil BWCT-string adapter pins bus-wide device enumeration ~5 s per insertion (or ~4.9 s with every request succeeding) Base system — bus / platform / cpu · sys/bus/u4b/serial/ubser.c:249 · pass 2 · new	dos	reproduced fixed
DF-5540	Low	2.4	uark cfg-chain synchronous-EP0 stall: uark_cfg_param chains six 1000 ms uninterruptible control writes whose errors are discarded — a silent/stalling ARK3116 (or unprivileged tcsetattr loop against one) parks the shared ucom taskqueue ~6.1 s per tcsetattr, blocking SIGKILL-immune close(2) behind it and stalling the USB hub event thread on unplug/detach drain (cfg-stall family, DF-5532 occupancy delta) Base system — bus / platform / cpu · sys/bus/u4b/serial/uark.c:361 · pass 2 · new	dos	reproduced fixed
DF-3199	Medium	2.3	Heap over-read in devfs_rule_create_link() disclosed as world-readable /dev link names Kernel memory leaks / uninitialized disclosure · sys/vfs/devfs/devfs_rules.c:243 · pass 2 · new	leak	reproduced fixed
DF-5402	Medium	2.3	sg(4) data-carrying SG_* ioctls are dead on DragonFly: IOC_VOID argument indirection misuse returns EFAULT for every SG_IO/SG_GET_VERSION_NUM/SG_SET_TIMEOUT/SG_GET_RESERVED_SIZE/SG_GET_SCSI_ID call Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:483 · pass 2 · new	dos	reproduced fixed
DF-2766	Low	2.3	journal_remove_all_journals never detaches: mnt_jbitmap (1024 bytes, M_JOURNAL) leaks on every journaled unmount Base system — kernel core (kern) · sys/kern/vfs_jops.c:423 · pass 2 · new	none	reproduced fixed
DF-2788	Low	2.3	callout_stop/stop_async/cancel/drain return 0 after dequeuing a pending callout: sync fast path never reads CALLOUT_PREVENTED it just caused to be set Base system — kernel core (kern) · sys/kern/kern_timeout.c:888 · pass 2 · new	none	reproduced fixed
DF-2801	Low	2.3	Namecache-reference leak on failed jail(2): pr_root handle never dropped on kern_jail error paths (deterministic via jail path = regular file) Base system — kernel core (kern) · sys/kern/kern_jail.c:206 · pass 2 · new	dos	reproduced fixed
DF-2812	Low	2.3	elf_lookup() STB_LOCAL branch returns the resolved address as the int error code and never writes *result → relocations against defined local symbols always fail (or write an uninitialized stack value) Base system — kernel core (kern) · sys/kern/link_elf.c:1003 · pass 2 · new	none	reproduced fixed
DF-2840	Low	2.3	vm.swapcache.* tunables accept unbounded/negative values, wedging the swapcache daemon state machine and burst accounting Base system — virtual memory · sys/vm/vm_swapcache.c:120 · pass 2 · new	denial_of_service	reproduced fixed
DF-2916	Low	2.3	sleepq timeout API is broken: documented sleepq_set_timeout() macro cannot compile (undefined tick_sbt/C_HARDCLOCK), sbt-vs-ticks unit confusion, and int64->int truncation into tsleep() Base system — kernel core (kern) · sys/kern/subr_sleepqueue.c:300 · pass 2 · new	denial_of_service	reproduced fixed
DF-3006	Low	2.3	nlinks double-decrement on DEVFS_RULE_RESET of a rule-created link underflows size_t and permanently leaks the target devfs node (silent, leak_count-balanced) Base system — filesystems · sys/vfs/devfs/devfs_core.c:526 · pass 2 · new	dos	reproduced fixed
DF-3161	Low	2.3	umount -f force-close never passes FREAD: fifo fifoinfo + connected socket pair leak permanently Base system — filesystems · sys/vfs/fifofs/fifo_vnops.c:610 · pass 2 · new	leak	reproduced fixed
DF-3279	Low	2.3	struct bridge_ifinfo leaked on every span-port delete (bridge_ioctl_addspan allocates it; bridge_delete_span frees only the bif) Kernel memory leaks / uninitialized disclosure · sys/net/bridge/if_bridge.c:1823 · pass 2 · new	dos	reproduced fixed
DF-3356	Low	2.3	Negative qsize survives set_fs_parms clamping: u_int-vs-int queue-limit compare in dummynet_io never fires → unbounded queue growth / kernel memory exhaustion (DF-0376 family confirmed in v3, missed by pass 1) Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:1100 · pass 2 · new	dos	reproduced fixed
DF-3378	Low	2.3	MRT6_INIT length gate uses sizeof(int *) (8) instead of sizeof(int) (4): IPv6 multicast routing cannot be enabled by any conforming daemon on 64-bit DragonFly Base system — network stack · sys/netinet6/ip6_mroute.c:426 · pass 2 · new	none	reproduced fixed
DF-3386	Low	2.3	CBQ cbq_getqstats() copies out uninitialized kernel stack: stats.handle and stats.red[3] never initialized (DF-0438's twin) Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_cbq.c:469 · pass 2 · new	leak	reproduced fixed
DF-3446	Low	2.3	Duplicate table-append leaks the radix entry: unbounded kernel memory exhaustion (48-104 bytes per rejected add) Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_table.c:168 · pass 2 · new	denial_of_service	reproduced fixed
DF-3485	Low	2.3	ng_iface (v1): first node creation panics in kfree(NULL) - bcopy() UB makes GCC drop the NULL guard on ng_iface_units Base system — network stack · sys/netgraph/iface/ng_iface.c:290 · pass 2 · new	panic	reproduced fixed
DF-3486	Low	2.3	v1 netgraph ng_eiface (and ng_iface): node constructors call if_attach()/ether_ifattach() from netisr control path - deterministic panic (self-deadlock on non-INVARIANTS) Base system — network stack · sys/netgraph/eiface/ng_eiface.c:356 · pass 2 · new	panic	reproduced fixed
DF-3526	Low	2.3	ng7 ng_iface: first node creation panics in kfree(NULL) — bcopy() UB makes GCC drop the NULL guard on ng_iface_units (DF-3485's ng7 twin) Base system — network stack · sys/netgraph7/iface/ng_iface.c:296 · pass 2 · new	panic	reproduced fixed
DF-3558	Low	2.3	ng_hole getstats/clrstats/getclrstats pass msg->data to ng_findhook strcmp without validating the advertised length against what was sent — heap OOB read, deterministic heap-residue match oracle (DF-0610/DF-2600/DF-3496 class on the DF-0534 enabler) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/hole/ng_hole.c:163 · pass 2 · new	leak	reproduced fixed
DF-4479	Low	2.3	setstate(object_initialized) reports EBUSY 'Can't set state' for transitions it performed: 1046 compares against sd_initializing (the source state) instead of the requested/actual result Base system — drivers · sys/dev/raid/vinum/vinumstate.c:250 · pass 2 · new	none	reproduced fixed
DF-4485	Low	2.3	vo_get_brightness_levels leaks the _BCL ACPI evaluation buffer on every successful call (unbounded under firmware reprobe notifies) Base system — drivers · sys/dev/acpica/acpi_video/acpi_video.c:1002 · pass 2 · new	dos	reproduced fixed
DF-4593	Low	2.3	format_config() plex line records zero subdisk names — missing string-advance inside the sd loop (DragonFly-specific regression vs FreeBSD) Base system — drivers · sys/dev/raid/vinum/vinumio.c:485 · pass 2 · new	none	reproduced fixed
DF-4852	Low	2.3	dm_target_stripe_init chunk-size validation bypassed via signed int overflow: chunk sizes up to INT_MAX blocks accepted (intended cap 256 blocks / 128KB) Base system — drivers · sys/dev/disk/dm/striped/dm_target_striped.c:98 · pass 2 · new	none	reproduced fixed
DF-4858	Low	2.3	Wrong-variable store mpll_ss \|= CLK_V(clk_v) corrupts memory-clock spread-spectrum programming on RV730 (CLK_V lost from mpll_ss2, CLK_S clobbered) — typo also present in upstream Linux Base system — drivers · sys/dev/drm/radeon/rv730_dpm.c:180 · pass 2 · new	none	reproduced fixed
DF-4939	Low	2.3	if_ic: every SIOCSIFFLAGS down→up cycle leaks the ic_obuf/ic_ifbuf pair (unbounded M_DEVBUF kernel heap leak) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ic/if_ic.c:179 · pass 2 · new	leak	reproduced fixed
DF-4958	Low	2.3	led_parse() leaks the sbuf on every empty parsed spec (and on sbuf_finish error): *sb = NULL without sbuf_delete() Base system — drivers · sys/dev/misc/led/led.c:202 · pass 2 · new	leak	reproduced fixed
DF-5135	Low	2.3	TUNABLE_bool stores a 4-byte int through (int*)&_Bool_param: setting any i915 bool tunable silently corrupts the following parameters (and the registered names are mangled to KBUILD_MODNAME.<param>) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_params.c:80 · pass 2 · new	none	reproduced fixed
DF-5380	Low	2.3	usb_quirk_get_entry() all-zero key unconditionally aliases the last dynamic-quirk slot; slot allocation never clears quirks[] — dynamic quirk-table state corruption (stale quirks inherited by real device entries; all-zero ADD/REMOVE mutate live entries) Base system — bus / platform / cpu · sys/bus/u4b/quirk/usb_quirk.c:786 · pass 2 · new	none	reproduced fixed
DF-5474	Low	2.3	Stock VKERNEL64 platform does not build: kern_mib.c's __build_id_start/__build_id_end are unresolvable — vkernel64's SYSTEM_LD override drops ${ELDFLAGS} (--build-id=sha1) and never uses the platform ldscript Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/db_trace.c:75 · pass 2 · new	none	reproduced fixed
DF-5523	Low	2.3	iicsmb block entry points perform zero count validation while the only /dev/smb caller passes an uninitialized stack byte: kernel-stack junk selects the on-wire transfer length (observed 0 and 255) and is disclosed back via smbcmd.rcount Base system — bus / platform / cpu · sys/bus/iicbus/iicsmb.c:474 · pass 2 · new	leak	reproduced fixed
DF-5559	Low	2.3	iicbus_get_addr() returns uninitialized kernel stack — iic_probe() is a stack-garbage coin flip and /dev/iicN is dead-on-arrival Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:115 · pass 2 · new	none	reproduced fixed
DF-5620	Low	2.3	acpi_cst_cx_mwait_setup executes global C3-preamble side effects (cpu_mwait_cx_no_bmsts/no_bmarb) on the rejected-descriptor error path: an invalid _CST MWAIT hint still disables the system-wide C3 BM_STS check and bus-master arbitration discipline Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_cstate_machdep.c:161 · pass 2 · new	none	reproduced fixed
DF-5726	Low	2.3	DDB 'b addr,count' silently truncates the skip count (radix-16 lexer + int struct fields) — breakpoint armed but can never fire, garbage negative Count displayed Base system — libkern / libprop / ddb · sys/ddb/db_break.c:106 · pass 2 · new	none	reproduced fixed
DF-5776	Low	2.3	/dev/pci PCIOCREAD/PCIOCWRITE accept unbounded pi_reg and report success (rc=0, sentinel data) for config offsets no mechanism can decode; PCIOCGETBAR validates pbi_reg not at all Base system — bus / platform / cpu · sys/bus/pci/pci_user.c:610 · pass 2 · new	none	reproduced fixed
DF-2615	Info	2.3	kdmsg_iocom_uninit leaks the queued LNK_PING when iocom threads are gone (one kdmsg_msg per hammer2 unmount) Base system — kernel core (kern) · sys/kern/kern_dmsg.c:264 · pass 2 · new	leak	reproduced fixed
DF-2912	Info	2.3	l64_makevirginlabel unsigned underflow on tiny slices: d_abase = d_total_size - ressize (and derived d_pstop) wrap to ~2^64 when the slice is smaller than the reserved area Base system — kernel core (kern) · sys/kern/subr_disklabel64.c:465 · pass 2 · new	none	reproduced fixed
DF-5463	Info	2.3	PTIOCSETTIMEOUT signed-multiply overflow wraps softc->io_timeout negative (UB), consumed as u_int32_t CDB timeout Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_pt.c:649 · pass 2 · new	none	reproduced fixed
DF-2862	Low	2.1	Heap OOB read in vfs_mountroot_try: strncpy(mf, cp, 96) leaves the parse buffer unterminated; ksscanf's strlen() and %80s copy adjacent heap bytes into devname, which kgetdiskbyname() prints to the console Kernel memory leaks / uninitialized disclosure · sys/kern/vfs_conf.c:421 · pass 2 · new	leak	reproduced fixed
DF-5447	Low	2.1	uvscom_pre_param() inverted switch: every baud rate — including all 11 supported ones — returns EINVAL; the port can never be programmed and uvscom_cfg_param() is unreachable Base system — bus / platform / cpu · sys/bus/u4b/serial/uvscom.c:514 · pass 2 · new	dos	reproduced fixed
DF-5449	Low	2.1	uvscom cfg callbacks chain sequential 1000 ms-timeout EP0 vendor requests with discarded errors: an evil SUNTAC-VID:PID device stretches the open cycle to ~4.1 s and open+close to ~6.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune and stalling the USB hub event thread on unplug Base system — bus / platform / cpu · sys/bus/u4b/serial/uvscom.c:640 · pass 2 · new	dos	reproduced fixed
DF-5456	Low	2.1	umoscom cfg callbacks chain 14 sequential 1000 ms-timeout EP0 vendor requests with discarded errors on first open (4 param + 5 open + 3 line-state + 2 status): evil MCS7703 stretches one open(2) to ~14.2 s of uninterruptible ucom-taskqueue occupancy, blocks close(2) SIGKILL-immune behind it, stalls the USB hub event thread on unplug; every later tcsetattr adds ~4.1 s (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/umoscom.c:368 · pass 2 · new	dos	reproduced fixed
DF-5476	Low	2.1	ubsa cfg callbacks chain synchronous 1000 ms-timeout EP0 vendor requests with discarded errors: an evil Belkin/eTek/GoHubs/Peracom adapter stretches every tcsetattr to 5.1 s (7.1 s for B0) and the first-open line-state cycle to 3.0 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind it (measured 9.97 s with one queued B0 tcsetattr) and stalling the USB hub event thread on unplug (user-amplifiable) Base system — bus / platform / cpu · sys/bus/u4b/serial/ubsa.c:359 · pass 2 · new	dos	reproduced fixed
DF-4146	Medium	1.9	trinity_parse_power_table trusts unvalidated VBIOS u16 table offsets, per-state stride walk, and indexes rdev->pm.power_state[] by StateArray ucNumEntries while it is allocated for pplib ucNumStates — heap OOB reads of the BIOS image and the power_state array Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/trinity_dpm.c:1751 · pass 2 · new	dos	reproduced fixed
DF-2623	Low	1.9	hammer2_fixup_pfses kprintf uses ripdata captured before hammer2_chain_modify COW'd and released the buffer Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:2399 · pass 2 · new	none	reproduced fixed
DF-2664	Low	1.9	Vendored LZ4 r97: LZ4_decompress_safe() reads one byte past the source buffer when inputSize==0 (upstream r96/v1.9.4 guard missing) Hammer2 · sys/vfs/hammer2/hammer2_lz4.c:407 · pass 2 · new	none	reproduced fixed
DF-2678	Low	1.9	vm_page_free_contig() can leak PG_FICTITIOUS DMA-reserve pages when vm_low_phys_reserved has been lowered below the freed block Base system — virtual memory · sys/vm/vm_page.c:2868 · pass 2 · new	denial_of_service	reproduced fixed
DF-2722	Low	1.9	kstrndup() reads one byte past the maxlen-bounded source when no NUL is present Kernel memory leaks / uninitialized disclosure · sys/kern/kern_slaballoc.c:1324 · pass 2 · new	panic	reproduced fixed
DF-3005	Low	1.9	Read-after-free of cdev->si_name in devfs_destroy_related_without_flag_worker after devfs_destroy_dev_worker frees the device Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_core.c:1508 · pass 2 · new	none	reproduced fixed
DF-3343	Low	1.9	Unclamped ic_txstream*8-1 indexes const ieee80211_htrates[77] in ieee80211_media_setup — OOB read up to ~1.9KB past the array on driver/HAL misconfiguration Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211.c:1620 · pass 2 · new	none	reproduced fixed
DF-3442	Low	1.9	iface_match(): kfnmatch() on a rule-supplied, not-guaranteed-NUL-terminated via/xmit/recv interface name reads past the instruction/rule allocation Base system — network stack · sys/net/ipfw3_basic/ip_fw3_basic.c:134 · pass 2 · new	none	reproduced fixed
DF-3455	Low	1.9	NOL/CAC timeout arithmetic is signed-overflow and tick-wrap unsafe: sysctl ints multiplied by 1000 overflow (UB) and dfs_timeout adds NOL_TIMEOUT before the wrap-aware compare — radar'd channels can be released from the NOL immediately Base system — network stack · sys/netproto/802_11/wlan/ieee80211_dfs.c:57 · pass 2 · new	denial_of_service	reproduced fixed
DF-3564	Low	1.9	SipHash_SetKey retains verbatim 128-bit key on the stack without zeroization Base system — crypto · sys/crypto/siphash/siphash.c:71 · pass 2 · new	none	reproduced fixed
DF-5042	Low	1.9	adv_pci_attach leaks parent_dmat on the adv_init() and IRQ failure unwinds — init_level is bumped to the ccb_infos teardown tier after creating parent_dmat Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/adv_pci.c:202 · pass 2 · new	none	reproduced fixed
DF-5043	Low	1.9	adv_pci_attach leaves the active IRQ resource allocated when bus_setup_intr() fails after bus_alloc_resource(SYS_RES_IRQ) succeeded Base system — drivers · sys/dev/disk/advansys/adv_pci.c:286 · pass 2 · new	none	reproduced fixed
DF-5171	Low	1.9	vcdstrategy() panics on BUF_CMD_FLUSH/BUF_CMD_FREEBLKS — mounting a HAMMER filesystem on a vcd-backed volume kills the vkernel inside mount(2) Base system — drivers · sys/dev/virtual/vkernel/cdrom/vcd.c:154 · pass 2 · new	panic	reproduced fixed
DF-5450	Low	1.9	nexus_activate_resource() is not idempotent: re-activation of an active MMIO resource double-maps and orphans kernel_map KVA + RW PTEs; no mapping rollback on activation failure Base system — bus / platform / cpu · sys/platform/pc64/x86_64/nexus.c:427 · pass 2 · new	leak	reproduced fixed
DF-5512	Low	1.9	ppbus_setup_intr() accepts overlapping interrupt registrations and overwrites its cookie bookkeeping: forced unregistration on bus release orphans live handlers Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:426 · pass 2 · new	none	reproduced fixed
DF-5539	Low	1.9	iicbb_print_child discloses an uninitialized kernel stack byte (and 'restores' it as the bus address) whenever the parent reset returns non-IIC_ENOADDR — reachable in-tree via lpbb's ppbus-busy path Base system — bus / platform / cpu · sys/bus/iicbus/iicbb.c:169 · pass 2 · new	leak	reproduced fixed
DF-5544	Low	1.9	uhci_pci_detach() swallows device_delete_children() failure: unconditional IRQ/IO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/uhci_pci.c:374 · pass 2 · new	panic	reproduced fixed
DF-5545	Low	1.9	xhci_pci_detach() swallows device_delete_children() failure: unconditional IRQ/MMIO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success Base system — bus / platform / cpu · sys/bus/u4b/controller/xhci_pci.c:355 · pass 2 · new	panic	reproduced fixed
DF-5546	Low	1.9	Forced-polling mode leaks the pci_alloc_1intr MSI allocation on every xhci attach/detach cycle (release gated on a never-created IRQ resource) Base system — bus / platform / cpu · sys/bus/u4b/controller/xhci_pci.c:234 · pass 2 · new	dos	reproduced fixed
DF-5642	Low	1.9	smbus_attach unconditionally re-creates the generic child and the whole 96-address probe child set on every attach: children survive every teardown path, so each detach+re-attach cycle leaks the full set of struct bsd_device and mints duplicate remapped /dev/smbN[-XX] nodes whose forced-slave address encoding no longer matches the device it probed Base system — bus / platform / cpu · sys/bus/smbus/smbus.c:94 · pass 2 · new	dos	reproduced fixed
DF-5703	Low	1.9	Kernel strtol/strtoul take the 0x/0X prefix without a following hex digit, violating the C99 strtol endptr contract and diverging from DragonFly's own userland libc on the same input (int-width twins of DF-5702; DF-5702's fix covered only the quad twins) Base system — libkern / libprop / ddb · sys/libkern/strtol.c:70 · pass 2 · new	none	reproduced fixed
DF-2770	Info	1.9	ptcread TIOCPKT_IOCTL path ignores uiomove error: EFAULT swallowed, read() returns 0 (EOF-like) with control byte consumed Base system — kernel core (kern) · sys/kern/tty_pty.c:718 · pass 2 · new	none	reproduced fixed
DF-2787	Info	1.9	mtx_notlocked_ex() returns the exact opposite of its documented contract (inverted exclusive-lock test in shipped header) Base system — kernel core (kern) · sys/kern/kern_mutex.c:436 · pass 2 · new	none	reproduced fixed
DF-2794	Info	1.9	sys_lwp_rtprio() with tid == -1 ignores the target pid and always operates on the caller's own lwp Privilege escalation (general use) · sys/kern/kern_resource.c:588 · pass 2 · new	none	reproduced fixed
DF-2933	Info	1.9	xio_init_kbuf: size_t→int truncation of kbytes at kern_xio.c:121 corrupts xio_bytes negative while returning success Base system — kernel core (kern) · sys/kern/kern_xio.c:119 · pass 2 · new	none	reproduced fixed
DF-2962	Info	1.9	kobj API robustness gaps: double kobj_init() silently leaks a permanent class reference (pins KLD class+ops forever), kobj_delete() on an uninitialized/deleted object NULL-derefs obj->ops->cls, and cyclic baseclass graphs recurse without bound Base system — kernel core (kern) · sys/kern/subr_kobj.c:137 · pass 2 · new	none	reproduced fixed
DF-3565	Info	1.9	Kernel DES weak/semi-weak key and parity checking disabled by default (des_check_key=0) Base system — crypto · sys/crypto/des/des_setkey.c:65 · pass 2 · new	none	reproduced fixed
DF-4750	Info	1.9	nmdm TIOCCDTR uses inverted mask: keeps DTR set and wipes all other modem bits Base system — drivers · sys/dev/misc/nmdm/nmdm.c:565 · pass 2 · new	none	reproduced fixed
DF-5419	Info	1.9	ppb_1284_read_id() early error returns leave the *read out-parameter uninitialized (caller consumes kernel stack on any peer-driven negotiation failure) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_1284.c:589 · pass 2 · new	none	reproduced fixed
DF-5575	Info	1.9	ppb_MS_loop() emits MS_DBRA(-1) whose branch lands on the DBRA itself — the loop body executes exactly once regardless of `iter` Base system — bus / platform / cpu · sys/bus/ppbus/ppb_msq.c:160 · pass 2 · new	none	reproduced fixed
DF-5578	Info	1.9	ufm(4): ufm_do_req() loads uninitialized stack buf[0] into *retbuf before the error check — latent DF-1062-class one-byte kernel-stack disclosure via FM_GET_STAT, contained on the current stack Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/misc/ufm.c:183 · pass 2 · new	none	reproduced fixed
DF-5679	Info	1.9	iscsi_crc32()/iscsi_crc32_ext() silently truncate size_t length to unsigned int — data-integrity contract violation for >=4GiB requests Base system — libkern / libprop / ddb · sys/libkern/icrc32.c:763 · pass 2 · new	none	reproduced fixed
DF-5714	Info	1.9	libkern/ffs.c is dead code — absent from conf/files, superseded by the cpufunc.h __builtin_ffs inline, and non-compilable in-kernel (#include <string.h> under -nostdinc); latent body machine-proven correct over the full 2^32 domain (ffsl.c twin equally dead) Base system — libkern / libprop / ddb · sys/libkern/ffs.c:33 · pass 2 · new	none	reproduced fixed
DF-5715	Info	1.9	sys/libkern/ffsl.c is dead, unlistable, and shadowed code (ffs-family tail, DF-5714 class) Base system — libkern / libprop / ddb · sys/libkern/ffsl.c:32 · pass 2 · new	none	reproduced fixed
DF-5716	Info	1.9	sys/libkern/flsl.c is dead, unlistable, and shadowed code (find-LAST-set, long) Base system — libkern / libprop / ddb · sys/libkern/flsl.c:32 · pass 2 · new	none	reproduced fixed
DF-5717	Info	1.9	sys/libkern/flsll.c is dead, unlistable, and shadowed code (find-LAST-set, long long) Base system — libkern / libprop / ddb · sys/libkern/flsll.c:32 · pass 2 · new	none	reproduced fixed
DF-5748	Info	1.9	rfcomm_detach()'s callout_active()/RFCOMM_DLC_DETACH deferred-free machinery is dead code under DragonFly's callout implementation — the documented callout-vs-detach lifetime 'safety net' never engages (misleading guard over the DF-0724 race) Base system — network stack · sys/netbt/rfcomm_upper.c:289 · pass 2 · new	none	reproduced fixed
DF-3960	Low	1.8	ar5416GetGainBoundariesAndPdadcs OOB reads on degenerate EEPROM calibration data (empty xpdGain mask, zero/inverted pier power ranges) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2371 · pass 2 · new	none	reproduced fixed
DF-3325	Low	1.7	Pre-dispatch rx-sequence check reads i_seq/i_qos past short TODS/DSTODS frames (>=24-byte length only enforced for the NODS path) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_hostap.c:551 · pass 2 · new	none	reproduced fixed
DF-4684	Low	1.1	amdgpu_fence_wait_empty: dead dma_fence_get_rcu bail — racing reader resurrects and keeps using an already-released fence (double-free tail empirically blocked by the port's refcount_inc saturation) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_fence.c:295 · pass 2 · new	none	reproduced fixed
DF-3567	Info	1.1	BF_set_key dereferences data[0] when len <= 0 (no lower-bound clamp; compiled-in dead code) Kernel memory leaks / uninitialized disclosure · sys/crypto/blowfish/bf_skey.c:80 · pass 2 · new	none	reproduced fixed
DF-3568	Info	1.1	rijndael_set_key performs no keyBits validation; invalid bits -> key overread + Nr=0 wild round-key walk Kernel memory leaks / uninitialized disclosure · sys/crypto/rijndael/rijndael-api.c:38 · pass 2 · new	none	reproduced fixed
DF-4199	Info	1.1	DCC/PTE read-bandwidth overhead factors (1 + 1/256)/(1 + 1/64)/(1 + 1/512) are C integer constant divisions that compile to *1 — the DCN1 DCC/PTE bandwidth overhead accounting is dead code Base system — drivers · sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:178 · pass 2 · new	none	reproduced fixed
DF-5605	Info	1.1	ua_mixer_set/ua_mixer_setrecsrc reentrancy dance gates on lockowned(), which on DragonFly returns true for a lock held shared by ANY thread — under a foreign-shared holder the mixer callbacks run with zero exclusion (latent; DFly-specific divergence from FreeBSD mtx_owned) Base system — bus / platform / cpu · sys/bus/u4b/audio/uaudio_pcm.c:139 · pass 2 · new	none	reproduced fixed
DF-5706	Info	1.1	memcchr.c live longword over-read (proven page-contained and result-filtered) + unreachable goto done at :102 Kernel memory leaks / uninitialized disclosure · sys/libkern/memcchr.c:83 · pass 2 · new	none	reproduced fixed
DF-4691	Info	1.0	cardbus_cis: decode_tuple_funce validates the LAN-NID length only against sizeof(nid), never against the tuple length — the card's MAC (PCI_IVAR_ETHADDR) is fabricated from stale bytes of previously parsed tuples; fepresent \|= 1<<type is a UB shift for type>=32 Kernel memory leaks / uninitialized disclosure · sys/dev/pccard/cardbus/cardbus_cis.c:278 · pass 2 · new	none	reproduced fixed
DF-5727	Low	0.8	DDB 'watch addr[,size]' — the syntax documented in ddb(4) — silently drops the size argument and always watches 4 bytes Base system — libkern / libprop / ddb · sys/ddb/db_watch.c:192 · pass 2 · new	none	reproduced fixed
DF-2806	Info	0.8	udev_event_attach returns stale ENOMEM on the success path when the device dict already exists Base system — kernel core (kern) · sys/kern/kern_udev.c:589 · pass 2 · new	none	reproduced fixed
DF-2807	Info	0.8	Short-buffer read() on /dev/udev silently drops the event and reports ENOMEM Base system — kernel core (kern) · sys/kern/kern_udev.c:846 · pass 2 · new	denial_of_service	reproduced fixed
DF-2930	Info	0.8	_systimer_init_periodic(): SYSTF_100KHZSYNC phase-sync branch is dead code (missing else-if) Base system — kernel core (kern) · sys/kern/kern_systimer.c:268 · pass 2 · new	none	reproduced fixed
DF-2937	Info	0.8	sched_setscheduler returns success (0) for invalid policies — POSIX-required EINVAL missing; silent no-op leaves processes at real-time priority Base system — kernel core (kern) · sys/kern/kern_p1003_1b.c:265 · pass 2 · new	none	reproduced fixed
DF-2974	Info	0.8	EVENTHANDLER_FAST_DEREGISTER macro is syntactically broken (missing underscore in list symbol) and the entire FAST handler API is dead code Base system — kernel core (kern) · sys/kern/subr_eventhandler.c:95 · pass 2 · new	none	reproduced fixed
DF-4779	Info	0.8	corecstat attaches on any Intel CPU outside family 06h — probe()/attach() model whitelist has no else-return, so the driver matches (e.g.) family-0x0F Pentium 4 and runs with an unassigned sc_version Base system — drivers · sys/dev/powermng/corecstat/corecstat.c:183 · pass 2 · new	none	reproduced fixed
DF-5498	Info	0.8	crom_add_simple_text() includes the 12-byte csrtext header in crc_len: crom_load()/crom_crc() read one quadlet past chunk->data[] (sub-object OOB read for 69..72-char text) and publish a spurious trailing quadlet + IEEE-1212-incorrect length in every broadcast text leaf Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:459 · pass 2 · new	none	reproduced fixed
DF-5634	Info	0.8	No struct iicbus_ivar is ever allocated for children (DF-5559's root-cause file): with DF-5559's accessor fix applied, iicbus_write_ivar returns success while silently discarding every address write Base system — bus / platform / cpu · sys/bus/iicbus/iicbus.c:44 · pass 2 · new	none	reproduced fixed
DF-5697	Info	0.8	kqsort with caller-supplied es == 0 never terminates (partition loop advances by +0) and performs an out-of-contract 8-byte access at the zero-length array's base (swapcode do-while executes once at n == 0) Base system — libkern / libprop / ddb · sys/libkern/qsort.c:48 · pass 2 · new	dos	reproduced fixed
DF-5596	Low	0.5	genassym.c no longer emits GD_CURRENTLDT consumed by standard-built global.s — shipped kernel links with a dangling undefined symbol and silently exports no gd_currentldt (C-to-asm contract guard defeated) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/genassym.c:230 · pass 2 · new	none	reproduced fixed
DF-5658	Low	0.5	vkernel64 genassym.c emits only 5 of the 26 GD_* macros global.s consumes — 13 restorable per-CPU exports (gd_currentldt, gd_reqflags, gd_common_tss, gd_savefpu, gd_fpu_lock, gd_fpending/gd_ipending/gd_spending, gd_cnt, gd_ss_eflags, gd_intr_nesting_level, gd_common_tssd, gd_tss_gdt) silently vanish from every VKERNEL64 build (DF-5596 twin at 21x scale, task_log lead confirmed) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/genassym.c:77 · pass 2 · new	none	reproduced fixed
DF-2790	Info	0.5	blist API performs no domain validation: count==0 triggers shift-by-64 UB that can clear a whole leaf or poison a live node as a terminator (bm_bighint = -1); blist_create lacks a BLIST_MAXBLKS guard (int64 radix wrap → infinite loop) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_blist.c:188 · pass 2 · new	corruption	reproduced fixed
DF-2817	Info	0.5	lwkt_token_swap() lower-bound-only KKASSERTs: <2-token invocation corrupts memory before td_toks_array in non-INVARIANTS kernels Kernel memory corruption (UAF / OOB write) · sys/kern/lwkt_token.c:952 · pass 2 · new	panic	reproduced fixed
DF-2860	Info	0.5	sglist_consume_uio() swallows all errors and unconditionally returns 0 — EFBIG/EFAULT indistinguishable from full success (dead code; upstream parity) Base system — kernel core (kern) · sys/kern/subr_sglist.c:417 · pass 2 · new	none	reproduced fixed
DF-2861	Info	0.5	_sglist_append_buf() ignores pmap_extract() failure — unmapped user addresses become physical-page-0 DMA segments instead of EFAULT (dead paths; upstream parity) Base system — kernel core (kern) · sys/kern/subr_sglist.c:125 · pass 2 · new	none	reproduced fixed
DF-2887	Info	0.5	uiomove/uiomovez/uiomove_fromphys/ureadc walk the iovec array with no uio_iovcnt guard — OOB iov walk on any inconsistent uio Kernel memory leaks / uninitialized disclosure · sys/kern/kern_subr.c:120 · pass 2 · new	none	reproduced fixed
DF-2914	Info	0.5	dev_is_good() tests a sentinel that is never installed: dead_dev_ops is assigned to no cdev, making every dead-device fence in the kernel dead code Base system — kernel core (kern) · sys/kern/kern_conf.c:127 · pass 2 · new	none	reproduced fixed
DF-2964	Info	0.5	gptinit() accepts any CRC-self-consistent LBA1 block as a GPT header: hdr_sig ("EFI PART"), hdr_revision, and the partition-array CRC (hdr_crc_table) are never validated Base system — kernel core (kern) · sys/kern/subr_diskgpt.c:108 · pass 2 · new	none	reproduced fixed
DF-2968	Info	0.5	Kernel threads leak one td_ucred reference per exit: crhold at creation is never crfreed on the LWKT teardown path Base system — kernel core (kern) · sys/kern/kern_kthread.c:62 · pass 2 · new	none	reproduced fixed
DF-3569	Info	0.5	camellia_set_key() performs no key-length validation: on production kernels any invalid bits is silently accepted, the schedule is never generated, and camellia_encrypt/camellia_decrypt degenerate to the identity function Base system — crypto · sys/crypto/camellia/camellia-api.c:37 · pass 2 · new	none	reproduced fixed
DF-4711	Info	0.5	feed_eq_init accepts AFMT_CHANNEL counts beyond the [SND_CHN_MAX] biquad state arrays (missing bound check; sample-driven function-pointer corruption if the invariant ever breaks) Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pcm/feeder_eq.c:342 · pass 2 · new	none	reproduced fixed
DF-5045	Info	0.5	sili OS-glue lock lifecycle asymmetry: three of four per-port locks are never uninited, and the port-alloc error unwinds lockuninit() a never-lockinit'ed ap_lock Base system — drivers · sys/dev/disk/sili/sili_dragonfly.c:198 · pass 2 · new	none	reproduced fixed
DF-5485	Info	0.5	GAS AccessWidth enumeration treated as a byte count: spec-legal dword _PCT GAS rejected ('Invalid control register GAS'), P-state domain permanently dead, cpufreq silently unavailable; qword misread as 4 bytes Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_pstate_machdep.c:564 · pass 2 · new	none	reproduced fixed
DF-5597	Info	0.5	ioapic_irqs[] stride invariant (sizeof(struct ioapic_irqinfo) == 1 << IOAPIC_IRQI_SZSHIFT) enforced only by a comment while genassym publishes both halves to different assembly consumers Base system — bus / platform / cpu · sys/platform/pc64/x86_64/genassym.c:273 · pass 2 · new	none	reproduced fixed
DF-5627	Info	0.5	ppb_get_epp_protocol() discards the BUS_READ_IVAR error and returns an uninitialized uintptr_t — stale kernel-stack bytes when the parent fails/omits the ivar (feeds mode2xfer's panic or wrong-protocol selection) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_base.c:100 · pass 2 · new	none	reproduced fixed
DF-5659	Info	0.5	vkernel64 global.s:77-93 exports 8 gd_CMAP/gd_PMAP1/gd_CADDR/gd_PADDR1 aliases via GD_PRV_* macros for fields that DO NOT EXIST in the vkernel64 struct privatespace — un-restorable silent-vanish dangles (stale i386 lineage, absent even from the pc64 twin) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/genassym.c:77 · pass 2 · new	none	reproduced fixed
DF-5667	Info	0.5	vkernel64 is_globaldata_space() blesses all SMP_MAXCPU(256) reserved per-CPU slots while only ncpus are ever mapped — kernacc() returns TRUE for ~7.9MB of unmapped KVA (latent panic landmine for any direct kernacc consumer; /dev/kmem saved only by kvm_access_check's PTE-loop ordering) Base system — bus / platform / cpu · sys/platform/vkernel64/platform/globaldata.c:84 · pass 2 · new	none	reproduced fixed
DF-5692	Info	0.5	kfnmatch() diverges from userland fnmatch(3) in four machine-demonstrated ways — MAXNEST>=20-star silent FNM_NOMATCH, trailing-backslash literal, signed-char bracket ranges, PATHNAME-unterminated-bracket hard fail Privilege escalation (general use) · sys/libkern/fnmatch.c:51 · pass 2 · new	none	reproduced fixed
DF-5698	Info	0.5	Kernel inet_ntop never sets errno — its own documented 'NULL (see errno)' contract is unimplemented Base system — libkern / libprop / ddb · sys/libkern/inet_ntop.c:51 · pass 2 · new	none	reproduced fixed
DF-5510	Low	0.4	Length-confused class-token search in ppb_pnp_detect(): OOB stack read past str[PPB_PnP_STRING_SIZE+1] and cross-field PnP class misclassification Kernel memory leaks / uninitialized disclosure · sys/bus/ppbus/ppbconf.c:278 · pass 2 · new	none	reproduced fixed
DF-2650	Medium	—	KKASSERT(radix != 0) in h2_bulkfree_callback — deterministic unprivileged kernel panic from a radix-0 on-disk data_off Hammer2 · sys/vfs/hammer2/hammer2_bulkfree.c:847 · pass 2 · new	panic	reproduced fixed
DF-2731	Medium	—	sys_extpread/sys_extpwrite/sys_extpreadv/sys_extpwritev accept negative offsets — unprivileged kernel panic on ext2 (INVARIANTS), POSIX EINVAL missing Base system — kernel core (kern) · sys/kern/sys_generic.c:153 · pass 2 · new	panic	reproduced fixed
DF-3037	Medium	—	msdosfs doscheckpath() unbounded ".." ancestor walk — rename(2) kernel livelock wedging the whole system (crafted FAT ".." cycle) Base system — filesystems · sys/vfs/msdosfs/msdosfs_vnops.c:1045 · pass 2 · new	dos	reproduced fixed
DF-5704	Medium	—	equals-walk type-mismatch early return abandons the _prop_stack: every ancestor's rwlock leaks permanently and (>=17 deep) each kmalloc'd extern element leaks — violation of the stack's pop-to-empty/pot_equals_finish contract Base system — libkern / libprop / ddb · sys/libprop/prop_stack.c:49 · pass 2 · new	dos	reproduced fixed
DF-1869	Critical	9.8	Remote kernel heap overflow in scsi_decap via attacker-controlled Data-In buffer offset (write-what-where) Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi_subr.c:566	corruption	reproduced fixed
DF-2458	Critical	9.8	Target-controlled buffer offset in scsi_decap gives malicious iSCSI target an arbitrary-offset kernel heap write Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:143	panic	reproduced fixed
DF-0569	High	9.8	Heap OOB write via byte-swapped alias_port used as array index: every NAT deployment corrupts heap ~1.6% of connections Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_nat/ip_fw3_nat.c:436	panic	reproduced fixed
DF-0393	Critical	9.6	Remote heap buffer overflow via oversized Mesh ID IE in sta_add: memcpy 2+meshid[1] into se_meshid[34] with no bounds check Kernel memory corruption (UAF / OOB write) · CVE-2022-23088 · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:310	panic	reproduced fixed
DF-1870	High	9.1	Remote kernel heap OOB read / info leak in iscsi_r2t via attacker-controlled R2T transfer length Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi_subr.c:79	leak	reproduced fixed
DF-0631	High	9.0	Use-after-free on ipfw3_state->stub after the owning rule is deleted Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_state.c:210	dos	reproduced fixed
1083	High	8.8	Off-by-one in CROM_MAX_DEPTH check in crom_next() allows stack OOB write of 12 bytes Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwcrom.c:115	panic	reproduced fixed
DF-0616	High	8.8	Heap buffer overflow in generic_netmap_rxsync: unbounded m_copydata into fixed-size netmap buffer Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_generic.c:669	heap-oob-write	reproduced fixed
DF-0677	High	8.8	sl_compress_init heap overflow via unvalidated max_state from PPP IPCP negotiation Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/net/ppp_layer/slcompress.c:69	corruption	reproduced fixed
DF-0753	High	8.8	Stale mbuf pointer after mpls_output may reallocate — use-after-free/double-free when route has PUSH op Kernel memory corruption (UAF / OOB write) · sys/netproto/mpls/mpls_input.c:208	panic	reproduced fixed
DF-0981	High	8.8	Heap buffer overflow in run_bulk_rx_callback aggregated-frame path (m_getcl cluster too small for device-controlled dmalen) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_run.c:2989	heap-oob-write (hardware-gated on this guest; up to ~2035B on a run(4)-equipped host)	reproduced fixed
DF-0987	High	8.8	cdcheckmedia unbounded TOC entry count overflows softc->toc.entries[100] -> heap corruption Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_cd.c:2947	panic	reproduced fixed
DF-2012	Medium	8.8	Integer overflow in GART table_size yields undersized VRAM table and OOB write via amdgpu_gart_bind/unbind Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_gart.c:362	panic	reproduced fixed
DF-0053	High	8.4	Heap buffer overflow in sysctl_jail_list (kern.jail.list) via unsigned underflow in size arithmetic Kernel memory corruption (UAF / OOB write) · sys/kern/kern_jail.c:671	panic	reproduced fixed
DF-0165	High	8.4	caps_priv_check corrupts cap argument before prison_priv_check: bypasses per-cap jail policy (raw sockets + mounts in jail) Privilege escalation (general use) · sys/kern/kern_caps.c:333	jail-policy bypass	reproduced fixed
DF-1437	High	8.4	Heap OOB write in sumo_construct_vid_mapping_table via unchecked VBIOS usVoltageIndex Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/sumo_dpm.c:1624	panic	reproduced fixed
DF-1483	High	8.4	Integer overflow in user-fence offset check allows OOB GPU memory write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:59	panic	reproduced fixed
DF-1837	High	8.4	Heap buffer overflow in dm_helpers_read_local_edid via uncapped EDID extension count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:583	panic	reproduced fixed
DF-0362	High	8.2	pfr_fix_anchor unbounded slash-count loop causes size_t wraparound in bcopy/memset: kernel panic via DIOCRGETTABLES Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_table.c:1740	panic	reproduced fixed
DF-0449	High	8.2	Heap buffer overflow in ng_string_parse: missing *buflen bounds check before bcopy of user-supplied string Kernel memory corruption (UAF / OOB write) · sys/netgraph/netgraph/ng_parse.c:704	panic	reproduced fixed
DF-0570	High	8.2	Remote OOB read: inbound port/icmp_id indexed into alias arrays without bounds check Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_nat/ip_fw3_nat.c:204	leak	reproduced fixed
DF-0632	Medium	8.2	Per-CPU state counters never decremented: permanent state-table exhaustion DoS Base system — network stack · sys/net/ipfw3_basic/ip_fw3_state.c:317	dos	reproduced fixed
DF-2425	Low	8.2	CDB heap overflow via unchecked cdb_len into 12-byte CmdBlock Kernel memory corruption (UAF / OOB write) · sys/dev/disk/amd/amd.c:399	panic	reproduced fixed
1085	High	8.1	crom_parse_text() write-underflow when text leaf crc_len < 2 corrupts memory before the caller buffer Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwcrom.c:215	panic	reproduced fixed
DF-0351	High	8.1	uint32 metric accumulation overflow enables route poisoning / route hijacking Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1089	dos	reproduced fixed
DF-0414	High	8.1	Unchecked ph->length in PPPoE discovery packets: remote heap OOB read via get_tag/scan_tags walk bound Kernel memory leaks / uninitialized disclosure · sys/netgraph7/pppoe/ng_pppoe.c:1314	panic	reproduced fixed
DF-0624	High	8.1	OOB heap read in smb_t2_placedata via malicious TRANS2 response byte counts Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_rq.c:436	panic	reproduced fixed
DF-0733	High	8.1	acl_check walks ACL hash without lock — UAF race vs concurrent acl_remove/acl_free_all from receive path (unauth remote) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_acl/ieee80211_acl.c:161	dos	reproduced fixed
DF-0767	High	8.1	nfs_lookitup returns uninitialized nfsnode pointer when server echoes parent filehandle — wild-pointer deref in create/mkdir/mknod/symlink Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_vnops.c:3061	panic	reproduced fixed
DF-2566	High	8.1	smb_t2_placedata corrupts mbuf m_len on oversized TRANS2 count causing kernel heap OOB read and panic Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_rq.c:424	panic	reproduced fixed
DF-0117	High	8.0	UAF on kdmsg state in diskiodone: state refcount not held across async I/O Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskiocom.c:372	panic	reproduced fixed
DF-2575	High	8.0	ip_fw3_dummynet_io caches rule pointer in dn_pkt->dn_priv with no refcount rule deletion during pipe transit causes UAF read+write on reinject Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3.c:630	panic	reproduced fixed
DF-1857	High	7.9	BMP pixel/RLE decoders read data with no bounds check against file size: kernel-memory info leak + DoS Kernel memory leaks / uninitialized disclosure · sys/dev/video/fb/bmp/splash_bmp.c:80	leak:4096	reproduced fixed
DF-0783	Critical	7.8	ext2_rename writes 24 attacker-controlled bytes onto kernel stack via (caddr_t)&dirbuf — stack overflow corrupted ptr deref arbitrary free + info leak (CRITICAL) Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_vnops.c:693	panic	reproduced fixed
DF-2132	Critical	7.8	dma_buf_get returns unrefcounted pointer; caller dma_buf_put over-drops f_count causing UAF (local unpriv->root) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_dma-buf.c:174	corruption	reproduced fixed
DF-0676	High	7.8	Double-free of mbuf in XMIT_ALL error path via NG_FREE_ITEM + NG_FREE_M on a peeked (non-detached) mbuf Kernel memory corruption (UAF / OOB write) · sys/netgraph7/one2many/ng_one2many.c:425	corruption	reproduced fixed
DF-0754	High	7.8	mpls_output() takes mbuf by-value but helpers silently reallocate head — root cause of DF-0753, also manifests in mpls_output_process double-free/leak + ip_output stale-m Kernel memory corruption (UAF / OOB write) · sys/netproto/mpls/mpls_output.c:50	panic	reproduced fixed
DF-0763	High	7.8	Missing on-disk radix validation in chain allocation — malicious filesystem image radix 17-31 causes heap OOB read/write via bcopy/hash/CRC/array iteration Hammer2 · triaged · 👤 dillon · 💬 1 · sys/vfs/hammer2/hammer2_chain.c:189	panic	reproduced fixed
DF-0776	High	7.8	Missing production bounds validation on B-tree node count/type — crafted image heap OOB read/write via bcopy element shift Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_btree.c:818	panic	reproduced fixed
DF-0780	High	7.8	Heap buffer overflow in fuse_io_execute READ from oversized daemon reply — memcpy daemon-chosen size into fixed buffer Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vnops.c:2048	panic	reproduced fixed
DF-0803	High	7.8	Integer truncation in e2fs_gcount computation bypasses overflow check — heap OOB from crafted ext2 64bit image Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_vfsops.c:620	panic	reproduced fixed
DF-0821	High	7.8	OOB kernel heap read/write via crafted signed bmap->linear from filesystem image Hammer2 · sys/vfs/hammer2/hammer2_freemap.c:616	panic	reproduced fixed
DF-0859	High	7.8	Unbounded ab_busycnt in hpfs_splitalsec/hpfs_concatalsec/hpfs_alblk2alsec bcopy overflows alsec heap buffer Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_alsubr.c:225	corruption	reproduced fixed
DF-0861	High	7.8	hpfs_cpinit unbounded code-page inner loop writes attacker data past hpm_cpdblk allocation (heap overflow) Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_subr.c:274	panic	reproduced fixed
DF-0871	High	7.8	Heap overflow in $AttrDef name copy via unbounded wchar-to-char do/while walk Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vfsops.c:444	panic	reproduced fixed
DF-0887	High	7.8	Heap overflow in ffs_truncate symlink fast-path via unbounded bzero of attacker-controlled di_size Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_inode.c:159	panic	reproduced fixed
DF-0894	High	7.8	Crafted fs_nindir in superblock causes OOB read/write of indirect-block buffers in ffs_balloc Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_balloc.c:291	panic	reproduced fixed
DF-0901	High	7.8	Unlocked hash-bucket traversal in smbfs_node_alloc races with smbfs_reclaim freeing smbnode (UAF read) Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_node.c:203	panic	reproduced fixed
DF-0903	High	7.8	Heap OOB write in ffs_write via crafted fs_qbmask (missing xfersize bounds check present in ffs_read) Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_readwrite.c:292	panic	reproduced fixed
DF-0912	High	7.8	fuse_audit_length validates daemon-claimed ohd->len (with integer underflow) instead of actual buffer size, unconditionally passes 3 opcodes Kernel memory leaks / uninitialized disclosure · sys/vfs/fuse/fuse_util.c:87	leak:80	reproduced fixed
DF-0915	High	7.8	fuse_device_write trusts daemon ohd->len over actual write size yielding heap OOB read and overflow write Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_device.c:182	panic	reproduced fixed
DF-0994	High	7.8	sastart ERR_PENDING drain uses stale bio pointer after goto again -> double biodone, queue corruption, bio UAF Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sa.c:1601	panic	reproduced fixed
DF-1209	High	7.8	r100_packet3_load_vbpntr unsigned underflow on c==0 yields unbounded heap OOB writes via CS ioctl Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r100.c:1315	panic	reproduced fixed
DF-1442	High	7.8	INQUIRY TRIM status writes past short inquiry buffer (heap overflow during DV probe) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ahci/ahci_cam.c:1134	panic	reproduced fixed
DF-1468	High	7.8	VBIOS-supplied indices into clock-info arrays OOB read in processpptables.c Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1101	panic	reproduced fixed
DF-1469	High	7.8	VBIOS-supplied entry count trusted without validation against firmware image bounds Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:383	panic	reproduced fixed
DF-1470	High	7.8	VBIOS-supplied table offsets never validated against firmware image size Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:61	panic	reproduced fixed
DF-1634	High	7.8	Use of uninitialized heap memory in dm_target_crypt_destroy after failed init Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/crypt/dm_target_crypt.c:489	panic	reproduced fixed
DF-1719	High	7.8	amdgpu_gem: GEM_VA ioctl passes unchecked offset_in_bo/map_size into amdgpu_vm_bo_map enabling offset+size wrap to corrupt GPU page tables Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_gem.c:644	leak	reproduced fixed
DF-1753	High	7.8	radeon_vce: OOB read and OOB write of IB buffer in cs_parse/cs_reloc via unchecked multi-dword command fields Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_vce.c:565	panic	reproduced fixed
DF-1797	High	7.8	smu_helper: heap OOB write in phm_get_svi2_*_voltage_table and phm_trim_voltage_table via unchecked VBIOS count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:244	panic	reproduced fixed
DF-1805	High	7.8	bktr_os: bktr_filter_detach calls knote_insert instead of knote_remove -> UAF via corrupted klist Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_os.c:724	panic	reproduced fixed
DF-1880	High	7.8	Heap OOB write in oce_hw_update_multicast: loop guard uses 64 but mac[] array has 32 slots Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_hw.c:568	panic	reproduced fixed
DF-1881	High	7.8	UAF / double-free in reservation RCU readers via unsafe dma_fence_get_rcu shim and non-RCU dma_fence_free Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_reservation.c:357	panic	reproduced fixed
DF-1912	High	7.8	mdstrategy_preload uses stale buf pointer across biodone: UAF + OOB bcopy on preloaded md image Kernel memory corruption (UAF / OOB write) · sys/dev/disk/md/md.c:349	panic	reproduced fixed
DF-1917	High	7.8	Unbounded sgl_off yields OOB SGE write into cmd->frame DMA allocation Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:219	panic	reproduced fixed
DF-1918	High	7.8	Unbounded sense_off yields OOB pointer-sized write into cmd->frame Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:266	panic	reproduced fixed
DF-1919	High	7.8	Integer truncation size_t->int in iov_len splits DMA alloc size from copyin size: heap overflow Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:161	panic	reproduced fixed
DF-2051	High	7.8	DFS_GET_THRESH writes sizeof(HAL_PHYERR_PARAM) into outdata without validating allocation or size (heap overflow / NULL-deref write) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_dfs/null/dfs_null.c:268	panic	reproduced fixed
DF-2195	High	7.8	kthread_stop() frees the LWKT thread via a bogus timed tsleep, causing use-after-free / double-free of struct thread Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_kthread.c:97	corruption	reproduced fixed
DF-2446	High	7.8	dm_message_ioctl frees and dereferences an uninitialized stack msg pointer Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_ioctl.c:1006	panic	reproduced fixed
DF-2461	High	7.8	i_prepPDU truncates PDU length to u_int and maxBurstLength accepts negative values enabling kernel heap overflow via ISCSISEND Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:291	panic	reproduced fixed
DF-2494	High	7.8	BSS out-of-bounds write on global ata_raid_arrays[] via untrusted LSI v2 raid_number Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:2802	none	reproduced fixed
DF-2495	High	7.8	Kernel stack/heap OOB write via untrusted total_disks in ata_raid_create and ata_raid_status ioctls Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:1051	none	reproduced fixed
DF-2580	High	7.8	Missing bounds check on table id gives controlled kernel heap OOB read/write on every ipfw3 table opcode Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_table.c:92	panic	reproduced fixed
DF-2583	High	7.8	Unvalidated parent->bytes yields OOB blockref array access during flush Hammer2 · sys/vfs/hammer2/hammer2_flush.c:1094	panic	reproduced fixed
DF-2605	High	7.8	Missing radix validation in hammer2_chain_alloc causes OOB read/write from crafted filesystem image Hammer2 · sys/vfs/hammer2/hammer2_chain.c:189	panic	reproduced fixed
DF-1088	Medium	7.8	No validation/stripping of dangerous user CCB flags allows privileged DMA to arbitrary physical memory and OOB reads Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_pass.c:546	none	reproduced fixed
DF-1010	Low	7.8	fwohci_ioctl performs privileged OHCI register/PHY/DMA operations without priv_check_cred Privilege escalation (general use) · sys/bus/firewire/fwohci.c:333	none	reproduced fixed
DF-1046	High	7.6	uint8_t loop-counter wrap in uvc_ctrl_init_dev causes unbounded kernel heap overflow from malicious USB descriptor Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_ctrls.c:917	corruption	reproduced fixed
DF-0017	High	7.5	Unbounded recursion in kdmsg_simulate_failure overflows the kernel thread stack (remote DoS) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_dmsg.c:1321	panic	reproduced fixed
DF-0417	High	7.5	Use-after-free race on nd_defrouter: defrtrlist_update returns unreferenced pointer consumed unlocked across RA prefix loop Kernel memory corruption (UAF / OOB write) · sys/netinet6/nd6_rtr.c:285	panic	reproduced fixed
DF-0617	High	7.5	Use-after-free in ng_ether_rcv_upper: bridge_input_p() return value discarded, freed mbuf fed to ether_demux_oncpu Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ether/ng_ether.c:657	dos	reproduced fixed
DF-0630	High	7.5	udp6_ctlinput returns without lwkt_replymsg, deadlocking the netisr on a single crafted ICMPv6 packet Base system — network stack · sys/netinet6/udp6_usrreq.c:434	dos	reproduced fixed
DF-0740	High	7.5	gre_input2 missing packet length validation — m_len/m_pkthdr.len underflow from crafted GRE option flags (no checksum verification) Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_gre.c:148	panic	reproduced fixed
DF-0945	High	7.5	swapoff_one mutates global swapblist without vm_token, racing with concurrent page-out (blist corruption / UAF on resize) Kernel memory corruption (UAF / OOB write) · sys/vm/swap_pager.c:536	dos	reproduced fixed
DF-2459	High	7.5	Re-queued NOP-IN PDU in _nop_in causes bcopy(NULL) panic in isc_sendPDU Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:212	panic	reproduced fixed
DF-2460	High	7.5	_reject dereferences pq->mp without NULL check panicking on data-less REJECT from malicious target Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:87	panic	reproduced fixed
DF-0571	Medium	7.5	kernel panic on any non-TCP/UDP/ICMP packet hitting NAT rule Base system — network stack · sys/net/ipfw3_nat/ip_fw3_nat.c:219	panic	reproduced fixed
DF-0730	Medium	7.5	ra_rate_thresh[3][8] heap OOB read/write — indexed up to rs_nrates-1(14) from remote peer rates IE Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_rssadapt.c:241	heap-oob-rw (latent)	reproduced fixed
DF-0743	Medium	7.5	struct greip/mobip_h overlay assumes ip_hl==5 — IP options make all GRE/mobile header reads use wrong offset compounds DF-0740 Base system — network stack · sys/netinet/ip_gre.c:133	misparse/dos	reproduced fixed
DF-1352	Medium	7.5	Heap overflow via unbounded device-supplied event_info_size in virtio-scsi Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/virtio/scsi/virtio_scsi.c:301	panic	reproduced fixed
DF-0572	High	7.4	Per-CPU cfg_nat pointer cached in shared firewall rule: cross-CPU RB-tree races -> corruption Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_nat/ip_fw3_nat.c:158	dos	reproduced fixed
DF-1716	High	7.4	ata-pci: out-of-bounds interrupt[] write/read when AHCI reports >8 channels -> kernel heap corruption + RIP control on next IRQ Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-pci.c:230	panic	reproduced fixed
DF-1737	High	7.4	ata-lowlevel: heap OOB write via unchecked ATAPI byte-count register polluting request->donecount Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-lowlevel.c:329	panic	reproduced fixed
DF-0768	Medium	7.4	nfs_readdirplusrpc_uio signed-overflow in nfsm_rndup(i) corrupts RPC reply cursor — kernel memory info leak via getdents or panic Privilege escalation (general use) · sys/vfs/nfs/nfs_vnops.c:2924	panic	reproduced fixed
DF-0564	Low	7.4	DLCI array access lacks local bounds check — ng7 twin of DF-0556 Base system — network stack · sys/netgraph7/lmi/ng_lmi.c:690	panic	reproduced fixed
DF-0074	High	7.3	DIOCGSLICEINFO heap buffer overflow via crafted GPT disk image (dss_nslices > MAX_SLICES) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskslice.c:556	panic	reproduced fixed
DF-0141	High	7.3	Missing privilege check in sys_vquotactl: any user can set/read all quotas Privilege escalation (general use) · sys/kern/vfs_quota.c:328	dos	reproduced fixed
DF-0795	High	7.3	Stack buffer overflow in VFAT long-filename reassembly via crafted FAT directory entry — no kernel stack canary Kernel memory corruption (UAF / OOB write) · sys/vfs/msdosfs/msdosfs_vnops.c:1662	corruption	reproduced fixed
DF-2114	Medium	7.3	ata_serialize() clobbers PCI bus pci_devinfo ivar on controller device -- heap OOB read + cross-device PCI config corruption on ATP850R Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/chipsets/ata-acard.c:206	corruption	reproduced fixed
DF-2300	Medium	7.3	Missing privilege check in FWOHCI_WRREG/RDREG ioctl allows operator-group users to write arbitrary OHCI hardware registers Privilege escalation (general use) · sys/bus/firewire/fwohci.c:354	limited_write	reproduced fixed
DF-2522	Medium	7.3	trm_SRBdone auto-sense bcopy uses user-controlled sense_len to copy out of 32-byte DMA slot and into 32-byte csio field (heap OOB read+write via pass(4)) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:2529	leak	reproduced fixed
DF-0473	High	7.2	ip_fw3_chk: unbounded filter_funcs[module][opcode] indexing -> OOB function pointer call on remote traffic Base system — network stack · sys/net/ipfw3/ip_fw3.c:506	panic	reproduced fixed
DF-0638	High	7.1	Decompress path avail_in integer underflow feeds OOB heap reads to inflate() from crafted PPP frame Kernel memory corruption (UAF / OOB write) · sys/netgraph7/deflate/ng_deflate.c:539	leak	reproduced fixed
DF-0769	High	7.1	hammer_vop_readdir OOB kernel-heap read / info leak via forged direntry data_len underflow Privilege escalation (general use) · sys/vfs/hammer/hammer_vnops.c:1728	panic (GENERIC/INVARIANTS ON); ~49160-byte kernel-heap info leak (production/INVARIANTS OFF)	reproduced fixed
DF-0781	High	7.1	Kernel heap info leak via unvalidated namelen in fuse_vop_readdir — bcopy past reply buffer + len underflow wild ptr Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vnops.c:1066	leak	reproduced fixed
DF-0811	High	7.1	OOB kernel heap write in ext2_cg_block_bitmap_init via buggy ext2_block_in_group divisor — setbit at wild offset Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_alloc.c:856	panic	reproduced fixed
DF-0812	High	7.1	Unvalidated redo_data_bytes in HAMMER REDO recovery leaks kernel memory / panics on mount of crafted image Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_recover.c:1296	panic	reproduced fixed
DF-0820	High	7.1	ffs_mountfs performs no validation of superblock geometry (fs_ncg/fs_ipg/fs_fpg/fs_fsize/fs_frag/fs_sbsize) — crafted image causes div-by-zero/infinite-loop/heap-overflow/bzero-corruption/OOB-read Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_vfsops.c:642	panic	reproduced fixed
DF-0831	High	7.1	Heap overflow in udf_getfid via negative frag_size from 4-byte FID alignment — size_t(-3) bcopy Kernel memory corruption (UAF / OOB write) · sys/vfs/udf/udf_vnops.c:543	panic	reproduced fixed
DF-0857	High	7.1	Missing ab_busycnt validation in hpfs_hpbmap allows OOB heap read via crafted fnode/alsec Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_alsubr.c:74	panic	reproduced fixed
DF-0878	High	7.1	Missing SUSP entry-length bounds check in cd9660_rrip_loop enables OOB heap read and kernel memory info leak Kernel memory leaks / uninitialized disclosure · sys/vfs/isofs/cd9660/cd9660_rrip.c:509	leak:250	reproduced fixed
DF-0888	High	7.1	ext2_indirtrunc bzero heap OOB write via ftruncate past indirect-block structural limit Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_inode.c:138	panic	reproduced fixed
DF-0914	High	7.1	ufs_bmaparray OOB read of indirect block buffer via unvalidated fs_nindir Kernel memory leaks / uninitialized disclosure · sys/vfs/ufs/ufs_bmap.c:221	panic	reproduced fixed
DF-0927	High	7.1	hpfs_genlookupbyname walks attacker dirent chain with no buffer bound, no reclen validation, and no DE_DOWN cycle guard Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_lookup.c:73	panic	reproduced fixed
DF-0932	High	7.1	LZ77 back-reference offset not bounded to current output position - heap OOB read before output buffer in NTFS decompression Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_compr.c:74	leak	reproduced fixed
DF-1754	High	7.1	radeon_vce: OOB read of p->relocs[] and wild pointer deref via non-multiple-of-4 chunk_relocs length_dw Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_vce.c:470	leak	reproduced fixed
DF-1818	High	7.1	sckmsrndr: fill_rect24 slow path over-advances draw_pos by 3*width per row writing past framebuffer mapping Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/sckmsrndr.c:438	panic	reproduced fixed
DF-2562	High	7.1	readdir trusts on-media name length as bcopy length -> kernel heap OOB read (info leak + panic) Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:702	leak:65535	reproduced fixed
1084	Medium	7.1	crom_init_context() trusts attacker-controlled info_len, allowing root-directory pointer to land past the csrrom buffer Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:67	leak:1024bytes	reproduced fixed
DF-0554	Medium	7.1	Missing min frame-length check + unsigned STEPBY underflow: kernel heap OOB read in LMI parser Kernel memory leaks / uninitialized disclosure · sys/netgraph/lmi/ng_lmi.c:552	leak:3	reproduced fixed
DF-0787	Medium	7.1	Unbounded attribute walk in ntfs_loadntnode: OOB read + infinite loop via fr_attroff/reclen==0 Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:305	panic	reproduced fixed
DF-0789	Medium	7.1	ntfs_runtovrun walks attacker run buffer with no length bound — OOB read Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:582	panic	reproduced fixed
DF-0791	Medium	7.1	Subnode dive in ntfs_ntlookupfile reads 8 bytes OOB when iep->reclen < sizeof(cn_t) or entry straddles buffer end Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:900	leak	reproduced fixed
DF-0874	Medium	7.1	Unbounded attr_indexentry walk in ntfs_readdir inner loop reads kernel heap past f_dirblbuf Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vnops.c:577	oob_read	reproduced fixed
DF-1607	Medium	7.1	Off-by-one out-of-bounds read in CMI enum-value loop Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_hp/acpi_hp.c:931	panic	reproduced fixed
DF-2142	Medium	7.1	Unbounded wire-controlled pos in dcons_checkc allows kernel OOB read / panic via FireWire peer Kernel memory corruption (UAF / OOB write) · sys/dev/misc/dcons/dcons.c:96	panic	reproduced fixed
DF-2236	Medium	7.1	iconv_xlat16_open trusts attacker-controlled cp_data size causing OOB heap read and NULL-deref panic Privilege escalation (general use) · sys/libiconv/iconv_xlat16.c:68	panic	reproduced fixed
DF-2555	Medium	7.1	Heap buffer overflow in $AttrDef name copy via unterminated wchar name Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vfsops.c:444	none	reproduced fixed
DF-0327	Low	7.1	ieee80211_ies_expand walks IE blob with no length validation: OOB read Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_node.c:982	none	reproduced fixed
DF-0745	High	7.0	Dead callout_active guard + callback-owns-free design causes double-free / TAILQ corruption race in l2cap_request_free Kernel memory corruption (UAF / OOB write) · sys/netbt/l2cap_misc.c:168	panic	reproduced fixed
DF-0843	High	7.0	Missing global lock on dirhash list enables use-after-free and list corruption across concurrent directory operations Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_dirhash.c:302	panic	reproduced fixed
DF-0884	High	7.0	Use-after-free in smbfs_readvdir via dead-code vnode lock upgrade on read(2) of directory Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_io.c:202	panic	reproduced fixed
DF-0917	High	7.0	Use-after-free on fuse_ipc during tx completion (daemon read/write drops lock before fip access) Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_ipc.c:112	panic	reproduced fixed
DF-0925	High	7.0	UAF in fuse_alloc_node races vnode reclaim (no refcount on fuse_node) Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_node.c:106	panic	reproduced fixed
DF-1416	High	7.0	Heap OOB write in power-state callback via unbounded ucNumDPMLevels Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1355	panic	reproduced fixed
DF-1640	High	7.0	Use-after-free + double-free of DM_TABLE_PARAMS string across table entries Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_ioctl.c:688	panic	reproduced fixed
DF-1749	High	7.0	amdgpu_acpi: UAF - ACPI notify handler never removed on device detach Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:369	panic	reproduced fixed
DF-1843	High	7.0	UAF in device-mapper open path: dmopen releases busy reference before open lifetime, racing dm_dev_remove_ioctl Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/device-mapper.c:209	panic	reproduced fixed
DF-1863	High	7.0	TOCTOU in amdgpu_ctx_add_fence: concurrent CS double dma_fence_put -> UAF/double-free Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:445	panic	reproduced fixed
DF-1927	High	7.0	UAF race in drm_sched_entity_fini: broken kthread_park allows concurrent scheduler pop_job during entity teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/scheduler/sched_entity.c:273	panic	reproduced fixed
DF-2188	High	7.0	vmap_list traversed and mutated without consistent lock; races yield list corruption UAF and double-free Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_vmalloc.c:64	corruption	reproduced fixed
DF-2206	High	7.0	iounmap() walks the global iomap_list without iomap_lock, racing concurrent inserters/removers into UAF read, double-free and NULL-deref panic Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_iomapping.c:68	panic	reproduced fixed
DF-2298	High	7.0	Heap OOB read/write via zero-length segment array from integer overflow in n Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdma.c:145	memcorrupt: demonstrated OOB-read-to-arbitrary-write through production fw_write (write target = groom-controlled pointer read 8 bytes past a 32-byte kmalloc; content = attacker iso payload, length up to u16 65535 per packet); fw_read is the arbitrary-read mirror; ungroomed firing = wild write/panic. uid=0 chain not completed -- entry requires a FireWire controller's /dev/fw* node (0660 root:operator), absent in QEMU; same evidence-class standard as DF-5413/DF-5548/DF-5613.	reproduced fixed
DF-2435	High	7.0	Heap buffer overflow in status_str via ksprintf of negative strtouq offsets Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/crypt/dm_target_crypt.c:462	panic	reproduced fixed
DF-2443	High	7.0	UAF / double-free race in dm_dev_remove lifecycle (no-ref-held precondition) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_dev.c:65	panic	reproduced fixed
DF-2447	High	7.0	dm_dev_remove_ioctl / dm_dev_resume_ioctl use-after-free: dmv operated on after dm_dev_unbusy drops the last reference Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_ioctl.c:349	panic	reproduced fixed
DF-0003	Medium	7.0	Negative unit number in devclass_alloc_unit causes heap OOB write via dc->devices[] Kernel memory corruption (UAF / OOB write) · sys/kern/subr_bus.c:1064	panic	reproduced fixed
DF-0033	Medium	7.0	Unsynchronized fdtol->fdl_refcount ++ / list splice in rfork fdshare path (UAF via refcount race) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_fork.c:568	panic	reproduced fixed
DF-0930	Medium	7.0	ntfs_nthashlookup returns unreferenced ntnode after releasing token - UAF in NTFS inode lookup Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_ihash.c:90	panic	reproduced fixed
DF-1300	Medium	7.0	dc_add_all_planes_for_stream writes plane_states[MAX_SURFACES=3] with unchecked plane_count (dead API, latent stack overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_resource.c:1564	panic	reproduced fixed
DF-1358	Medium	7.0	Stack buffer overflow in amr_quartz_get_work via controller-supplied completion count Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr.c:2095	panic	reproduced fixed
DF-2041	Medium	7.0	Imported GEM obj->resv set to uninitialized dma_buf->resv heap memory Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_dmabuf.c:322	panic	reproduced fixed
DF-2072	Medium	7.0	Signed table_id bounds check allows OOB heap read/write in SMU10 table copy Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/smu10_smumgr.c:116	none	reproduced fixed
DF-2086	Medium	7.0	Double-free of ch->dma in ata_dmaalloc error path Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-dma.c:151	dos	reproduced fixed
DF-2125	Medium	7.0	Lockless segment read in vm_phys_fictitious_to_vm_page races unreg->kfree yielding NULL-deref panic or UAF of vm_page array Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_vm.c:152	corruption	reproduced fixed
DF-2128	Medium	7.0	Multi-page sg entry OOB read/write in sg_pcopy_from_buffer / sg_pcopy_to_buffer via DMAP Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_scatterlist.c:167	corruption	reproduced fixed
DF-2189	Medium	7.0	vmap() computes allocation size in 32-bit arithmetic; large count overflows and maps count pages into undersized VA Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_vmalloc.c:55	corruption	reproduced fixed
DF-2191	Medium	7.0	UAF: sio_pccard_detach does not stop/drain dtr_ch and busy_ch callouts before softc is freed Kernel memory corruption (UAF / OOB write) · sys/dev/serial/sio/sio_pccard.c:117	corruption	reproduced fixed
DF-2353	Medium	7.0	Use-after-free on device disconnect: sc->data freed before /dev/videoX cdev is destroyed Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_drv.c:2493	panic	reproduced fixed
DF-2462	Medium	7.0	ism_stop frees session while CAM/ic_action and sysctl handlers can still dereference it (UAF) Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:752	leak	reproduced fixed
DF-2552	Medium	7.0	Integer overflow in sbuf_extend/sbuf_extendsize yields undersized reallocation and ~2GiB heap overflow Kernel memory corruption (UAF / OOB write) · sys/kern/subr_sbuf.c:131	none	reproduced fixed
DF-2553	Medium	7.0	sbuf_uionew truncates ssize_t uio_resid to int length then uiomove()s full original size into undersized buffer Kernel memory corruption (UAF / OOB write) · sys/kern/subr_sbuf.c:237	none	reproduced fixed
DF-0105	Low	7.0	DT_CALLOUT_ARMED set before callout_reset creates enqueue/cancel race (panic or tq_callouts underflow + spurious UAF) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_taskqueue.c:355	none	reproduced fixed
DF-0249	Low	7.0	Driver b_resid>b_bcount underflows iolen to huge size_t: oversized copyout leaks kernel heap Kernel memory leaks / uninitialized disclosure · sys/kern/kern_physio.c:112	leak	reproduced fixed
DF-0557	Low	7.0	Callout UAF race on hook disconnect/node shutdown: callout_stop doesnt drain ticker Kernel memory corruption (UAF / OOB write) · sys/netgraph/lmi/ng_lmi.c:1062	panic	reproduced fixed
DF-1001	Low	7.0	INQUIRY EVPD Unit Serial Number pre-fill writes past short CAM buffer Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/storage/umass.c:2326	none	reproduced fixed
DF-1002	Low	7.0	INQUIRY EVPD Supported Page List augmentation trusts device-supplied length against unvalidated buffer Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/storage/umass.c:2578	none	reproduced fixed
DF-1016	Low	7.0	FIOASYNC stores raw struct proc pointer without PHOLD -> kernel heap UAF on process exit via fork Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_dev.c:1044	none	reproduced fixed
DF-1154	Low	7.0	Unbounded per-CRTC plane count can overflow MAX_SURFACES stack/heap buffers Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4496	panic	reproduced fixed
DF-1435	Low	7.0	DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled length field Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-cd.c:1582	none	reproduced fixed
DF-2034	Low	7.0	Signed table_id comparison allows OOB array index in vega10_copy_table_from_smc / _to_smc Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:37	panic	reproduced fixed
DF-2209	Low	7.0	Stale pointer after kfree in drm_sysfs_connector_remove -- connector->kdev not NULLed, creating latent UAF via drm_sysfs_connector_add early-return guard Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_sysfs.c:35	dos	reproduced fixed
DF-2234	Low	7.0	iconv_add() and iconv_register_cspair() accept unbounded charset names; iconv_sysctl_cslist() strcpy overflows 31-byte stack buffer Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv.c:179	panic	reproduced fixed
DF-2249	Low	7.0	convchar==1 path converts one byte without checking inbytesleft/outbytesleft > 0: 1-byte OOB read/write Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv_xlat.c:92	none	reproduced fixed
DF-0490	High	6.8	Type confusion in in_lifaddr_ioctl: AF_INET6 check matches IPv6 addresses cast to in_ifaddr — unpriv heap OOB read/info leak via SIOCGLIFADDR Kernel memory corruption (UAF / OOB write) · sys/netinet/in.c:908	leak:0	reproduced fixed
DF-0983	High	6.8	Heap overflow in urtwn_efuse_read_data via crafted efuse extended header on RTL8188EU Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_urtwn.c:1755	panic	reproduced fixed
DF-1011	High	6.8	Integer overflow in nitv (uint16_t) during UVC descriptor parsing -> ~250KB heap buffer overflow Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_drv.c:1674	panic	reproduced fixed
DF-2532	High	6.8	xa_start panics in xa_done KKASSERT when a B_FAILONDIS bio fails with no live span Base system — drivers · sys/dev/disk/xdisk/xdisk.c:976	panic	reproduced fixed
DF-2361	Medium	6.8	P packet out-of-bounds stack write via NUM_REGS/struct mismatch and missing lower bound Kernel memory corruption (UAF / OOB write) · sys/cpu/x86_64/misc/x86_64-gdbstub.c:438	dos	reproduced fixed
DF-2362	Medium	6.8	m/M packets accept unbounded length overflowing 400-byte static I/O buffers Kernel memory corruption (UAF / OOB write) · sys/cpu/x86_64/misc/x86_64-gdbstub.c:118	dos	reproduced fixed
DF-0556	Low	6.8	DLCI array index without local bounds check in nglmi_rcvdata: latent heap OOB write Base system — network stack · sys/netgraph/lmi/ng_lmi.c:692	panic	reproduced fixed
DF-1008	Low	6.8	Async packet parser mishandles packets spanning >2 DMA buffers -> buffer leak + forged headers Base system — bus / platform / cpu · sys/bus/firewire/fwohci.c:2650	none	reproduced fixed
DF-1694	Low	6.8	dce_aux: stack buffer overflow in AUX write-reply path (bound check compares HW field against itself) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/dce/dce_aux.c:285	panic	reproduced fixed
DF-0472	High	6.7	ip_fw3_ctl_add_rule missing cmd_len validation: heap over-read + info leak + OOB function pointer call Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3.c:950	leak:~1KB	reproduced fixed
DF-0668	High	6.7	Unbounded table id in all dispatch/ioctl handlers -> per-CPU heap OOB write, OOB read, and wild function-pointer call Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_table.c:92	panic	reproduced fixed
DF-0823	High	6.7	hammer2_xop_helper_cleanup stops only MASTER-indexed threads — leaks survivors into freed heap UAF on unmount of multi-chain PFS Hammer2 · sys/vfs/hammer2/hammer2_admin.c:437	panic	reproduced fixed
DF-0897	High	6.7	Stack buffer overflow via non-NUL-terminated name/linkname in devfs_rule_ioctl Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_rules.c:104	panic	reproduced fixed
DF-1064	High	6.7	Unbounded CPU counter in MADT LAPIC/x2APIC enumeration causes out-of-bounds kernel BSS writes Kernel memory corruption (UAF / OOB write) · DF-1042 · sys/platform/pc64/acpica/acpi_madt.c:274	panic	reproduced fixed
DF-1407	High	6.7	Unbounded i2c_bus[i] write via BIOS-controlled num_indices in amdgpu_atombios_i2c_init Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:140	panic	reproduced fixed
DF-1732	High	6.7	vinumio: heap buffer overflow - unbounded config-line copy in vinum_scandisk reads attacker-controlled disk data into 2KB buffer Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumio.c:763	panic	reproduced fixed
DF-1827	High	6.7	isc_soc: heap overflow in isc_sendPDU MH_ALIGN misuse leaves no room for AHS or header digest Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:111	panic	reproduced fixed
DF-1851	High	6.7	32-bit integer overflow in hptmv HPT_IOCTL_PARAM size check enables kernel heap overflow Kernel memory corruption (UAF / OOB write) · FreeBSD-SA-09:11.hptmv · sys/dev/raid/hptmv/hptproc.c:292	panic	reproduced fixed
DF-1894	High	6.7	Integer overflow in dmc_header->fw_size*4 causes unbounded heap OOB read in intel_csr_load_program Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_csr.c:404	panic	reproduced fixed
DF-1946	High	6.7	amdgpu_ucode_validate only checks datasize==size_bytes: no minimum size, no header cross-validation (root of DF-1838 family) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251	leak:24+	reproduced fixed
DF-1947	High	6.7	Integer underflow + missing bounds in amdgpu_ucode_init_single_fw/patch_jt memcpy: heap OOB write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:347	panic	reproduced fixed
DF-0056	Medium	6.7	Heap overflow via unchecked p_filesz > p_memsz in PT_LOAD segment loading Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf.c:507	panic	reproduced fixed
DF-0573	Medium	6.7	Unvalidated ioc->id used as nats[] index: OOB read/write of pointer array Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_nat/ip_fw3_nat.c:745	panic	reproduced fixed
DF-1128	Medium	6.7	Zero-level power state: OOB read performance_levels[-1] and integer underflow memset overflow in SMC state upload Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/si_dpm.c:5662	leak:4	reproduced fixed
DF-1645	Medium	6.7	Unchecked / signedness-buggy msg->index allows OOB read+write of vinum SD/DRIVE/PLEX/VOL arrays via VINUM_SETSTATE(_FORCE) Privilege escalation (general use) · sys/dev/raid/vinum/vinumstate.c:848	panic	reproduced fixed
DF-2104	Medium	6.7	radeon ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> kernel heap OOB read and arbitrary SMC SRAM write (radeon twin of DF-2096) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ci_smc.c:186	none	reproduced fixed
DF-2119	Medium	6.7	Double dma_fence_put on normal benchmark completion (heap double-free / UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:36	corruption	reproduced fixed
DF-2156	Medium	6.7	_alloc_safe_mem size math is broken: heap underflow on small req_sz and integer overflow on huge req_sz Kernel memory corruption (UAF / OOB write) · sys/dev/misc/tbridge/safe_mem.c:80	corruption	reproduced fixed
DF-2602	Medium	6.7	Heap buffer overflow in smb_smb_ssnsetup plaintext-password path via iconv length mismatch Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_smb.c:268	panic	reproduced fixed
DF-0198	Low	6.7	tag_types[tag_type] indexed without bounds check Base system — kernel core (kern) · sys/kern/subr_devstat.c:211	none	reproduced fixed
DF-0480	Low	6.7	TCP-MD5 signature option construction overflows 40-byte opt[] stack buffer (disabled by default) Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_output.c:779	dos	reproduced fixed
DF-1007	Low	6.7	fwohci_rx_enable ignores fwohci_add_rx_buf allocation failure -> db[-1] OOB write Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci.c:1406	none	reproduced fixed
DF-1482	Low	6.7	vr_encap copies m_pkthdr.len bytes into fixed MCLBYTES TX buffer without bounds check: heap overflow when MTU raised Kernel memory corruption (UAF / OOB write) · sys/dev/netif/vr/if_vr.c:1288	panic	reproduced fixed
DF-2084	Low	6.7	mpu401_un_init frees mpu401 struct without stopping/draining the live callout (use-after-free via mpu401_timeout) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/midi/mpu401.c:103	dos	reproduced fixed
DF-2278	Low	6.7	CAM_DATA_PHYS / CAM_SG_LIST_PHYS accepted by pass allowing user-supplied raw physical DMA addresses to reach the SIM Privilege escalation (general use) · sys/bus/cam/scsi/scsi_pass.c:565	panic	reproduced fixed
DF-0797	High	6.6	Unvalidated vol_no from crafted volume header causes kernel heap OOB write in volume_map bitmap Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_ondisk.c:210	panic	reproduced fixed
DF-1781	High	6.6	drm_crtc: uninitialized heap read in drm_mode_setcrtc cleanup derefs garbage connector pointers Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_crtc.c:713	panic	reproduced fixed
DF-1625	Medium	6.6	Integer overflow in VCE create-command img_size bypasses BO size validation Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vce.c:823	panic	reproduced fixed
DF-1655	Medium	6.6	radeon_uvd: integer overflow in radeon_uvd_cs_msg_decode bypasses buffer-size validation Base system — drivers · sys/dev/drm/radeon/radeon_uvd.c:367	panic	reproduced fixed
DF-2055	Medium	6.6	Integer underflow in drm_gem_fb_create_with_funcs accepts undersized GEM buffers (size check bypass via (height-1) wraparound) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_gem_framebuffer_helper.c:161	panic	reproduced fixed
DF-0281	High	6.5	Remote kernel panic: divide-by-zero via PN MCC command with mtu=0 Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3019	dos	reproduced fixed
DF-0350	High	6.5	Unbounded mesh route-table growth + attacker-controlled lifetime: remote memory exhaustion DoS Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1057	dos	reproduced fixed
DF-0494	High	6.5	Remote unauthenticated kernel heap+stack memory disclosure via ARP reply using attacker-controlled ar_hln/ar_pln Kernel memory leaks / uninitialized disclosure · CVE-2026-110912 · sys/netinet/if_ether.c:1182	leak:190bytes	reproduced fixed
DF-0594	High	6.5	TKIP RX length underflow on too-short frames -> OOB read and KASSERT panic in wep_decrypt/michael_mic/m_copydata Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:266	panic	reproduced fixed
DF-0671	High	6.5	Unbounded recursion in NetBIOS retarget handling causes kernel stack overflow / panic Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_trantcp.c:263	panic	reproduced fixed
DF-0751	High	6.5	Infinite loop for MPLS explicit-NULL label 0/2 with clear bottom-of-stack bit — single-packet remote hard hang Base system — network stack · sys/netproto/mpls/mpls_input.c:101	dos / hard-hang - single-packet remote kernel busy-loop (one CPU at 100% holding mplock, no panic, no dmesg, power-cycle required)	reproduced fixed
DF-0032	Medium	6.5	fdcopy() failure in fork1() permanently leaks the child proc, nprocs, and the per-uid proc-count (system-wide fork DoS) Base system — kernel core (kern) · sys/kern/kern_fork.c:491	dos	reproduced fixed
DF-0207	Medium	6.5	Memory leak in clist_alloc_cblocks: old c_data never freed on resize Kernel memory leaks / uninitialized disclosure · sys/kern/tty_subr.c:61	leak	reproduced fixed
DF-0301	Medium	6.5	Missing replay protection on CARP advertisements: L2-adjacent DoS of failover Base system — network stack · sys/netinet/ip_carp.c:1137	dos	reproduced fixed
DF-0418	Medium	6.5	Unbounded default-router and prefix list growth from spoofed RAs: RA-flooding kernel memory exhaustion DoS Base system — network stack · sys/netinet6/nd6_rtr.c:689	dos	reproduced fixed
DF-0445	Medium	6.5	altq_etherclassify NULL-pointer dereference: mbuf chain walk advances to m_next without NULL check Base system — network stack · sys/net/if_ethersubr.c:927	panic	reproduced fixed
DF-0596	Medium	6.5	Unsynchronized SMP race on xmitWin causes heap OOB write on timeSent[] in ng_pptpgre Kernel memory corruption (UAF / OOB write) · sys/netgraph/pptpgre/ng_pptpgre.c:121	dos	reproduced fixed
DF-0752	Medium	6.5	mbuf leak in mpls_forward on route-not-found — remote memory-exhaustion DoS Base system — network stack · sys/netproto/mpls/mpls_input.c:199	dos	reproduced fixed
DF-0779	Medium	6.5	tmpfs_readdir cookie generation panics on attacker-supplied bogus NFS cookie — KKASSERT/RB_NEXT(NULL) Base system — filesystems · sys/vfs/tmpfs/tmpfs_vnops.c:1697	panic	reproduced fixed
DF-1646	Medium	6.5	bre() plex_concat builds rqe with negative sdoffset for subdisk-gap plexes, corrupting/arbitrary-leaking drive data outside the subdisk Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrequest.c:494	panic	reproduced fixed
DF-2251	Medium	6.5	Fully reversible non-cryptographic MINSTD PRNG is sole source of randomness for security-sensitive kernel values Base system — libkern / libprop / ddb · sys/libkern/random.c:36	leak	reproduced fixed
DF-0653	Low	6.5	Signed integer overflow in ieee80211_pwrsave frame-age computation yields KASSERT panic Base system — network stack · sys/netproto/802_11/wlan/ieee80211_power.c:359	dos	reproduced fixed
DF-0732	High	6.4	TOCTOU in MACCMD_LIST: as_nacls read without lock before buffer sizing — heap OOB write (grow) and uninit heap info leak (shrink) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_acl/ieee80211_acl.c:313	panic	reproduced fixed
DF-1496	High	6.4	Unbounded VBIOS ucSclkEntryNum overflows fixed 8-entry stack table in atomctrl_get_smc_sclk_range_table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1368	panic	reproduced fixed
DF-1783	High	6.4	radeon_bios: heap buffer overflow in radeon_atrm_call - unbounded memcpy of ACPI-returned buffer into 256K BIOS buffer Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_bios.c:183	panic	reproduced fixed
DF-0605	Medium	6.4	Use-after-free in pfi_get_ifaces() RB tree walk under concurrent interface detach Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_if.c:763	panic	reproduced fixed
DF-0609	Medium	6.4	Missing return after m_freem in netisr_characterize causes UAF read and NULL-deref panic Kernel memory corruption (UAF / OOB write) · sys/net/netisr.c:515	panic	reproduced fixed
DF-0628	Medium	6.4	Use-after-free of struct smbiod on shutdown: destroyer frees iod without waiting for the iod kthread to exit Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_iod.c:675	panic	reproduced fixed
DF-0712	Medium	6.4	Undersized kmalloc in ieee80211_alloc_countryie: 3-byte heap overflow when channel list has >=84 distinct power runs Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_regdomain.c:248	none_observable_intra_object_padding	reproduced fixed
DF-0735	Medium	6.4	ip_input/ip_output called from netgraph thread context: ASSERT_NETISR_NCPUS panic (INVARIANTS) and PFIL list UAF (production) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_ipfw.c:245	panic	reproduced fixed
DF-0949	Medium	6.4	sys_mlockall use-after-free: stale vm_map_entry pointer held across vm_fault_wire which releases the map lock Kernel memory corruption (UAF / OOB write) · sys/vm/vm_mmap.c:1066	panic	reproduced fixed
DF-1609	Medium	6.4	Heap OOB write in PowerPlay table entry callback via unbounded levels[index] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:736	panic	reproduced fixed
DF-1667	Medium	6.4	ath EDMA: m_rxpending use-after-free / double-free in ath_edma_stoprecv vs deferred tasklet Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_rx_edma.c:188	panic	reproduced fixed
DF-1685	Medium	6.4	agp: UAF / TOCTOU race between agp_find_memory and AGP_{BIND,UNBIND,FREE}_MEMORY Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:488	panic	reproduced fixed
DF-2157	Medium	6.4	Global safe_mem list has no concurrency protection: concurrent alloc/free corrupts linkage (UAF / double-unlink) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/tbridge/safe_mem.c:55	corruption	reproduced fixed
DF-2159	Medium	6.4	Unlocked traversal of irq_list in disable_irq/enable_irq and free_irq lookup yields UAF, double-free and SLIST_REMOVE NULL-deref panic Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_irq.c:116	corruption	reproduced fixed
DF-2233	Medium	6.4	Lockless list traversal in iconv_open/iconv_lookupcs/iconv_lookupconv allows use-after-free via concurrent module unload Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv.c:146	panic	reproduced fixed
DF-0679	Low	6.4	Use-after-free: dangling match/nomatch hook pointers when ng_bpf_setprog fails in newhook Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bpf/ng_bpf.c:280	none	reproduced fixed
DF-0694	Low	6.4	wep_setkey missing upper-bound key length validation allows stack overflow in RC4 key buffer Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:122	panic	reproduced fixed
DF-1068	Low	6.4	pci_token does not serialize ioctl against kernel-side pci_devq mutation -> UAF/double-free window Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci_user.c:59	none	reproduced fixed
DF-1501	Low	6.4	Heap OOB write in musycc_attach when PCI device reports nchan > NPORT Kernel memory corruption (UAF / OOB write) · sys/dev/misc/musycc/musycc.c:1494	panic	reproduced fixed
DF-1649	Low	6.4	acpi_ec: EcSpaceHandler missing Width<=64 bound -> OOB past UINT64 Value buffer Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_ec.c:818	panic	reproduced fixed
DF-1670	Low	6.4	if_vke: select()/FD_SET stack buffer overflow when sc_fd >= FD_SETSIZE Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vkernel/net/if_vke.c:631	panic	reproduced fixed
DF-1779	Low	6.4	radeon_dp_mst: latent unbounded idx into new_attribs[6]/cur_stream_attribs[6] + ignored VCPI alloc failure Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_dp_mst.c:114	panic	reproduced fixed
DF-1871	Low	6.4	scsi_encap overflows cmd->cdb on oversized inline CDB from CAM pass-through Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi_subr.c:494	panic	reproduced fixed
DF-2113	Low	6.4	Use-after-free: unimplemented led_detach leaves dangling gpio pointer in surviving LED cdevs Kernel memory corruption (UAF / OOB write) · sys/dev/misc/gpio/gpio_led.c:206	none	reproduced fixed
DF-2115	Low	6.4	Double dma_fence_put (UAF / double-free) on self-test copy-mismatch or kmap-failure paths Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_test.c:140	none	reproduced fixed
DF-2171	Low	6.4	i_setopt free-and-reassign of sp->opt strings is unlocked; concurrent ISCSISETOPT ioctls race into double-free / UAF Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_subr.c:104	corruption	reproduced fixed
DF-0893	High	6.3	hammer_enter_undo_history mutates RB tree/TAILQ without lock racing concurrent frontends Base system — filesystems · sys/vfs/hammer/hammer_undo.c:125	panic	reproduced fixed
DF-0764	Medium	6.3	Stale worklist_tail in add_to_worklist — process_worklist_item LK_NOWAIT can free the tail causing UAF write + orphaned items + unmount panic Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_softdep.c:462	dos	reproduced fixed
DF-0799	Medium	6.3	VREG read np->n_size TOCTOU race — concurrent stat syncs n_size down causing uint64 underflow + OOB heap leak via uiomovebp Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_bio.c:224	leak:24576	reproduced fixed
DF-1138	Medium	6.3	OOB read in si_parse_power_table VCE state fill-in: clk_idx never bounds-checked against ucNumEntries Kernel memory leaks / uninitialized disclosure · DF-1127 · sys/dev/drm/radeon/si_dpm.c:6882	leak:1008	reproduced fixed
DF-2214	Medium	6.3	32-bit integer overflow in DMA copy size (num_gpu_pages << 12) silently truncates copy Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rv770_dma.c:44	corruption	reproduced fixed
DF-2421	Medium	6.3	INQUIRY/READ_CAPACITY/page_inquiry dereference user-controlled data_ptr without CAM_DIR validation Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:1083	panic	reproduced fixed
DF-0805	Low	6.3	LZ4 read path compressed_size bounds checked only by KKASSERT — heap OOB read on non-INVARIANTS kernels Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:197	panic	reproduced fixed
DF-1255	Low	6.3	vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:466	none	reproduced fixed
DF-1637	Low	6.3	Double-free of crypto_session on cryptoapi_cipher_setkey failure Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/crypt/dm_target_crypt.c:559	panic	reproduced fixed
DF-2153	Low	6.3	Unchecked integer overflow in dma_fence_array_create size computation yields heap OOB write (latent, EXPORT_SYMBOL) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_fence-array.c:173	corruption	reproduced fixed
DF-1624	Medium	6.2	MSI-X fallback path passes rid=0 to pci_release_msix_vector, causing guaranteed kernel panic Base system — drivers · sys/dev/virtual/virtio/pci/virtio_pci.c:494	panic	reproduced fixed
DF-2351	Medium	6.2	uint16_t to uint8_t truncation of nfmt/nfrm/nitv causes NULL-deref panic on device attach Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_drv.c:1737	panic	reproduced fixed
DF-0880	High	6.1	Heap over-read in udf_vget via unbounded file-entry l_ea/l_ad Kernel memory leaks / uninitialized disclosure · sys/vfs/udf/udf_vfsops.c:514	panic	reproduced fixed
DF-1413	High	6.1	Unchecked VBIOS conn_num drives OOB write past connectors[16] in update_slot_layout_info Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1732	panic	reproduced fixed
DF-1642	High	6.1	kfree of uninitialized msg pointer in dm_message_ioctl when DM_MESSAGE_STR absent Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_ioctl.c:1006	panic	reproduced fixed
DF-1725	High	6.1	radeon_cs: heap OOB read in radeon_cs_packet_next_reloc via non-4-aligned relocs length_dw Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_cs.c:89	leak	reproduced fixed
DF-2227	High	6.1	Unbounded while(*cp!="\"") scan in XML attribute-value parser causes heap OOB read / kernel panic Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_object.c:484	panic	reproduced fixed
DF-0536	Medium	6.1	Unprivileged kernel heap over-read via non-NUL-terminated sg_data in ng_connect_data Privilege escalation (general use) · sys/netgraph7/socket/ng_socket.c:752	leak	reproduced fixed
DF-0744	Medium	6.1	udp6_output corrupts sticky socket options and leaks per-call options memory when ip6_setpktoptions fails Kernel memory leaks / uninitialized disclosure · sys/netinet6/udp6_output.c:134	leak:20bytes/iter+silent-sticky-state-corruption	reproduced fixed
DF-0778	Medium	6.1	ufs_readlink OOB read / panic via i_size truncation to int — crafted FFS image heap info leak or DoS Privilege escalation (general use) · sys/vfs/ufs/ufs_vnops.c:1740	panic	reproduced fixed
DF-0815	Medium	6.1	Missing privilege check on BULKFREE_SCAN/ASYNC and DEBUG_DUMP ioctls — unprivileged DoS + kernel address leak via msgbuf Hammer2 · sys/vfs/hammer2/hammer2_ioctl.c:83	leak:kernel_ptrs	reproduced fixed
DF-0830	Medium	6.1	hpfs_readdir dep-walk unbounded against 2KB bread buffer — panic/heap-leak/infinite-loop via crafted dirblk Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_vnops.c:825	panic	reproduced fixed
DF-0862	Medium	6.1	hpfs_bminit integer overflow in hpm_dbnum computation undersizes bitmap arrays OOB read/write Kernel memory corruption (UAF / OOB write) · sys/vfs/hpfs/hpfs_subr.c:109	panic	reproduced fixed
DF-0863	Medium	6.1	hpfs_cpload OOB read of cpdsec via unchecked d_cpcnt past fixed d_cpdblk[3] array Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_subr.c:228	panic	reproduced fixed
DF-0864	Medium	6.1	hpfs_toupper indexes hpm_cpdblk[cp] with unchecked on-disk de_cpid OOB read on every name lookup Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_subr.c:55	leak:34813	reproduced fixed
DF-0865	Medium	6.1	hpfs_validateparent walks directory entries by attacker-controlled de_reclen with no buffer-bound check OOB read Kernel memory leaks / uninitialized disclosure · sys/vfs/hpfs/hpfs_subr.c:567	panic	reproduced fixed
DF-0881	Medium	6.1	Heap OOB read in sparing-table scan rt_l unbounded by st_size Kernel memory leaks / uninitialized disclosure · sys/vfs/udf/udf_vfsops.c:662	panic	reproduced fixed
DF-0886	Medium	6.1	autofs_node_vn loses a create race panicking kernel on concurrent first-lookup Base system — filesystems · sys/vfs/autofs/autofs_vnops.c:569	panic	reproduced fixed
DF-0934	Medium	6.1	Accumulated input offset never bounded - heap OOB read of compressed input buffer (cup) in NTFS decompression Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_compr.c:55	panic	reproduced fixed
DF-1330	Medium	6.1	mixer_setrecsrc uses bitmask as array index causing OOB kernel read into envy24ht_mixmap[25] Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/envy24ht.c:1953	leak	reproduced fixed
DF-1347	Medium	6.1	amd_Reselect indexes target arrays with -1 via ffs(0)-1 on malicious reselect ID Kernel memory leaks / uninitialized disclosure · sys/dev/disk/amd/amd.c:1829	panic	reproduced fixed
DF-2181	Medium	6.1	wait_on_bit_timeout() timeout is permanently expired: absolute ticks compared against a relative jiffies count Base system — drivers · sys/dev/drm/linux_wait.c:108	dos	reproduced fixed
DF-2200	Medium	6.1	Missing runtime bounds check on gpio in 4/5 entry points (sibling of DF-2199) Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c:42	dos	reproduced fixed
DF-2497	Medium	6.1	Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:348	dos	reproduced fixed
DF-2498	Medium	6.1	Intel MatrixRAID heap OOB read via untrusted disk_idx and unvalidated map pointer Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:2132	none	reproduced fixed
DF-2594	Medium	6.1	Unvalidated redo_data_bytes and REDO record size in recovery cause OOB kernel-memory read on mount of crafted image Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_recover.c:1225	panic	reproduced fixed
DF-2595	Medium	6.1	Missing zero-length packet guard causes type confusion in bpf_filter OOB read panic Kernel memory corruption (UAF / OOB write) · sys/netgraph/bpf/ng_bpf.c:403	none	reproduced fixed
DF-0322	Low	6.1	No validation of tid/baw before indexing ni_rx_ampdu[tid] and setting rxa_wnd Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ht.c:566	none	reproduced fixed
DF-1135	Low	6.1	Heap OOB read in hdaa_eld_dump: computed length never bounds field/SAD access Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/hda/hdaa.c:644	panic	reproduced fixed
DF-1168	Low	6.1	Heap OOB read: unvalidated VBIOS clock indices into SCLK/MCLK dependency tables Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3179	panic	reproduced fixed
DF-2161	Low	6.1	enable_irq ignores bus_setup_intr return value; disable_irq does not invalidate cookiep, inviting stale-cookie double-teardown Base system — drivers · sys/dev/drm/linux_irq.c:159	dos	reproduced fixed
DF-0471	High	6.0	ip_fw3_ctl_x: size_t underflow in sopt_valsize when <4 causes unbounded bcopy heap corruption/panic Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3.c:1038	panic	reproduced fixed
DF-0661	High	6.0	Kernel stack overflow via unchecked user-controlled VLA in ngdread/ngdwrite Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_device.c:509	panic	reproduced fixed
DF-0734	High	6.0	Negative ioc_setupcnt bypasses signed upper-bound check — >131KB kernel stack OOB read exfiltrated to SMB server Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_usr.c:299	panic	reproduced fixed
DF-1397	High	6.0	Heap overflow in plex/subdisk auto-naming via strcat past filled 64-byte name field Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:1455	panic	reproduced fixed
DF-0181	Medium	6.0	sysctl_hostname leaks XLOCK on EPERM: jailed root deadlocks host sysctl subsystem Base system — kernel core (kern) · sys/kern/kern_mib.c:217	dos	reproduced fixed
DF-0476	Medium	6.0	ip_fw3_register_module: strncpy bounded by strlen(src) not sizeof(dst): buffer overflow + missing NUL Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3.c:180	leak:22bytes	reproduced fixed
DF-0588	Medium	6.0	tunwrite leaks mbuf chain on unsupported address family (m_freem(m) vs m_freem(top)) Privilege escalation (general use) · sys/net/tun/if_tun.c:875	dos	reproduced fixed
DF-0739	Medium	6.0	Heap over-read / kernel memory disclosure in ip_fw3_ctl_set_get — bcopy sopt_valsize bytes from 4-byte ctx->sets Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3/ip_fw3_set.c:213	leak	reproduced fixed
DF-1604	Medium	6.0	Divide-by-zero panic via attacker-controlled geometry (heads=0 or sectors=0) when cylinders==16383 Base system — drivers · sys/dev/virtual/virtio/block/virtio_blk.c:711	panic	reproduced fixed
DF-2039	Medium	6.0	Use-after-free: discard_buffer_callout not drained before freeing sc->buf and destroying dev_lock in tpm20_release Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm20.c:137	panic	reproduced fixed
DF-2078	Medium	6.0	goto restart_search reads OOB past power-state array returning OOB pointer used to program SMC Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:214	dos	reproduced fixed
DF-2105	Medium	6.0	Integer overflow in u32 bounds checks in ci_set_smc_sram_address and ci_copy_bytes_to_smc (wraparound defeats SMC SRAM upper bound) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ci_smc.c:36	none	reproduced fixed
DF-2141	Medium	6.0	tokenize() writes token pointers with no bounds check -> static-BSS OOB write via VINUM_CREATE ioctl Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumparser.c:162	corruption	reproduced fixed
DF-2207	Medium	6.0	Signed 32-bit overflow in iounmap() byte-size math (npages * PAGE_SIZE) yields OOB pmap_unmapdev / wrong phys_avail match for >=2 GB mappings Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_iomapping.c:80	panic	reproduced fixed
DF-2246	Medium	6.0	Destructive DDB sysctls (debug.panic/panic2/enter_debugger) have no jail confinement: jailed root can crash or freeze entire host Privilege escalation (general use) · sys/ddb/db_sysctl.c:56	dos	reproduced fixed
DF-2262	Medium	6.0	XPT_DEV_MATCH trusts user-supplied EDT cookie kernel pointers: arbitrary kernel-address deref UAF KASLR leak Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:2446	panic	reproduced fixed
DF-0042	Low	6.0	Relocation r_offset never bounds-checked against target section size (OOB / wild kernel write) Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf_obj.c:940	none	reproduced fixed
DF-0061	Low	6.0	Relocation r_offset never bounds-checked against module size (DF-0042 analogue, wild write) Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf.c:714	none	reproduced fixed
DF-0072	Low	6.0	Missing sign/upper-bound validation on cfh_nfiles before heap alloc + file read (DoS; 32-bit integer-overflow heap OOB) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_checkpoint.c:596	none	reproduced fixed
DF-0975	Low	6.0	XPT_DEV_MATCH cookie fields are user-controlled kernel pointers blindly dereferenced (arbitrary kread / panic) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:2444	none	reproduced fixed
DF-1317	Low	6.0	Heap buffer overflow in sbp_fix_inq_data via short INQUIRY data buffer Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sbp/sbp.c:1504	none	reproduced fixed
DF-1533	Low	6.0	Unbounded cmd_7k->generic.size used as SG-list write offset in 9K_SA passthru Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twa/tw_cl_io.c:295	panic	reproduced fixed
DF-1684	Low	6.0	scvidctl: integer overflow in sc_set_pixel_mode bounds check allows OOB video-memory write via KDRASTER Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/scvidctl.c:318	panic	reproduced fixed
DF-2047	Low	6.0	tbridge_printf size_t underflow yields OOB kernel write once 128kB buffer fills Kernel memory corruption (UAF / OOB write) · sys/dev/misc/tbridge/tbridge.c:139	panic	reproduced fixed
DF-0134	Medium	5.9	Missing structural validation in l64_readdisklabel: crafted partition fields accepted without bounds checks Base system — kernel core (kern) · sys/kern/subr_disklabel64.c:176	none	reproduced fixed
DF-0741	Medium	5.9	gre_mobile_input bcopy size underflow (m_len-msiz-ip_hl*4) — huge overwrite when mobile header larger than mbuf Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_gre.c:223	panic	reproduced fixed
DF-0742	Medium	5.9	gre_input2 and gre_mobile_input dereference header fields at offset 20+ without m_pullup — OOB read on chained mbufs Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_gre.c:133	panic	reproduced fixed
DF-0825	Medium	5.9	nfs_getnickauth post-increment bug: auth_str points 4 bytes into 8-byte kmalloc — OOB heap read into RPC request + kfree of non-base pointer Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_syscalls.c:1115	leak:4bytes+panic	reproduced fixed
DF-0841	Medium	5.9	NULL deref in ISDOTDOT lookup path — VTODE(vpp) on unassigned vpp=NUL via missing assignment Base system — filesystems · sys/vfs/msdosfs/msdosfs_lookup.c:557	panic	reproduced fixed
DF-0018	Low	5.9	Duplicate DELETE for same DMSG msgid triggers KKASSERT panic (DoS) Base system — kernel core (kern) · sys/kern/kern_dmsg.c:1076	panic	reproduced fixed
DF-0356	Low	5.9	nd6_resolve ln_hold mbuf accessed without nd6_mtx: UAF race with nd6_timer Kernel memory corruption (UAF / OOB write) · sys/netinet6/nd6.c:2078	dos	reproduced fixed
DF-0486	Low	5.9	syncache_insert dereferences possibly-uninitialized sc2 in cache-overflow path when cachelimit=0 Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_syncache.c:359	dos	reproduced fixed
DF-0493	Low	5.9	KASSERT-only bounds check on nack before xwin[] indexing: no runtime protection in production kernels Base system — network stack · sys/netgraph/l2tp/ng_l2tp.c:1141	dos	reproduced fixed
DF-0657	Low	5.9	ccmp_decrypt block-straddle path bounds-checked only by KASSERT (OOB read+write on oddly fragmented RX mbuf chains) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:619	panic	reproduced fixed
DF-1336	Low	5.9	Multi-fragment RX frame truncation when total_len is exact multiple of MCLBYTES Kernel memory leaks / uninitialized disclosure · sys/dev/netif/re/if_re.c:1209	none	reproduced fixed
DF-2436	High	5.8	Use of uninitialized heap memory in dm_target_crypt_destroy on partial init failure Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/crypt/dm_target_crypt.c:489	panic	reproduced fixed
DF-0137	Medium	5.8	Unlocked TAILQ traversal in varsymset_init() during fork: data race/UAF Kernel memory corruption (UAF / OOB write) · sys/kern/kern_varsym.c:519	panic	reproduced fixed
DF-0725	Medium	5.8	if_clone_destroy UAF: drops ifnet_lock before dereferencing ifp->if_dname/if_dunit — concurrent destroy frees ifnet Kernel memory corruption (UAF / OOB write) · sys/net/if_clone.c:110	panic	reproduced fixed
DF-2087	Medium	5.8	acpi_mapbase tracking list is mutated without any lock; concurrent AcpiOsMapMemory/UnmapMemory race into UAF and list corruption Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/Osd/OsdMemory.c:59	dos	reproduced fixed
DF-2252	Medium	5.8	Off-by-one NUL write before caller buffer when inlen <= 0 Kernel memory corruption (UAF / OOB write) · sys/libkern/hexncpy.c:52	panic	reproduced fixed
DF-0328	Low	5.8	node_getmimoinfo loops on untrusted ni_mimo_chains without clamping to array size Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_node.c:1164	none	reproduced fixed
DF-0380	Low	5.8	Non-atomic refcount --node->refs/--hook->refs under crit_enter only: cross-CPU UAF/double-free race Kernel memory corruption (UAF / OOB write) · sys/netgraph/netgraph/ng_base.c:473	dos	reproduced fixed
DF-0395	Low	5.8	sta_lookup returns entry with table lock released: callers dereference unlocked TOCTOU use-after-free window Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1283	dos	reproduced fixed
DF-0986	Low	5.8	mt7601_set_chan unbounded linear search over mt7601_rf_chan[14] reads OOB for chan outside 1..14 Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_mtw.c:3693	none	reproduced fixed
DF-1159	Low	5.8	Unvalidated NIC descriptor index in RX mismatch recovery causes OOB kernel heap access Base system — drivers · sys/dev/netif/bge/if_bge.c:3061	panic	reproduced fixed
DF-1643	Low	5.8	Missing caps_priv_check on destructive ATA ioctls (IOCATADETACH/ATTACH/REINIT/REQUEST) Privilege escalation (general use) · sys/dev/disk/nata/ata-all.c:369	none	reproduced fixed
DF-1916	Low	5.8	QCB free-list and queue manipulation race on SMP: crit_enter does not block cross-CPU ida_intr Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ida/ida.c:118	panic	reproduced fixed
DF-0195	High	5.7	Unlocked devstat list: concurrent device detach vs sysctl walk yields UAF (world-readable sysctl) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_devstat.c:268	leak	reproduced fixed
DF-0035	Medium	5.7	Integer underflow in sysctl_kern_msgbuf causes kernel heap OOB read via copyout Kernel memory leaks / uninitialized disclosure · sys/kern/subr_prf.c:1177	panic	reproduced fixed
DF-2263	Medium	5.7	EOF drain loop in sastart re-processes freed bio (double biodone / kernel hang) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sa.c:1603	dos	reproduced fixed
DF-0088	Low	5.7	No runtime validation in free_unrl against out-of-range/double-free (KASSERT-only, defense-in-depth) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_unit.c:556	none	reproduced fixed
DF-0280	Low	5.7	Integer overflow in ptr_array allocation in pf_setup_pfsync_matching (32-bit only theoretical) Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_ioctl.c:942	none	reproduced fixed
DF-0403	Low	5.7	Unvalidated dst_ring from custom lookup causes OOB index into dst_ents array Base system — network stack · sys/net/netmap/netmap_vale.c:1162	dos	reproduced fixed
DF-0404	Low	5.7	Potential OOB ring access in netmap_bwrap_register for NICs with asymmetric TX/RX ring counts Kernel memory leaks / uninitialized disclosure · sys/net/netmap/netmap_vale.c:1699	dos	reproduced fixed
DF-0578	Low	5.7	SLIOCSUNIT struct-assigns embedded callout nodes: callout queue corruption Kernel memory corruption (UAF / OOB write) · sys/net/sl/if_sl.c:365	panic	reproduced fixed
DF-0618	Low	5.7	Signed integer overflow in ieee80211_dwds_discover age calculation causes KASSERT panic Base system — network stack · sys/netproto/802_11/wlan/ieee80211_wds.c:336	dos	reproduced fixed
DF-1466	Low	5.7	Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/dpt/dpt_scsi.c:858	none	reproduced fixed
DF-1477	Low	5.7	agp_i810_bind_memory offset check bypassed via 64-bit integer wraparound -> OOB GTT writes Kernel memory corruption (UAF / OOB write) · sys/dev/agp/intel-gtt.c:1259	panic	reproduced fixed
DF-1756	Low	5.7	radeon_vce: unsigned underflow in firmware header scan when datasize < strlen(prefix)+9 Base system — drivers · sys/dev/drm/radeon/radeon_vce.c:60	panic	reproduced fixed
DF-2117	Low	5.7	drm_scdc_read/drm_scdc_write accept size_t but assign to uint16_t i2c_msg.len with no bounds check; drm_scdc_write can overflow 1+size before kmalloc/memcpy Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_scdc_helper.c:66	none	reproduced fixed
DF-2485	Low	5.7	Unbounded NumPhysDisks/NumActiveVolumes loop counts read past IOC config-page trailing arrays Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_raid.c:1149	limited_write	reproduced fixed
DF-0534	Medium	5.6	Heap OOB read in ngc_send: ng_mesg buffer under-allocated, header fields read out of bounds Kernel memory leaks / uninitialized disclosure · sys/netgraph7/socket/ng_socket.c:254	leak	reproduced fixed
DF-0844	Medium	5.6	Heap OOB read when parsing crafted directory entries near buffer tail — missing d_reclen >= DIRSIZ validation Kernel memory leaks / uninitialized disclosure · sys/vfs/ufs/ufs_dirhash.c:200	leak:255	reproduced fixed
DF-1042	Medium	5.6	lapic_set_cpuid missing bounds validation allows OOB write to APIC ID mapping arrays via crafted MADT Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/apic/lapic.c:1212	panic	reproduced fixed
DF-2172	Medium	5.6	radeon_ucode_validate performs no minimum-size, NULL, or sub-field validation -- OOB reads and NULL deref in validator and all print functions Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_ucode.c:156	panic	reproduced fixed
DF-0261	Low	5.6	act_ofs copied from user input without validation against cmd_len -> heap OOB read Kernel memory leaks / uninitialized disclosure · sys/net/ipfw/ip_fw2.c:4515	none	reproduced fixed
DF-0308	Low	5.6	X_ipip_input reads viftable/last_encap_vif without mroute_token: race with vif teardown Base system — network stack · sys/net/ip_mroute/ip_mroute.c:1709	none	reproduced fixed
DF-1506	Low	5.6	Missing emu_intr_unregister on detach and attach-failure leaves dangling IRQ consumer pointing at freed emu_pcm_info (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/emu10kx-pcm.c:1453	panic	reproduced fixed
DF-0142	High	5.5	Sleeping allocation (M_WAITOK kmalloc) while holding ac_spin -> panic/deadlock Base system — kernel core (kern) · sys/kern/vfs_quota.c:158	panic	reproduced fixed
DF-0272	High	5.5	Missing ifnet_unlock on error paths in SIOCAIFGROUP/SIOCDIFGROUP/SIOCGIFGROUP/SIOCSIFDESCR: permanent ifnet_mtx deadlock Privilege escalation (general use) · sys/net/if.c:2389	dos	reproduced fixed
DF-0858	High	5.5	Unbounded dive depth in hpfs_hpbmap allows infinite kernel loop via cyclic alsec pointers Base system — filesystems · sys/vfs/hpfs/hpfs_alsubr.c:78	dos	reproduced fixed
DF-0876	High	5.5	ext2_gd_csum OOB heap read via unvalidated on-disk group descriptor size Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_csum.c:684	leak	reproduced fixed
DF-0877	High	5.5	ext2_dx_csum OOB heap read via unvalidated htree entry count Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_csum.c:253	leak	reproduced fixed
DF-0923	High	5.5	UAF of vm_map_backing and vm_map across per-iteration unlock in /proc/<pid>/map Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_map.c:65	panic	reproduced fixed
DF-1639	High	5.5	NULL-deref kernel panic in dm_table_load_ioctl via missing/non-array cmd_data Base system — drivers · sys/dev/disk/dm/dm_ioctl.c:707	panic	reproduced fixed
DF-1727	High	5.5	ttm_bo_vm: uninitialized kernel pages returned to userspace via TTM BO mmap fault Kernel memory leaks / uninitialized disclosure · sys/dev/drm/ttm/ttm_bo_vm.c:690	leak	reproduced fixed
DF-2187	High	5.5	vunmap() unconditional SLIST_REMOVE/kfree on addr-not-found dereferences NULL and panics Base system — drivers · sys/dev/drm/linux_vmalloc.c:77	panic	reproduced fixed
DF-2231	High	5.5	Unbounded attacker-controlled pref_len in _prop_object_copyin causes kernel panic / memory exhaustion (prop_object_copyin_limit dead variable) Kernel memory corruption (UAF / OOB write) · sys/libprop/prop_kern.c:383	dos	reproduced fixed
DF-2297	High	5.5	Divide-by-zero in fwdma_malloc_multiseg when esize is zero Base system — bus / platform / cpu · sys/bus/firewire/fwdma.c:153	panic	reproduced fixed
DF-0075	Medium	5.5	DIOCGSLICEINFO leaks kernel pointers (KASLR bypass) via raw struct diskslices copyout Kernel memory leaks / uninitialized disclosure · sys/kern/subr_diskslice.c:556	leak:24bytes	reproduced fixed
DF-0079	Medium	5.5	Unprivileged local DoS via u_int truncation of iov_len in /dev/null and /dev/zero write (infinite kernel loop) Base system — kernel core (kern) · sys/kern/kern_memio.c:292	dos	reproduced fixed
DF-0107	Medium	5.5	dkcksum32 OOB read via DIOCSDINFO ioctl with crafted d_npartitions Kernel memory leaks / uninitialized disclosure · sys/kern/subr_disklabel32.c:264	panic	reproduced fixed
DF-0475	Medium	5.5	act_ofs never validated: OOB pointer deref via ACTION_PTR during packet matching Base system — network stack · sys/net/ipfw3/ip_fw3.c:520	panic	reproduced fixed
DF-0585	Medium	5.5	TAPSIFINFO leaks the ifnet serializer on type mismatch (local DoS / kernel wedge) Kernel memory leaks / uninitialized disclosure · sys/net/tap/if_tap.c:738	dos	reproduced fixed
DF-0598	Medium	5.5	smb_sm_lookupint leaks a VC reference on every failed lookup, pinning VCs and hanging teardown Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_conn.c:124	dos	reproduced fixed
DF-0599	Medium	5.5	smb_vc_create error path NULL-deferences vc_iod via smb_vc_disconnect (trivially-triggerable kernel panic via invalid charset name) Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_conn.c:460	panic	reproduced fixed
DF-0680	Medium	5.5	NULL-pointer dereference / local kernel panic via getsockopt on RFCOMM socket with unknown option (rfcomm_socket.c:121-126) Privilege escalation (general use) · sys/netbt/rfcomm_upper.c:562	panic	reproduced fixed
DF-0682	Medium	5.5	NULL-deref panic in l2cap_ctloutput getsockopt path (l2cap_socket.c:126-131) — same defect class as DF-0680 Privilege escalation (general use) · sys/netbt/l2cap_upper.c:521	panic	reproduced fixed
DF-0687	Medium	5.5	Missing break in sco_ctloutput PRCO_GETOPT causes NULL-deref panic via getsockopt (DF-0682 pattern) Base system — network stack · sys/netbt/sco_socket.c:113	panic	reproduced fixed
DF-0688	Medium	5.5	sco_ctloutput PRCO_SETOPT unconditionally NULL-dereferences on every setsockopt Base system — network stack · sys/netbt/sco_socket.c:123	panic	reproduced fixed
DF-0709	Medium	5.5	sco_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — mbuf-exhaustion DoS Base system — network stack · sys/netbt/sco_socket.c:111	dos	reproduced fixed
DF-0748	Medium	5.5	Unchecked uint16_t index into 10-element log_if_table — OOB read + kernel panic on matching packet Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_log.c:114	panic	reproduced fixed
DF-0770	Medium	5.5	Record sync error silently dropped in hammer_sync_inode — variable name typo tmp_error=-error should be -tmp_error Base system — filesystems · sys/vfs/hammer/hammer_inode.c:3066	data-integrity (silent error-drop; not memory corruption)	reproduced fixed
DF-0777	Medium	5.5	hammer2_vop_readdir leaks kernel heap via unvalidated on-disk name_len/namlen — OOB read past inode/data buffer into heap Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:706	leak:65535	reproduced fixed
DF-0782	Medium	5.5	Integer overflow in fuse_vop_write at offset near INT64_MAX triggers KKASSERT panic via negative newsize Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vnops.c:1469	panic	reproduced fixed
DF-0790	Medium	5.5	ATTRLIST parsing DoS in ntfs_ntvattrget: reclen==0 infinite loop or reclen>len NULL deref panic Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:186	dos	reproduced fixed
DF-0796	Medium	5.5	NULL deref in hammer2_inode_chain_and_parent when cluster has NULL chain slot — sibling hammer2_inode_chain handles correctly this does not Hammer2 · sys/vfs/hammer2/hammer2_inode.c:436	panic	reproduced fixed
DF-0804	Medium	5.5	Panic / NULL deref via crafted HAMMER2 image in strategy_read_completion — unknown bref.type/methods from media Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:441	panic	reproduced fixed
DF-0810	Medium	5.5	nfs_getcookie() OOB array index via int truncation of 64-bit directory offset — local panic Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_subs.c:1341	panic	reproduced fixed
DF-0817	Medium	5.5	NULL deref in h2_bulkfree_sync freemap lookup error path — live_chain->error deref when live_chain is NULL Hammer2 · sys/vfs/hammer2/hammer2_bulkfree.c:1046	panic	reproduced fixed
DF-0822	Medium	5.5	Sustained CPU-burn DoS via unchecked radix in hammer2_freemap_adjust count calculation Hammer2 · sys/vfs/hammer2/hammer2_freemap.c:977	panic	reproduced fixed
DF-0829	Medium	5.5	HPFS EA ioctls walk past fn_int using unvalidated on-disk fn_ealen — kernel heap info leak via copyout Privilege escalation (general use) · sys/vfs/hpfs/hpfs_vnops.c:144	leak:65540	reproduced fixed
DF-0834	Medium	5.5	ufs_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang (UFS analog of DF-0824) Base system — filesystems · sys/vfs/ufs/ufs_lookup.c:1130	dos	reproduced fixed
DF-0839	Medium	5.5	hammer_ioc_set_version leaks sync_lock and finalize_lock on undo-upgrade error — deadlocks or panics filesystem Base system — filesystems · sys/vfs/hammer/hammer_ioctl.c:638	dos	reproduced fixed
DF-0842	Medium	5.5	Missing sliding-window allocation in inflate updatewindow() — NULL-pointer-write panic on malformed HAMMER2 zlib block Hammer2 · sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c:373	panic	reproduced fixed
DF-0850	Medium	5.5	Missing interior-node limit validation in ext2_htree_find_leaf — OOB heap read/panic from crafted ext2 htree image Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_htree.c:308	panic	reproduced fixed
DF-0855	Medium	5.5	dirfs_findfd KKASSERT panic / NULL deref on unlinked dirfs nodes Base system — filesystems · sys/vfs/dirfs/dirfs_subr.c:479	panic	reproduced fixed
DF-0872	Medium	5.5	Divide-by-zero and undefined-shift in BPB bpmftrec computation from crafted boot sector Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vfsops.c:343	panic	reproduced fixed
DF-0875	Medium	5.5	hammer2_get_volume unconditional panic on out-of-range data_off from crafted filesystem image Hammer2 · sys/vfs/hammer2/hammer2_ondisk.c:731	panic	reproduced fixed
DF-0879	Medium	5.5	Unbounded CE continuation chain in cd9660_rrip_loop allows infinite kernel loop via crafted ISO Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_rrip.c:503	dos	reproduced fixed
DF-0883	Medium	5.5	Unvalidated logical block size lb_size enables divide-by-zero and UB shifts Base system — filesystems · sys/vfs/udf/udf_vfsops.c:306	panic	reproduced fixed
DF-0904	Medium	5.5	Infinite kernel-thread loop in hammer2_update_spans when non-inode chain under super-root Hammer2 · sys/vfs/hammer2/hammer2_iocom.c:313	dos	reproduced fixed
DF-0910	Medium	5.5	Divide-by-zero kernel panic via HAMMER_IOC_PRUNE with mod_tid=0 Base system — filesystems · sys/vfs/hammer/hammer_prune.c:305	panic	reproduced fixed
DF-0911	Medium	5.5	procfs ATTACH skips saving p_oppid for already-owned children; DETACH reparents victim to proc0 leaking permanent zombies Base system — filesystems · sys/vfs/procfs/procfs_ctl.c:153	logic_orphan	reproduced fixed
DF-0919	Medium	5.5	Unvalidated fs->fs_frag causes kernel panic and OOB array access in FFS bitmap/fragacct helpers Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_subr.c:195	panic	reproduced fixed
DF-0921	Medium	5.5	Missing privilege check in /proc/<pid>/map exposes VM layout and mapped file paths of any process Privilege escalation (general use) · sys/vfs/procfs/procfs_map.c:56	leak	reproduced fixed
DF-0926	Medium	5.5	Type-confusion panic in fuse_alloc_node when daemon reuses nodeid with conflicting type Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_node.c:106	panic	reproduced fixed
DF-0929	Medium	5.5	Unvalidated data_len in hammer_ioc_dedup causes kernel OOB read via crafted image Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_dedup.c:92	panic	reproduced fixed
DF-1048	Medium	5.5	Kernel panic / divide-by-zero in umcs7840_calc_baudrate when c_ospeed == 0 (B0) via tcsetattr Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/umcs.c:1056	panic	reproduced fixed
DF-1096	Medium	5.5	Unvalidated XSAVE header in npxpop allows unprivileged user to panic kernel via XRSTOR #GP Base system — bus / platform / cpu · sys/platform/pc64/x86_64/npx.c:416	panic	reproduced fixed
DF-1323	Medium	5.5	Divide-by-zero panic in iceland_thermal_setup_fan_table from unchecked VBIOS fan temperatures Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2122	dos	reproduced fixed
DF-1325	Medium	5.5	Divide-by-zero in fiji_thermal_setup_fan_table from unvalidated VBIOS fan temperature deltas Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:2171	dos	reproduced fixed
DF-1332	Medium	5.5	amdgpu_fill_buffer uint32_t truncation skips VRAM clear for nodes>=4GiB (cross-user VRAM info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2183	leak	reproduced fixed
DF-1334	Medium	5.5	Kernel divide-by-zero panics from VBIOS-supplied zero clock/spread-spectrum/voltage divisors Base system — drivers · sys/dev/drm/radeon/rv770_dpm.c:548	dos	reproduced fixed
DF-1341	Medium	5.5	Unsigned underflow of nlevels in r600_texture_size causes local DoS (multi-minute kernel spin) Base system — drivers · sys/dev/drm/radeon/r600_cs.c:1418	dos	reproduced fixed
DF-1361	Medium	5.5	OOB kernel read via unbounded ReplySize in mps_user_pass_thru copyout Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_user.c:858	leak	reproduced fixed
DF-1599	Medium	5.5	32-bit truncation of last_pfn bypasses VM offset bounds check and panics the kernel via BUG_ON Base system — drivers · sys/dev/drm/radeon/radeon_vm.c:446	panic	reproduced fixed
DF-1611	Medium	5.5	Divide-by-zero in hubp1_cursor_set_position when pixel_clk_khz == 0 Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:1117	panic	reproduced fixed
DF-1612	Medium	5.5	Divide-by-zero in hubp1_vready_workaround when pipe_dest->htotal == 0 Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:123	panic	reproduced fixed
DF-1615	Medium	5.5	Unmatched crit_exit() in twe_suspend corrupts critical-section accounting and panics INVARIANTS kernels Base system — drivers · sys/dev/raid/twe/twe_freebsd.c:494	panic	reproduced fixed
DF-1616	Medium	5.5	Divide-by-zero panic in ath_beacon_proc when ic->ic_lintval is 0 Base system — drivers · sys/dev/netif/ath/ath/if_ath_beacon.c:481	panic	reproduced fixed
DF-1635	Medium	5.5	NULL pointer dereference via strsep-parsed cipher spec components Base system — drivers · sys/dev/disk/dm/crypt/dm_target_crypt.c:470	panic	reproduced fixed
DF-1648	Medium	5.5	Divide-by-zero panic from crafted EDID with min_vfreq == 0 in mod_freesync_build_vrr_params Base system — drivers · sys/dev/drm/amd/display/modules/freesync/freesync.c:93	panic	reproduced fixed
DF-1658	Medium	5.5	nvmm: mach->commvmobj creation reference never dropped -> kernel memory leak / local DoS Base system — drivers · sys/dev/virtual/nvmm/nvmm.c:197	panic	reproduced fixed
DF-1666	Medium	5.5	drm_syncobj: unprivileged fd+struct file leak via broken LinuxKPI fd shim -> system-wide ENFILE DoS Base system — drivers · sys/dev/drm/drm_syncobj.c:407	panic	reproduced fixed
DF-2035	Medium	5.5	Divide-by-zero kernel panic in vega20_fan_ctrl_set_fan_speed_rpm via 8*speed uint32 wraparound Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:186	panic	reproduced fixed
DF-2052	Medium	5.5	DFS_SET_THRESH dereferences indata without verifying ATH_DIAG_IN was set (NULL-pointer-deref panic) Privilege escalation (general use) · sys/dev/netif/ath/ath_dfs/null/dfs_null.c:260	panic	reproduced fixed
DF-2069	Medium	5.5	Divide-by-zero kernel panic via crafted IDENTIFY in CHS path of tf_write Base system — drivers · sys/dev/disk/nata/chipsets/ata-serverworks.c:216	panic	reproduced fixed
DF-2075	Medium	5.5	drm_vm_info leaks struct_mutex permanently on SYSCTL_OUT failure (local DoS) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_sysctl.c:175	dos	reproduced fixed
DF-2124	Medium	5.5	Unconditional NULL-pointer dereference in drm_mmap d_mmap handler panics before the auth check Base system — drivers · sys/dev/drm/drm_vm.c:47	panic	reproduced fixed
DF-2127	Medium	5.5	Inverted skip condition + dead curoff in sg_pcopy_from_buffer / sg_pcopy_to_buffer break data extraction (GuC firmware loading DoS) Base system — drivers · sys/dev/drm/linux_scatterlist.c:167	corruption	reproduced fixed
DF-2177	Medium	5.5	acpi_PkgStr NULL-pointer dereference via firmware-supplied zero-length String/Buffer (kernel DoS) Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_package.c:76	panic	reproduced fixed
DF-2186	Medium	5.5	sn_pccard_detach re-enters the ifnet serializer instead of exiting it -- guaranteed panic on every device detach Base system — drivers · sys/dev/netif/sn/if_sn_pccard.c:115	panic	reproduced fixed
DF-2229	Medium	5.5	prop_array_iterator and 3 siblings lack prop_object_is_array NULL/type guard enabling kernel panic via DM ioctl Base system — libkern / libprop / ddb · sys/libprop/prop_array.c:538	panic	reproduced fixed
DF-2230	Medium	5.5	Kernel plist integer parsing silently saturates decimal values exceeding INT64_MAX (unsigned fallback is dead code) Base system — libkern / libprop / ddb · sys/libprop/prop_number.c:519	none	reproduced fixed
DF-2232	Medium	5.5	Signed integer overflow in idr_grow() growth loop causes kernel hang or panic-sized kmalloc Kernel memory corruption (UAF / OOB write) · sys/libkern/linux_idr.c:427	dos	reproduced fixed
DF-2237	Medium	5.5	iconv_xlat16_conv dereferences d_table[c1] without NULL check after case-conversion mutates c1/c2 Base system — libkern / libprop / ddb · sys/libiconv/iconv_xlat16.c:155	panic	reproduced fixed
DF-2293	Medium	5.5	Zero bufreq.psize passed to FW_STSTREAM/FW_SRSTREAM causes divide-by-zero panic in fwdma_malloc_multiseg Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:458	dos	reproduced fixed
DF-2294	Medium	5.5	FW_SBINDADDR / FW_CBINDADDR NULL-pointer dereference when receive xferq is uninitialized (local DoS) Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:617	dos	reproduced fixed
DF-2318	Medium	5.5	NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote on cards lacking a valid CISTPL_VERS_1 Base system — bus / platform / cpu · sys/bus/pccard/pccard.c:1001	panic	reproduced fixed
DF-2352	Medium	5.5	Division by zero in uvc_drv_try_frame_interval for continuous-interval frames (bFrameIntervalType==0) Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_drv.c:1922	panic	reproduced fixed
DF-2420	Medium	5.5	NULL pointer dereference of xa when ahci_ata_get_xfer() returns NULL Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:1082	panic	reproduced fixed
DF-2432	Medium	5.5	Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0 Base system — drivers · sys/dev/disk/ccd/ccd.c:1319	panic	reproduced fixed
DF-2442	Medium	5.5	KKASSERT kernel panic in dm_dev_insert on concurrent dm_dev_create name collision Base system — drivers · sys/dev/disk/dm/dm_dev.c:187	panic	reproduced fixed
DF-2448	Medium	5.5	dm_table_load_ioctl: NULL-pointer-dereference panic via missing cmd_data array Base system — drivers · sys/dev/disk/dm/dm_ioctl.c:707	panic	reproduced fixed
DF-2450	Medium	5.5	NULL-deref kernel panic when dm backing path resolves to a non-device vnode Base system — drivers · sys/dev/disk/dm/dm_pdev.c:69	panic	reproduced fixed
DF-2452	Medium	5.5	NULL-deref kernel panic via mismatched feature_count in _init_features Base system — drivers · sys/dev/disk/dm/flakey/dm_target_flakey.c:131	panic	reproduced fixed
DF-2496	Medium	5.5	Kernel divide-by-zero panics from crafted RAID geometry (width/interleave/total_sectors == 0) Base system — drivers · sys/dev/disk/nata/ata-raid.c:1028	panic	reproduced fixed
DF-2505	Medium	5.5	Drive-controlled / TOCTOU OOB kernel heap read in DVD_STRUCT_BCA and DVD_STRUCT_MANUFACT Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/atapi-cd.c:1537	leak	reproduced fixed
DF-2550	Medium	5.5	setfown() leaks vnode exclusive lock and reference on VOP_GETATTR failure causing permanent file DoS Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:3541	panic	reproduced fixed
DF-2554	Medium	5.5	Divide-by-zero kernel panic from unvalidated boot sector bf_bps=0 during mount Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_vfsops.c:331	panic	reproduced fixed
DF-2556	Medium	5.5	clist_alloc_cblocks leaks previous c_data buffer on every reallocation Base system — kernel core (kern) · sys/kern/tty_subr.c:48	dos	reproduced fixed
DF-2584	Medium	5.5	Flush depth limit panics instead of deferring DoS via deeply nested crafted image Hammer2 · sys/vfs/hammer2/hammer2_flush.c:56	panic	reproduced fixed
DF-0038	Low	5.5	journal_putpages UNDO records btoc(a_count) pages instead of a_count bytes (silent rollback corruption) Base system — kernel core (kern) · sys/kern/vfs_jops.c:955	none	reproduced fixed
DF-0361	Low	5.5	Default netmap ioctl passthrough fabricates zeroed stack struct socket passed to ifioctl Privilege escalation (general use) · sys/net/netmap/netmap.c:1488	none	reproduced fixed
DF-0644	Low	5.5	check_from_lookup / check_to_lookup OOB read via unvalidated table index cmd->arg1 Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_basic.c:311	panic	reproduced fixed
DF-0759	Low	5.5	Double NG_FREE_ITEM on out-hook data path panics INVARIANTS kernels Base system — network stack · sys/netgraph7/ng_split.c:134	panic	reproduced fixed
DF-0794	Low	5.5	Divide-by-zero panic when fs_ncg==0 — unvalidated superblock geometry mounts successfully then traps on first allocation Base system — filesystems · sys/vfs/ufs/ffs_alloc.c:676	panic	reproduced fixed
DF-0979	Low	5.5	Multiple error paths use tsleep(0) infinite-hang instead of panic, enabling silent kernel DoS Base system — bus / platform / cpu · sys/platform/pc64/x86_64/pmap.c:2908	none	reproduced fixed
DF-1092	Low	5.5	Unbounded EHCI extended-capability chain traversal allows malicious PCI controller to hang the kernel Base system — bus / platform / cpu · sys/bus/u4b/controller/ehci_pci.c:517	dos	reproduced fixed
DF-1170	Low	5.5	Divide-by-zero in smu7_get_profiling_clk when golden MCLK value is zero Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2737	panic	reproduced fixed
DF-1485	Low	5.5	NULL-pointer dereference when find_idle_secondary_pipe exhausts idle pipes Base system — drivers · sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1151	panic	reproduced fixed
DF-1508	Low	5.5	kqfilter detach dereferences NULL dev->si_drv1 after close frees state Base system — drivers · sys/dev/misc/vkbd/vkbd.c:311	panic	reproduced fixed
DF-1548	Low	5.5	Divide-by-zero panic in XPT_CALC_GEOMETRY when block_size > 1 MiB Base system — drivers · sys/dev/disk/advansys/advansys.c:441	panic	reproduced fixed
DF-1582	Low	5.5	mfi_tbolt_get_cmd NULL-derefs when Thunderbolt command pool is empty Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:784	panic	reproduced fixed
DF-1584	Low	5.5	mfi_build_and_issue_cmd leaks Thunderbolt command slot on mfi_tbolt_build_io failure Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi_tbolt.c:1097	leak	reproduced fixed
DF-2160	Low	5.5	NULL-deref kernel panic in disable_irq/enable_irq when irq is not (or no longer) registered Base system — drivers · sys/dev/drm/linux_irq.c:150	panic	reproduced fixed
DF-2478	Low	5.5	Unbounded md device auto-creation on open allows kernel memory exhaustion (DoS) by operator-group users Base system — drivers · sys/dev/disk/md/md.c:135	denial_of_service	reproduced fixed
DF-2501	Low	5.5	XPT_RESET_DEV dereferences softc->atadev[tid] with no NULL or bounds check Base system — drivers · sys/dev/disk/nata/atapi-cam.c:428	panic	reproduced fixed
DF-2504	Low	5.5	CDRIOCSETBLOCKSIZE accepts block_size=0 -> divide-by-zero kernel panic Base system — drivers · sys/dev/disk/nata/atapi-cd.c:723	panic	reproduced fixed
1086	Medium	5.4	crom_parse_text() CROM_END check treats crc_len as bytes instead of quadlets, allowing OOB read past csrrom Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:207	leak:60bytes	reproduced fixed
DF-0612	Medium	5.4	ieee80211_parse_tdma() join path skips IE length and tdma_slot validation, enabling heap OOB write via setbit() from crafted beacon Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_tdma.c:645	oob_write	reproduced fixed
DF-0288	Low	5.4	OOB read in mesh peering action: peer_linkid/peer_rcode decoded before length check Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_mesh.c:2174	none	reproduced fixed
DF-0353	Low	5.4	hwmp_recv_perr switches on dest_flags instead of dest_rcode: PERR never actioned Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1768	none	reproduced fixed
DF-0363	Low	5.4	ieee80211_dump_pkt reads WEP/QoS/4-addr fields without bounds-checking against frame length: OOB read when debug enabled Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_proto.c:591	none	reproduced fixed
DF-0371	Low	5.4	Unlocked memcmp of lp_marker before LACP_LOCK: torn-read data race with lacp_xmit_marker Base system — network stack · sys/net/lagg/ieee8023ad_lacp.c:1934	none	reproduced fixed
DF-0481	Low	5.4	Integer overflow in root path cost comparison allows topology manipulation via crafted BPDU Base system — network stack · sys/net/bridge/bridgestp.c:513	none	reproduced fixed
DF-0555	Low	5.4	m_pullup is dead code: packetlen=m_len then m_len<packetlen always false, mbuf chains mis-parsed Base system — network stack · sys/netgraph/lmi/ng_lmi.c:575	none	reproduced fixed
DF-0583	Low	5.4	ieee80211_parse_ath heap over-read via short Atheros vendor IE Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_superg.c:198	leak	reproduced fixed
DF-0103	Medium	5.3	p_tracenode/p_traceflag mutated without target p_token -> refcount double-drop/UAF and NULL-deref TOCTOU Kernel memory corruption (UAF / OOB write) · sys/kern/kern_ktrace.c:506	panic	reproduced fixed
DF-0144	Medium	5.3	copyin return value silently discarded before prop_dictionary_copyin Base system — kernel core (kern) · sys/kern/vfs_quota.c:345	panic	reproduced fixed
DF-0518	Medium	5.3	ICMP error generation (icmp_error) not rate-limited: reflection/amplification DoS Base system — network stack · sys/netinet/ip_icmp.c:144	dos	reproduced fixed
DF-0729	Medium	5.3	NULL mbuf dereference in P2P routing-loop detector when m_copym(M_NOWAIT) fails — kernel panic under memory pressure Base system — network stack · sys/netinet6/ip6_forward.c:138	panic	reproduced fixed
DF-1299	Medium	5.3	OOB kernel-heap reads from VBIOS-controlled flex-array counts across table walks Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/bios/bios_parser.c:175	leak	reproduced fixed
DF-1306	Medium	5.3	Unbounded nonClockInfoIndex causes heap OOB read in kv_parse_power_table Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/kv_dpm.c:2668	leak	reproduced fixed
DF-1307	Medium	5.3	Unbounded VCE clk_idx causes heap OOB read in kv_parse_power_table Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/kv_dpm.c:2703	leak	reproduced fixed
DF-1672	Medium	5.3	cik_sdma: integer overflow in cik_copy_dma size computation -> silent data corruption on >=4GB moves Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/cik_sdma.c:586	panic	reproduced fixed
DF-1693	Medium	5.3	amdgpu_debugfs: PCIE/DIDT/SMC register handlers perform no upper-bound validation on user-supplied register offset Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:229	panic	reproduced fixed
DF-2091	Medium	5.3	Integer overflow in si_copy_dma size computation truncates DMA copy for BOs >= 4GB Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/si_dma.c:240	dos	reproduced fixed
DF-2167	Medium	5.3	Integer overflow in evergreen_copy_dma size computation (sibling of DF-2091) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen_dma.c:115	corruption	reproduced fixed
DF-2196	Medium	5.3	task_struct allocated in kthread_run() is never freed and td_linux_task is never cleared, leaking memory and leaving dangling back-pointer in struct thread Kernel memory leaks / uninitialized disclosure · sys/dev/drm/linux_kthread.c:54	none	reproduced fixed
DF-0021	Low	5.3	Signed-int overflow in oversized kmalloc size reconstruction (*kup << PAGE_SHIFT) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_slaballoc.c:1202	leak	reproduced fixed
DF-0264	Low	5.3	Unsigned wraparound in p_len when TCP th_off exceeds actual header Base system — network stack · sys/net/pf/pf.c:6623	none	reproduced fixed
DF-0283	Low	5.3	Unconditional kernel panic if mbuf chain ends with zero-length mbuf Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:1956	panic	reproduced fixed
DF-0331	Low	5.3	Unbounded kprintf on fragment-queue exhaustion: remote log-flood DoS Base system — network stack · sys/netgraph7/ppp/ng_ppp.c:1519	dos	reproduced fixed
DF-0392	Low	5.3	Fragment overlap trim uses non-8-aligned shifts for last-fragment overlaps: inconsistent reassembly metadata Base system — network stack · sys/net/pf/pf_norm.c:412	none	reproduced fixed
DF-0456	Low	5.3	NULL deref in rfcomm_session_complete: credit NULL check under #ifdef DIAGNOSTIC only, no guard on production Base system — network stack · sys/netbt/rfcomm_session.c:446	dos	reproduced fixed
DF-0469	Low	5.3	ip6_get_prevhdr dereferences ip6e without validating len against m_len: fragile implicit contract Kernel memory leaks / uninitialized disclosure · sys/netinet6/ip6_input.c:1418	none	reproduced fixed
DF-0485	Low	5.3	IPv6 syncache hash uses only 64/128 address bits with 32-bit secret: attacker-guaranteed bucket collisions Base system — network stack · sys/netinet/tcp_syncache.c:157	none	reproduced fixed
DF-0487	Low	5.3	sc_flags assign instead of OR wipes SCF_HASH and negotiated-option flags on TF_NOOPT listener Base system — network stack · sys/netinet/tcp_syncache.c:1102	none	reproduced fixed
DF-0519	Low	5.3	ICMP PMTUD accepts attacker-controlled nextmtu: PMTU poisoning via unauthenticated frag-needed Base system — network stack · sys/netinet/ip_icmp.c:282	dos	reproduced fixed
DF-0520	Low	5.3	icmp_reflect reflects source-route/RR/TS IP options into echo reply: info leak + source-route revival Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_icmp.c:1025	leak	reproduced fixed
DF-0563	Low	5.3	Dead m_pullup: packetlen=m_len makes check tautologically false — ng7 twin of DF-0555 Base system — network stack · sys/netgraph7/lmi/ng_lmi.c:569	none	reproduced fixed
DF-0626	Low	5.3	frag6_nfragpackets counter leak on queue allocation failure permanently reduces reassembly capacity Base system — network stack · sys/netinet6/frag6.c:267	dos	reproduced fixed
DF-0646	Low	5.3	ip_len double-counted in ip_divert_in() after ip_reass() (corrupted packet metadata on fragmented divert) Base system — network stack · sys/netinet/ip_divert.c:607	dos	reproduced fixed
DF-0747	Low	5.3	check_established reads TCP th_flags from non-first IP fragments without pullup — OOB read + firewall misclassification Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_layer4/ip_fw3_layer4.c:173	leak:0	reproduced fixed
DF-0900	Low	5.3	Signed integer overflow in RPC reply verifier length allows mbuf length corruption Base system — filesystems · sys/vfs/nfs/krpc_subr.c:425	dos	reproduced fixed
DF-1021	Low	5.3	Sleeping allocation M_WAITOK inside critical section in fw_get_tlabel -> panic under memory pressure Base system — bus / platform / cpu · sys/bus/firewire/firewire.c:1647	none	reproduced fixed
DF-1082	Low	5.3	miibus device_t UAF race between uether_ifdetach and unprivileged SIOCGIFMEDIA ioctl Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/usb_ethernet.c:289	panic	reproduced fixed
DF-1101	Low	5.3	Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len, enabling OOB read via dup_sockaddr Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/x86_64/autoconf.c:351	panic	reproduced fixed
DF-1140	Low	5.3	OOB read in si_parse_power_table: nonClockInfoIndex taken from VBIOS without bounds check Kernel memory leaks / uninitialized disclosure · DF-1127 · sys/dev/drm/radeon/si_dpm.c:6848	panic	reproduced fixed
DF-1144	Low	5.3	Unbounded VBIOS-supplied indices into nonClockInfo[]/clockInfo[] arrays in ci_parse_power_table Kernel memory leaks / uninitialized disclosure · DF-1127 · sys/dev/drm/amd/amdgpu/ci_dpm.c:5688	panic	reproduced fixed
DF-1196	Low	5.3	Unchecked power_state index increment in DYNPM downclock path causes kernel OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r600.c:360	panic	reproduced fixed
DF-1472	Low	5.3	get_clock_voltage_limit reads entries[0] without numEntries check; off-by-one in get_state_entry_v2 Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:432	none	reproduced fixed
DF-1572	Low	5.3	DMSG_DBG_SHELL reply handler logs attacker-controlled string to console without rate limiting Base system — drivers · sys/dev/disk/xdisk/xdisk.c:592	dos	reproduced fixed
DF-1608	Low	5.3	Unchecked ACPI buffer length when reading WMI command result Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_hp/acpi_hp.c:847	panic	reproduced fixed
DF-1665	Low	5.3	twa: OOB read of tw_cli_severity_string_table[severity] via firmware-controlled severity bits Kernel memory leaks / uninitialized disclosure · sys/dev/raid/twa/tw_cl_misc.c:55	leak:0	reproduced fixed
DF-1900	Low	5.3	Integer overflow in last_valid_bit can drive clear_bit with negative index into stack bitmap (latent: CONFIG_HSA_AMD not defined) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:127	panic	reproduced fixed
DF-2135	Low	5.3	Missing smc_idx_lock around SMC indirect SRAM register access in radeon kv_smc.c (radeon twin of DF-2130) Privilege escalation (general use) · sys/dev/drm/radeon/kv_smc.c:75	none	reproduced fixed
DF-2253	Low	5.3	sep==NULL misplaces NUL terminator and truncates output Kernel memory corruption (UAF / OOB write) · sys/libkern/hexncpy.c:56	none	reproduced fixed
DF-2301	Low	5.3	Off-by-one OOB read in print_db iterates one past the DMA descriptor array Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci.c:2347	leak	reproduced fixed
DF-2471	Low	5.3	Missing channel bounds check on card-reported channel in SCSI async event handler Base system — drivers · sys/dev/disk/isp/isp.c:5438	limited_write	reproduced fixed
DF-0004	Info	5.3	devaddq error path leaks data buffer due to wrong variable checked (loc instead of data) Base system — kernel core (kern) · sys/kern/subr_bus.c:615	none	reproduced fixed
DF-0470	Info	5.3	Disabling ip6_hdrnestlimit sysctl (=0) removes only ext-header depth bound: no hard floor Base system — network stack · sys/netinet6/ip6_input.c:693	none	reproduced fixed
DF-0575	Info	5.3	Wrong timeout variable for inbound TCP/UDP state cleanup: 6x/3x premature expiry Base system — network stack · sys/net/ipfw3_nat/ip_fw3_nat.c:971	none	reproduced fixed
DF-0920	Info	5.3	Kernel heap pointer leaked to msgbuf via unconditional kprintf on NFS reply re-queue Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_iod.c:134	leak:0bytes	reproduced fixed
DF-2320	Medium	5.2	Unbounded tuple.ptr from attacker-controlled longlink/MFC addresses drives bus_space_read out of the mapped CIS window Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:212	panic	reproduced fixed
DF-0138	Low	5.2	Cross-jail USER varsym namespace sharing (per-UID not per-jail) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_varsym.c:259	none	reproduced fixed
DF-0248	Low	5.2	Lockless SLIST traversal in accept_filt_get races with crit_enter-only add/del -> UAF Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_accf.c:99	none	reproduced fixed
DF-1370	Low	5.2	Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps.c:1269	none	reproduced fixed
DF-1591	Low	5.2	Firmware-controlled AEN severity indexes tws_sev_str[5] out of bounds via strcpy Kernel memory leaks / uninitialized disclosure · sys/dev/raid/tws/tws_cam.c:52	panic	reproduced fixed
DF-1862	Low	5.2	ixgbe_dcb_config_pfc_82599 uses unbounded u8 map[] to size PFC loop: OOB read + OOB MMIO write (latent) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ix/ixgbe_dcb_82599.c:321	panic	reproduced fixed
DF-2096	Low	5.2	amdgpu_ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> OOB read of firmware buffer and unbounded SMC SRAM write Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/ci_smc.c:208	dos	reproduced fixed
DF-2204	Low	5.2	No device-removal path and non-idempotent add: stale/UAF list nodes and list corruption on re-add Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85	panic	reproduced fixed
DF-2328	Low	5.2	Missing NUL-termination of PnP string enables OOB stack read in search_token() Kernel memory leaks / uninitialized disclosure · sys/bus/ppbus/ppbconf.c:219	panic	reproduced fixed
DF-0070	Medium	5.1	Heap OOB read in elf_getnote: untrusted n_namesz advances offset past note buffer with no bounds check Kernel memory leaks / uninitialized disclosure · sys/kern/kern_checkpoint.c:313	panic	reproduced fixed
DF-0477	Medium	5.1	ip_fw3_ctl_get_modules: bcopy without checking strlen(module_str) <= sopt_valsize: buffer overflow Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3.c:985	dos	reproduced fixed
DF-0606	Medium	5.1	_db_show_mesh invokes ieee80211_mesh_rt_update() from DDB: takes lockmgr lock and mutates mesh route state inside a read-only debugger pretty-printer Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ddb.c:897	panic	reproduced fixed
DF-0619	Medium	5.1	Heap OOB read in rip6_send via unvalidated sockaddr length Kernel memory leaks / uninitialized disclosure · sys/netinet6/raw_ip6.c:743	leak:26	reproduced fixed
DF-0718	Medium	5.1	smb_dev2share type-confuses non-vnode fd (socket/pipe/kqueue) as vnode via unchecked fp->f_data cast — kernel panic Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_dev.c:395	panic	reproduced fixed
DF-1130	Medium	5.1	Firmware header OOB heap read in si_mc/si_cp/si_rlc microcode loaders via unchecked offset/size fields Kernel memory leaks / uninitialized disclosure · DF-1119 · sys/dev/drm/radeon/si.c:1574	panic	reproduced fixed
DF-2110	Medium	5.1	Negative PCX width/height passes mode-match and drives a multi-exabyte bcopy -> kernel panic / OOB write past the video window Kernel memory corruption (UAF / OOB write) · sys/dev/video/fb/pcx/splash_pcx.c:176	panic	reproduced fixed
DF-2121	Medium	5.1	Unsigned integer underflow in EFI variable name NUL-terminator check causes OOB read / kernel panic Kernel memory corruption (UAF / OOB write) · sys/dev/misc/efirt/efidev.c:110	panic	reproduced fixed
DF-2122	Medium	5.1	vinum_rqinfo: signed negative index yields out-of-bounds kernel-memory read past rqinfo[] Privilege escalation (general use) · sys/dev/raid/vinum/vinummemory.c:219	panic	reproduced fixed
DF-2316	Medium	5.1	pnp_parse_desc reads fixed descriptor offsets without validating declared length causing heap OOB reads up to 17 bytes Kernel memory leaks / uninitialized disclosure · sys/bus/isa/pnpparse.c:95	panic	reproduced fixed
DF-2523	Medium	5.1	trm_Reselect spins forever (no exit) if reselected target/LUN does not match any DCB - interrupt-context DoS Base system — drivers · sys/dev/disk/trm/trm.c:2427	dos	reproduced fixed
DF-2524	Medium	5.1	trm_Disconnect dereferences pDCB->pActiveSRB without NULL check kernel panic on spurious disconnect (acknowledged in source) Base system — drivers · sys/dev/disk/trm/trm.c:2354	panic	reproduced fixed
DF-0024	Low	5.1	Heap overflow in linker_search_path() via over-long kldload module name Kernel memory corruption (UAF / OOB write) · sys/kern/kern_linker.c:1458	corruption	reproduced fixed
DF-0040	Low	5.1	Section-header index not bounds-checked against e_shnum in link_elf_obj_load_file (heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf_obj.c:551	none	reproduced fixed
DF-0041	Low	5.1	Unbounded st_name / sh_name offsets into symbol/section string tables (heap OOB read via strcmp) Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf_obj.c:304	none	reproduced fixed
DF-0057	Low	5.1	Missing e_shentsize validation causes heap OOB read on shdr[] array Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf.c:590	none	reproduced fixed
DF-0058	Low	5.1	Unbounded sh_link to symstrindex causes heap OOB read (DF-0040 analogue, worse: no check at all) Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf.c:601	none	reproduced fixed
DF-0060	Low	5.1	DT_HASH d_ptr dereferenced without bounds validation - wild kernel read in parse_dynamic Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf.c:240	none	reproduced fixed
DF-0062	Low	5.1	Unbounded st_name offsets into strtab (DF-0041 analogue, heap OOB read via strcmp) Kernel memory leaks / uninitialized disclosure · sys/kern/link_elf.c:698	none	reproduced fixed
DF-0196	Low	5.1	STAILQ_REMOVE in devstat_remove_entry derefs NULL if node already absent Base system — kernel core (kern) · sys/kern/subr_devstat.c:139	none	reproduced fixed
DF-0334	Low	5.1	Divide-by-zero panic in ephemeral port allocation on degenerate sysctl port range Base system — network stack · sys/netinet/in_pcb.c:424	panic	reproduced fixed
DF-0426	Low	5.1	MFC table protected only by crit_enter (local-CPU) not token/lock: cross-CPU UAF race Kernel memory corruption (UAF / OOB write) · sys/netinet6/ip6_mroute.c:359	dos	reproduced fixed
DF-0442	Low	5.1	rmc_init stores user-driven maxqueued_ without validation: div-by-zero or heap OOB via fixed-size array modulus Base system — network stack · sys/net/altq/altq_rmclass.c:680	dos	reproduced fixed
DF-0532	Low	5.1	bt3c_download_firmware: unvalidated block_size causes heap OOB read of msg->data Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:1121	panic	reproduced fixed
DF-1186	Low	5.1	arcmsr_handle_virtual_command INQUIRY always writes 36 bytes regardless of CAM dxfer_len Kernel memory corruption (UAF / OOB write) · sys/dev/raid/arcmsr/arcmsr.c:2947	panic	reproduced fixed
DF-1387	Low	5.1	Divide-by-zero in cypress_populate_mclk_value when VBIOS ss.rate==0 Base system — drivers · sys/dev/drm/radeon/cypress_dpm.c:553	none	reproduced fixed
DF-1488	Low	5.1	Uninitialized stack read of prefetchable[] in cbb_cardbus_auto_open programs bridge prefetch bits with stack garbage Base system — drivers · sys/dev/pccard/pccbb/pccbb.c:1005	none	reproduced fixed
DF-1738	Low	5.1	ata-lowlevel: divide-by-zero panic in ata_tf_write CHS path from device-supplied zero geometry Base system — drivers · sys/dev/disk/nata/ata-lowlevel.c:771	panic	reproduced fixed
DF-1740	Low	5.1	vinumioctl: VINUM_GETFREELIST signed fe allows negative free-list index -> 16-byte OOB heap read Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumioctl.c:76	panic	reproduced fixed
DF-2247	Low	5.1	Translation table size never validated: heap OOB read and NULL-deref panic via undersized/NULL d_table Kernel memory leaks / uninitialized disclosure · sys/libiconv/iconv_xlat.c:61	leak	reproduced fixed
DF-2260	Low	5.1	XPT_DEV_MATCH reads num_patterns without bounding by pattern_buf_len: kernel heap OOB read Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_xpt.c:3291	panic	reproduced fixed
DF-0824	Medium	5.0	ext2_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang Base system — filesystems · sys/vfs/ext2fs/ext2_lookup.c:1212	dos	reproduced fixed
DF-1931	Low	5.0	Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_rate/amrr/amrr.c:246	panic	reproduced fixed
DF-1948	Low	5.0	Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE (sibling of DF-1931) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_rate/onoe/onoe.c:220	panic	reproduced fixed
DF-0260	Low	4.8	tcpopts_match/ipopts_match read options beyond m_pullup-guaranteed contiguous region Kernel memory leaks / uninitialized disclosure · sys/net/ipfw/ip_fw2.c:1296	none	reproduced fixed
DF-0262	Low	4.8	IPv6 NAT destination-translation corrupts source address (copy-paste bug) Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf.c:3896	none	reproduced fixed
DF-0263	Low	4.8	ICMP-error NAT for other protocol corrupts inner source (copy-paste bug) Base system — network stack · sys/net/pf/pf.c:5732	none	reproduced fixed
DF-0305	Low	4.8	HMAC comparison uses non-constant-time bcmp: timing side-channel Base system — network stack · sys/netinet/ip_carp.c:581	none	reproduced fixed
DF-0310	Low	4.8	Non-atomic increment of global fragment ID (ip6_id): data race / predictable fragment IDs Base system — network stack · sys/netinet6/ip6_output.c:753	none	reproduced fixed
DF-0516	Low	4.8	ip6opts_match bails to opts_check on short first mbuf: IPv6 option matching silently skipped -> firewall bypass Base system — network stack · sys/net/ip6fw/ip6_fw.c:256	none	reproduced fixed
DF-0651	Low	4.8	IP_MINTTL (GTSM) bypassed for all raw sockets except the last in rip_input delivery list Kernel memory leaks / uninitialized disclosure · sys/netinet/raw_ip.c:164	leak	reproduced fixed
DF-0784	High	4.7	ext2_readlink truncates i_size (uint64) to signed int — unbounded kernel heap disclosure via uiomove (ext2 analog of DF-0778) Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_vnops.c:1345	leak:4078	reproduced fixed
DF-0604	Medium	4.7	Cross-CPU race on global pfi_buffer corrupts pf dynamic-interface address tables (filtering bypass) Base system — network stack · sys/net/pf/pf_if.c:74	panic	reproduced fixed
DF-0615	Medium	4.7	Unsynchronized address-selection policy table: UAF race between unprivileged sysctl reader and privileged ioctl mutator Kernel memory corruption (UAF / OOB write) · sys/netinet6/in6_src.c:728	leak:3384	reproduced fixed
DF-0762	Medium	4.7	NULL deref in hammer2_chain_lastdrop no-parent retry path — parent->core.spin released when parent is NULL Hammer2 · sys/vfs/hammer2/hammer2_chain.c:646	dos	reproduced fixed
DF-0819	Medium	4.7	blkmap_lock leaked on hammer_bnew error paths — goto failed jumps past hammer_unlock permanently deadlocking HAMMER filesystem Base system — filesystems · sys/vfs/hammer/hammer_blockmap.c:285	dos	reproduced fixed
DF-0889	Medium	4.7	hpmp leaked in hpfs_mountfs failed-mount path (memory exhaustion DoS) Base system — filesystems · sys/vfs/hpfs/hpfs_vfsops.c:262	dos	reproduced fixed
DF-0918	Medium	4.7	NULL-deref panic via dead/replied race in fuse_ipc_wait early-return paths Base system — filesystems · sys/vfs/fuse/fuse_ipc.c:163	panic	reproduced fixed
DF-1137	Medium	4.7	Kernel divide-by-zero in si_thermal_setup_fan_table from unvalidated VBIOS fan temp deltas Base system — drivers · DF-1129 · sys/dev/drm/radeon/si_dpm.c:6057	dos	reproduced fixed
DF-1139	Medium	4.7	OOB read / kernel panic in si_get_std_voltage_value when cac_leakage_table.count==0 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/si_dpm.c:4158	panic	reproduced fixed
DF-1297	Medium	4.7	Divide-by-zero in ci_thermal_setup_fan_table from unvalidated VBIOS temperature deltas Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2159	panic	reproduced fixed
DF-1354	Medium	4.7	Integer underflow in mclk_latency loop in vega12_apply_clocks_adjust_rules (count-1 wraps when count==0) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1973	panic	reproduced fixed
DF-1619	Medium	4.7	NULL-pointer dereference panic in mrsas_get_mpt_cmd when command pool is empty Base system — drivers · sys/dev/raid/mrsas/mrsas_cam.c:580	panic	reproduced fixed
DF-1650	Medium	4.7	rs780_dpm: divide-by-zero in rs780_program_at via drm_mode_vrefresh()==0 Base system — drivers · sys/dev/drm/radeon/rs780_dpm.c:66	panic	reproduced fixed
DF-1695	Medium	4.7	atapi-cam: XPT_RESET_DEV dereferences atadev[tid] without NULL check or state_lock Base system — drivers · sys/dev/disk/nata/atapi-cam.c:428	panic	reproduced fixed
DF-2037	Medium	4.7	Divide-by-zero kernel panic in amdgpu_pll_compute when target_clock or post_div is zero Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_pll.c:88	panic	reproduced fixed
DF-2038	Medium	4.7	dc_create_stream_for_sink: unchecked NULL from dc_create_transfer_func() dereferenced in construct() -> kernel panic Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_stream.c:58	panic	reproduced fixed
DF-2076	Medium	4.7	drm_bufs_info NULL-pointer write when M_NULLOK kmalloc fails (local panic) Base system — drivers · sys/dev/drm/drm_sysctl.c:226	dos	reproduced fixed
DF-2103	Medium	4.7	Daemon work queue (daemonq/dqend) and intqp pool guarded only by crit_enter/exit (per-CPU interrupt deferral not MP lock); cross-CPU races lose/leak requests and lose wakeups stalling daemon (local DoS) Base system — drivers · sys/dev/raid/vinum/vinumdaemon.c:88	corruption	reproduced fixed
DF-2130	Medium	4.7	Missing smc_idx_lock spinlock on all SMC SRAM register access -- race condition corrupts GPU power-management state Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/kv_smc.c:78	none	reproduced fixed
DF-2136	Medium	4.7	Reservation ww_mutex lock leak when reservation_object_reserve_shared fails in ttm_eu_reserve_buffers Base system — drivers · sys/dev/drm/ttm/ttm_execbuf_util.c:131	none	reproduced fixed
DF-2140	Medium	4.7	NULL pointer dereference in construct() under memory pressure -> kernel panic Privilege escalation (general use) · sys/dev/drm/amd/display/dc/core/dc_surface.c:42	panic	reproduced fixed
DF-2182	Medium	4.7	wait_on_bit_timeout() lost-wakeup / indefinite hang: missing tsleep_interlock() before condition re-check Base system — drivers · sys/dev/drm/linux_wait.c:111	dos	reproduced fixed
DF-2198	Medium	4.7	Divide-by-zero in ar5416IQCalibration when IQ cal measurements are small-but-nonzero Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5416/ar5416_cal_iq.c:95	panic	reproduced fixed
DF-2210	Medium	4.7	Unconditional NULL dereference of ch->dma in ata_national_setmode panics kernel when DMA unavailable Base system — drivers · sys/dev/disk/nata/chipsets/ata-national.c:77	panic	reproduced fixed
DF-2269	Medium	4.7	Kernel heap OOB read in cdreaddvdstructure() default case via short-transfer underflow Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_cd.c:4288	leak	reproduced fixed
DF-2586	Medium	4.7	sysctl_kern_msgbuf OOB kernel-memory read via unsigned underflow in linear-section length Privilege escalation (general use) · sys/kern/subr_prf.c:1177	panic	reproduced fixed
DF-0001	Low	4.7	Reachable KASSERT panic in kern_truncate()/kern_ftruncate() when VOP_GETATTR fails under quotas Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:4036	panic	reproduced fixed
DF-0011	Low	4.7	Missing NULL check on sbcreatecontrol() in SO_PASSCRED path -> kernel NULL-deref panic Base system — kernel core (kern) · sys/kern/uipc_usrreq.c:694	panic	reproduced fixed
DF-0076	Low	4.7	soisconnected derefs head->so_accf based on inherited child SO_ACCEPTFILTER flag (NULL-deref/UAF race) Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_socket2.c:252	none	reproduced fixed
DF-0108	Low	4.7	Unvalidated d_secsize in writedisklabel enables oversized I/O transfer Kernel memory corruption (UAF / OOB write) · sys/kern/subr_disklabel32.c:336	panic	reproduced fixed
DF-0367	Low	4.7	lagg_input dereferences ifp->if_lagg unlocked: UAF during concurrent port detach Kernel memory corruption (UAF / OOB write) · sys/net/lagg/if_lagg.c:1442	dos	reproduced fixed
DF-0370	Low	4.7	Marker PDU reflection without rate-limiting or request-address validation: on-link amplification DoS Base system — network stack · sys/net/lagg/ieee8023ad_lacp.c:1911	none	reproduced fixed
DF-0396	Low	4.7	sta_iterate drops table lock across user callback: entry can be freed concurrently use-after-free Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1413	dos	reproduced fixed
DF-0978	Low	4.7	pmap_remove_all/pmap_remove_specific: pv_entry accessed without hold after releasing pm_spin (speculative UAF) Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/pmap.c:4840	none	reproduced fixed
DF-1003	Low	4.7	usb_make_dev creates visible cdev before setting si_drv1 -> NULL-deref race in usb_open Base system — bus / platform / cpu · sys/bus/u4b/usb_device.c:1991	none	reproduced fixed
DF-1024	Low	4.7	NULL-deref panic in cam_periph_alloc failure path when xpt_create_path fails Base system — bus / platform / cpu · sys/bus/cam/cam_periph.c:219	none	reproduced fixed
DF-1206	Low	4.7	alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure Base system — drivers · sys/dev/netif/alc/if_alc.c:1361	none	reproduced fixed
DF-1226	Low	4.7	Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_calc_wrpll_link) Base system — drivers · sys/dev/drm/i915/intel_ddi.c:1298	none	reproduced fixed
DF-1267	Low	4.7	NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cmdline_mode fails under OOM Base system — drivers · sys/dev/drm/drm_fb_helper.c:2176	none	reproduced fixed
DF-1301	Low	4.7	Display scaling math divides by stream/plane rect dimensions with no zero guard (kernel #DE panic) Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_resource.c:635	none	reproduced fixed
DF-1302	Low	4.7	Unguarded integer divides by timing fields in modeset commit path allow kernel panic Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:1621	none	reproduced fixed
DF-1316	Low	4.7	Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/ni.c:769	none	reproduced fixed
DF-1318	Low	4.7	NULL cam_path dereference in sbp_target_reset iterating all LUNs Base system — drivers · sys/dev/disk/sbp/sbp.c:2098	none	reproduced fixed
DF-1322	Low	4.7	NULL-pointer dereference at attach when Envy24 subsystem unknown and EEPROM absent Base system — drivers · sys/dev/sound/pci/envy24.c:2409	none	reproduced fixed
DF-1343	Low	4.7	OOM in radeon_add_atom_connector turns into NULL-deref panic via drm_connector_cleanup on uninitialized connector Base system — drivers · sys/dev/drm/radeon/radeon_connectors.c:2343	none	reproduced fixed
DF-1376	Low	4.7	Unguarded divide-by-zero in spread-spectrum step_size when pll reference clock is zero Base system — drivers · sys/dev/drm/radeon/atombios_crtc.c:1129	none	reproduced fixed
DF-1419	Low	4.7	NULL deref in smu8_construct_max_power_limits_table when VBIOS omits SCLK dependency table Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:259	none	reproduced fixed
DF-1420	Low	4.7	OOB read of vddc_dependency_on_sclk in smu8_read_sensor GFX_SCLK (index vs table->count) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1688	none	reproduced fixed
DF-1425	Low	4.7	Unchecked HBA-controlled msg_len in screen-service writes NUL byte at arbitrary scratch offset Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir.c:1717	none	reproduced fixed
DF-1430	Low	4.7	OOB array read in twe_format_aen: TWE_AEN_UNIT(aen) up to 255 indexes twe_drive[16] Kernel memory leaks / uninitialized disclosure · sys/dev/raid/twe/twe.c:1808	none	reproduced fixed
DF-1440	Low	4.7	NULL ddc_bus dereference in amdgpu_connector_get_edid for connectors with failed I2C bus init Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:296	none	reproduced fixed
DF-1441	Low	4.7	drm_connector_cleanup on never-initialized connector in amdgpu_connector_add error path Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1902	none	reproduced fixed
DF-1444	Low	4.7	Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth) Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:1082	none	reproduced fixed
DF-1451	Low	4.7	SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/sdma_v4_0.c:918	none	reproduced fixed
DF-1465	Low	4.7	dpt_intr exits entire ISR on one bogus status packet (return should be continue) Base system — drivers · sys/dev/raid/dpt/dpt_scsi.c:1518	none	reproduced fixed
DF-1479	Low	4.7	my_start ignores my_encap failure: leaks dequeued mbuf and NULL-derefs BPF_MTAP under memory pressure Base system — drivers · sys/dev/netif/my/if_my.c:1290	panic	reproduced fixed
DF-1569	Low	4.7	Hauppauge EEPROM block-parse reads block_2/block_3 via attacker-influenced offsets without bounds checks (kernel stack OOB read / panic on probe) Kernel memory leaks / uninitialized disclosure · sys/dev/video/bktr/bktr_card.c:1001	panic	reproduced fixed
DF-1573	Low	4.7	Firmware upgrade path reads out of bounds on attacker-shaped firmware image Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_sysctl.c:257	panic	reproduced fixed
DF-1583	Low	4.7	mfi_tbolt_alloc_cmd leaks lock and NULL-derefs sc->mfi_cmd_pool_tbolt on kmalloc failure Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:455	panic	reproduced fixed
DF-1601	Low	4.7	ks_kbds slave list torn down without kbd_token in kbdmux_term, racing KBDIO_UNLOADING callback (UAF / list corruption) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/kbdmux/kbdmux.c:452	panic	reproduced fixed
DF-1613	Low	4.7	Unbounded pitch underflow in hubp1_program_size can hang the GPU Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:167	dos	reproduced fixed
DF-1623	Low	4.7	NULL-pointer dereference in atmel_reset_device when cmdprocobj (T6) object is absent Base system — drivers · sys/dev/smbus/atmel_mxt/atmel_mxt.c:418	panic	reproduced fixed
DF-1628	Low	4.7	Missing error-handling goto after opps[j] NULL check leaves NULL OPP pointer in pool, enabling later NULL-deref DoS Base system — drivers · sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1065	panic	reproduced fixed
DF-1644	Low	4.7	IOCATAREQUEST accepts count==0, passing ZERO_LENGTH_PTR as DMA target Base system — drivers · sys/dev/disk/nata/ata-all.c:462	panic	reproduced fixed
DF-1647	Low	4.7	bre() plex_concat NULL dereference when plex has zero subdisks (local DoS panic) Base system — drivers · sys/dev/raid/vinum/vinumrequest.c:491	panic	reproduced fixed
DF-1659	Low	4.7	ahci_pm: NULL deref in ahci_pm_read/ahci_pm_write when CCB pool exhausted Base system — drivers · sys/dev/disk/ahci/ahci_pm.c:841	panic	reproduced fixed
DF-1723	Low	4.7	ath_edma_tx: unvalidated hardware-supplied ts_queue_id used to index sc->sc_txq[] Base system — drivers · sys/dev/netif/ath/ath/if_ath_tx_edma.c:681	panic	reproduced fixed
DF-1787	Low	4.7	ast_reinit frees softc before ata_reinit calls ast_done/ast_detach -> NULL-deref panic on hot-unplug/reset Base system — drivers · sys/dev/disk/nata/atapi-tape.c:210	panic	reproduced fixed
DF-1799	Low	4.7	smu_helper: latent infinite loop in phm_get_voltage_index and smu_get_voltage_dependency_table_ppt_v1 (uint8_t i vs uint32_t count) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:388	panic	reproduced fixed
DF-1800	Low	4.7	smu_helper: phm_get_lowest_enabled_level infinite-loops when mask==0 Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:520	panic	reproduced fixed
DF-1839	Low	4.7	Unsigned underflow in psp_v3_1_compare_sram_data ucode_size loop: OOB read and MMIO storm (latent - caller inside #if 0) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/psp_v3_1.c:553	panic	reproduced fixed
DF-1856	Low	4.7	Unchecked kzalloc failure in i915 MST fake-encoder init leads to NULL-deref panic on hub plug-in Base system — drivers · sys/dev/drm/i915/intel_dp_mst.c:541	panic	reproduced fixed
DF-1876	Low	4.7	Integer underflow in psp_v11_0_compare_sram_data loop causes OOB read of ucode buffer — variant of DF-1839 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/psp_v11_0.c:498	panic	reproduced fixed
DF-1908	Low	4.7	get_mfd_cell_dev calls dev_info on possibly-NULL device: NULL-deref on lookup failure Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_acp.c:165	panic	reproduced fixed
DF-1929	Low	4.7	NULL-pointer dereference in acpi_battery_find_dev when battery devclass is absent Base system — drivers · sys/dev/acpica/acpi_battery.c:349	panic	reproduced fixed
DF-1934	Low	4.7	NULL-deref panic in dce4_hdmi_set_color_depth when radeon_get_connector_for_encoder returns NULL Base system — drivers · sys/dev/drm/radeon/evergreen_hdmi.c:342	panic	reproduced fixed
DF-1939	Low	4.7	NULL-deref in siba_bwn_read_ivar SIBA_IVAR_PCICORE_REVID when hardware lacks detected PCI/PCIE core Base system — drivers · sys/dev/netif/bwn/siba/siba_bwn.c:450	panic	reproduced fixed
DF-2036	Low	4.7	Unguarded divide by pp_table->FanMaximumRpm in vega20_fan_ctrl_get_fan_speed_percent Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:117	panic	reproduced fixed
DF-2053	Low	4.7	Error-cleanup NULL-deref + refcount leak in amdgpu_bo_list_create iterates wrong indices (dormant: userptr disabled on DFBSD) Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:142	panic	reproduced fixed
DF-2108	Low	4.7	Unchecked JOY_SOFTC() return dereferences NULL across all four dev entry points (local DoS / panic) Privilege escalation (general use) · sys/dev/misc/joy/joy.c:157	panic	reproduced fixed
DF-2118	Low	4.7	NULL-deref panic in amdgpu_dig_monitor_is_duallink when encoder has no linked connector Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_encoders.c:196	panic	reproduced fixed
DF-2147	Low	4.7	Unguarded aux_offset[instance] array index from firmware-derived i2c_id Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_dp_auxch.c:63	corruption	reproduced fixed
DF-2155	Low	4.7	Unguarded division by zero panics the kernel in bw_frc_to_fixed / bw_floor2 / bw_ceil2 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:69	panic	reproduced fixed
DF-2158	Low	4.7	_free_safe_mem dereferences hdr->alloc_sz to compute tail/mem before any integrity check (OOB read) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/tbridge/safe_mem.c:116	corruption	reproduced fixed
DF-2168	Low	4.7	NULL-deref in dal_irq_service_set/ack when info->funcs is NULL on uninitialized table slots Base system — drivers · sys/dev/drm/amd/display/dc/irq/irq_service.c:118	panic	reproduced fixed
DF-2225	Low	4.7	_PROP_ONCE_RUN sets completion flag before calling init racing concurrent first-user into NULL-deref on uninitialized rb_tree Privilege escalation (general use) · sys/libprop/prop_dictionary.c:288	panic	reproduced fixed
DF-2302	Low	4.7	NULL pointer dereference in fwohci_db_free when bus_dmamap_create fails partway through initialization Base system — bus / platform / cpu · sys/bus/firewire/fwohci.c:1236	panic	reproduced fixed
DF-2329	Low	4.7	Lost-wakeup race in ppb_request_bus() can permanently hang a process opening a parallel port device Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:464	denial_of_service	reproduced fixed
DF-2470	Low	4.7	Infinite loop in response-queue pointer update when target mode advances the output index Base system — drivers · sys/dev/disk/isp/isp.c:5113	denial_of_service	reproduced fixed
DF-2587	Low	4.7	NULL-dereference panic in ng_ether_input/input_orphan/output when IFP2NG(ifp) NULL Base system — network stack · sys/netgraph/ether/ng_ether.c:206	panic	reproduced fixed
DF-1681	Info	4.7	cs4281: unguarded divide in cs4281_rate_to_rv would panic if rate==0 reaches the driver Base system — drivers · sys/dev/sound/pci/cs4281.c:209	panic	reproduced fixed
DF-1729	Info	4.7	ttm_bo_vm: NULL deref panic in iomem fault path when fictitious page lookup misses Base system — drivers · sys/dev/drm/ttm/ttm_bo_vm.c:665	panic	reproduced fixed
DF-2340	High	4.6	Multicast filter buffer allocated before device descriptor is fetched -> write through ZERO_LENGTH_PTR in kue_setmulti Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/if_kue.c:488	panic	reproduced fixed
DF-2290	Medium	4.6	Unchecked info_len in crom_init_context enables OOB heap reads up to ~1000 bytes past csrrom[] buffer Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:59	leak	reproduced fixed
DF-2319	Medium	4.6	NULL pointer dereference in CISTPL_CFTABLE_ENTRY handler when no CISTPL_CONFIG precedes it Base system — bus / platform / cpu · sys/bus/pccard/pccard_cis.c:907	panic	reproduced fixed
DF-0991	Low	4.6	EHCI/XHCI early-takeover extended-capability walks have no cycle bound (hang + OOB MMIO reads) Base system — bus / platform / cpu · sys/bus/pci/pci.c:2900	none	reproduced fixed
DF-0992	Low	4.6	VPD parser calls krealloc with M_ZERO, panicking INVARIANTS kernels (krealloc explicitly asserts M_ZERO unsupported) Base system — bus / platform / cpu · sys/bus/pci/pci.c:1150	none	reproduced fixed
DF-1041	Low	4.6	Unbounded out-of-bounds read loops in CISTPL_CFTABLE_ENTRY power and misc-extension parsing Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:984	panic	reproduced fixed
DF-1549	Low	4.6	OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:1146	panic	reproduced fixed
DF-1568	Low	4.6	OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels (sibling of DF-1549) Base system — drivers · sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1005	panic	reproduced fixed
DF-1777	Low	4.6	radeon_dp_mst: missing NULL check on create_fake_mst_encoder return -> NULL deref on best_encoder callback Base system — drivers · sys/dev/drm/radeon/radeon_dp_mst.c:230	panic	reproduced fixed
DF-1883	Low	4.6	Divide-by-zero in ad_attach/ad_describe via crafted IDENTIFY geometry (heads=0 or sectors=0) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-disk.c:147	panic	reproduced fixed
DF-1903	Low	4.6	nvme_pci_detach dereferences NULL bus handle on BAR(0)-mapping-failure error path: kernel panic Base system — drivers · sys/dev/disk/nvme/nvme_attach.c:122	panic	reproduced fixed
DF-2093	Low	4.6	NULL pointer dereference in PLX attach path when local I/O resource allocation fails Kernel memory leaks / uninitialized disclosure · sys/dev/netif/wi/if_wi_pci.c:177	dos	reproduced fixed
DF-2327	Low	4.6	NULL+1 pointer dereference in ppb_pnp_detect() via malformed PnP string from malicious peripheral Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:242	panic	reproduced fixed
DF-1626	Medium	4.5	VCE IB parser lacks per-field dword bounds, enabling OOB read (pass 1) and OOB write (pass 2) into shared SA BO pool Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vce.c:724	panic	reproduced fixed
DF-2202	Medium	4.5	Unvalidated 4-bit register field indexes 9-element lookup table (OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/df_v1_7.c:50	panic	reproduced fixed
DF-2250	Medium	4.5	Unsynchronized read-modify-write race on global PRNG state randseed (SMP) Base system — libkern / libprop / ddb · sys/libkern/random.c:36	none	reproduced fixed
DF-0187	Low	4.5	vacl_get_acl/aclcheck call VOPs without vnode lock, inconsistent with set/delete Base system — kernel core (kern) · sys/kern/kern_acl.c:88	none	reproduced fixed
DF-0434	Low	4.5	bpf_filter_read (knote f_event) reads bd_* state and re-arms callout without bpf_token: race Kernel memory corruption (UAF / OOB write) · sys/net/bpf.c:1206	dos	reproduced fixed
DF-0511	Low	4.5	UAF/stale-socket race in deferred upcall ng_ksocket_incoming2: queued so pointer may be freed by shutdown Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ksocket/ng_ksocket.c:985	none	reproduced fixed
DF-1339	Low	4.5	Unvalidated NCQ error tag allows OOB read on ap_ccbs via malicious device log page Kernel memory leaks / uninitialized disclosure · sys/dev/disk/sili/sili.c:2138	none	reproduced fixed
DF-1679	Low	4.5	drm_open updates dev->open_count without drm_global_mutex (documented lock contract violation) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_file.c:330	none	reproduced fixed
DF-1878	Low	4.5	radeon_dp_work_func walks connector_list without mode_config mutex (acknowledged in source) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_irq_kms.c:98	panic	reproduced fixed
DF-2126	Low	4.5	Legacy DMA mmap path returns a kernel virtual address where a page-frame-number is required (type confusion in a_result) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_vm.c:66	leak	reproduced fixed
DF-2473	Low	4.5	isp_handle_platform_atio copies firmware CDB length into 16-byte cdb_bytes without bound (target-mode heap overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_freebsd.c:1926	limited_write	reproduced fixed
DF-2480	Low	4.5	daddr_t (int32) truncation of block address for >1TB MMC/SD media Base system — drivers · sys/dev/disk/mmcsd/mmcsd.c:326	corruption	reproduced fixed
DF-0895	High	4.4	OOB heap read via unvalidated FUSE daemon reply size in INIT/STATFS/STATVFS Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vfsops.c:216	leak:80bytes	reproduced fixed
DF-0055	Medium	4.4	Use-after-free of shared udev event dictionary in udev_event_externalize (multi-reader) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_udev.c:540	panic	reproduced fixed
DF-0239	Medium	4.4	Missing resume_kproc implementation: suspend permanently freezes kernel daemons Base system — kernel core (kern) · sys/kern/kern_kthread.c:216	dos	reproduced fixed
DF-0354	Medium	4.4	nd6_sysctl_prlist stack buffer over-read leaks kernel memory when router count exceeds buffer capacity Kernel memory leaks / uninitialized disclosure · sys/netinet6/nd6.c:2238	leak:728bytes	reproduced fixed
DF-0382	Medium	4.4	config_red divides by (max_th-min_th) and max_th without zero check: kernel panic — same bug class as dummynet v1 unfixed Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:1351	panic	reproduced fixed
DF-0441	Medium	4.4	Divide-by-zero kernel panic when ns_per_byte==0: CBQ class add/modify unconditionally divides by user-supplied value Base system — network stack · sys/net/altq/altq_rmclass.c:237	panic	reproduced fixed
DF-0474	Medium	4.4	Opcode iteration loop: F_LEN(cmd)==0 causes infinite loop hanging netisr thread Base system — network stack · sys/net/ipfw3/ip_fw3.c:493	dos	reproduced fixed
DF-0669	Medium	4.4	NULL-pointer dereference in rn_flush on never-created tables -> kernel panic via delete/flush ioctl and module unload Base system — network stack · sys/net/ipfw3_basic/ip_fw3_table.c:130	panic	reproduced fixed
DF-0731	Medium	4.4	rssadapt_tx_complete unconditionally dereferences arg2(rssi) NULL — every in-tree driver passes NULL — instant panic Base system — network stack · sys/netproto/802_11/wlan/ieee80211_rssadapt.c:327	panic	reproduced fixed
DF-0749	Medium	4.4	Unbounded table-id index in MAC-table lookup matchers — heap OOB read before eh-NULL gate (same DF-0668 pattern) Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_layer2/ip_fw3_layer2.c:118	panic	reproduced fixed
DF-0761	Medium	4.4	ipfw3 sockopt path bypasses securelevel>=3 firewall-mutability gate — missing check present in all sibling glue layers Privilege escalation (general use) · sys/net/ipfw3/ip_fw3_glue.c:50	policy-bypass	reproduced fixed
DF-0772	Medium	4.4	Infinite loop in hammer2_fixup_pfses on non-INODE blockref under super-root — system-wide HAMMER2 mount/unmount hang Hammer2 · sys/vfs/hammer2/hammer2_vfsops.c:2389	dos	reproduced fixed
DF-0773	Medium	4.4	NULL deref in devfs_inode_to_vnode — vn_lock called on NULL vp when inode not found Base system — filesystems · sys/vfs/devfs/devfs_core.c:959	panic	reproduced fixed
DF-0832	Medium	4.4	Off-by-one OOB read in udf_bmap_internal ICB iteration — ad_offset > l_ad should be + sizeof(ad) Kernel memory leaks / uninitialized disclosure · sys/vfs/udf/udf_vnops.c:1104	leak:8	reproduced fixed
DF-0835	Medium	4.4	smbfs_advlock unconditionally overwrites lock type to SMB_LOCK_EXCL — shared locks become exclusive, unlocks acquire new locks Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_vnops.c:927	logic/auth violation + remote DoS ceiling	reproduced fixed
DF-0867	Medium	4.4	Kernel panic via unvalidated rec_type in mirror_write_rec path Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:575	dos	reproduced fixed
DF-0898	Medium	4.4	NULL pointer deref when DEVFS_RULE_LINK is used without DEVFS_RULE_NAME Base system — filesystems · sys/vfs/devfs/devfs_rules.c:113	panic	reproduced fixed
DF-1051	Medium	4.4	sgopen unlocks an unheld lock and releases a periph reference that was never acquired Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:388	panic	reproduced fixed
DF-1310	Medium	4.4	Signed RX-length overflow in non-mergeable mode leads to NULL-deref panic from crafted device response Base system — drivers · sys/dev/virtual/virtio/net/if_vtnet.c:1702	panic	reproduced fixed
DF-1596	Medium	4.4	UVD destroy message lacks filp ownership check (cross-user session kill) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:781	panic	reproduced fixed
DF-1614	Medium	4.4	sln_rx mishandles RX ring wraparound: dead-code bounds check + missing modulo cause OOB reads (info leak / DoS) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/sln/if_sln.c:850	panic	reproduced fixed
DF-1633	Medium	4.4	drm_gem_mmap_single skips per-file access control, allowing any local DRM client to mmap arbitrary GEM objects via brute-forceable offset Privilege escalation (general use) · sys/dev/drm/drm_gem.c:1082	panic	reproduced fixed
DF-1678	Medium	4.4	drm_close dereferences ERR_PTR from drm_minor_acquire on device unregister -> kernel panic Base system — drivers · sys/dev/drm/drm_file.c:373	panic	reproduced fixed
DF-1682	Medium	4.4	hptmv: unchecked divide by (bArnMember-1) in hpt_rebuild_data_block -> kernel panic (local DoS) Base system — drivers · sys/dev/raid/hptmv/ioctl.c:461	panic	reproduced fixed
DF-1697	Medium	4.4	mps_sas_lsi: SAS topology and IR config change loops trust firmware NumEntries/NumElements without bounding to allocation size (heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_sas_lsi.c:208	panic	reproduced fixed
DF-2056	Medium	4.4	iwm_fill_paging_mem copies paging sections with no length/NULL validation -> kernel OOB read or NULL-deref panic from malformed firmware Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm_fw.c:170	panic	reproduced fixed
DF-2081	Medium	4.4	Missing privilege check on SIOCGATHSPECTRAL allows unprivileged radio reconfiguration and enables memory bugs Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_spectral.c:181	dos	reproduced fixed
DF-2100	Medium	4.4	intel_vgt_deballoon calls drm_mm_remove_node on unallocated balloon slots, dereferencing NULL mm Base system — drivers · sys/dev/drm/i915/i915_vgpu.c:119	dos	reproduced fixed
DF-2107	Medium	4.4	Unbounded, unchecked SMBIOS structure-table walk causes OOB read and kernel panic Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi_smbios.c:147	panic	reproduced fixed
DF-2183	Medium	4.4	NULL-pointer dereference in backlight_register: make_dev() return value never assigned to sc->cdev Base system — drivers · sys/dev/misc/backlight/backlight.c:116	panic	reproduced fixed
DF-2203	Medium	4.4	Unbounded write to stack array tmp_topology overflows when hive exceeds 4 nodes Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:66	panic	reproduced fixed
DF-2275	Medium	4.4	KKASSERT panic in DAIOCTRIM from non-512-aligned user-supplied offsets Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:443	panic	reproduced fixed
DF-2276	Medium	4.4	Infinite loop / negative b_bcount in DAIOCTRIM from negative user-supplied length Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:436	dos	reproduced fixed
DF-2309	Medium	4.4	I2CRDWR ioctl leaks usrbufs array on copyin failure (kernel memory exhaustion DoS) Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:351	dos	reproduced fixed
DF-2576	Medium	4.4	ip_fw3_ctl_zero_entry KKASSERT(zmsg.start_rule==NULL) fires deterministically on every zero/resetlog of a specific rule (root DoS panic on default INVARIANTS kernel) Base system — network stack · sys/net/ipfw3/ip_fw3.c:932	panic	reproduced fixed
DF-2592	Medium	4.4	Kernel heap memory disclosure via ip_fw3_ctl_set_get unbounded bcopy from 4-byte field Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3/ip_fw3_set.c:206	leak:4088	reproduced fixed
DF-0005	Low	4.4	TIOCSTI unrestricted terminal input injection with no killswitch Privilege escalation (general use) · sys/kern/tty.c:1158	none	reproduced fixed
DF-0019	Low	4.4	usched_bsd4.queue_checks accepts <=0 causing NULL-deref/panic in cache-coherent chooseproc Base system — kernel core (kern) · sys/kern/usched_bsd4.c:1483	panic	reproduced fixed
DF-0020	Low	4.4	ELF ABI-note descriptor read out of bounds (note_overflow ignores n_descsz) Kernel memory leaks / uninitialized disclosure · sys/kern/imgact_elf.c:1700	panic	reproduced fixed
DF-0026	Low	4.4	Root-writable bioq_reorder_minor_interval used as modulus divisor without validation -> divide-by-zero panic Base system — kernel core (kern) · sys/kern/subr_disk.c:1325	panic	reproduced fixed
DF-0029	Low	4.4	Unchecked copyin() in jrecord_data leaves stale kernel data in the journal stream Base system — kernel core (kern) · sys/kern/vfs_journal.c:1093	none	reproduced fixed
DF-0046	Low	4.4	Missing SEMVMX upper-bound in semop/semexit allows semval overflow, wrap, spurious wakeups, and rollback corruption Base system — kernel core (kern) · sys/kern/sysv_sem.c:848	dos	reproduced fixed
DF-0059	Low	4.4	Uninitialized segs[1]/segs[0] dereference when fewer than 2 PT_LOAD segments Kernel memory corruption (UAF / OOB write) · sys/kern/link_elf.c:399	none	reproduced fixed
DF-0063	Low	4.4	Hash-chain cycle in link_elf_lookup_symbol causes kernel infinite-loop DoS Base system — kernel core (kern) · sys/kern/link_elf.c:812	none	reproduced fixed
DF-0071	Low	4.4	Missing sign/upper-bound validation on vpcount before heap alloc + file read (negative->huge kmalloc M_WAITOK DoS) Base system — kernel core (kern) · sys/kern/kern_checkpoint.c:561	none	reproduced fixed
DF-0157	Low	4.4	xio_uio_copy missing upper-bound check; KKASSERT(bytes>=0) is tautology on unsigned size_t Kernel memory leaks / uninitialized disclosure · sys/kern/kern_xio.c:196	none	reproduced fixed
DF-0158	Low	4.4	Signed uoffset/bytes in copy routines let negative values bypass EFAULT guard Base system — kernel core (kern) · sys/kern/kern_xio.c:235	none	reproduced fixed
DF-0173	Low	4.4	Divide-by-zero panic via kern.hz=0 loader tunable Base system — kernel core (kern) · sys/kern/subr_param.c:200	none	reproduced fixed
DF-0191	Low	4.4	Divide-by-zero panic via log_wakeups_per_second=0 sysctl Base system — kernel core (kern) · sys/kern/subr_log.c:87	none	reproduced fixed
DF-0228	Low	4.4	hdr_lba_table (uint64) read via le32toh() -> silent 64-to-32 truncation Base system — kernel core (kern) · sys/kern/subr_diskgpt.c:133	none	reproduced fixed
DF-0358	Low	4.4	Sign error in netmap_grab_packets: computes cur+reserved instead of cur-reserved, forwarding wrong slots to host stack Base system — network stack · sys/net/netmap/netmap.c:736	none	reproduced fixed
DF-0374	Low	4.4	config_red divides by (max_th-min_th) and max_th without zero/negative check: kernel panic via setsockopt Base system — network stack · sys/net/dummynet/ip_dummynet.c:1346	dos	reproduced fixed
DF-0375	Low	4.4	red_drops divides by fs->lookup_step taken verbatim from user config: panic when lookup_step==0 Base system — network stack · sys/net/dummynet/ip_dummynet.c:885	dos	reproduced fixed
DF-0421	Low	4.4	ng_ubt_rcvdata calls panic() on malformed HCI frames from netgraph hook: local DoS Base system — network stack · sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1755	dos	reproduced fixed
DF-0422	Low	4.4	Missing validation of queue length in NGM_UBT_NODE_SET_QLEN: negative qlen -> uint32 wrap to 0xFFFFFFFF unbounded queuing Base system — network stack · sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1625	dos	reproduced fixed
DF-0424	Low	4.4	Unvalidated mf6cc_parent stored in MFC: OOB read in ip6_mdq debug path when parent >= MAXMIFS(64) Kernel memory leaks / uninitialized disclosure · sys/netinet6/ip6_mroute.c:751	none	reproduced fixed
DF-0439	Low	4.4	hfsc_dequeue panic() on NULL from hfsc_getq: kernel-panic DoS if backlogged class queue drains underneath scheduler Base system — network stack · sys/net/altq/altq_hfsc.c:827	dos	reproduced fixed
DF-0623	Low	4.4	Divide-by-zero panic in ng_car_schedule: SET_CONF permits cir==0 in non-SHAPE modes Base system — network stack · sys/netgraph7/ng_car.c:656	dos	reproduced fixed
DF-0642	Low	4.4	Signed nssid bypass in ieee80211_scan_copy_ssid causes heap buffer overflow and kernel panic Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_scan.c:296	panic	reproduced fixed
DF-0674	Low	4.4	nb_put_name() unbounded NetBIOS-name walk: infinite loop on 0xFF and heap OOB read Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_trantcp.c:122	panic	reproduced fixed
DF-0684	Low	4.4	hci_complete_sco enqueues to hci_scodone without bounds check (kernel memory exhaustion DoS) Base system — network stack · sys/netbt/hci_unit.c:538	dos	reproduced fixed
DF-0715	Low	4.4	smb_memdupin signed-length validation accepts zero (ZERO_LENGTH_PTR panic) and negative (huge kmalloc panic) lengths Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_subr.c:136	panic	reproduced fixed
DF-0727	Low	4.4	NULL-pointer dereference in NGM_FLOW_COOKIE handler when lasthook is NULL and left/right hook disconnected Base system — network stack · sys/netgraph7/tee/ng_tee.c:263	panic	reproduced fixed
DF-0736	Low	4.4	Kernel panic via forged mbuf tag with invalid dir value — panic() on attacker-controllable data Base system — network stack · sys/netgraph7/ng_ipfw.c:251	panic	reproduced fixed
DF-0746	Low	4.4	Use-after-free in l2cap_rtx: req->lr_id read after zfree in DPRINTF Kernel memory corruption (UAF / OOB write) · sys/netbt/l2cap_misc.c:190	none	reproduced fixed
DF-0838	Low	4.4	Crafted image triggers kernel panic via unimplemented directory hash algorithm (ALG2/ALG3) Base system — filesystems · sys/vfs/hammer/hammer_subs.c:953	panic	reproduced fixed
DF-0852	Low	4.4	Unvalidated user ssector causes signed-integer overflow in volume descriptor loop and volume_space_size Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_vfsops.c:326	dos	reproduced fixed
DF-0853	Low	4.4	high_sierra flag is sticky — type confusion when descriptors are mixed in crafted ISO Kernel memory corruption (UAF / OOB write) · sys/vfs/isofs/cd9660/cd9660_vfsops.c:334	none	reproduced fixed
DF-0941	Low	4.4	Kernel divide-by-zero panic in vm_get_pg_color via writable CPU topology sysctls (CTLFLAG_RW) Base system — virtual memory · sys/vm/vm_page.c:1225	panic	reproduced fixed
DF-1004	Low	4.4	usb_config_parse INIT zeros target interface endpoints before verifying alt exists -> stale pointers on failure Base system — bus / platform / cpu · sys/bus/u4b/usb_device.c:717	none	reproduced fixed
DF-1006	Low	4.4	print_db reads DMA descriptor array OOB (off-by-one loop bound <= max plus db[i+1]) Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci.c:2347	none	reproduced fixed
DF-1019	Low	4.4	daioctl uses KKASSERT (debug-only macro) to validate user-controlled DAIOCTRIM alignment -> panic on INVARIANTS, silent bypass on production Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:443	none	reproduced fixed
DF-1114	Low	4.4	RSDP accepted without checksum or Length validation (firmware-integrity hardening gap) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_sdt.c:120	dos	reproduced fixed
DF-1169	Low	4.4	Integer underflow sends 0xFFFFFFFF PCIe DPM level to SMC firmware Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4382	none	reproduced fixed
DF-1429	Low	4.4	NULL-deref panic in twe_report_request: device_printf(td_disk) when td_disk is NULL Base system — drivers · sys/dev/raid/twe/twe.c:1862	none	reproduced fixed
DF-1493	Low	4.4	Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0 Base system — drivers · sys/dev/disk/ccd/ccd.c:1319	panic	reproduced fixed
DF-1505	Low	4.4	Missing NULL check on dev->si_drv1 in genkbdkqfilter and genkbdfiltdetach (kernel panic on detached kbd) Base system — drivers · sys/dev/misc/kbd/kbd.c:839	panic	reproduced fixed
DF-1592	Low	4.4	Unvalidated csio->cdb_len overflows cmd_pkt->cmd.pkt_a.cdb[16] in tws_execute_scsi Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_cam.c:757	panic	reproduced fixed
DF-1618	Low	4.4	Integer underflow in dce120_timing_generator_validate_timing defeats the v_blank lower-bound check Base system — drivers · sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:107	panic	reproduced fixed
DF-1651	Low	4.4	sbsh: SIOCLOADFIRMW firmware pointer dereferenced in kernel without copyin -> fatal page fault Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sbsh/if_sbsh.c:409	panic	reproduced fixed
DF-1668	Low	4.4	vmbus: NULL deref in vmbus_msghc_wakeup on host-injected spurious VERSION_RESP Base system — drivers · sys/dev/virtual/hyperv/vmbus/vmbus.c:613	panic	reproduced fixed
DF-1669	Low	4.4	if_vke: uninitialized struct tapinfo stack read leaks via ifconfig ifp->if_mtu/if_baudrate Kernel memory leaks / uninitialized disclosure · sys/dev/virtual/vkernel/net/if_vke.c:771	leak:0	reproduced fixed
DF-1700	Low	4.4	vn: signed integer overflow in file-backed disk-size math (vn->sc_size = vn_size * PAGE_SIZE / DEV_BSIZE) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/vn/vn.c:559	panic	reproduced fixed
DF-1721	Low	4.4	amdgpu_gem: GEM_CREATE GDS-domain ALIGN(size,4) wrap to zero produces zero-size GEM object Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_gem.c:248	none	reproduced fixed
DF-1722	Low	4.4	amdgpu_gem: GEM_VA ioctl VA-reserved-area bypass via HOLE_END then GMC_HOLE_MASK Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_gem.c:566	none	reproduced fixed
DF-1807	Low	4.4	amdgpu_fence: power-of-two check accepts 0 -> kcalloc(0) returns ZERO_LENGTH_PTR -> NULL deref panic on first emit Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_fence.c:424	panic	reproduced fixed
DF-1852	Low	4.4	Unchecked copyin return + no M_ZERO in hptmv ioctl lets stale kernel heap leak via copyout Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptmv/hptproc.c:297	panic	reproduced fixed
DF-1853	Low	4.4	NULL-pointer dereference of gIal_Adapter in hptmv ioctl path panics kernel when no adapter attached Base system — drivers · sys/dev/raid/hptmv/hptproc.c:309	panic	reproduced fixed
DF-1872	Low	4.4	Divide-by-zero panic via sysctl kern.dcons.poll_hz=0 Kernel memory leaks / uninitialized disclosure · sys/dev/misc/dcons/dcons_os.c:353	panic	reproduced fixed
DF-1885	Low	4.4	initsd computes size=0 for init_blocksize in [1,511]: OOB read / NULL-deref panic via bcmp Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumrevive.c:511	panic	reproduced fixed
DF-1898	Low	4.4	Firmware-controlled lengths in iwm_phy_db_set_section never validated against RX packet size: heap OOB read / kernel panic Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm_phy_db.c:268	panic	reproduced fixed
DF-1902	Low	4.4	Host-root triggerable kernel panic via IFM_ETH_MASTER on non-1000baseT media Base system — drivers · sys/dev/netif/mii_layer/mii_physubr.c:372	panic	reproduced fixed
DF-1905	Low	4.4	Missing AcpiRemoveNotifyHandler in detach leaves dangling ACPI notify handler: UAF/freed-text jump after kldunload Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_dock/acpi_dock.c:518	panic	reproduced fixed
DF-1915	Low	4.4	ida_detach frees DMA maps and QCB memory while I/O may be in flight: UAF/panic Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ida/ida.c:276	panic	reproduced fixed
DF-1935	Low	4.4	CTLFLAG_ANYBODY on writable brightness/mute sysctls allows unprivileged local writes (variant of DF-1892) Base system — drivers · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:167	none	reproduced fixed
DF-2046	Low	4.4	dma_fence_default_wait returns negative value on clean timeout (unsigned wrap) misreported as error to unprivileged render clients Privilege escalation (general use) · sys/dev/drm/linux_fence.c:124	none	reproduced fixed
DF-2048	Low	4.4	NULL-pointer dereference in TBRIDGE_GETRESULT dereferences tbridge_curtest without NULL check Base system — drivers · sys/dev/misc/tbridge/tbridge.c:266	panic	reproduced fixed
DF-2057	Low	4.4	NULL pointer dereference via unvalidated backing-device vnode type in dm_pdev_insert Base system — drivers · sys/dev/disk/dm/dm_pdev.c:168	panic	reproduced fixed
DF-2098	Low	4.4	GPIO index unvalidated in 4/5 ar5416 HAL exported functions (HALASSERT compiled out) -> UB shifts -> local DoS Base system — drivers · sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:90	dos	reproduced fixed
DF-2150	Low	4.4	dm-linear loads tables with no offset/length bounds check; offset arithmetic overflows and breaks device confinement Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/linear/dm_target_linear.c:75	none	reproduced fixed
DF-2169	Low	4.4	maxluns clamp is a dead store; user-controlled value flows unfiltered into CAM cpi->max_lun, enabling local LUN-scan DoS Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_subr.c:123	none	reproduced fixed
DF-2201	Low	4.4	GPIO index unvalidated in 4/5 exported ar5212 HAL GPIO functions (HALASSERT compiled out; SetIntr has no check) -> UB shifts -> local DoS Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:41	dos	reproduced fixed
DF-2212	Low	4.4	ttm_exit() deadlocks forever in uninterruptible wait_event on condition that can never become true Base system — drivers · sys/dev/drm/ttm/ttm_module.c:40	dos	reproduced fixed
DF-2241	Low	4.4	Signed divide/modulo by -1 on LONG_MIN triggers #DE trap leaking db_active wedging system after DDB exit Privilege escalation (general use) · sys/ddb/db_expr.c:147	dos	reproduced fixed
DF-2264	Low	4.4	Control-device ioctl path leaks cam_periph_lock (SIM-wide deadlock) Privilege escalation (general use) · sys/bus/cam/scsi/scsi_sa.c:849	dos	reproduced fixed
DF-2267	Low	4.4	CAMGETPASSTHRU can spin forever holding the SIM lock (privileged local DoS) Base system — bus / platform / cpu · sys/bus/cam/cam_periph.c:901	denial_of_service	reproduced fixed
DF-2312	Low	4.4	I2CRDWR: no upper-bound validation on nmsgs allows massive kernel allocations (DoS) Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:351	panic	reproduced fixed
DF-2437	Low	4.4	Module-unload handler destroys shared objcache even when dm_target_remove fails EBUSY causing NULL-deref panic on subsequent I/O Base system — drivers · sys/dev/disk/dm/delay/dm_target_delay.c:440	panic	reproduced fixed
DF-2466	Low	4.4	Heap overflow in i_send via ahs_len/ds_len padding mismatch with i_prepPDU Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi.c:454	panic	reproduced fixed
DF-2502	Low	4.4	Signed int len assigned from u_int32_t dxfer_len signedness overflow in INQUIRY bzero and odd-length kmalloc/bcopy Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/atapi-cam.c:353	corruption	reproduced fixed
DF-2515	Low	4.4	SCSI CDB heap buffer overflow past orb[7] into ind_ptr on 16-byte CDBs Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sbp/sbp.c:2337	limited_write	reproduced fixed
DF-1788	Info	4.4	acpi_fujitsu: CTLFLAG_ANYBODY sysctls forward unbounded user ints into ACPI control methods Base system — drivers · sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:415	none	reproduced fixed
DF-0270	Low	4.3	OOB read in PAP ACK/NAK debug: wrong bound len+4 should be len-4 Kernel memory leaks / uninitialized disclosure · sys/net/sppp/if_spppsubr.c:4390	none	reproduced fixed
DF-0284	Low	4.3	Missing per-command payload bounds checks in MCC handlers (OOB read) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521	none	reproduced fixed
DF-0290	Low	4.3	GANN sequence comparison not wrap-safe (raw <= on uint32) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:2649	none	reproduced fixed
DF-0294	Low	4.3	KASSERT panic/uint16 truncation in get_scan_result from remote IE length Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ioctl.c:280	panic	reproduced fixed
DF-0346	Low	4.3	Uninitialized stack read of rsnparms on WPS/TSN assoc path bypasses HT-cipher downgrade protection Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_hostap.c:1934	none	reproduced fixed
DF-0386	Low	4.3	ng_ppp_frag_checkstale sequence tracking diverges after gaps: stale-packet delivery suppressed Base system — network stack · sys/netgraph/ppp/ng_ppp.c:1384	none	reproduced fixed
DF-0387	Low	4.3	No MRRU enforcement on MP fragment reassembly: peer can assemble oversized PDUs beyond negotiated MRRU Base system — network stack · sys/netgraph/ppp/ng_ppp.c:1203	dos	reproduced fixed
DF-0394	Low	4.3	SSID/rates/xrates copies rely solely on upstream parse_beacon validation: KASSERT is no-op on production kernels Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:282	none	reproduced fixed
DF-0432	Low	4.3	Crafted PFSYNC_ACT_BUS endtime prematurely marks pfsync_sync_ok: HA-status spoofing Base system — network stack · sys/net/pf/if_pfsync.c:950	none	reproduced fixed
DF-0455	Low	4.3	MCC multi-byte length decode reverses octet ordering: interoperability bug for MCC frames >= 128 bytes Base system — network stack · sys/netbt/rfcomm_session.c:1027	none	reproduced fixed
DF-0468	Low	4.3	ip6_savecontrol ext-header walk has no nest limit (self-flagged by code comment) Base system — network stack · sys/netinet6/ip6_input.c:1214	dos	reproduced fixed
DF-0482	Low	4.3	sc_topology_change_time never initialized: premature TC timer expiry defeats topology change notification Base system — network stack · sys/net/bridge/bridgestp.c:1465	none	reproduced fixed
DF-1073	Low	4.3	pnp_check_quirks PNP_QUIRK_EXTRA_IO writes past ic_port[ISA_NPORT] without bounds check Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnp.c:335	none	reproduced fixed
DF-1121	Low	4.3	Extended SCSI message with length=7 causes 1-byte DMA write past msgin[8] into lastmsg Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sym/sym_hipd.c:1652	panic	reproduced fixed
DF-1132	Low	4.3	NULL deref / panic in bwn_dma_parse_cookie on unexpected TX-status cookie Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn.c:7065	panic	reproduced fixed
DF-2152	Low	4.3	ath_led_event indexes sc_hwmap[32] with unchecked rate index from received frame (OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_led.c:189	corruption	reproduced fixed
DF-0273	Medium	4.2	Missing break between SIOCSIFDESCR and SIOCSIFFLAGS: fall-through reinterprets description length as interface flags Base system — network stack · sys/net/if.c:2131	dos	reproduced fixed
DF-1654	Medium	4.2	sbsh: RX descriptor length=0 with only 2046 bytes after m_adj(m,2) -> heap overflow Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sbsh/if_sbsh.c:767	panic	reproduced fixed
DF-0089	Low	4.2	Resource merge in release path ignores address contiguity - creates false spans across unmanaged gaps Base system — kernel core (kern) · sys/kern/subr_rman.c:560	none	reproduced fixed
DF-0338	Low	4.2	tcp_mtudisc accepts forged ICMP MTU small enough to drive t_maxseg negative Base system — network stack · sys/netinet/tcp_subr.c:1783	none	reproduced fixed
DF-0399	Low	4.2	rtredirect_oncpu ignores rt_setgate return: routes redirect that failed or self-targets Base system — network stack · sys/net/route.c:421	none	reproduced fixed
DF-0582	Low	4.2	ieee80211_parse_beacon FHPARMS/DSPARMS field reads exceed declared IE length: OOB read Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_input.c:571	panic	reproduced fixed
DF-1598	Low	4.2	Firmware header fields read without size check after amdgpu_ucode_validate Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/sdma_v2_4.c:154	panic	reproduced fixed
DF-2095	Low	4.2	u8 loop-variable underflow + signed shift UB in intel_dp_aux_set_pwm_freq (DoS via malicious eDP panel) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_dp_aux_backlight.c:114	dos	reproduced fixed
DF-0119	Info	4.2	Latent OOB write if aux_data/aux_size invariant breaks Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskiocom.c:207	none	reproduced fixed
DF-0595	Info	4.2	Michael MIC verification uses non-constant-time memcmp (defense-in-depth) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:359	leak:timing	reproduced fixed
DF-1345	Medium	4.1	Divide-by-zero in polaris10_thermal_setup_fan_table from VBIOS-controlled fan temperature points Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:2048	dos	reproduced fixed
DF-0241	Low	4.1	kproc_start dereferences thread pointer before checking kthread_create error Base system — kernel core (kern) · sys/kern/kern_kthread.c:176	none	reproduced fixed
DF-0298	Low	4.1	ng_type->refs refcount mutated without typelist lock Kernel memory corruption (UAF / OOB write) · sys/netgraph7/netgraph/ng_base.c:636	none	reproduced fixed
DF-0304	Low	4.1	CARP shared secret key material not zeroed before kfree Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_carp.c:307	leak	reproduced fixed
DF-0376	Low	4.1	Negative qsize bypasses queue-size limit via signed/unsigned comparison: unbounded mbuf accumulation / OOM Base system — network stack · sys/net/dummynet/ip_dummynet.c:1437	dos	reproduced fixed
DF-0397	Low	4.1	rt_setshims: unchecked R_Malloc (M_NULLOK) leads to NULL-pointer-write panic via bcopy to NULL Base system — network stack · sys/net/route.c:1374	dos	reproduced fixed
DF-0491	Low	4.1	NULL td dereference in SIOCSIFDSTADDR and default ioctl handlers despite documented td might be NULL contract Base system — network stack · sys/netinet/in.c:606	dos	reproduced fixed
DF-0496	Low	4.1	rn_walktree_from dereferences caller-supplied mask without NULL check Kernel memory leaks / uninitialized disclosure · sys/net/radix.c:1098	leak	reproduced fixed
DF-0523	Low	4.1	Deferred INTERNAL_UPCALL re-invokes upcall against torn-down node/socket: UAF/NULL deref (DF-0511 v1 twin) Kernel memory corruption (UAF / OOB write) · sys/netgraph/ksocket/ng_ksocket.c:623	none	reproduced fixed
DF-0707	Low	4.1	Missing return after NG_FREE_ITEM in ng_etf_rcvdata — same pattern as DF-0696 (reduced impact in ng7) Privilege escalation (general use) · sys/netgraph7/etf/ng_etf.c:377	panic	reproduced fixed
DF-0792	Low	4.1	NULL deref in direct I/O paths when hammer_get_volume fails — hammer_rel_volume(NULL) unconditional Base system — filesystems · sys/vfs/hammer/hammer_io.c:1487	panic	reproduced fixed
DF-0985	Low	4.1	mtw_ucode_write heap overflow via oversized firmware ILM/DLM lengths (firmware-supplied metadata overflows txd_fw->buf[]) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:1056	none	reproduced fixed
DF-1034	Low	4.1	Boot-time kernel panic on malformed MP-table INT entry (dst_apic_int >= IO-APIC pin count) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:1296	none	reproduced fixed
DF-1049	Low	4.1	Serializer leak on bus_setup_intr failure in ig4iic_attach causes self-deadlock during cleanup Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:648	none	reproduced fixed
DF-1050	Low	4.1	NULL-deref kernel panic in usb_detach when usb_proc_create failed during usb_attach_sub Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/controller/usb_controller.c:180	none	reproduced fixed
DF-1094	Low	4.1	Use-after-free of acpi_event_info during detach races in-flight AcpiOsExecute event work Kernel memory corruption (UAF / OOB write) · sys/bus/gpio/gpio_acpi/gpio_acpi.c:341	panic	reproduced fixed
DF-1100	Low	4.1	Unsynchronized use-after-free of bus->ifp in usbpf_xfertap (DONE tap path) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_pf.c:362	panic	reproduced fixed
DF-1105	Low	4.1	NULL-pointer dereference panic via uhci_reset() in uhci_pci_attach error paths Privilege escalation (general use) · sys/bus/u4b/controller/uhci_pci.c:286	panic	reproduced fixed
DF-1129	Low	4.1	Divide-by-zero in si_thermal_setup_fan_table from unvalidated BIOS fan-table temperatures Base system — drivers · sys/dev/drm/amd/amdgpu/si_dpm.c:6489	panic	reproduced fixed
DF-1207	Low	4.1	alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12-bit) and nsegs (4-bit) without bounds validation Kernel memory leaks / uninitialized disclosure · sys/dev/netif/alc/if_alc.c:3304	none	reproduced fixed
DF-1220	Low	4.1	acpi_eval_osc() dereferences _OSC return without validating it is a Buffer Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi.c:1326	none	reproduced fixed
DF-1303	Low	4.1	mlx_getslot uses firmware-reported me_max_commands as array bound without clamping to MLX_NSLOTS Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mlx/mlx.c:1962	none	reproduced fixed
DF-1331	Low	4.1	NULL pointer dereference in attach error path when cfg is unset Base system — drivers · sys/dev/sound/pci/envy24ht.c:2519	none	reproduced fixed
DF-1426	Low	4.1	Divide-by-zero in iir_init from HBA-supplied mapping fields with zero heads or secs Base system — drivers · sys/dev/raid/iir/iir.c:413	none	reproduced fixed
DF-1428	Low	4.1	NULL-deref panic in twe_describe_controller: p[0] from twe_get_param not checked Base system — drivers · sys/dev/raid/twe/twe.c:1691	none	reproduced fixed
DF-1457	Low	4.1	MC firmware header fields trusted without bounds validation causing heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/gmc_v8_0.c:314	none	reproduced fixed
DF-1538	Low	4.1	gmc_v7_0_mc_load_microcode trusts MC firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457 v7 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/gmc_v7_0.c:189	panic	reproduced fixed
DF-1550	Low	4.1	NULL pointer dereference of tdp_table from VBIOS PowerPlay table missing usPowerTuneTableOffset Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_powertune.c:1294	panic	reproduced fixed
DF-1553	Low	4.1	cik_sdma_load_microcode trusts SDMA firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457/DF-1538 SDMA twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/cik_sdma.c:539	panic	reproduced fixed
DF-1610	Low	4.1	NULL pointer dereference of cac_dtp_table when VBIOS omits usPowerTuneTableOffset (sibling of DF-1550) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_powertune.c:1120	panic	reproduced fixed
DF-1653	Low	4.1	sbsh: unbounded spin loop in issue_cx28975_cmd hangs the kernel Base system — drivers · sys/dev/netif/sbsh/if_sbsh.c:1042	dos	reproduced fixed
DF-1663	Low	4.1	ttm_page_alloc: fini races vm_lowmem shrinker on static_buf and _manager lifetime Base system — drivers · sys/dev/drm/ttm/ttm_page_alloc.c:388	panic	reproduced fixed
DF-1701	Low	4.1	vn: unlocked SLIST vn_list mutations vs SLIST_FOREACH in vnget -> list corruption / UAF Kernel memory corruption (UAF / OOB write) · sys/dev/disk/vn/vn.c:137	panic	reproduced fixed
DF-1731	Low	4.1	tws_attach arms IRQ and publishes /dev/tws<unit> before sc->reqs allocated -> NULL-deref panic Base system — drivers · sys/dev/raid/tws/tws.c:268	panic	reproduced fixed
DF-1735	Low	4.1	vinumio: divide-by-zero panic in set_drive_parms when device reports media_blksize==0 Base system — drivers · sys/dev/raid/vinum/vinumio.c:119	panic	reproduced fixed
DF-1766	Low	4.1	ar5413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers causes OOB read and index wrap Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:302	panic	reproduced fixed
DF-1770	Low	4.1	intel_dsi_vbt: NULL-deref on dsi_hosts[port] in mipi_exec_send_packet Base system — drivers · sys/dev/drm/i915/intel_dsi_vbt.c:127	panic	reproduced fixed
DF-1773	Low	4.1	intel_dsi_vbt: NULL-deref on vbt.lfp_lvds_vbt_mode in intel_dsi_vbt_init Base system — drivers · sys/dev/drm/i915/intel_dsi_vbt.c:508	panic	reproduced fixed
DF-1785	Low	4.1	radeon_bios: kmalloc-NULL-deref ordering in radeon_acpi_vfct_bios - memcpy before NULL check Base system — drivers · sys/dev/drm/radeon/radeon_bios.c:717	panic	reproduced fixed
DF-1831	Low	4.1	ichwd_attach fail path dereferences ZERO_LENGTH_PTR softc, panicking on attach failure Kernel memory corruption (UAF / OOB write) · sys/dev/misc/ichwd/ichwd.c:603	panic	reproduced fixed
DF-1842	Low	4.1	amr_cam_attach overflows amr_cam_sim[] if controller reports more than AMR_MAX_CHANNELS channels Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr_cam.c:170	panic	reproduced fixed
DF-1845	Low	4.1	gpio_unregister calls devfs_clone_bitmap_get instead of _put, panicking kernel after repeated attach/detach Kernel memory leaks / uninitialized disclosure · sys/dev/misc/gpio/gpio.c:596	leak	reproduced fixed
DF-1865	Low	4.1	Unbounded KCS reply-collection loop hangs kthread on hostile/buggy BMC Base system — drivers · sys/dev/misc/ipmi/ipmi_kcs.c:410	dos	reproduced fixed
DF-1866	Low	4.1	ipmi_kcs_probe_align has unbounded polling loops (boot-time DoS) Base system — drivers · sys/dev/misc/ipmi/ipmi_kcs.c:527	dos	reproduced fixed
DF-1879	Low	4.1	Missing pipe_bpp!=0 guard in vlv_dsi_get_pclk causes kernel divide-by-zero panic Base system — drivers · sys/dev/drm/i915/vlv_dsi_pll.c:325	panic	reproduced fixed
DF-1886	Low	4.1	parityrebuild divides by plex->stripesize and plex->subdisks with no zero guard: div0 panic Base system — drivers · sys/dev/raid/vinum/vinumrevive.c:116	panic	reproduced fixed
DF-1937	Low	4.1	Divide-by-zero in spread-spectrum clock math when ATOM BIOS supplies ss.rate==0 Base system — drivers · sys/dev/drm/radeon/rv730_dpm.c:97	panic	reproduced fixed
DF-1942	Low	4.1	Integer overflow in r600_copy_dma size_in_dw: silent short/zero-length GPU copy with successful fence (latent on R600, live on rv770/evergreen siblings) Base system — drivers · sys/dev/drm/radeon/r600_dma.c:457	panic	reproduced fixed
DF-1963	Low	4.1	Use-after-free in MOD_UNLOAD: kfree(k8pnow_current_state) before sysctl_ctx_free Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/powernow/powernow.c:322	panic	reproduced fixed
DF-2044	Low	4.1	mps_pci_free releases never-allocated IRQ resource panicking kernel on attach-failure paths Base system — drivers · sys/dev/raid/mps/mps_pci.c:230	panic	reproduced fixed
DF-2082	Low	4.1	amrd_detach runs without synchronizing in-flight bios UAF in amrd_intr after controller detach Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr_disk.c:276	dos	reproduced fixed
DF-2116	Low	4.1	UAF/TOCTOU race: IRQ handler dereferences sc->mpu while detach frees it (mpu401_uninit runs before emu_intr_unregister) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/emu10kx-midi.c:223	corruption	reproduced fixed
DF-2137	Low	4.1	NULL-deref panic via device_get_softc(devclass_get_device(...)) in sc_get_softc and sc_find_softc Base system — drivers · sys/dev/misc/syscons/syscons_nexus.c:117	panic	reproduced fixed
DF-2138	Low	4.1	Missing u<0 guard in sc_get_cons_priority allows negative unit to reach sccninit and NULL-deref Base system — drivers · sys/dev/misc/syscons/syscons_nexus.c:162	none	reproduced fixed
DF-2143	Low	4.1	splash_unregister leaves stale decoder pointers in decoder_set (use-after-unload) Kernel memory corruption (UAF / OOB write) · sys/dev/video/fb/splash.c:146	corruption	reproduced fixed
DF-2151	Low	4.1	Kernel panic on device attach error path: bus_release_resource uses wrong rid for io resource Kernel memory leaks / uninitialized disclosure · sys/dev/raid/dpt/dpt_pci.c:174	none	reproduced fixed
DF-2254	Low	4.1	kqsort_r recurses without depth bound: latent stack-exhaustion DoS (sibling of DF-2245 via shared qsort.c body) Base system — libkern / libprop / ddb · sys/libkern/qsort_r.c:7	panic	reproduced fixed
DF-2261	Low	4.1	PROBE_SERIAL_NUM_1 OOB-read of VPD 0x80 response and XPT_GDEV_TYPE overflow of cgd->serial_num[252] Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:6335	leak	reproduced fixed
DF-2307	Low	4.1	UAF race in gpio_acpi_unmap_aei: deferred AEI event handler dereferences freed info struct Kernel memory corruption (UAF / OOB write) · sys/bus/gpio/gpio_acpi/gpio_acpi.c:347	panic	reproduced fixed
DF-2477	Low	4.1	md_drvcleanup module-unload path has refcnt TOCTOU that frees md_s out from under a racing mdopen Base system — drivers · sys/dev/disk/md/md.c:133	corruption	reproduced fixed
DF-2526	Low	4.1	trm_detach tears down DMA/IOPORT resources before bus_teardown_intr interrupt handler can execute against freed memory during detach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:3696	corruption	reproduced fixed
DF-2530	Low	4.1	Unclamped sense_len overflows 32-byte inline sense_data buffer on CHECK CONDITION Kernel memory corruption (UAF / OOB write) · sys/dev/disk/vpo/vpo.c:266	limited_write	reproduced fixed
DF-1710	Info	4.1	amdgpu_vcn: firmware header fields used without bounds checks - heap overflow via crafted firmware (defense-in-depth) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vcn.c:126	panic	reproduced fixed
DF-0388	Medium	4.0	Kernel heap info leak via uninitialized rt_msghdr.rtm_inits in NET_RT_DUMP sysctl: no M_ZERO on buffer Privilege escalation (general use) · sys/net/rtsock.c:1676	leak:130bytes	reproduced fixed
DF-2314	Medium	4.0	Missing large_len>0 guard in ANSI-string trim walks buf[] backwards (OOB stack read + NUL write + stack info-leak via device desc) Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnp.c:399	leak	reproduced fixed
DF-0025	Low	4.0	Missing privilege check on sys_kldstat()/sys_kldsym() leaks kernel symbol and module addresses Privilege escalation (general use) · sys/kern/kern_linker.c:940	leak	reproduced fixed
DF-0090	Low	4.0	rman_reserve_resource has no count==0 guard - unsigned underflow in range math corrupts resource list Base system — kernel core (kern) · sys/kern/subr_rman.c:205	none	reproduced fixed
DF-0333	Low	4.0	Kernel pointer leak to unprivileged users via in_pcblist_range xinpcb dump Kernel memory leaks / uninitialized disclosure · sys/netinet/in_pcb.c:2409	leak	reproduced fixed
DF-0389	Low	4.0	Sockaddr padding not zeroed in rt_msg_buffer/rt_msg_mbuf: 1-7 bytes kernel memory leak per sockaddr Kernel memory leaks / uninitialized disclosure · sys/net/rtsock.c:1140	leak	reproduced fixed
DF-1000	Low	4.0	Unbounded linear scan in rum_set_chan over rfprog channel table (defense-in-depth) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_rum.c:2083	none	reproduced fixed
DF-2315	Low	4.0	pnp_check_quirks PNP_QUIRK_EXTRA_IO writes ic_port[] past ISA_NPORT without bounds check Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnp.c:335	corruption	reproduced fixed
DF-2508	Low	4.0	u32 integer overflow in afd_sense capabilities-path mediasize calculation Base system — drivers · sys/dev/disk/nata/atapi-fd.c:409	corruption	reproduced fixed
DF-2525	Low	4.0	trm_check_eeprom default-load writes 8-byte u_long into 4-byte field schema 122-byte OOB write of static trm_eepromBuf[] on x86_64 at attach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:3304	limited_write	reproduced fixed
DF-1689	Medium	3.9	vega20_processpptables: VBIOS powerplay table size not validated against structure footprint -> OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:636	panic	reproduced fixed
DF-1690	Medium	3.9	vega20_processpptables: append_vbios_pptable dereferences smc_dpm_info VBIOS table without validating its size Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:714	panic	reproduced fixed
DF-0095	Low	3.9	Per-process shmmap_state sized at alloc-time shmseg but all loops re-read LIVE root-writable shminfo.shmseg - OOB when raised Kernel memory corruption (UAF / OOB write) · sys/kern/sysv_shm.c:284	none	reproduced fixed
DF-0096	Low	3.9	sglist_join has reversed bcopy arguments - joins produce stale/garbage segments (dead code, identical to upstream FreeBSD) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_sglist.c:583	none	reproduced fixed
DF-0295	Low	3.9	UAF race in setappie: non-atomic pointer swap/free vs concurrent beacon/IE readers Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_ioctl.c:2272	none	reproduced fixed
DF-0321	Low	3.9	Uninitialized stack read of maxunequalmcs when HTC_TXUNEQUAL set but ic_txstream<2 Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_ht.c:1643	none	reproduced fixed
DF-0597	Low	3.9	Use-after-free in ng_pptpgre (netgraph7) session timer callbacks after hook disconnect frees hpriv Kernel memory corruption (UAF / OOB write) · sys/netgraph7/pptpgre/ng_pptpgre.c:494	panic	reproduced fixed
DF-0629	Low	3.9	ng_ether_rcv_upper skips bridge_input_p handoff, bypassing bridge input filtering on upper-hook-injected packets Kernel memory corruption (UAF / OOB write) · sys/netgraph/ether/ng_ether.c:582	none	reproduced fixed
DF-0798	Low	3.9	Missing bounds check on B-Tree node in-buffer offset — OOB heap read during CRC validation Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_ondisk.c:1306	panic	reproduced fixed
DF-0827	Low	3.9	FAT12 1-byte OOB read in pcbmap via crafted cluster chain on small-FAT images Kernel memory leaks / uninitialized disclosure · sys/vfs/msdosfs/msdosfs_fat.c:187	leak:1	reproduced fixed
DF-1791	Low	3.9	puc: NULL-deref kernel panic in puc_config_superio when BAR 0 fails to allocate Base system — drivers · sys/dev/misc/puc/puc.c:273	panic	reproduced fixed
DF-1888	Low	3.9	Buffer over-read + u16 length underflow in e1000_mng_host_if_write_generic on misaligned offset with short length Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ig_hal/e1000_manage.c:237	panic	reproduced fixed
DF-1924	Low	3.9	Unbounded hardware spin in tws_init_ctlr hangs kernel at device attach Base system — drivers · sys/dev/raid/tws/tws_hdm.c:100	dos	reproduced fixed
DF-1925	Low	3.9	Unbounded hardware spin in tws_ctlr_reset stage-1 hangs kernel during recovery Base system — drivers · sys/dev/raid/tws/tws_hdm.c:473	dos	reproduced fixed
DF-1926	Low	3.9	tws_init_connect leaks sole internal-request slot on poll failure permanently disabling controller init/reset Kernel memory leaks / uninitialized disclosure · sys/dev/raid/tws/tws_hdm.c:188	leak	reproduced fixed
DF-1943	Low	3.9	r600_copy_dma under-reserves ring dwords: sync semaphore+fence can overflow reserved count corrupting GPU command stream Base system — drivers · sys/dev/drm/radeon/r600_dma.c:459	panic	reproduced fixed
DF-1958	Low	3.9	Unclamped csio->cdb_len and csio->sense_len allow OOB read of cdb_bytes and OOB write of sense_data in vpo_intr Kernel memory leaks / uninitialized disclosure · sys/dev/disk/vpo/vpo.c:220	panic	reproduced fixed
DF-0036	Info	3.9	%n format specifier enabled in kernel printf engine with zero in-tree consumers Kernel memory leaks / uninitialized disclosure · sys/kern/subr_prf.c:688	none	reproduced fixed
DF-0357	Info	3.9	nd6_cache_lladdr ignores lladdrlen parameter, uses ifp->if_addrlen for bcopy Kernel memory leaks / uninitialized disclosure · sys/netinet6/nd6.c:1768	none	reproduced fixed
DF-0372	Info	3.9	Undefined behavior shift 1 << if_dunit for member NIC unit numbers >= 32 Base system — network stack · sys/net/lagg/ieee8023ad_lacp.c:310	none	reproduced fixed
DF-0136	Medium	3.8	Jail isolation breach: varsym_list(VARSYM_SYS) leaks host varsyms to jailed processes Kernel memory leaks / uninitialized disclosure · sys/kern/kern_varsym.c:263	leak	reproduced fixed
DF-1945	Low	3.8	afd_describe divides by attacker-controlled sectorsize=0: kernel panic at attach (bootverbose only) Base system — drivers · sys/dev/disk/nata/atapi-fd.c:383	panic	reproduced fixed
DF-0344	Low	3.7	No re-validation of m_len>=hlen after pfil hook rewrite/dummynet re-entry Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_input.c:631	dos	reproduced fixed
DF-0465	Low	3.7	Handshake state irrevocably corrupted when noise_begin_session kmalloc(M_NOWAIT) fails Base system — network stack · sys/net/wg/wg_noise.c:1188	none	reproduced fixed
DF-0693	Low	3.7	ICV verification reads past mbuf data when ICV straddles mbuf boundary Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:477	leak	reproduced fixed
DF-0714	Low	3.7	One-byte OOB read in TCP option parser correct_mss when olen==1 after consuming NOPs Kernel memory leaks / uninitialized disclosure · sys/netgraph7/tcpmss/ng_tcpmss.c:426	none	reproduced fixed
DF-1188	Low	3.7	OOB read in em_rxeof when NIC reports desc_len=0 on error descriptor Kernel memory leaks / uninitialized disclosure · sys/dev/netif/em/if_em.c:3692	panic	reproduced fixed
DF-2101	Low	3.7	DSCSR_10FDX status branch sets IFM_HDX instead of IFM_FDX (duplex misreport -> duplex-mismatch DoS) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mii_layer/amphy.c:268	none	reproduced fixed
DF-0113	Low	3.6	PT_DETACH reparents tracee to recycled p_oppid PID Base system — kernel core (kern) · sys/kern/sys_process.c:350	none	reproduced fixed
DF-0147	Low	3.6	Signed/unsigned accounting: int64_t delta added to uint64_t ac_bytes can wrap Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_quota.c:160	none	reproduced fixed
DF-0151	Low	3.6	Fixed-size reads in preload_modinfo_value ignore field length Kernel memory leaks / uninitialized disclosure · sys/kern/subr_module.c:374	none	reproduced fixed
DF-0152	Low	3.6	preload_dump_internal termination check weaker than other walkers; huge len advances pointer Kernel memory leaks / uninitialized disclosure · sys/kern/subr_module.c:410	none	reproduced fixed
DF-0156	Low	3.6	be_uuid_dec decodes time_mid with wrong byte order (le16dec instead of be16dec) Base system — kernel core (kern) · sys/kern/kern_uuid.c:361	none	reproduced fixed
DF-0166	Low	3.6	syscap_set INPARENT: uid/prison checked without p_token before capability mutation Base system — kernel core (kern) · sys/kern/kern_caps.c:164	none	reproduced fixed
DF-0203	Low	3.6	Sentinel -1 collision: fuwordadd32 fault indistinguishable from mutex value -1 Base system — kernel core (kern) · sys/kern/kern_umtx.c:146	none	reproduced fixed
DF-0209	Low	3.6	clist_nextc trusts caller cp without validating within live ring window Kernel memory corruption (UAF / OOB write) · sys/kern/tty_subr.c:229	none	reproduced fixed
DF-0212	Low	3.6	lwkt_serialize_handler_try omits post-acquire re-check of handler-enabled bit Base system — kernel core (kern) · sys/kern/lwkt_serialize.c:189	none	reproduced fixed
DF-0311	Low	3.6	Multicast setsockopt discards copyin error: partially-initialized mbuf fed to ip6_setmoptions Base system — network stack · sys/netinet6/ip6_output.c:1496	none	reproduced fixed
DF-0312	Low	3.6	Unchecked ifindex2ifnet[] indexing from embedded address scope-id on loopback output Kernel memory leaks / uninitialized disclosure · sys/netinet6/ip6_output.c:577	none	reproduced fixed
DF-0407	Low	3.6	setsockopt(IP_OPTIONS) overwrites copyin error: parses stale mbuf data as IP options on copyin failure Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_output.c:1097	none	reproduced fixed
DF-0504	Low	3.6	ng_fec_choose_port dereferences ether/ip/ip6 headers with no mbuf length validation Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_fec.c:1018	panic	reproduced fixed
DF-0537	Low	3.6	TOCTOU race on priv->datasock in ng_connect_data: check unlocked, set under lock Kernel memory corruption (UAF / OOB write) · sys/netgraph7/socket/ng_socket.c:790	dos	reproduced fixed
DF-0549	Low	3.6	netmap_obj_offset returns 0 on error indistinguishable from valid offset 0: masks failures Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_mem2.c:227	none	reproduced fixed
DF-0639	Low	3.6	Compress path avail_in integer underflow (avail_in = inlen - 1) on 0-length mbuf Kernel memory corruption (UAF / OOB write) · sys/netgraph7/deflate/ng_deflate.c:451	panic	reproduced fixed
DF-1005	Low	3.6	usbd_get_phys strlen(phys)-1 underflows to 255 when phys empty -> OOB null-byte write at phys[255] (latent) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_device.c:2273	none	reproduced fixed
DF-1225	Low	3.6	Use of uninitialized stack variable n_entries when icl_get_combo_buf_trans hits default branch Base system — drivers · sys/dev/drm/i915/intel_ddi.c:890	none	reproduced fixed
DF-1277	Low	3.6	sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors Base system — drivers · sys/dev/netif/sk/if_sk.c:2712	none	reproduced fixed
DF-1458	Low	3.6	OOB stack read in cyapa_raw_input via unbounded device-reported finger count Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/cyapa/cyapa.c:1262	none	reproduced fixed
DF-1525	Low	3.6	Unbounded channel index causes OOB write past openedaudio[] in sound_oss_sysinfo Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/sound.c:1308	dos	reproduced fixed
DF-1589	Low	3.6	Unbounded ucNumEntries-1 read in init_over_drive_limits reads patom_record_v2[-1] when ucNumEntries==0 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:269	panic	reproduced fixed
DF-1638	Low	3.6	u_int16_t truncation of buffer size in ess_dmasetup/ess_dmapos causes busy-loop stall and kernel heap info leak when buffersize=65536 Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/solo.c:769	dos	reproduced fixed
DF-1757	Low	3.6	radeon_vce: TOCTOU in destroy-session cleanup clears handles reallocated to different filp Base system — drivers · sys/dev/drm/radeon/radeon_vce.c:519	none	reproduced fixed
DF-1782	Low	3.6	ata-siliconimage: OOB read in ata_sii_setmode PIO timing lookup (piotimings[mode&0x0f] on 5-element array with index 8..12) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/chipsets/ata-siliconimage.c:366	none	reproduced fixed
DF-1899	Low	3.6	UB left shift 1<<vmid in amdgpu_amdkfd_is_kfd_vmid lets out-of-range VMIDs pass KFD guard (latent: CONFIG_HSA_AMD not defined) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:514	panic	reproduced fixed
DF-2090	Low	3.6	Unsigned underflow in max_payload_size-1 bypasses HW buffer chunking when HW buffer is empty (dead code today) Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96	none	reproduced fixed
DF-2194	Low	3.6	Undefined-behavior mask in AcpiOsReadPciConfiguration zeroes all 32-bit PCI config reads Privilege escalation (general use) · sys/dev/acpica/Osd/OsdHardware.c:96	none	reproduced fixed
DF-2223	Low	3.6	pcie_capability_read_dword leaves *dst uninitialized on register-not-implemented path diverging from LinuxKPI contract Kernel memory leaks / uninitialized disclosure · sys/dev/drm/linux_pci.c:35	denial_of_service	reproduced fixed
DF-2513	Low	3.6	Unvalidated device-controlled shift in namespace block-size computation Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:673	corruption	reproduced fixed
DF-0210	Info	3.6	clist_catq infinite loop on aliasing (cls==cld) Base system — kernel core (kern) · sys/kern/tty_subr.c:294	none	reproduced fixed
DF-2029	Info	3.6	iir_ioctl performs no privilege check on RAID management commands Privilege escalation (general use) · sys/dev/raid/iir/iir_ctrl.c:221	none	reproduced fixed
DF-0118	Low	3.5	Memory leak of dios_io/dios_open on kdmsg state teardown (no destructor for state->any.any) Base system — kernel core (kern) · sys/kern/subr_diskiocom.c:637	none	reproduced fixed
DF-0973	Low	3.5	PROBE_MODE_SENSE OOB read via device-controlled blk_desc_len in mode header Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_xpt.c:6234	none	reproduced fixed
DF-1009	Low	3.5	Driver enables FireWire physical-request DMA into host memory by default (PhysUpperBound=0x10000) Base system — bus / platform / cpu · sys/bus/firewire/fwohci.c:1864	none	reproduced fixed
DF-1115	Low	3.5	Dead switch-error check in mmc_switch_status compares a status field to a raw bit value Base system — bus / platform / cpu · sys/bus/mmc/mmc_subr.c:211	none	reproduced fixed
DF-1730	Low	3.5	atombios_dp: unvalidated DP lane count from malicious sink causes OOB stack reads during link training Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/atombios_dp.c:312	panic	reproduced fixed
DF-0860	Medium	3.4	ngc_send does not validate ng_mesg length or arglen causing heap OOB read (FreeBSD CVE-2008-5736 never ported) Kernel memory leaks / uninitialized disclosure · CVE-2008-5736 · sys/netgraph/socket/ng_socket.c:248	leak:128	reproduced fixed
DF-0099	Low	3.4	Off-by-one heap NUL-byte overflow in vfs_mountroot_try via ksscanf width/buffer-size mismatch Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_conf.c:419	none	reproduced fixed
DF-0174	Low	3.4	Integer overflow in ncallout via unbounded kern.maxfiles Base system — kernel core (kern) · sys/kern/subr_param.c:282	none	reproduced fixed
DF-0235	Low	3.4	No bounds validation on watchdog period (negative/>period_max accepted) Base system — kernel core (kern) · sys/kern/kern_wdog.c:114	none	reproduced fixed
DF-0373	Low	3.4	delete_pipe uses wrong constant DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 permanently undeletable Base system — network stack · sys/net/dummynet/ip_dummynet.c:1654	none	reproduced fixed
DF-0462	Low	3.4	bzero targets wrong field (&conf not &stats) with wrong size (session_stats=32 not sess_config=8): 24-byte intra-struct overflow Kernel memory corruption (UAF / OOB write) · sys/netgraph7/l2tp/ng_l2tp.c:748	none	reproduced fixed
DF-0551	Low	3.4	MTU unsigned underflow when parent MTU < EVL_ENCAPLEN(4) Base system — network stack · sys/net/vlan/if_vlan.c:727	panic	reproduced fixed
DF-1222	Low	3.4	RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow) Kernel memory leaks / uninitialized disclosure · sys/dev/virtual/amazon/ena/ena.c:1457	none	reproduced fixed
DF-1241	Low	3.4	iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-byte overflow of cmd descriptor ring Kernel memory corruption (UAF / OOB write) · sys/dev/netif/iwi/if_iwi.c:1784	none	reproduced fixed
DF-1382	Low	3.4	SIOCSIFMTU sets if_mtu even when MTU exceeds VGE_JUMBO_MTU Base system — drivers · sys/dev/netif/vge/if_vge.c:2005	none	reproduced fixed
DF-1409	Low	3.4	OOB read of fixed-size ucMuxState[2] via BIOS-controlled enum_id in router-record parsing Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:431	none	reproduced fixed
DF-1597	Low	3.4	Signed/unsigned confusion in tpm_tis12_write causes stack buffer over-read on zero-length write Kernel memory leaks / uninitialized disclosure · sys/dev/crypto/tpm/tpm.c:821	panic	reproduced fixed
DF-1686	Low	3.4	agp: off-by-one in agp_mmap aperture bounds check exposes one physical page past the AGP aperture Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:860	none	reproduced fixed
DF-1741	Low	3.4	vinumioctl: VINUM_RESETCONFIG case missing break falls through into VINUM_SETSTATE Base system — drivers · sys/dev/raid/vinum/vinumioctl.c:214	none	reproduced fixed
DF-2199	Low	3.4	Missing/ineffective bounds checks on gpio pin in 4 of 5 entry points (UB in shift macros, register field corruption) Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c:42	dos	reproduced fixed
DF-2205	Low	3.4	Error path leaves half-initialized device on hive list and masks subsequent failures Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85	none	reproduced fixed
DF-2238	Low	3.4	Off-by-two OOB write when full input line terminated with Enter Kernel memory corruption (UAF / OOB write) · sys/ddb/db_input.c:264	none	reproduced fixed
DF-2239	Low	3.4	Before-buffer OOB read and conditional OOB write on CTRL(n) down-arrow at end of history Kernel memory leaks / uninitialized disclosure · sys/ddb/db_input.c:236	none	reproduced fixed
DF-1652	Info	3.4	sbsh: SIOCLOADFIRMW EBUSY guard is dead code (error clobbered by copyin) Base system — drivers · sys/dev/netif/sbsh/if_sbsh.c:405	none	reproduced fixed
DF-0143	Medium	3.3	nlookupdata leaked on nlookup failure (missing nlookup_done) Base system — kernel core (kern) · sys/kern/vfs_quota.c:354	dos	reproduced fixed
DF-0145	Medium	3.3	vq_done stub leaks all quota RB-trees on unmount Base system — kernel core (kern) · sys/kern/vfs_quota.c:142	dos	reproduced fixed
DF-0202	Medium	3.3	Unthrottled kprintf log-flood DoS via umtx_sleep/wakeup on unmapped address Base system — kernel core (kern) · sys/kern/kern_umtx.c:150	dos	reproduced fixed
DF-0337	Medium	3.3	tcp_pcblist sysctl raw-copies entire inpcb and tcpcb with kernel pointers to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/netinet/tcp_subr.c:1284	leak:113ptrs	reproduced fixed
DF-0650	Medium	3.3	Heap OOB read in rip_send via unvalidated sockaddr length (IPv4 twin of DF-0619) Kernel memory leaks / uninitialized disclosure · sys/netinet/raw_ip.c:632	leak:4	reproduced fixed
DF-0788	Medium	3.3	Heap info leak via resident attribute data offset in ntfs_attrtontvattr — a_dataoff past record boundary Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:536	leak	reproduced fixed
DF-0922	Medium	3.3	Kernel heap pointer leaked to userspace via %p of vm_object in /proc/<pid>/map Kernel memory leaks / uninitialized disclosure · sys/vfs/procfs/procfs_map.c:208	leak	reproduced fixed
DF-0933	Medium	3.3	Compressed NTFS block leaves output tail uninitialized - stale kernel-heap info leak Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_compr.c:70	leak:4088	reproduced fixed
DF-0938	Medium	3.3	Uninitialized kernel stack leaked via /proc/<pid>/fpregs read Kernel memory leaks / uninitialized disclosure · sys/vfs/procfs/procfs_fpregs.c:54	leak:~300	reproduced fixed
DF-0993	Medium	3.3	fill_dbregs leaves dr[8]-dr[15] uninitialized - 64-byte kernel stack leak via /proc/<pid>/dbregs and PT_GETDBREGS Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/machdep.c:3104	leak:64	reproduced fixed
DF-1056	Medium	3.3	fill_fpregs leaks ~404 bytes of uninitialized kernel stack via PT_GETFPREGS / /proc/pid/fpregs Kernel memory leaks / uninitialized disclosure · sys/platform/vkernel64/x86_64/cpu_regs.c:711	leak:404	reproduced fixed
DF-1353	Medium	3.3	vega12_force_clock_level OOB read of dpm_levels[16] via user-controlled mask Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1798	leak	reproduced fixed
DF-1641	Medium	3.3	Kernel pointer leak via non-NUL-terminated dm_dev UUID returned through info/deps ioctls Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/dm_ioctl.c:409	panic	reproduced fixed
DF-2449	Medium	3.3	dm_table_load_ioctl: uninitialized heap start/length in dm_table_entry_t leak to userspace via status ioctl Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/dm_ioctl.c:743	leak:16	reproduced fixed
DF-2557	Medium	3.3	Kernel stack info leak via SO_PASSCRED auto-created SCM_CREDS on AF_UNIX SOCK_DGRAM Privilege escalation (general use) · sys/kern/uipc_usrreq.c:683	leak:62	reproduced fixed
DF-2558	Medium	3.3	Kernel stack info leak via unp_pcblist sysctl (net.local.{dgram stream seqpacket}.pcblist) Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_usrreq.c:1465	leak:~510	reproduced fixed
DF-0006	Low	3.3	kern.ttys sysctl leaks kernel function/heap pointers to unprivileged users Kernel memory leaks / uninitialized disclosure · CVE-2024-25941 · sys/kern/tty.c:2891	leak:102ptrs	reproduced fixed
DF-0009	Low	3.3	VFS_CONF (vfs.generic) sysctl leaks kernel pointers (vfc_vfsops, vfc_next) to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/kern/vfs_subr.c:1839	leak:21bytes(11 vfc_vfsops + 10 vfc_next kernel pointers/run; KASLR-defeat)	reproduced fixed
DF-0010	Low	3.3	Uninitialized struct cmsgcred leaks kernel stack via synthesized SCM_CREDS (SO_PASSCRED) Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_usrreq.c:683	leak:62	reproduced fixed
DF-0015	Low	3.3	Missing visibility/privilege check in kern.proc.pathname -> exe-path disclosure of arbitrary processes Privilege escalation (general use) · sys/kern/kern_proc.c:2080	leak	reproduced fixed
DF-0016	Low	3.3	kinfo_proc (kern.proc.*) exports unredacted kernel pointers (KASLR defeat) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_proc.c:1603	leak:69	reproduced fixed
DF-0027	Low	3.3	wait4/wait6 leak uninitialized kernel stack via status, rusage/wrusage and siginfo on WNOHANG/WCONTINUED return paths Kernel memory leaks / uninitialized disclosure · sys/kern/kern_exit.c:913	leak:148	reproduced fixed
DF-0034	Low	3.3	Uninitialized st_padding1 leaked to userspace via every stat syscall Kernel memory leaks / uninitialized disclosure · sys/kern/vfs_vnops.c:852	leak:2bytes	reproduced fixed
DF-0050	Low	3.3	msgctl(IPC_STAT) leaks kernel heap pointers (msg_first/msg_last) and uninitialized padding to any local user Kernel memory leaks / uninitialized disclosure · sys/kern/sysv_msg.c:324	leak:8	reproduced fixed
DF-0054	Low	3.3	Truncated prison-id sysctl node name in prison_sysctl_create (off-by-one in ksnprintf size) Base system — kernel core (kern) · sys/kern/kern_jail.c:993	none	reproduced fixed
DF-0077	Low	3.3	Uninitialized kernel stack bytes leaked via kern.ntp_pll.gettime sysctl (struct ntptimeval trailing padding) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_ntptime.c:205	leak:4	reproduced fixed
DF-0093	Low	3.3	Kernel heap pointer leaked to userspace via shmctl(IPC_STAT) shm_internal field + struct padding Kernel memory leaks / uninitialized disclosure · sys/kern/sysv_shm.c:420	leak:8	reproduced fixed
DF-0101	Low	3.3	struct ktr_header written to trace file leaks kernel pointer (ktr_buf) and uninitialized padding Kernel memory leaks / uninitialized disclosure · sys/kern/kern_ktrace.c:611	leak:8	reproduced fixed
DF-0102	Low	3.3	Uninitialized payload fields (ktr_sysret.ktr_eosys, ktr_syscall padding) written to trace file Kernel memory leaks / uninitialized disclosure · sys/kern/kern_ktrace.c:139	leak:2	reproduced fixed
DF-0120	Low	3.3	Unprivileged read of all kernel env variables (boot/loader secrets) Privilege escalation (general use) · sys/kern/kern_environment.c:135	leak:N	reproduced fixed
DF-0133	Low	3.3	Algorithmic-complexity DoS in EBR recursion (tetranacci explosion) Base system — kernel core (kern) · sys/kern/subr_diskmbr.c:427	none	reproduced fixed
DF-0135	Low	3.3	Integer overflow in l64_setdisklabel partition bounds check: p_boffset+p_bsize wraparound bypasses ENOSPC Privilege escalation (general use) · sys/kern/subr_disklabel64.c:304	none	reproduced fixed
DF-0146	Low	3.3	prop_dictionary/prop_array leaks on several sys_vquotactl paths Base system — kernel core (kern) · sys/kern/vfs_quota.c:374	none	reproduced fixed
DF-0179	Low	3.3	Unconditional kernel address leak via kern.proc sysctl (KASLR bypass) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_kinfo.c:128	none	reproduced fixed
DF-0186	Low	3.3	vacl_delete silently ignores user-supplied ACL type, always deletes ACL_TYPE_DEFAULT Base system — kernel core (kern) · sys/kern/kern_acl.c:107	none	reproduced fixed
DF-0199	Low	3.3	Day-of-month 0 causes unsigned underflow in fattime2timespec (crafted FAT image) Base system — kernel core (kern) · sys/kern/subr_fattime.c:233	none	reproduced fixed
DF-0204	Low	3.3	umtx_wakeup ignores count argument: over-wakeup / cross-process thundering herd Base system — kernel core (kern) · sys/kern/kern_umtx.c:297	none	reproduced fixed
DF-0216	Low	3.3	sysctl_kcollect_data copies past user buffer (unsigned underflow in bounds check) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_collect.c:235	none	reproduced fixed
DF-0224	Low	3.3	ksched_getparam leaves sched_priority uninitialized for non-RT procs -> kernel stack info leak Kernel memory leaks / uninitialized disclosure · sys/kern/kern_sched.c:142	none	reproduced fixed
DF-0229	Low	3.3	uint32 wraparound in table_lba+table_blocks location bounds-check Base system — kernel core (kern) · sys/kern/subr_diskgpt.c:139	none	reproduced fixed
DF-0256	Low	3.3	Kernel pointer info leak via kern.file sysctl (f_file, f_data) to unprivileged users Kernel memory leaks / uninitialized disclosure · disputed · sys/kern/subr_kcore.c:67	leak	reproduced fixed
DF-0292	Low	3.3	Missing privilege check on SIOCG80211 (get path): unpriv info disclosure Privilege escalation (general use) · sys/netproto/802_11/wlan/ieee80211_ioctl.c:3467	leak	reproduced fixed
DF-0307	Low	3.3	Kernel heap/code pointer leak via SYSCTL_OPAQUE of mfctable and viftable to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/net/ip_mroute/ip_mroute.c:90	leak	reproduced fixed
DF-0359	Low	3.3	Unguarded uint32 subtraction can underflow nr_hwavail causing self-inflicted ring-state corruption Base system — network stack · sys/net/netmap/netmap.c:906	dos	reproduced fixed
DF-0435	Low	3.3	bpf_movein IEEE80211_RADIO path: ibp_len from user packet drives link-header copy without proper mbuf bounds check Kernel memory leaks / uninitialized disclosure · sys/net/bpf.c:264	none	reproduced fixed
DF-0498	Low	3.3	SIOC_L2CAP_L2CA_GET_INFO: unvalidated info_size causes oversized kmalloc + feature non-functional Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:1061	dos	reproduced fixed
DF-0499	Low	3.3	Unprivileged info disclosure: read-only L2CAP node ioctls (GET_CON_LIST, GET_CHAN_LIST) lack privilege check Privilege escalation (general use) · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:850	none	reproduced fixed
DF-0591	Low	3.3	Legacy netgraph/ng_bridge leaks mbuf+meta when the bridge has exactly one link (numLinks==1 fan-out loop never runs) Base system — network stack · sys/netgraph/bridge/ng_bridge.c:663	dos	reproduced fixed
DF-0686	Low	3.3	Duplicate m_copym in l2cap_ssend leaks an mbuf chain on every send() Base system — network stack · sys/netbt/l2cap_socket.c:433	dos	reproduced fixed
DF-0698	Low	3.3	Filter entries leaked on hook disconnect (LIST_REMOVE without kfree) and node shutdown (no hashtable walk) Base system — network stack · sys/netgraph/etf/ng_etf.c:473	dos	reproduced fixed
DF-0866	Low	3.3	cd9660_readdir leaks kernel heap bytes via uninitialized struct dirent padding (d_unused1/d_unused2/d_name pad) Kernel memory leaks / uninitialized disclosure · sys/vfs/isofs/cd9660/cd9660_vnops.c:447	leak:7bytes	reproduced fixed
DF-0916	Low	3.3	smb_time_unix2dos year-computation loop unbounded allows kernel livelock DoS via crafted timestamps Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_subr.c:170	dos	reproduced fixed
DF-0924	Low	3.3	Attacker-controlled kernel heap allocation size via read() resid Base system — filesystems · sys/vfs/procfs/procfs_map.c:61	dos	reproduced fixed
DF-1015	Low	3.3	usb_kqfilter leaks FIFO refcount on filter/mode-mismatch EOPNOTSUPP paths -> permanent USB device detach hang Base system — bus / platform / cpu · sys/bus/u4b/usb_dev.c:1175	none	reproduced fixed
DF-1031	Low	3.3	NULL pointer dereference in init_disk makes -c (CD image) always crash the vkernel Base system — bus / platform / cpu · sys/platform/vkernel64/platform/init.c:487	none	reproduced fixed
DF-1032	Low	3.3	db_Grp7_11 OOB read when disassembling swapgs/rdtscp (6-entry array indexed by f_reg returning 7) Kernel memory leaks / uninitialized disclosure · sys/cpu/x86_64/misc/db_disasm.c:204	none	reproduced fixed
DF-1062	Low	3.3	Uninitialized kernel stack leaks to userspace via short vendor control-IN responses from malicious CH341 device Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/uchcom.c:417	none	reproduced fixed
DF-1069	Low	3.3	host_pcib_get_busno returns success without writing *busnum for Intel 82454NX at unexpected slot Base system — bus / platform / cpu · sys/bus/pci/pci_pci.c:707	none	reproduced fixed
DF-1087	Low	3.3	Kernel heap pointers leaked to userspace via full-CCB copyout in CAMIOCOMMAND/CAMGETPASSTHRU Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_pass.c:546	leak	reproduced fixed
DF-1118	Low	3.3	Integer overflow in skl_wm_method1/skl_wm_method2 watermark calculation via downscale-adjusted pixel rate Base system — drivers · sys/dev/drm/i915/intel_pm.c:4487	panic	reproduced fixed
DF-1218	Low	3.3	drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails Privilege escalation (general use) · sys/dev/drm/drm_atomic_helper.c:2938	none	reproduced fixed
DF-1232	Low	3.3	Kernel heap address leak to userspace via fibctx->unique in aac_open_aif Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac.c:3451	leak:4	reproduced fixed
DF-1233	Low	3.3	aac_close_aif orphans fibctx list when removing head, leaking every subsequent context permanently Base system — drivers · sys/dev/raid/aac/aac.c:3488	none	reproduced fixed
DF-1265	Low	3.3	Sideband reply parsers memcpy attacker-controlled num_bytes without bounds check (OOB read past msg_rx) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_dp_mst_topology.c:441	none	reproduced fixed
DF-1273	Low	3.3	Stale index used as voltage lookup key in CAC table population (functional correctness) Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:423	none	reproduced fixed
DF-1275	Low	3.3	VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:341	none	reproduced fixed
DF-1321	Low	3.3	OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25] Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/envy24.c:2038	none	reproduced fixed
DF-1324	Low	3.3	Wrong loop bound in iceland_populate_smc_mvdd_table uses VddciLevelCount instead of MvddLevelCount Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:675	none	reproduced fixed
DF-1443	Low	3.3	ATA PASS-16 passthrough drops lba_high_exp (copy-paste bug assigns lba_mid_exp twice) Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:1319	none	reproduced fixed
DF-1507	Low	3.3	O_NONBLOCK never honored in vkbd read/write (uses wrong flag constant) Base system — drivers · sys/dev/misc/vkbd/vkbd.c:347	panic	reproduced fixed
DF-1522	Low	3.3	Off-by-one OOB read in ath_hal_EepromDataRead (off == ATH_DATA_EEPROM_SIZE allowed) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ah.c:1402	leak:2	reproduced fixed
DF-1524	Low	3.3	Kernel pointer disclosure via unprivileged SIOCGATHNODERATESTATS rate-stats ioctl Privilege escalation (general use) · sys/dev/netif/ath/ath_rate/sample/sample.c:1181	leak:16	reproduced fixed
DF-1577	Low	3.3	Off-by-one in get_powerplay_table_entry_v1_0 allows OOB read of one state entry Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310	panic	reproduced fixed
DF-1594	Low	3.3	Uninitialized rv515_watermark.sclk read writes garbage to display priority MMIO Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/rv515.c:946	panic	reproduced fixed
DF-1602	Low	3.3	draw_txtmouse reads/writes scp->scr past vtb_size on the bottom screen row (FIXME-acknowledged) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/scvgarndr.c:340	panic	reproduced fixed
DF-1605	Low	3.3	NULL-pointer dereference in vtblk_strategy: sc dereferenced before the NULL check Base system — drivers · sys/dev/virtual/virtio/block/virtio_blk.c:527	panic	reproduced fixed
DF-1636	Low	3.3	Memory leak of priv struct on early error paths before dm_table_init_target Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/crypt/dm_target_crypt.c:489	leak	reproduced fixed
DF-1656	Low	3.3	radeon_uvd: missing radeon_bo_kunmap in error paths leaks kernel BO mapping Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_uvd.c:489	none	reproduced fixed
DF-1657	Low	3.3	radeon_uvd: destroy message missing filp ownership check -> cross-process UVD session teardown Privilege escalation (general use) · sys/dev/drm/radeon/radeon_uvd.c:505	none	reproduced fixed
DF-1702	Low	3.3	scmouse: heap buffer overflow in mouse_cut - per-line \r bytes not accounted for in cut_buffer sizing Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/scmouse.c:92	none	reproduced fixed
DF-1720	Low	3.3	amdgpu_gem: amdgpu_gem_object_open ignores amdgpu_vm_bo_add OOM failure, returns success without bo_va Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gem.c:143	none	reproduced fixed
DF-1728	Low	3.3	ttm_bo_vm: BO kref leak on each mmap of already-mapped BO (kernel memory exhaustion DoS) Base system — drivers · sys/dev/drm/ttm/ttm_bo_vm.c:420	dos	reproduced fixed
DF-1748	Low	3.3	radeon_gem: integer overflow in radeon_mode_dumb_create size (pitch*height wraps u32) Base system — drivers · sys/dev/drm/radeon/radeon_gem.c:764	panic	reproduced fixed
DF-1762	Low	3.3	immio: off-by-one OOB heap read in OUTSTR path for odd blen Kernel memory leaks / uninitialized disclosure · sys/dev/disk/vpo/immio.c:739	leak:1	reproduced fixed
DF-1860	Low	3.3	apple_smc_mb_sysctl_fanid leaks kernel stack via unbounded strlen in sysctl_handle_string Kernel memory leaks / uninitialized disclosure · sys/dev/apple/smc/smc_sysctl.c:51	leak	reproduced fixed
DF-1867	Low	3.3	kcs_start_write uses 1-second busy DELAY inside 10x retry loop: CPU pin for ~minutes per ioctl Base system — drivers · sys/dev/misc/ipmi/ipmi_kcs.c:182	dos	reproduced fixed
DF-1892	Low	3.3	Hardware-control sysctls exposed writable to unprivileged users (CTLFLAG_ANYBODY): local DoS via cpu_speed/backlight/fan Privilege escalation (general use) · sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:250	none	reproduced fixed
DF-1910	Low	3.3	i2s_pdata never freed: per-attach memory leak in all error paths of acp_hw_init Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_acp.c:242	leak	reproduced fixed
DF-1936	Low	3.3	Unconditional kprintf on every VM retry fault: local kernel-log DoS Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/vega10_ih.c:288	dos	reproduced fixed
DF-2042	Low	3.3	Broken error path in i915_gem_prime_import leaks dma_buf_attachment Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/i915_gem_dmabuf.c:305	leak	reproduced fixed
DF-2070	Low	3.3	Incorrect 48-bit LBA reconstruction in tf_read corrupts read-back sector address Base system — drivers · sys/dev/disk/nata/chipsets/ata-serverworks.c:179	dos	reproduced fixed
DF-2080	Low	3.3	Uninitialized kernel heap memory disclosure via ATH_DIAG_DYN on non-output spectral control commands Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_spectral.c:218	leak	reproduced fixed
DF-2129	Low	3.3	apple_smc_mmio_key_read silently under-fills caller buffer, leaking kernel stack via sysctl Kernel memory corruption (UAF / OOB write) · sys/dev/apple/smc/smc_mmio.c:75	none	reproduced fixed
DF-2131	Low	3.3	Off-by-one OOB read of timings[] in ata_ite_8213_setmode at UDMA6 Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/chipsets/ata-ite.c:158	panic	reproduced fixed
DF-2148	Low	3.3	Missing privilege check on PPS_IOC_KCBIND allows unprivileged kernel clock-discipline binding Privilege escalation (general use) · sys/dev/misc/pps/pps.c:183	none	reproduced fixed
DF-2149	Low	3.3	pps_open is a boolean flag not a reference count; any close tears down the bus/interrupt for all openers Base system — drivers · sys/dev/misc/pps/pps.c:118	dos	reproduced fixed
DF-2154	Low	3.3	Uninitialized kernel stack memory leaked to userspace via sysctl read of failing Sony ACPI node Privilege escalation (general use) · sys/dev/acpica/acpi_sony/acpi_sony.c:183	leak	reproduced fixed
DF-2216	Low	3.3	dmi_match() leaks kgetenv() buffer on every code path Base system — drivers · sys/dev/drm/linux_dmi.c:44	denial_of_service	reproduced fixed
DF-2283	Low	3.3	sgread: tsleep on local stack address &hstat has no wakeup source; read() blocks indefinitely (local DoS) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:763	denial_of_service	reproduced fixed
DF-2286	Low	3.3	Kernel pointer leak via targreturnccb copyout of ccb_hdr.cbfcnp and ccb_hdr.path Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_target.c:967	leak	reproduced fixed
DF-2287	Low	3.3	Memory leak of targ_cmd_descr in targread abort_queue drain loop Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_target.c:921	leak	reproduced fixed
DF-2519	Low	3.3	ATA PASS-THROUGH 16 drops LBA high extension byte (copy-paste defect) Base system — drivers · sys/dev/disk/sili/sili_cam.c:1217	corruption	reproduced fixed
DF-2543	Low	3.3	Unprivileged kernel-pointer leak via hw.bus.devices sysctl (dv_handle/dv_parent) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_bus.c:3890	leak:219	reproduced fixed
DF-0037	Info	3.3	sys_getpgid / sys_getsid lack cross-session visibility checks (unprivileged pgid/sid enumeration) Privilege escalation (general use) · sys/kern/kern_prot.c:106	leak:64bytes	reproduced fixed
DF-0092	Info	3.3	sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trailing padding Kernel memory leaks / uninitialized disclosure · sys/kern/subr_rman.c:700	none	reproduced fixed
DF-1698	Info	3.3	mps_sas_lsi: PhysDisk OFFLINE branch uses \|= instead of &= ~ to clear RAID_COMPONENT flag, locking disk out of OS permanently Base system — drivers · sys/dev/raid/mps/mps_sas_lsi.c:481	none	reproduced fixed
DF-2008	Info	3.3	Debugfs amdgpu_sa_info leaks kernel GPU virtual address and fence metadata to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_sa.c:380	leak	reproduced fixed
DF-2043	Info	3.3	i915_gem_dmabuf_mmap is a no-op stub that silently misreports success Base system — drivers · sys/dev/drm/i915/i915_gem_dmabuf.c:149	none	reproduced fixed
DF-0329	Low	3.1	icmp6_redirect_output leaks uninitialized mbuf heap bytes in padded redirected-header option Kernel memory leaks / uninitialized disclosure · sys/netinet6/icmp6.c:2560	leak	reproduced fixed
DF-0419	Low	3.1	nd6_ra_input mutates per-interface ND timing state (reachable/retrans/chlim/linkmtu) without nd6_mtx: data race Base system — network stack · sys/netinet6/nd6_rtr.c:272	dos	reproduced fixed
DF-0544	Low	3.1	hardware_error and data_buffer_overflow: missing NG_HCI_M_PULLUP + length check on 1-byte body Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:826	panic	reproduced fixed
DF-0545	Low	3.1	Buffer accounting u_int16_t wrap in num_compl_pkts via attacker-controlled compl_pkt: throughput DoS Base system — network stack · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:905	dos	reproduced fixed
DF-0567	Low	3.1	Memory leak of in-progress reassembly mbuf when new ACL START arrives Base system — network stack · sys/netbt/hci_link.c:471	dos	reproduced fixed
DF-0902	Info	3.1	setfs() leaves path buffer non-null-terminated after strncpy (latent OOB-read in strlen) Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_mountrpc.c:347	none	reproduced fixed
DF-1873	Info	3.1	dcons DMA buffer allocated without M_ZERO: stale kernel memory leaked to FireWire peer Kernel memory leaks / uninitialized disclosure · sys/dev/misc/dcons/dcons_os.c:462	none	reproduced fixed
DF-1994	Info	3.1	Missing payload-length validation in iwm_rx_time_event_notif firmware notification handler Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm_time_event.c:207	panic	reproduced fixed
DF-0132	Low	3.0	Unvalidated sensor type as array index: OOB write in sensor_attach/detach Base system — kernel core (kern) · sys/kern/kern_sensors.c:143	none	reproduced fixed
DF-0140	Low	3.0	Unchecked queue argument -> OOB write on wc_blocked[queue] Kernel memory corruption (UAF / OOB write) · sys/kern/subr_sleepqueue.c:266	none	reproduced fixed
DF-0189	Low	3.0	TOCTOU race in /dev/klog single-open enforcement Base system — kernel core (kern) · sys/kern/subr_log.c:98	none	reproduced fixed
DF-0193	Low	3.0	vfs_vptofh reads vp->v_mount twice without snapshot/NULL-check Base system — kernel core (kern) · sys/kern/vfs_vfsops.c:266	none	reproduced fixed
DF-0274	Low	3.0	SIOCADDMULTI trusts user sa_len for heap alloc and bcopy without bounds check Kernel memory leaks / uninitialized disclosure · sys/net/if.c:2327	leak	reproduced fixed
DF-0316	Low	3.0	OOB read: wg_output dereferences 4 bytes from mbuf without length check in BPF AF_UNSPEC path Kernel memory leaks / uninitialized disclosure · sys/net/wg/if_wg.c:2289	none	reproduced fixed
DF-0383	Low	3.0	SET_TICKS computes len8dn_hz as signed int: overflow for jumbo at high dn_hz — same as dummynet v1 unfixed Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:450	dos	reproduced fixed
DF-0443	Low	3.0	Integer overflow in scaled scheduler parameter math: maxidle/offtime/pkttime products truncate to 32-bit int Base system — network stack · sys/net/altq/altq_rmclass.c:248	none	reproduced fixed
DF-0446	Low	3.0	SIOCSIFMTU missing lower-bound validation: ifr_mtu=0 or negative accepted, corrupts downstream MSS/fragmentation math Base system — network stack · sys/net/if_ethersubr.c:715	none	reproduced fixed
DF-0548	Low	3.0	bitmap[0]=~3 marks non-existent objects free when pool has <32 objects Base system — network stack · sys/net/netmap/netmap_mem2.c:677	dos	reproduced fixed
DF-0620	Low	3.0	Off-by-one OOB write in IPV6_CHECKSUM offset validation in rip6_output Kernel memory corruption (UAF / OOB write) · sys/netinet6/raw_ip6.c:403	dos	reproduced fixed
DF-0728	Low	3.0	CHANNEL/XCHANNEL priority inversion between attachv and chan_change — 4-byte overflow if driver sets both bits Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_radiotap.c:103	leak	reproduced fixed
DF-1027	Low	3.0	inittodr reads daysinmonth[12] OOB via unvalidated RTC month -> system clock corruption Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/isa/clock.c:1112	none	reproduced fixed
DF-1108	Low	3.0	Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len (pc64 sibling of DF-1101) Kernel memory corruption (UAF / OOB write) · DF-1101 · sys/platform/pc64/x86_64/autoconf.c:274	panic	reproduced fixed
DF-1229	Low	3.0	Untrusted diag BufferType used as fw_diag_buffer_list[3] index (OOB write into mpr_softc) Base system — drivers · sys/dev/raid/mpr/mpr.c:2388	none	reproduced fixed
DF-1230	Low	3.0	mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128 Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr.c:2458	none	reproduced fixed
DF-1256	Low	3.0	Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with missing release_firmware Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_device.c:757	none	reproduced fixed
DF-1348	Low	3.0	Unbounded bcopy of CDB into CmdBlock[12] overflows SRB on >12-byte CDBs Kernel memory corruption (UAF / OOB write) · sys/dev/disk/amd/amd.c:399	none	reproduced fixed
DF-1432	Low	3.0	Heap OOB read in radeon_print_display_setup via BIOS-controlled encoder_id indexing encoder_names[38] Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_display.c:714	none	reproduced fixed
DF-1462	Low	3.0	ATA_PASS_16 FIS lba_high_exp never set due to copy-paste duplication of lba_mid_exp assignment Base system — drivers · sys/dev/disk/sili/sili_cam.c:1217	none	reproduced fixed
DF-1531	Low	3.0	hpt_get_logical_devices writes one DEVICEID before the count check (4-byte heap overflow when nMaxCount=0) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/gui_lib.c:479	panic	reproduced fixed
DF-1704	Low	3.0	iscsi initiator: heap OOB write of 1-3 NUL bytes in i_send due to padding-calc mismatch when ahs_len not multiple of 4 Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi.c:461	panic	reproduced fixed
DF-1736	Low	3.0	vinumio: sappend in format_config writes 1-2 bytes past malloc config buffer when text reaches end Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumio.c:415	panic	reproduced fixed
DF-1771	Low	3.0	intel_dsi_vbt: unbounded attacker-controlled len in mipi_exec_send_packet causes heap OOB read (v3 sequences) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_dsi_vbt.c:124	panic	reproduced fixed
DF-1772	Low	3.0	intel_dsi_vbt: integer overflow in DSI timing math writes wrong DPHY/Hs-to-Lp register values Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_dsi_vbt.c:566	panic	reproduced fixed
DF-1922	Low	3.0	aac_print_fib iterates controller-supplied SgCount without bounding against FIB data size (debug-only) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/aac/aac_debug.c:240	panic	reproduced fixed
DF-1956	Low	3.0	Inverted loop condition in psp_v10_0_compare_sram_data bypasses SRAM integrity check Base system — drivers · sys/dev/drm/amd/amdgpu/psp_v10_0.c:433	panic	reproduced fixed
DF-1962	Low	3.0	Undersized freqs_available[80] overflows when formatting 16-state list (80 chars + NUL = 81) Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/powernow/powernow.c:343	panic	reproduced fixed
DF-2077	Low	3.0	sizespec silently wraps on attacker-controlled length strings (integer overflow + signed-multiplier corruption) Base system — drivers · sys/dev/raid/vinum/vinumutil.c:197	none	reproduced fixed
DF-2085	Low	3.0	Operator-precedence error in agp_sis_set_aperture misprograms WINCTRL to 512M and invokes signed-shift UB Base system — drivers · sys/dev/agp/agp_sis.c:215	none	reproduced fixed
DF-2213	Low	3.0	OOB read on piotiming[] via raw mode&ATA_MODE_MASK index writes garbage PIO timing to disk controller Privilege escalation (general use) · sys/dev/disk/nata/chipsets/ata-cyrix.c:67	none	reproduced fixed
DF-2467	Low	3.0	TOCTOU in i_create_session: sc->sessions[n] assigned outside the search lock Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi.c:623	corruption	reproduced fixed
DF-2527	Low	3.0	vniocattach_file missing positive vn_size check -> signed integer overflow and bogus disk geometry Base system — drivers · sys/dev/disk/vn/vn.c:559	corruption	reproduced fixed
DF-0112	Info	3.0	__sccl scanset range-fill writes tab[256] when range endpoint is 0xFF Kernel memory corruption (UAF / OOB write) · sys/kern/subr_scanf.c:605	none	reproduced fixed
DF-0244	Info	3.0	ldisc_deregister missing lower-bound check: negative index OOB write into linesw[] Base system — kernel core (kern) · sys/kern/tty_conf.c:122	none	reproduced fixed
DF-0084	Low	2.9	Off-by-one OOB read in get_next_valid_apicid: array indexed before bound check in while condition Kernel memory leaks / uninitialized disclosure · sys/kern/subr_cpu_topology.c:91	none	reproduced fixed
DF-0347	Low	2.9	Undefined behavior: 1<<32 in WPA/RSN cipher selector parsing for unknown OUI Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hostap.c:1198	none	reproduced fixed
DF-0541	Low	2.9	Uninitialized cp.data[0] in Command Reject MTU_EXCEEDED sets link MTU to stack garbage Kernel memory leaks / uninitialized disclosure · sys/netbt/l2cap_signal.c:91	leak	reproduced fixed
DF-1378	Low	2.9	Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt.c:420	none	reproduced fixed
DF-1406	Low	2.9	OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data upper nibble>=8 Kernel memory leaks / uninitialized disclosure · sys/dev/disk/advansys/advlib.c:1073	none	reproduced fixed
DF-1552	Low	2.9	chip_ids[15] indexed by (rev>>4)&0xF is a 1-element OOB read at probe/attach when chip reports rev with high nibble 0xF Kernel memory leaks / uninitialized disclosure · sys/dev/netif/sn/if_sn.c:140	panic	reproduced fixed
DF-0643	Low	2.7	check_forward heap OOB read via unvalidated cmd->arg3 destination count Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_basic.c:213	panic	reproduced fixed
DF-0507	Info	2.6	IPv6 port-selection hash XORs destination with itself: always zero, no load balancing Base system — network stack · sys/netgraph7/ng_fec.c:1056	none	reproduced fixed
DF-0771	Medium	2.5	Missing data_len validation on inode load — crafted image heap OOB read via struct copy past buffer end Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_inode.c:524	leak:128	reproduced fixed
DF-0022	Low	2.5	PPS_IOC_KCBIND missing privilege check allows unprivileged kernel-PLL binding (NTP confusion) Privilege escalation (general use) · sys/kern/kern_clock.c:1680	none	reproduced fixed
DF-0030	Low	2.5	jrecord_write_path goto again can spin indefinitely under concurrent rename (local DoS) Base system — kernel core (kern) · sys/kern/vfs_journal.c:1251	none	reproduced fixed
DF-0052	Low	2.5	alst_leaf_alloc corrupts bm_bighint hint by mutating start before the bighint-decision comparison Base system — kernel core (kern) · sys/kern/subr_alist.c:443	none	reproduced fixed
DF-0067	Low	2.5	add_buffer_randomness_src passes full remaining length (bytes) instead of chunk size (n), defeating cross-CPU entropy splitting Base system — kernel core (kern) · sys/kern/kern_nrandom.c:650	none	reproduced fixed
DF-0097	Low	2.5	sglist_consume_uio truncates iov_len (size_t) to int - signedness confusion / data drop (dead code) Base system — kernel core (kern) · sys/kern/subr_sglist.c:383	none	reproduced fixed
DF-0111	Low	2.5	CT_CHAR (%c) non-suppress bcopy reads width bytes without checking inr -> OOB read Kernel memory leaks / uninitialized disclosure · sys/kern/subr_scanf.c:307	none	reproduced fixed
DF-0128	Low	2.5	fp_vpopen NULL deref on td->td_proc when called from pure thread context Base system — kernel core (kern) · sys/kern/kern_fp.c:165	none	reproduced fixed
DF-0129	Low	2.5	fp_mmap dereferences fp->f_data without NULL check after f_type check Base system — kernel core (kern) · sys/kern/kern_fp.c:472	none	reproduced fixed
DF-0130	Low	2.5	fp_read all=1 mode can spin indefinitely on persistent EINTR/ERESTART Base system — kernel core (kern) · sys/kern/kern_fp.c:271	none	reproduced fixed
DF-0148	Low	2.5	TOCTOU: vq_write_ok check and vfs_stdaccount commit are separate critical sections Base system — kernel core (kern) · sys/kern/vfs_quota.c:443	none	reproduced fixed
DF-0161	Low	2.5	m_tag_copy_chain reverses tag order: tprev=t misplaced inside else branch Base system — kernel core (kern) · sys/kern/uipc_mbuf2.c:376	none	reproduced fixed
DF-0167	Low	2.5	syscap_get INPARENT: no same-uid/same-prison authorization: info leak of capability config Kernel memory leaks / uninitialized disclosure · sys/kern/kern_caps.c:95	none	reproduced fixed
DF-0177	Low	2.5	cttykqfilter forwards knote to ttyvp with no token and no reference Kernel memory corruption (UAF / OOB write) · sys/kern/tty_tty.c:284	none	reproduced fixed
DF-0178	Low	2.5	cttyvp() snapshot read of s_ttyvp unsynchronized vs proc_token-held writers Base system — kernel core (kern) · sys/kern/tty_tty.c:74	none	reproduced fixed
DF-0190	Low	2.5	logopen performs no jail check beyond devfs file mode Privilege escalation (general use) · sys/kern/subr_log.c:92	none	reproduced fixed
DF-0200	Low	2.5	Negative tv_sec bypasses 1980-truncate guard in timespec2fattime Base system — kernel core (kern) · sys/kern/subr_fattime.c:150	none	reproduced fixed
DF-0208	Low	2.5	No validation of negative length in clist_qtob/btoq/ndflush Base system — kernel core (kern) · sys/kern/tty_subr.c:127	none	reproduced fixed
DF-0217	Low	2.5	sysctl reads kcollect_ary outside lock racing collection thread Base system — kernel core (kern) · sys/kern/kern_collect.c:233	none	reproduced fixed
DF-0223	Low	2.5	Missing sched_priority bounds check in SCHED_OTHER + signed-overflow UB in p4prio_to_rtpprio Base system — kernel core (kern) · sys/kern/kern_sched.c:181	none	reproduced fixed
DF-0232	Low	2.5	SIOCSPGRP invokes fsetown(-INT_MIN) -> signed-overflow UB on attacker-controlled value Base system — kernel core (kern) · sys/kern/sys_socket.c:164	none	reproduced fixed
DF-0360	Low	2.5	nm_dump_buf writes unbounded hex dump into fixed 8 KiB static buffer _dst Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap.c:322	none	reproduced fixed
DF-0415	Low	2.5	Signed integer overflow in keepalive t_maxidle: t_keepintvl*t_keepcnt exceeds INT_MAX at high hz Base system — network stack · sys/netinet/tcp_usrreq.c:1644	dos	reproduced fixed
DF-0433	Low	2.5	bpf_mtap_hdr submits partially-initialized stack mbuf: bpf_mtap reads uninitialized m_pkthdr.rcvif Kernel memory leaks / uninitialized disclosure · sys/net/bpf.c:1347	dos	reproduced fixed
DF-0437	Low	2.5	Receive-path filter dereferences mbuf data without m_pullup: OOB read within mbuf cluster on short first mbuf Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:474	none	reproduced fixed
DF-0501	Low	2.5	netgraph message leak on ioctl timeout-vs-response race Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:910	dos	reproduced fixed
DF-0512	Low	2.5	Unbounded sockaddr stored into fixed-size struct sockaddr in accept response: type confusion latent Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ksocket/ng_ksocket.c:1250	panic	reproduced fixed
DF-0600	Low	2.5	Unvalidated sa_len in dup_sockaddr callers enables heap OOB read of up to ~250 bytes Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_conn.c:462	leak:251	reproduced fixed
DF-0635	Low	2.5	Pred1Compress outbuf overflow: input size bound check off by 6, up to 7-byte heap OOB write Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_pred1.c:397	panic	reproduced fixed
DF-0685	Low	2.5	TOCTOU on hci_num_cmd_pkts in hci_send_cmd causes uint8_t underflow Base system — network stack · sys/netbt/hci_unit.c:314	panic	reproduced fixed
DF-0697	Low	2.5	SET_FILTER ENOMEM path leaks the inbound ng_mesg (return bypasses epilogue) Base system — network stack · sys/netgraph/etf/ng_etf.c:327	dos	reproduced fixed
DF-0870	Low	2.5	Unprivileged kernel heap info leak via volume_list when device_name not NUL-terminated Privilege escalation (general use) · sys/vfs/hammer/hammer_volume.c:107	leak:device_path_string	reproduced fixed
DF-0995	Low	2.5	sardpos leaks uninitialized kernel stack via MTIOCRDSPOS/MTIOCRDHPOS when device returns short READ POSITION data Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_sa.c:3247	none	reproduced fixed
DF-1014	Low	2.5	sescleanup leaks ses_objmap/ses_private/ses_typidx/ses_eltmap on device removal -> memory exhaustion DoS Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ses.c:231	none	reproduced fixed
DF-1036	Low	2.5	return_bounce_pages wakes wrong map (typo: passes map instead of wait_map to add_map_callback) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/busdma_machdep.c:1306	none	reproduced fixed
DF-1074	Low	2.5	nexus_deactivate_resource truncates MMIO size to 32 bits, leaving stale PTEs and orphaning KVA for >4 GiB BARs Privilege escalation (general use) · sys/platform/pc64/x86_64/nexus.c:462	none	reproduced fixed
DF-1160	Low	2.5	OOB read in HDMI IRQ handler: afmt_status indexed before bounds check Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/evergreen.c:4803	panic	reproduced fixed
DF-1224	Low	2.5	Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_sas.c:2766	none	reproduced fixed
DF-1261	Low	2.5	dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race) Base system — drivers · sys/dev/sound/pcm/dsp.c:2370	none	reproduced fixed
DF-1276	Low	2.5	DMA map cleanup loops use wrong array index [i] instead of [j], leaking all created maps Base system — drivers · sys/dev/netif/sk/if_sk.c:3120	none	reproduced fixed
DF-1335	Low	2.5	Off-by-one OOB read of vddc_table[MAX_NO_VREG_STEPS=32] in rv770_populate_smc_vddc_table Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/rv770_dpm.c:1124	none	reproduced fixed
DF-1338	Low	2.5	SGE scatter/gather table bounds mismatch allows latent OOB write in sili_load_prb_callback Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili.c:1245	none	reproduced fixed
DF-1365	Low	2.5	fd_detach does not stop fd->tohandle callout (UAF on detach race) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/fd/fd.c:1090	none	reproduced fixed
DF-1436	Low	2.5	Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger Kernel memory leaks / uninitialized disclosure · sys/dev/disk/sdhci/sdhci.c:1735	none	reproduced fixed
DF-1486	Low	2.5	Out-of-bounds stack read of fclks.data[-1] when SMU reports a single FCLK level Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1368	leak:8	reproduced fixed
DF-1518	Low	2.5	ar5416ChainTxDesc indexes ah_keytype[] unconditionally, causing OOB read when keyIx == HAL_TXKEYIX_INVALID Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c:583	panic	reproduced fixed
DF-1570	Low	2.5	xa_close returns holding xdisk_lk and releases the wrong lock on race paths Base system — drivers · sys/dev/disk/xdisk/xdisk.c:767	dos	reproduced fixed
DF-1571	Low	2.5	xa_size dereferences sc with no lock; UAF if xa_terminate_check runs concurrently Kernel memory corruption (UAF / OOB write) · sys/dev/disk/xdisk/xdisk.c:828	panic	reproduced fixed
DF-1588	Low	2.5	Off-by-one out-of-bounds read in vega10_get_powerplay_table_entry state-array index check Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1308	panic	reproduced fixed
DF-1620	Low	2.5	mrsas_startio leaks allocated mrsas_mpt_cmd on every build-failure path Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mrsas/mrsas_cam.c:481	leak	reproduced fixed
DF-1660	Low	2.5	ar5212_ani: HAL_DIAG_ANI_PARAMS allows setting maxLevel > array dim -> wild OOB read in ar5212AniControl Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5212_ani.c:181	panic	reproduced fixed
DF-1675	Low	2.5	ar5416_ani: ar5416AniControl OOB array index via untrusted maxLevel (DF-1660 variant) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:230	panic	reproduced fixed
DF-1718	Low	2.5	ar5112: ar5112GetChannelMaxMinPower returns AH_TRUE on no-match without initializing *minPow -> stale stack leak via 802.11h PowerCapability Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5112.c:765	leak:7	reproduced fixed
DF-1763	Low	2.5	immio: missing clen bound allows OOB read of csio struct in CDB-send loop Kernel memory leaks / uninitialized disclosure · sys/dev/disk/vpo/immio.c:702	leak:240	reproduced fixed
DF-1861	Low	2.5	dma_fence reference leak in amdgpu_pasid_free_delayed when fence-array allocation fails Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_ids.c:135	leak	reproduced fixed
DF-1864	Low	2.5	Missing braces in drm_sched_entity_init loop silently drops -ENOMEM, leaving partially-initialized sched entities Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:174	panic	reproduced fixed
DF-1914	Low	2.5	drm_agp_info_ioctl copies uninitialized trailing struct padding back to userspace Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_agpsupport.c:62	leak	reproduced fixed
DF-1928	Low	2.5	Off-by-one NUL byte write in acpi_battery_clean_str past struct acpi_bif / ioctl union Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_battery.c:326	panic	reproduced fixed
DF-2040	Low	2.5	Truncation of mem->num_pages (unsigned long) to unsigned in VRAM-visible accounting and free paths Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vram_mgr.c:112	panic	reproduced fixed
DF-2045	Low	2.5	extra_history_size pool leaks on failed history realloc; function falsely returns success Kernel memory leaks / uninitialized disclosure · sys/dev/misc/syscons/schistory.c:122	leak	reproduced fixed
DF-2054	Low	2.5	Memory leak of userspace entry array on idr_alloc failure in BO_LIST_OP_CREATE Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:285	leak	reproduced fixed
DF-2071	Low	2.5	kbdsw dispatch functions dereference kbdsw[kb_index] without bounds/NULL checks unlike kbd_intr Kernel memory leaks / uninitialized disclosure · sys/dev/misc/kbd/kbdsw.c:80	none	reproduced fixed
DF-2295	Low	2.5	fw_read copies iso stream packet by attacker-controlled stream.len without bounding to psize (DMA buffer over-read) Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwdev.c:321	leak	reproduced fixed
DF-2296	Low	2.5	FW_ASYREQ send-path bcopy over-reads ioctl heap buffer when req.len exceeds data[] capacity Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwdev.c:529	leak	reproduced fixed
DF-0007	Info	2.5	Uninitialized struct sigaction trailing padding leaked to userspace via oact copyout Kernel memory leaks / uninitialized disclosure · sys/kern/kern_sig.c:260	leak:4bytes	reproduced fixed
DF-0012	Info	2.5	vop_nremove quota-accounting glue: latent NULL-deref on nc_vp, nlink TOCTOU, wrong mount for PFS overlays Base system — kernel core (kern) · sys/kern/vfs_vopops.c:1660	none	reproduced fixed
DF-0048	Info	2.5	CALLOUT_PREVENTED set on wrong structure (verifier/cc) vs read from backend _callout -> wrong callout_stop/cancel/drain return Base system — kernel core (kern) · sys/kern/kern_timeout.c:600	none	reproduced fixed
DF-0086	Info	2.5	dev_dopen dereferences inner *a_fpp without NULL check (latent panic, no current trigger) Base system — kernel core (kern) · sys/kern/kern_device.c:151	none	reproduced fixed
DF-0121	Info	2.5	Signed/unsigned confusion defeats length clamp in KENV_GET Base system — kernel core (kern) · sys/kern/kern_environment.c:141	none	reproduced fixed
DF-0717	Info	2.5	Memory leak in netmap_open when devfs_set_cdevpriv fails — kfree missing on error path Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_freebsd.c:382	none	reproduced fixed
DF-0963	Info	2.5	Unvalidated keyBits/Nr in production kernels causes infinite loop walking rk off the end of the key schedule (latent) Kernel memory leaks / uninitialized disclosure · sys/crypto/rijndael/rijndael-alg-fst.c:734	none	reproduced fixed
DF-1489	Info	2.5	NULL dereference inside warning branch of cbb_cardbus_auto_open (rman_get_start(NULL)) Base system — drivers · sys/dev/pccard/pccbb/pccbb.c:1028	none	reproduced fixed
DF-1971	Info	2.5	Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_fb.c:224	leak	reproduced fixed
DF-2011	Info	2.5	hdspe_intr leaks sc->lock (lockmgr LK_EXCLUSIVE) on device_get_children error path Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/hdspe.c:96	leak	reproduced fixed
DF-2134	Info	2.5	dma_buf_fd silently ignores O_CLOEXEC -- fd leaks across exec() Base system — drivers · sys/dev/drm/linux_dma-buf.c:150	none	reproduced fixed
DF-2176	Info	2.5	Missing NULL-buf guard in write-path memcpy diverges from amdgpu fix Base system — drivers · sys/dev/drm/radeon/atombios_i2c.c:61	panic	reproduced fixed
DF-2192	Info	2.5	GEM object leak on pin_pages failure in batch pool create path Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_batch_pool.c:133	none	reproduced fixed
DF-2291	Medium	2.4	crom_parse_text bounds check missing sizeof(u_int32_t) multiplier allows OOB heap read past ROM buffer Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwcrom.c:207	leak	reproduced fixed
DF-0984	Low	2.4	OOB read of ridx2rate[] in urtwn_rx_frame for legacy rates >= 12 Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_urtwn.c:1069	none	reproduced fixed
DF-1099	Low	2.4	Parent DMA tag sc->fc.dmat never destroyed in detach Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci_pci.c:300	leak	reproduced fixed
DF-1103	Low	2.4	Uninitialized kernel stack bytes leaked to userspace via short USB interrupt transfers in packet reassembly Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/input/uep.c:225	leak	reproduced fixed
DF-1281	Low	2.4	Unbounded EventDataLength loop in mpt_core_event reads past reply frame leaking kernel memory to console Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt.c:559	none	reproduced fixed
DF-1447	Low	2.4	OOB read of static wordsForPdgains[] when EEPROM xpd_mask has no set bits (numPdGains=0) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:763	none	reproduced fixed
DF-1715	Low	2.4	adwlib: adw_find_period reads one element past adw_syncrates[] on unrecognized mc_sdtr, leaking 1 byte of adjacent rodata Kernel memory leaks / uninitialized disclosure · sys/dev/disk/advansys/adwlib.c:825	leak:4	reproduced fixed
DF-1776	Low	2.4	radeon_dp_mst: uninitialized kernel stack byte read in radeon_dp_mst_probe when AUX transfer fails Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_dp_mst.c:676	leak:1	reproduced fixed
DF-1778	Low	2.4	radeon_dp_mst: unbounded goto-loop in check_status enables HPD workqueue DoS via malicious hub Base system — drivers · sys/dev/drm/radeon/radeon_dp_mst.c:716	dos	reproduced fixed
DF-2092	Low	2.4	OOB stack read in Hauppauge EEPROM parser leaks kernel stack bytes to dmesg Kernel memory leaks / uninitialized disclosure · sys/dev/video/cxm/cxm_eeprom.c:145	leak	reproduced fixed
DF-2258	Low	2.4	OOB read: gain_table_entries[32] via unclamped gain_index in ar9300_paprd_setup_gain_table Vendored third-party (contrib) · sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:2003	leak	reproduced fixed
DF-2259	Low	2.4	Uninitialized stack reads in create_pa_curve when training bins lack samples Vendored third-party (contrib) · sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:1398	leak	reproduced fixed
DF-2529	Low	2.4	1-byte heap OOB read in OUT-data transfer path of imm_do_scsi Kernel memory leaks / uninitialized disclosure · sys/dev/disk/vpo/immio.c:739	leak	reproduced fixed
DF-1063	Info	2.4	USB_GET_GPIO returns 1 byte of uninitialized kernel stack on a short control-IN response Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/uslcom.c:622	none	reproduced fixed
DF-0450	Medium	2.3	OOB kernel heap read in ng_string_unparse via unbounded strlen on binary data without NUL terminator Kernel memory corruption (UAF / OOB write) · sys/netgraph/netgraph/ng_parse.c:722	leak:2	reproduced fixed
DF-0451	Medium	2.3	OOB read in ng_fixedstring_unparse: known bufSize ignored, delegates to unbounded strlen Kernel memory leaks / uninitialized disclosure · sys/netgraph/netgraph/ng_parse.c:785	leak:7	reproduced fixed
DF-0670	Medium	2.3	Missing sopt_valsize validation -> heap OOB read of ioc_table fields, info leak via table LIST Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_table.c:92	none	reproduced fixed
DF-1357	Medium	2.3	Kernel heap info leak via unchecked request-sense length in Linux-compat ioctl Kernel memory leaks / uninitialized disclosure · sys/dev/raid/amr/amr.c:583	leak:223	reproduced fixed
DF-0080	Low	2.3	MEMRANGE_SET ioctl bypasses securelevel (mem_ioctl never checks FWRITE flag) Privilege escalation (general use) · sys/kern/kern_memio.c:521	none	reproduced fixed
DF-0238	Low	2.3	Callout overwrites sysctl-visible wdog_auto_period with driver-reported min Base system — kernel core (kern) · sys/kern/kern_wdog.c:108	none	reproduced fixed
DF-0240	Low	2.3	suspend_kproc swallows timeout: always returns 0 even when daemon did not stop Base system — kernel core (kern) · sys/kern/kern_kthread.c:195	none	reproduced fixed
DF-0293	Low	2.3	OOB heap read in setwparsnie during WPA/RSN app-IE split Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_ioctl.c:2319	none	reproduced fixed
DF-0297	Low	2.3	1-byte heap OOB read in ng_name_node name-length validation Kernel memory leaks / uninitialized disclosure · sys/netgraph7/netgraph/ng_base.c:817	none	reproduced fixed
DF-0340	Low	2.3	in6_ifremloop leaks rtentry refcount when matched route is not loopback host route Base system — network stack · sys/netinet6/in6.c:318	none	reproduced fixed
DF-0341	Low	2.3	in6_lifaddr_ioctl SIOCDLIFADDR copies prefix mask into ifra_dstaddr instead of ifra_prefixmask Base system — network stack · sys/netinet6/in6.c:1606	none	reproduced fixed
DF-0379	Low	2.3	NGM_BINARY2ASCII heap OOB read via ng_unparse: arglen not validated against mesgType/respType struct size Kernel memory leaks / uninitialized disclosure · sys/netgraph/netgraph/ng_base.c:1505	leak	reproduced fixed
DF-0412	Low	2.3	Kernel heap OOB read in ng_string_unparse via unbounded strlen on binary data without NUL terminator Kernel memory leaks / uninitialized disclosure · sys/netgraph7/netgraph/ng_parse.c:747	leak	reproduced fixed
DF-0438	Low	2.3	Kernel stack info-leak via uninitialized redstats[3] array in hfsc_getqstats copyout Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_hfsc.c:293	leak	reproduced fixed
DF-0478	Low	2.3	Rule set field not validated: 1<<set with set>=32 is UB enabling rule-set bypass Base system — network stack · sys/net/ipfw3/ip_fw3.c:487	none	reproduced fixed
DF-0577	Low	2.3	Integer overflow in SLIOCSKEEPAL/SLIOCSOUTFILL interval computation: tight callout loop DoS Base system — network stack · sys/net/sl/if_sl.c:398	dos	reproduced fixed
DF-0592	Low	2.3	Uninitialized kernel stack leaked to userspace via fairq_getqstats copyout of struct fairq_classstats Privilege escalation (general use) · sys/net/altq/altq_fairq.c:282	leak:176	reproduced fixed
DF-0603	Low	2.3	Kernel pointer leak via DIOCIGETIFACES wholesale copyout of struct pfi_kif Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_if.c:763	leak:224bytes	reproduced fixed
DF-0613	Low	2.3	Control-message request msg leaked on EBUSY early return in POINT2POINT/BROADCAST handler Base system — network stack · sys/netgraph/iface/ng_iface.c:660	dos	reproduced fixed
DF-0652	Low	2.3	cbq_getqstats leaks uninitialized kernel stack to userspace via class_stats_t Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_cbq.c:473	leak	reproduced fixed
DF-0658	Low	2.3	Uninitialized kernel stack leaked via priq_getqstats copyout of struct priq_classstats Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_priq.c:221	leak	reproduced fixed
DF-0665	Low	2.3	Kernel address disclosed to netgraph peer via ngdioctl datap->p = addr Kernel memory leaks / uninitialized disclosure · sys/netgraph/ng_device.c:476	leak	reproduced fixed
DF-0846	Low	2.3	Credential and vnode-reference leak when Q_QUOTAON re-enables quotas on same vnode Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_quota.c:437	leak	reproduced fixed
DF-0869	Low	2.3	Missing bounds validation in hammer_format_volume_header allows signed-int64 overflow in vol_buf_beg/end Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_volume.c:652	panic	reproduced fixed
DF-1013	Low	2.3	SESIOC_GETOBJMAP leaks 2 bytes uninitialized kernel stack per object (struct padding) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ses.c:503	none	reproduced fixed
DF-1030	Low	2.3	Unbounded strlen on possibly non-NUL-terminated user cv_volid in chsetvoltag Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:1300	none	reproduced fixed
DF-1053	Low	2.3	SG_DXFER_TO_FROM_DEV silently maps to CAM_DIR_NONE, passing unmapped user pointer to the HBA Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:527	none	reproduced fixed
DF-1054	Low	2.3	sgoninvalidate does not abort pending I/O or wake blocked readers, causing permanent hang on device removal Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:169	none	reproduced fixed
DF-1067	Low	2.3	PCIOCGETCONF_OLD leaks uninitialized kernel stack padding to userspace Kernel memory leaks / uninitialized disclosure · sys/bus/pci/pci_user.c:316	none	reproduced fixed
DF-1079	Low	2.3	Unbounded length in m/M GDB commands overflows remcomOutBuffer / reads remcomInBuffer out of bounds Kernel memory corruption (UAF / OOB write) · sys/cpu/x86_64/misc/x86_64-gdbstub.c:313	none	reproduced fixed
DF-1080	Low	2.3	P command register-index check (regno < NUM_REGS=22) allows stack OOB write past the registers struct Kernel memory corruption (UAF / OOB write) · sys/cpu/x86_64/misc/x86_64-gdbstub.c:438	none	reproduced fixed
DF-1110	Low	2.3	Memory leak of usrbufs array on I2CRDWR copyin-failure path Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/iic.c:352	leak	reproduced fixed
DF-1111	Low	2.3	Ignored copyin/copyout return values in I2CRDWR leak uninitialized kernel heap to I2C bus Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/iic.c:360	leak	reproduced fixed
DF-1156	Low	2.3	ISP_FC_GETDINFO ioctl missing bounds check on ifc->chan -> OOB fcparam read Kernel memory leaks / uninitialized disclosure · sys/dev/disk/isp/isp_freebsd.c:479	panic	reproduced fixed
DF-1270	Low	2.3	Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas.c:1685	none	reproduced fixed
DF-1504	Low	2.3	genkbd_get_fkeystr off-by-one bound (> instead of >=) permits one-element OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/misc/kbd/kbd.c:1119	none	reproduced fixed
DF-1532	Low	2.3	Kernel stack info leak via TW_CL_IOCTL_GET_COMPATIBILITY_INFO Kernel memory leaks / uninitialized disclosure · sys/dev/raid/twa/tw_cl_io.c:656	leak:0	reproduced fixed
DF-1541	Low	2.3	Out-of-bounds read in NGM_TEXT_CONFIG via strcmp/kprintf on non-NUL-terminated user string Kernel memory leaks / uninitialized disclosure · sys/dev/netif/mn/if_mn.c:360	leak:0	reproduced fixed
DF-1688	Low	2.3	agp: signed-int loop variable in agp_generic_unbind_memory overflows for >2 GB allocations Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:609	panic	reproduced fixed
DF-1691	Low	2.3	viapm: viasmb_bread reports untrusted hardware length as bytes-written, leaking kernel stack Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/viapm/viapm.c:852	leak:0	reproduced fixed
DF-1711	Low	2.3	intpm: intsmb_bread discards SMBus block-read bytes; leaks uninitialized kernel stack via /dev/smb* SMB_BREAD Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/intpm/intpm.c:836	leak:32	reproduced fixed
DF-1714	Low	2.3	evdev: client memory and lock leak in evdev_open error paths Base system — drivers · sys/dev/misc/evdev/cdev.c:117	dos	reproduced fixed
DF-1745	Low	2.3	mpt_pci: DMA tag leak in mpt_dma_mem_alloc error paths Base system — drivers · sys/dev/disk/mpt/mpt_pci.c:718	none	reproduced fixed
DF-1760	Low	2.3	isc_sm: memory leak - proc_out default-error branch leaks non-CCB pduq on any non-EAGAIN/EPIPE send error Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:549	dos	reproduced fixed
DF-1803	Low	2.3	snp: SNPGTTY writes 8-byte cdev_t into 4-byte dev_t user buffer - kernel pointer leak + 4-byte overrun Kernel memory corruption (UAF / OOB write) · sys/dev/misc/snp/snp.c:582	leak:4	reproduced fixed
DF-1844	Low	2.3	GPIOINFO ioctl leaks kernel cdev pointer to userspace (KASLR bypass for root) Kernel memory leaks / uninitialized disclosure · sys/dev/misc/gpio/gpio.c:466	leak	reproduced fixed
DF-1890	Low	2.3	Signed integer overflow in amdsb_watchdog period conversion, enabled by 100x-wrong period_max Base system — drivers · sys/dev/misc/amdsbwd/amdsbwd.c:217	panic	reproduced fixed
DF-2050	Low	2.3	tsleep timeout computed as hz * user-controlled int32 can overflow or go negative Base system — drivers · sys/dev/misc/tbridge/tbridge.c:274	dos	reproduced fixed
DF-2112	Low	2.3	Memory leak in led_attach error path when gpio_map fails Base system — drivers · sys/dev/misc/gpio/gpio_led.c:190	none	reproduced fixed
DF-2120	Low	2.3	Wrong object unreserved on destination-BO pin failure (lock imbalance) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:114	none	reproduced fixed
DF-2170	Low	2.3	headerDigest/dataDigest strcmp on stack buffer left non-NUL-terminated by ENAMETOOLONG copyinstr Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_subr.c:85	none	reproduced fixed
DF-2266	Low	2.3	CAMGETPASSTHRU leaks stale kernel pointers and prior I/O data via whole-CCB bcopy Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_periph.c:888	leak	reproduced fixed
DF-2277	Low	2.3	Kernel pointer leak to userspace via unconditional bcopy of full union ccb on CAMIOCOMMAND completion Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_pass.c:610	leak	reproduced fixed
DF-2280	Low	2.3	SESIOC_GETOBJMAP leaks 2 bytes of uninitialized kernel stack per object via ses_object struct padding Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ses.c:559	leak	reproduced fixed
DF-2311	Low	2.3	iicread() leaks I2C bus lock on iicbus_block_read failure Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:253	denial_of_service	reproduced fixed
DF-0384	Info	2.3	delete_pipe uses DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 undeletable — same as v1 Base system — network stack · sys/net/dummynet3/ip_dummynet3.c:1645	none	reproduced fixed
DF-0909	Info	2.3	Memory leak of dirfs_mount structure on mount-time stat failure Base system — filesystems · sys/vfs/dirfs/dirfs_vfsops.c:148	none	reproduced fixed
DF-1742	Info	2.3	vinumioctl: VINUM_*CONFIG bcopy entire struct including kernel pointers vp/dev to userland Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumioctl.c:127	leak	reproduced fixed
DF-1743	Info	2.3	vinumioctl: resetstats() switch falls through drive_object->sd_object; reply->error uninitialized on no-match Base system — drivers · sys/dev/raid/vinum/vinumioctl.c:427	none	reproduced fixed
DF-1786	Info	2.3	fb: FBIO_ADPINFO leaks kernel framebuffer addresses to userspace Kernel memory leaks / uninitialized disclosure · sys/dev/video/fb/fb.c:682	leak	reproduced fixed
DF-2123	Info	2.3	vinum_meminfo discloses the kernel address of the malloced[] debug table to userspace Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinummemory.c:184	leak	reproduced fixed
DF-2265	Info	2.3	sasetparams ENODEV early return leaks ccomp allocation Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sa.c:2757	dos	reproduced fixed
DF-1567	Low	2.1	Unvalidated lane_count causes OOB read of link_status[] in DP link-training helpers Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_dp_helper.c:46	panic	reproduced fixed
DF-1752	Low	2.1	ata-queue: ata_fail_requests leaks controller serialization lock when failing running request Base system — drivers · sys/dev/disk/nata/ata-queue.c:577	dos	reproduced fixed
DF-2173	Low	2.1	I/O resources leaked on ata_attach() failure in ata_pccard_attach() Base system — drivers · sys/dev/disk/nata/ata-card.c:125	none	reproduced fixed
DF-1098	Low	2.0	Missing resource cleanup when bus_dma_tag_create fails in fwohci_pci_attach Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci_pci.c:320	leak	reproduced fixed
DF-1972	Info	2.0	u32 to uint16 truncation of pitch into fb_info enables syscons mmap SIZE_MAX underflow Base system — drivers · sys/dev/drm/radeon/radeon_fb.c:271	panic	reproduced fixed
DF-0085	Low	1.9	taskqgroup_drain_all uses wrong loop bound (ncpus instead of tqg_cnt) - latent UAF if API adopted Kernel memory corruption (UAF / OOB write) · sys/kern/subr_gtaskqueue.c:806	none	reproduced fixed
DF-0124	Low	1.9	Unsynchronized open-mode bookkeeping in cnopen/cnclose (D_MPSAFE) Base system — kernel core (kern) · sys/kern/tty_cons.c:368	none	reproduced fixed
DF-0125	Low	1.9	sysctl_kern_consmute races cnread/cnwrite/cnioctl forwarding (no lock) Base system — kernel core (kern) · sys/kern/tty_cons.c:257	none	reproduced fixed
DF-0150	Low	1.9	Unbounded strlen/strcmp on TLV string fields ignores declared length Kernel memory leaks / uninitialized disclosure · sys/kern/subr_module.c:69	none	reproduced fixed
DF-0163	Low	1.9	module_register_init runs lookup/register/MOD_EVENT without mod_token Base system — kernel core (kern) · sys/kern/kern_module.c:89	none	reproduced fixed
DF-0170	Low	1.9	Ignored copyin return feeds uninitialized stack sched_param into ksched Base system — kernel core (kern) · sys/kern/kern_p1003_1b.c:202	none	reproduced fixed
DF-0182	Low	1.9	Uninitialized kernel stack memory disclosed via vm.resident sysctl Kernel memory leaks / uninitialized disclosure · sys/kern/imgact_resident.c:82	none	reproduced fixed
DF-0183	Low	1.9	UAF of tsleep wait channel when racing unregister of in-flight resident image Kernel memory corruption (UAF / OOB write) · sys/kern/imgact_resident.c:291	none	reproduced fixed
DF-0237	Low	1.9	TOCTOU on wdog_auto_enable in wdog_ioctl Base system — kernel core (kern) · sys/kern/kern_wdog.c:191	none	reproduced fixed
DF-0253	Low	1.9	Namecache lock+ref leaked on nc_vp==NULL error path (missing nlookup_done) Base system — kernel core (kern) · sys/kern/vfs_synth.c:82	none	reproduced fixed
DF-0254	Low	1.9	Namecache reference leaked on every successful call (cache_drop never called) Base system — kernel core (kern) · sys/kern/vfs_synth.c:86	none	reproduced fixed
DF-0277	Low	1.9	Kernel pointer leak via DIOCGETRULE: bcopy of pf_rule exposes kif/anchor/rpool.cur/skip[].ptr Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_ioctl.c:1336	leak	reproduced fixed
DF-0278	Low	1.9	Kernel pointer leak via DIOCGETADDR: bcopy of pf_pooladdr exposes pfi_kif* Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_ioctl.c:2220	leak	reproduced fixed
DF-0279	Low	1.9	Kernel pointer leak via DIOCGETALTQ: bcopy of pf_altq exposes altq_disc Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_ioctl.c:2088	leak	reproduced fixed
DF-0336	Low	1.9	tcp6_getcred hands live cred pointer to blocking copyout (UAF window) unlike IPv4 path Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_subr.c:1366	leak	reproduced fixed
DF-0381	Low	1.9	NGM_LISTHOOKS dereferences hook->peer without lock or ref: TOCTOU NULL-deref/UAF vs concurrent disconnect Kernel memory corruption (UAF / OOB write) · sys/netgraph/netgraph/ng_base.c:1374	dos	reproduced fixed
DF-0390	Low	1.9	rt_xaddrs accepts sockaddrs with sa_len below _SA_MINSIZE: inconsistent with RO_MISSFILTER validation Base system — network stack · sys/net/rtsock.c:1010	none	reproduced fixed
DF-0400	Low	1.9	rt_fixchange indexes mask bytes by key length without verifying mask size: latent OOB read Kernel memory leaks / uninitialized disclosure · sys/net/route.c:1130	none	reproduced fixed
DF-0425	Low	1.9	MRT6 setsockopt handlers cast mtod() without verifying m_len against struct size: reads uninitialized mbuf data Kernel memory leaks / uninitialized disclosure · sys/netinet6/ip6_mroute.c:277	leak	reproduced fixed
DF-0479	Low	1.9	ip_fw3_ctl_delete_rule: unchecked direct pointer deref of sopt_val without size validation Base system — network stack · sys/net/ipfw3/ip_fw3.c:850	dos	reproduced fixed
DF-0506	Low	1.9	ng_fec_ether_cmdmulti iterates if_multiaddrs lockless + leaks membership on partial kmalloc failure Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_fec.c:542	panic	reproduced fixed
DF-0515	Low	1.9	add_entry6 null-terminates fw_in_if.name but not fw_out_if.name: kfnmatch bounded over-read Kernel memory leaks / uninitialized disclosure · sys/net/ip6fw/ip6_fw.c:851	leak	reproduced fixed
DF-0552	Low	1.9	VLAN tag match strips priority on input but stores full 16-bit tag: input/output asymmetry Base system — network stack · sys/net/vlan/if_vlan.c:605	none	reproduced fixed
DF-0574	Low	1.9	Uninitialized kernel stack read as alias IPs via count mismatch in copyin Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_nat/ip_fw3_nat.c:756	panic	reproduced fixed
DF-0576	Low	1.9	Callout handlers dereference sc_ttyp before NULL check/token: callout-vs-close race panic Base system — network stack · sys/net/sl/if_sl.c:1012	panic	reproduced fixed
DF-0655	Low	1.9	Expanded AES key schedule (containing raw 128-bit key) not zeroed before ccmp_ctx freed Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:119	leak	reproduced fixed
DF-0716	Low	1.9	smb_strdupin ignores copyin return value — TOCTOU race leaks uninitialized kernel heap memory to SMB server via TRANS2 name Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_subr.c:113	leak:8	reproduced fixed
DF-0719	Low	1.9	nsmb_dev_open races si_drv1 allocation outside any lock — memory leak / stale-pointer window Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_dev.c:104	panic	reproduced fixed
DF-0977	Low	1.9	pmap_change_attr non-atomic read-modify-write on DMAP PDEs (lost A-bit updates, stale cache attr window) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/pmap.c:6279	none	reproduced fixed
DF-1052	Low	1.9	SG_IO sense-data copyout reads past csio->sense_data when sense_resid exceeds mx_sb_len Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_sg.c:570	none	reproduced fixed
DF-1055	Low	1.9	sgwrite truncates uio_resid to int and does not validate reply_len, enabling allocation-size confusion Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sg.c:648	none	reproduced fixed
DF-1195	Low	1.9	Missing goto out after ME/RLC firmware size checks allows malformed firmware use and kernel heap OOB read Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600.c:2559	panic	reproduced fixed
DF-1201	Low	1.9	VT_PROCESS scp->proc stored without refcount; signal_vt_rel/acq PHOLD can hit freed/reused proc struct (UAF / pid-recycling) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/syscons.c:1251	panic	reproduced fixed
DF-1247	Low	1.9	Out-of-bounds read in bwn_phy_g_dc_lookup_init via hardcoded loop bound (64 vs 63 valid pairs) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:2599	none	reproduced fixed
DF-1266	Low	1.9	Missing bounds validation on drm_fbdev_overalloc enables u32 overflow in framebuffer height Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_fb_helper.c:2014	none	reproduced fixed
DF-1291	Low	1.9	Sense copyout over-reads 64-byte command packet in mly_user_command Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mly/mly.c:2922	none	reproduced fixed
DF-1355	Low	1.9	Inverted assertion in vega12_display_configuration_changed_task (functional bug) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:2112	none	reproduced fixed
DF-1512	Low	1.9	vga_switcheroo_lock_ddc leaks mux_hw_lk on the no-handler / no-switch_ddc error path Kernel memory leaks / uninitialized disclosure · sys/dev/video/vga/vga_switcheroo.c:557	leak	reproduced fixed
DF-1564	Low	1.9	Kernel stack info leak via uninitialized bytesReturned copyout Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1260	leak	reproduced fixed
DF-1565	Low	1.9	Kernel heap info leak via unbounded copyout of oversized outbuffer Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1289	leak	reproduced fixed
DF-1579	Low	1.9	Kernel stack info leak via uninitialized bytesReturned copyout Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptrr/hptrr_osm_bsd.c:1236	leak	reproduced fixed
DF-1580	Low	1.9	Kernel heap info leak via oversized copyout of unzeroed outbuffer Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptrr/hptrr_osm_bsd.c:1266	leak	reproduced fixed
DF-1629	Low	1.9	OpRegion KVA mappings leak on every suspend/resume: pmap_mapbios mappings invisible to DRM iounmap() Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_opregion.c:987	leak	reproduced fixed
DF-1631	Low	1.9	evdev_open leaks allocated client on every error path (memory-exhaustion DoS) Privilege escalation (general use) · sys/dev/misc/evdev/evdev.c:118	leak	reproduced fixed
DF-1673	Low	1.9	cik_sdma: firmware header offset/size fields not bounds-checked in cik_sdma_load_microcode Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/cik_sdma.c:471	panic	reproduced fixed
DF-1674	Low	1.9	amdgpu_dpm: VBIOS power-table parsing reads heap OOB via unchecked offsets and indices Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:282	panic	reproduced fixed
DF-1680	Low	1.9	lpt: backoff-clamp typo makes callout spin at 1-tick interval instead of backing off Privilege escalation (general use) · sys/dev/misc/lpt/lpt.c:418	dos	reproduced fixed
DF-1705	Low	1.9	virtio_balloon: inverted bounds KASSERT in vtballoon_update_stat disables defense-in-depth check Base system — drivers · sys/dev/virtual/virtio/balloon/virtio_balloon.c:474	panic	reproduced fixed
DF-1706	Low	1.9	virtio_balloon: vtballoon_update_stats called from kthread without the serializer it requires Base system — drivers · sys/dev/virtual/virtio/balloon/virtio_balloon.c:551	panic	reproduced fixed
DF-1707	Low	1.9	virtio_balloon: vtballoon_detach deadlocks if balloon thread waiting on host or balloon inflated Base system — drivers · sys/dev/virtual/virtio/balloon/virtio_balloon.c:379	dos	reproduced fixed
DF-1794	Low	1.9	tw_osl_cam: CAM completion-status fallback is dead code - unhandled CL error codes complete CCB with status 0 (CAM_REQ_INPROG) Base system — drivers · sys/dev/raid/twa/tw_osl_cam.c:731	none	reproduced fixed
DF-1846	Low	1.9	gpio_map leaks pin_mapped on partial-failure of the loop, permanently locking out pins Base system — drivers · sys/dev/misc/gpio/gpio.c:211	dos	reproduced fixed
DF-1877	Low	1.9	dp_work and audio_work not flushed in radeon_irq_kms_fini: UAF after device teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_irq_kms.c:313	panic	reproduced fixed
DF-1887	Low	1.9	revive_block leaks rangelock when read returns B_ERROR: permanent I/O hang on affected stripe Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumrevive.c:137	leak	reproduced fixed
DF-2058	Low	1.9	Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART fails at pdev insert time Base system — drivers · sys/dev/disk/dm/dm_pdev.c:107	panic	reproduced fixed
DF-2106	Low	1.9	Unbounded sg_count drives OOB read in mfi_print_sgl / mfi_validate_sg debug helpers (MFI_DEBUG builds only) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi_debug.c:66	none	reproduced fixed
DF-2111	Low	1.9	Uninitialized kernel-stack bytes leaked to the console splash screen when bpsl < width (or compressed stream is short) Kernel memory leaks / uninitialized disclosure · sys/dev/video/fb/pcx/splash_pcx.c:176	none	reproduced fixed
DF-2197	Low	1.9	kthread_park() returns the wrong value (ts->kt_exitvalue instead of a success code) Base system — drivers · sys/dev/drm/linux_kthread.c:103	none	reproduced fixed
DF-2220	Low	1.9	kobject_release leaks kobj->name string allocated by kobject_init_and_add Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_kobject.c:39	denial_of_service	reproduced fixed
DF-2224	Low	1.9	seq_printf forwards __va_list into ksnprintf variadic parameter instead of using kvsnprintf Base system — drivers · sys/dev/drm/linux_printf.c:37	leak	reproduced fixed
DF-2235	Low	1.9	Read-before-bounds-check: 1-byte OOB read of source buffer in UCS-2/UTF-16 input parsing Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv_ucs.c:247	panic	reproduced fixed
DF-2310	Low	1.9	I2CRDWR: unchecked copyin return value sends uninitialized kernel heap to I2C device Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/iic.c:360	leak	reproduced fixed
DF-0023	Info	1.9	Missing return after EINVAL in sys_read/sys_write/sys_extpwrite bypasses nbyte>SSIZE_MAX guard Base system — kernel core (kern) · sys/kern/sys_generic.c:130	dos	reproduced fixed
DF-0066	Info	1.9	Undefined behavior: shift by sysctl-controlled token_window_shift in backoff spin Kernel memory leaks / uninitialized disclosure · sys/kern/lwkt_token.c:398	none	reproduced fixed
DF-0078	Info	1.9	pps_shift/pps_shiftmax sysctl lack range validation allowing UB shift counts in hardpps (root self-DoS) Base system — kernel core (kern) · sys/kern/kern_ntptime.c:265	none	reproduced fixed
DF-0114	Info	1.9	PT_IO trusts user piod_len without bounds check; narrows size_t into ssize_t uio_resid Base system — kernel core (kern) · sys/kern/sys_process.c:429	none	reproduced fixed
DF-0115	Info	1.9	sys_ptrace discards copyout error returning PT_IO descriptor Base system — kernel core (kern) · sys/kern/sys_process.c:112	none	reproduced fixed
DF-0155	Info	1.9	Division by unvalidated freq<=0 -> kernel divide-by-zero panic Base system — kernel core (kern) · sys/kern/kern_systimer.c:269	none	reproduced fixed
DF-0159	Info	1.9	xio_init_pages accepts negative npages; only upper bound asserted Base system — kernel core (kern) · sys/kern/kern_xio.c:142	none	reproduced fixed
DF-0164	Info	1.9	sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME Kernel memory leaks / uninitialized disclosure · sys/kern/kern_module.c:348	none	reproduced fixed
DF-0180	Info	1.9	Fragile zeroing contract for fill_kinfo_lwp aggregation (+=) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_kinfo.c:219	none	reproduced fixed
DF-0201	Info	1.9	dhp computed from raw tv_sec instead of UTC-adjusted t1 Base system — kernel core (kern) · sys/kern/subr_fattime.c:150	none	reproduced fixed
DF-0211	Info	1.9	No negative-size guard on ccmax in clist_alloc_cblocks Base system — kernel core (kern) · sys/kern/tty_subr.c:61	none	reproduced fixed
DF-0222	Info	1.9	csprng_get_random byte count signed int: huge u_int requests silently truncate to 0 Base system — kernel core (kern) · sys/kern/subr_csprng.c:127	none	reproduced fixed
DF-0405	Info	1.9	Missing null-termination of bdg_basename when namelen==IFNAMSIZ: OOB read in debug format strings Kernel memory leaks / uninitialized disclosure · sys/net/netmap/netmap_vale.c:331	none	reproduced fixed
DF-0452	Info	1.9	Octal/hex escape loops in ng_get_string_token: counter k never incremented, consumes all consecutive digits Base system — network stack · sys/netgraph/netgraph/ng_parse.c:1599	none	reproduced fixed
DF-0608	Info	1.9	sizeof(ips) pointer-vs-struct typo in NGM_CISCO_GET_IPADDR response sizing Kernel memory corruption (UAF / OOB write) · sys/netgraph7/iface/ng_iface.c:724	none	reproduced fixed
DF-0681	Info	1.9	Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports bogus flow-control credits Base system — network stack · sys/netbt/rfcomm_upper.c:550	none	reproduced fixed
DF-0695	Info	1.9	RC4 key material and S-box left unzeroed on kernel stack after encrypt/decrypt Base system — network stack · sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:334	none	reproduced fixed
DF-0828	Info	1.9	Buffer leak in markvoldirty_upgrade on bread error (dead code path) Base system — filesystems · sys/vfs/msdosfs/msdosfs_fat.c:1154	none	reproduced fixed
DF-0854	Info	1.9	User-controlled iconv charset names copied without null-termination — bounded kernel-stack OOB read via kprintf/strcasecmp Kernel memory leaks / uninitialized disclosure · sys/vfs/msdosfs/msdosfs_vfsops.c:116	none	reproduced fixed
DF-0942	Info	1.9	vm_page_set_invalid dereferences m->object without NULL check (latent; no in-tree caller triggers it) Base system — virtual memory · sys/vm/vm_page.c:4101	none	reproduced fixed
DF-0948	Info	1.9	swap_pager_putpages stripe-boundary trim is off-by-one, invoking freeswapspace with npages=0 Base system — virtual memory · sys/vm/swap_pager.c:1713	none	reproduced fixed
DF-0970	Info	1.9	Poly1305 one-time key (poly_key) left unzeroed on stack after _chacha20poly1305_init returns Base system — crypto · sys/crypto/chachapoly.c:52	none	reproduced fixed
DF-1350	Info	1.9	XPT_CALC_GEOMETRY divides by block_size with no zero check Base system — drivers · sys/dev/disk/amd/amd.c:683	none	reproduced fixed
DF-1671	Info	1.9	if_vke: LOW_POW_2(0) undefined shift when nmbclusters < NetifNum*2 Base system — drivers · sys/dev/virtual/vkernel/net/if_vke.c:89	panic	reproduced fixed
DF-1751	Info	1.9	amdgpu_acpi: wrong allocator - AcpiOsFree(M_ACPICA) on kzalloc(M_DRM) atif memory Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:755	panic	reproduced fixed
DF-1859	Info	1.9	UB shift 1<<biBitCount in splash_bmp ncols computation (folded into DF-1857 fix) Base system — drivers · sys/dev/video/fb/bmp/splash_bmp.c:538	none	reproduced fixed
DF-1998	Info	1.9	amdgpu_gfx_kiq_init calls amdgpu_bo_unreserve on unreserved BO (ttm reservation imbalance) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:299	none	reproduced fixed
DF-1999	Info	1.9	amdgpu_gfx_compute_mqd_sw_fini kfrees mqd_backup without NULLing the slot (double-free landmine) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:366	panic	reproduced fixed
DF-2088	Info	1.9	ACPI_DEBUG_MEMMAP build reuses a found track by moving it to list head without unlinking, orphaning nodes and risking cycles Base system — drivers · sys/dev/acpica/Osd/OsdMemory.c:96	none	reproduced fixed
DF-2094	Info	1.9	Resource leak in ata_ali_sata_allocate error path: io released with wrong device and rid Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/chipsets/ata-acerlabs.c:152	none	reproduced fixed
DF-2099	Info	1.9	ar5416GpioGet reads wrong GPIO input bit on AR9287 (KIWI) due to missing else Base system — drivers · sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:192	none	reproduced fixed
DF-2139	Info	1.9	Raw RDRAND entropy bytes logged to world-readable kernel message buffer Privilege escalation (general use) · sys/dev/crypto/rdrand/rdrand.c:175	leak	reproduced fixed
DF-2184	Info	1.9	Memory leak in backlight_destroy: softc is never freed Base system — drivers · sys/dev/misc/backlight/backlight.c:111	none	reproduced fixed
DF-2185	Info	1.9	backlight_lock is never lockinit()d — lockuninit() called instead during SYSINIT Privilege escalation (general use) · sys/dev/misc/backlight/backlight.c:45	panic	reproduced fixed
DF-2193	Info	1.9	Off-by-one OOB read in fire fade loop at bottom-right corner (buf[64320]) Kernel memory leaks / uninitialized disclosure · sys/dev/misc/syscons/fire/fire_saver.c:56	panic	reproduced fixed
DF-1793	Info	1.6	puc: IRQ resource leak when BUS_SETUP_INTR fails during attach Kernel memory leaks / uninitialized disclosure · sys/dev/misc/puc/puc.c:229	leak	reproduced fixed
DF-1893	Info	1.5	Uninitialized UINT32 arg consumed by SET after failed HCI GET in hci_key_action Base system — drivers · sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:474	none	reproduced fixed
DF-1600	Low	1.1	Out-of-bounds read on carrier_detect_main[max1] when no positive carrier detected (max1 stays -1) Kernel memory leaks / uninitialized disclosure · sys/dev/video/bktr/msp34xx.c:744	panic	reproduced fixed
DF-1621	Low	1.1	Unbounded bcopy of user-controlled csio->cdb_len into 32-byte CDB32 frame (DF-1356/1547 class) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_cam.c:489	panic	reproduced fixed
DF-2068	Low	1.1	Unchecked capacity*struct_size multiplication can overflow in construct/presized/reserve (latent heap OOB) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/basics/vector.c:43	none	reproduced fixed
DF-2190	Low	1.1	vmap() leaks the vmap descriptor when kmem_alloc_nofault fails Base system — drivers · sys/dev/drm/linux_vmalloc.c:53	none	reproduced fixed
DF-0064	Info	1.1	Unsynchronized data race on desc->total_objects (statistics-only, no security impact) Base system — kernel core (kern) · sys/kern/kern_objcache.c:357	none	reproduced fixed
DF-0069	Info	1.1	Signed integer overflow (C UB) in lock range end calculation (caught by guard, no corruption reachable) Base system — kernel core (kern) · sys/kern/kern_lockf.c:227	none	reproduced fixed
DF-0082	Info	1.1	Latent heap overflow in sbuf_extend via int truncation of caller length (zero callers, unreachable today) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_sbuf.c:150	none	reproduced fixed
DF-0699	Info	1.1	Wrong byte counter after BPF truncation: totlen -= len should be totlen = len Base system — network stack · sys/netgraph/bpf/ng_bpf.c:414	none	reproduced fixed
DF-0962	Info	1.1	Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-exploitable) Base system — virtual memory · sys/vm/vm_unix.c:86	none	reproduced fixed
DF-1746	Info	1.1	ttm_bo_util: ttm_bo_kmap bounds check allows OOB page-array index Base system — drivers · sys/dev/drm/ttm/ttm_bo_util.c:584	panic	reproduced fixed
DF-2023	Info	1.1	evdev_hid2key indexes static scancode table with unbounded signed int no bounds check Kernel memory leaks / uninitialized disclosure · sys/dev/misc/evdev/evdev_utils.c:217	panic	reproduced fixed
DF-2097	Info	1.1	sil164_detect uses uninitialized reg9 when sil164_readb fails (unchecked return) Base system — drivers · sys/dev/drm/i915/dvo_sil164.c:176	none	reproduced fixed
DF-2178	Info	1.1	Dead obj==NULL checks give false impression of bounds safety across all package helpers Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_package.c:48	none	reproduced fixed
DF-2180	Info	1.1	ttm_bo_man_get_node silently swallows allocator errors (returns 0 instead of ret) Base system — drivers · sys/dev/drm/ttm/ttm_bo_manager.c:75	none	reproduced fixed
DF-0094	Info	0.8	shmrealloc initializes OLD shmsegs[] instead of newsegs[] - heap OOB write + uninit new array (dead code) Kernel memory corruption (UAF / OOB write) · sys/kern/sysv_shm.c:683	none	reproduced fixed
DF-0300	Info	0.8	ng_decodeidname truncates u_long to ng_ID_t without range check Base system — network stack · sys/netgraph7/netgraph/ng_base.c:919	none	reproduced fixed
DF-0444	Info	0.8	rmc_newclass does not reject negative priority: only checks upper bound, latent negative array index Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_rmclass.c:201	none	reproduced fixed
DF-1459	Info	0.8	bzero of softc uses sizeof(pointer) instead of sizeof(struct) - latent garbage init Base system — drivers · sys/dev/smbus/cyapa/cyapa.c:488	none	reproduced fixed
DF-1513	Info	0.8	vga_switcheroo_write uses negative errno return convention inconsistent with BSD dev_write Base system — drivers · sys/dev/video/vga/vga_switcheroo.c:1112	none	reproduced fixed
DF-1683	Info	0.8	hptmv: default ioctl dispatch reads struct fields from lpInBuffer before validating nInBufferSize (heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptmv/ioctl.c:337	panic	reproduced fixed
DF-1824	Info	0.8	aac_cam: unbounded CDB bcopy overflows struct aac_srb.cdb[16] into sg_map Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac_cam.c:443	panic	reproduced fixed
DF-2030	Info	0.8	dig_encoder_sel_to_atom discards computed value returns literal 0 Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:154	none	reproduced fixed
DF-2144	Info	0.8	decoders counter never increments except at DELTA-aligned boundaries (registration array logic bug) Kernel memory corruption (UAF / OOB write) · sys/dev/video/fb/splash.c:124	corruption	reproduced fixed
DF-1780	Info	0.6	radeon_dp_mst: dead error-threshold check (retries==10000 vs loop bound 50) silently hides SAT timeout Base system — drivers · sys/dev/drm/radeon/radeon_dp_mst.c:101	none	reproduced fixed
DF-0221	Low	0.5	Signed 1<<31 overflow disables Fortuna pool 31 from reseed schedule Base system — kernel core (kern) · sys/kern/subr_csprng.c:203	none	reproduced fixed
DF-0708	Low	0.5	Filter entries leaked on shutdown — hashtable not purged before kfree(privdata) Base system — network stack · sys/netgraph7/etf/ng_etf.c:437	dos	reproduced fixed
DF-0002	Info	0.5	sys_fhopen returns spurious success (fd 0) on VREG-without-VM-object invariant violation Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:4933	none	reproduced fixed
DF-0043	Info	0.5	SYSCTL_INT declared for long counters (auxrecovervnodes1/2) - type/size mismatch Base system — kernel core (kern) · sys/kern/vfs_lock.c:109	none	reproduced fixed
DF-0087	Info	0.5	Signed integer overflow (C UB) in new_unrhdr last computation when high=INT_MAX Kernel memory corruption (UAF / OOB write) · sys/kern/subr_unit.c:257	none	reproduced fixed
DF-0098	Info	0.5	sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defense-in-depth, dead code) Kernel memory leaks / uninitialized disclosure · sys/kern/subr_sglist.c:402	none	reproduced fixed
DF-0100	Info	0.5	Missing NULL check on vfsconf_find_by_name("devfs") before dereference in vfs_mountroot_devfs Base system — kernel core (kern) · sys/kern/vfs_conf.c:300	none	reproduced fixed
DF-0171	Info	0.5	Ignored copyout return in sys_sched_getparam Base system — kernel core (kern) · sys/kern/kern_p1003_1b.c:245	none	reproduced fixed
DF-0464	Info	0.5	bzero (not explicit_bzero) used to clear sensitive key material in heap structs: DSE risk Base system — network stack · sys/net/wg/wg_noise.c:411	none	reproduced fixed
DF-0614	Info	0.5	NGM_CISCO_GET_IPADDR response sized with sizeof(ips) (pointer) instead of sizeof(*ips) (struct) Kernel memory corruption (UAF / OOB write) · sys/netgraph/iface/ng_iface.c:697	none	reproduced fixed
DF-0936	Info	0.5	NUL-termination write underflows when aux_size==0 (latent OOB write, dead code today; live twin at hammer2_iocom.c:149) Hammer2 · sys/vfs/hammer2/hammer2_msgops.c:72	none	reproduced fixed
DF-0964	Info	0.5	Missing bounds check on ivlen in cryptoapi_cipher_encrypt/decrypt (latent stack buffer overflow) Kernel memory corruption (UAF / OOB write) · sys/crypto/cryptoapi/cryptoapi.c:1118	none	reproduced fixed
DF-1047	Info	0.5	Wrong loop bound (USB_DEV_QUIRKS_MAX vs USB_QUIRK_MAX) in USB_DEV_QUIRK_ADD/REMOVE quirk-name lookup Privilege escalation (general use) · sys/bus/u4b/quirk/usb_quirk.c:883	none	reproduced fixed
DF-1107	Info	0.5	Incomplete index validation in camq_remove; none in camq_change_priority Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_queue.c:174	none	reproduced fixed
DF-1622	Info	0.5	Unbounded loop in cxm_saa7115_configure reads past saa7115_scalings[]/saa7115_audio_clock[] (missing i< before NUM_ELEMENTS) Kernel memory leaks / uninitialized disclosure · sys/dev/video/cxm/cxm_saa7115.c:825	none	reproduced fixed
DF-1677	Info	0.5	nvme: queue alloc/free/create/delete helpers accept uint16_t qid without validating against NVME_MAX_QUEUES Base system — drivers · sys/dev/disk/nvme/nvme.c:128	panic	reproduced fixed
DF-1850	Info	0.5	ksprintf overflows 9-byte msp/dpl version string buffers by up to 2 bytes (lands in struct padding, no impact today) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_audio.c:442	none	reproduced fixed
DF-1970	Info	0.5	Latent kfree() on embedded drm_framebuffer would corrupt slab if reached Base system — drivers · sys/dev/drm/radeon/radeon_fb.c:331	panic	reproduced fixed
DF-1997	Info	0.5	amdgpu_gfx_scratch_free performs unbounded 1u << (reg - reg_base) shift (latent UB) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:98	panic	reproduced fixed
DF-2013	Info	0.5	sili_pci_detach leaves sc_pregs dangling (typo nulls sc_regs twice) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili_attach.c:375	panic	reproduced fixed
DF-2033	Info	0.5	Wrong sizeof in smb_attach bzero() zeroes only first pointer-sized bytes of softc Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/smb/smb.c:129	leak	reproduced fixed
DF-2089	Info	0.5	Missing lower-bound check on signed gpio_ddc_line index in acquire_i2c_hw_engine allows negative-index array read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c:122	dos	reproduced fixed
DF-2102	Info	0.5	Resource leak in wbsio_attach on child-add / set-resource / probe-and-attach failure paths Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/wbsio/wbsio.c:256	none	reproduced fixed
DF-2109	Info	0.5	Undefined behavior in radix_max when tree height reaches RADIX_TREE_MAX_HEIGHT (shift >= word width) Base system — drivers · sys/dev/drm/linux_radix.c:42	none	reproduced fixed
DF-2179	Info	0.5	Signed-integer overflow UB in SM() shift of EEPROM antdiv_ctl1 Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar9002/ar9285_diversity.c:98	none	reproduced fixed
DF-2162	Info	0.3	parent_dmat DMA tag leaked on bt_pci_attach error paths Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt_pci.c:142	none	reproduced fixed
DF-0265	High	—	Missing distance bounds validation in inflate: heap OOB read when windowBits<15 Kernel memory leaks / uninitialized disclosure · CVE-2018-25032 · sys/net/zlib.c:4824	heap OOB read (info-leak/panic); LATENT in-kernel (netgraph7_deflate not in X86_64_GENERIC); demonstrated deterministically via userspace harness linking the verbatim audited sys/net/zlib.c	reproduced fixed
DF-2548	Medium	—	sysctl kern.ttys leaks raw kernel pointers (function + heap) to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/kern/tty.c:2911	leak:102ptrs	reproduced fixed
DF-1687	Low	—	agp: agp_close frees all GART state and clears as_isopen on EVERY close, not on last close Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:789	dos	reproduced fixed
DF-2019	Info	—	drm_setmaster_ioctl: lessor check and drm_set_master fall-through (lines 215-225) are dead code Base system — drivers · sys/dev/drm/drm_auth.c:187	none	reproduced fixed

Confirmed — reproduced 845

These findings have a working proof-of-concept that reproduced the bug on a live DragonFlyBSD kernel guest (kernel panic, memory corruption, privilege gain, or an observable leak). This is the highest-confidence tier — the vulnerability is confirmed real.

ID	Sev	CVSS	Title	Impact	PoC
DF-5809	Medium	5.5	vfs_export_lookup() returns an unref'd netcred after dropping NE_LOCK; consumers keep it across the NFS request while DELEXPORT frees it (use-after-free of the authorization credential) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_subr.c:2297	dos	reproduced
DF-5815	Low	4.4	vm.max_launder sysctl accepts negative values: per-queue launder budget goes negative, dirty-page laundering is silently and permanently disabled, and any unprivileged memory workload then livelocks the pagedaemon (deterministic whole-machine freeze until power-cycle) Base system — virtual memory · sys/vm/vm_pageout.c:828	dos	reproduced
DF-5795	Low	3.9	m_move_pkthdr() never clears M_PKTHDR on the source mbuf — live stale packet-header (stale len/rcvif/csum/pf) glued mid-chain on every M_MOVE_PKTHDR, contradicting its documented contract Base system — kernel core (kern) · sys/kern/uipc_mbuf.c:2551	none	reproduced
DF-5796	Low	3.7	m_copyback()/m_copyback2() write through shared (refcount>1) clusters with no M_WRITABLE gate — cross-packet data corruption; remote sink is bridge_output()'s in-place ether_shost rewrite on m_copypacket-shared flood copies Privilege escalation (general use) · sys/kern/uipc_mbuf.c:2368	none	reproduced
DF-5797	Low	3.3	utimensat(2)/utimes(2)/futimens(2) let a non-owner with write permission set arbitrary file timestamps (POSIX permission-model violation, HAMMER2 default root) Privilege escalation (general use) · sys/kern/vfs_syscalls.c:3961	none	reproduced
DF-5835	Low	3.3	tvtohz_high/tstohz_high/tvtohz_low/tstohz_low: signed int overflow at the sec == INT_MAX/hz boundary turns ~249-day timers into immediate fires (kernel UB, unprivileged) Privilege escalation (general use) · sys/kern/kern_clock.c:1198	none	reproduced
DF-5842	Low	3.3	select/pselect/ppoll pass unvalidated (negative/unnormalized) timeouts into kern_kevent — POSIX EINVAL missing, ~146-year sleeps collapse to immediate or arbitrary-short returns Base system — kernel core (kern) · sys/kern/sys_generic.c:807	dos	reproduced
DF-5803	Medium	2.5	expand_name() logs an unterminated, uninitialized kmalloc buffer via %s — recycled kernel-heap bytes disclosed into the user-readable kernel log Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sig.c:2453	leak	reproduced
DF-5834	Info	2.3	pps_fetch_timeout(): normalized finite sub-tick timeout inverts into an unbounded sleep (tstohz_low()==0 -> tsleep with no timeout armed) Base system — kernel core (kern) · sys/kern/kern_clock.c:1616	none	reproduced
DF-5824	Low	1.9	inferior() strands one PHOLD on proc0 per returning-0 call — unprivileged setpgid grows proc0's p_lock without bound, overflowing the PLOCK flag word (demonstrated: PLOCK_WAITRES bit set live) Base system — kernel core (kern) · sys/kern/kern_proc.c:477	none	reproduced
DF-3157	High	10.0	msdosfs_fhtovp feeds fully attacker-controlled NFS file-handle fields into deget/readep/deupdat: 31-byte kernel heap OOB read+write, arbitrary in-volume device-offset read/write via stat()/SETATTR, deterministic fatal kernel panic (3/3) and nfsd wedge — remotely reachable on any NFS-exported msdosfs, no crafted image needed Kernel memory corruption (UAF / OOB write) · sys/vfs/msdosfs/msdosfs_denode.c:363 · pass 2 · new	panic	reproduced
DF-3044	Medium	8.8	BOOTP/DHCP reply acceptance has zero origin validation and a fully deterministic transaction XID — spoofed reply gives same-L2 attacker total control of the diskless client (root/swap NFS server, hostname, default route) Base system — filesystems · sys/vfs/nfs/bootp_subr.c:595 · pass 2 · new	panic	reproduced
DF-4140	High	8.2	Drive free list grows without bound: OOB write past the 16-entry (256-byte) drive->freelist heap array with attacker-chosen u64 pairs from ordinary config Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:436 · pass 2 · new	panic	reproduced
DF-2738	Medium	8.1	CTLFLAG_PRISON never enforced: jailed uid-0 can write host-global sysctls (kern.maxfiles, kern.securelevel, debug., net., vm.*) Privilege escalation (general use) · sys/kern/kern_sysctl.c:1438 · pass 2 · new	dos	reproduced
DF-3514	High	7.9	ng_ID_rehash/ng_name_rehash migrate hash entries only under #ifdef INVARIANTS (double-insert on production/module builds) and ng_ID_rehash destroys the old table with the WRONG mask -> 'hashdestroy: hash not empty' kernel panic (list-corruption UAF) — root cause of DF-3271's fix_failed mystery Kernel memory corruption (UAF / OOB write) · sys/netgraph7/netgraph/ng_base.c:953 · pass 2 · new	panic	reproduced
DF-2996	High	7.8	nfs_sillyrename consumes nfs_lookitup() result with no error check, uninitialized np, and no identity/type validation — wild-pointer write and VDIR n_cookies type confusion; deterministic kernel panic from unprivileged unlink() against a mounted share Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_vnops.c:3036 · pass 2 · new	panic	reproduced
DF-3783	High	7.8	BT848SCLIP / capture geometry → unbounded RISC program emission overflows the fixed 8-page dma_prog/odd_dma_prog buffers (up to 37×; also clip-less via 2046-row odd-only YUV4:2:2) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1219 · pass 2 · new	dos	reproduced
DF-3789	High	7.8	METEORSETGEO accepts frames=0 → bigbuf resize block skipped entirely → oversized rows/cols stored → 626,696-byte OOB RISC-DMA write and OOB read() heap disclosure with the default RGB16 format (no SACTPIXFMT; distinct trigger from DF-1216) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1642 · pass 2 · new	leak	reproduced
DF-4329	High	7.8	i915 request-object RCU lifetime protocol is a no-op on DragonFly: empty synchronize_rcu()/cond_synchronize_rcu(), ignored SLAB_TYPESAFE_BY_RCU, unconditional dma_fence_get_rcu — lockless readers (GEM_BUSY) race freed-and-reused request memory and chase attacker-influenced pointers Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_request.c:732 · pass 2 · new	panic	reproduced
DF-4325	Medium	7.8	sf_txeof() trusts DMA-written 15-bit TX completion index: OOB descriptor read feeds arbitrary pointer to m_freem(), OOB NULL write, and sf_tx_cnt underflow Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sf/if_sf.c:998 · pass 2 · new	panic	reproduced
DF-4326	Medium	7.8	sf_rxeof() trusts DMA-written 11-bit endidx: sf_newbuf() OOB-writes mbuf pointer + DMA address up to 12KB past the entire contigmalloc'd descriptor block Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sf/if_sf.c:940 · pass 2 · new	panic	reproduced
DF-3172	High	7.5	ffs_indirtrunc wild and attacker-aimed kernel bzero via unvalidated on-disk fs_nindir and unclamped lastbn Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_inode.c:535 · pass 2 · new	panic	reproduced
DF-3180	Medium	7.5	tmpfs_fhtovp passes an unpinned tmpfs_node to tmpfs_alloc_vp; blocking releases the mount token and reclaim frees the node under the caller (window proven by on-guest panic from fhopen race; stock kernels reach a use-after-free at tmpfs_subr.c:382) Kernel memory corruption (UAF / OOB write) · sys/vfs/tmpfs/tmpfs_vfsops.c:453 · pass 2 · new	panic	reproduced
DF-3205	Medium	7.5	krpc_call has zero-entropy transaction IDs and no reply-source filtering: deterministic xid (0xFFFFFF00+n), deterministic reserved-port sweep, and an unconnected socket whose from-address is discarded — any LAN host can blindly forge boot-critical RPC replies and become the diskless client's NFS/portmap authority Base system — filesystems · sys/vfs/nfs/krpc_subr.c:201 · pass 2 · new	dos	reproduced
DF-3268	Medium	7.5	pf state-table hard limit (PFSTATE_HIWAT / `set limit states`) is never enforced — unbounded state growth, remote memory-exhaustion DoS Base system — network stack · sys/net/pf/pf.c:278 · pass 2 · new	dos	reproduced
DF-3361	Medium	7.5	pf fragment pools have no enforced limit: unbounded kernel memory growth under fragment flood (remote DoS) Base system — network stack · sys/net/pf/pf_norm.c:118 · pass 2 · new	dos	reproduced
DF-5739	High	7.4	Expiry-callout teardown race: hci_acl_timeout() (softclock) frees refcnt-0 links concurrently with event-context hci_link_free()/hci_acl_recv() (netisr) - dead callout_active() deferral lets two hci_link_free() bodies interleave: double kfree demonstrated ('memchunk already freed' panic) Base system — network stack · sys/netbt/hci_link.c:191 · pass 2 · new	panic	reproduced
DF-3785	High	7.3	BT848_REEPROM: signed (offset+count) guard bypassed with negative offset → readEEProm() writes up to 32767 bytes into eeProm.bytes[256] (~32 KiB kernel heap overflow of the 260-byte M_IOCTLOPS ioctl argument, content attacker-controllable via DF-1217's raw I2C write) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:2086 · pass 2 · new	dos	reproduced
DF-3786	High	7.3	BT848_SIGNATURE: signCard() has no bound on count → single-bit OOB read-modify-write up to ~3.8 KiB past the 260-byte ioctl argument (bit-OR heap corruption primitive) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:2094 · pass 2 · new	dos	reproduced
DF-3781	Medium	7.3	update_rxhead path: unchecked 10-bit rxcd->qid produces OOB MMIO write up to 0x29F0 past the 4KB vmxnet3 BAR0 (panic / cross-device MMIO corruption) Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2321 · pass 2 · new	panic	reproduced
DF-3376	High	7.1	Lockless nd6_ra_input tail races nd6_timer expiry-sweep frees: UAF on nd_prefix/nd_defrouter (M_IP6NDP) with fatal route-replication panic; single-site fix empirically falsified Kernel memory corruption (UAF / OOB write) · sys/netinet6/nd6_rtr.c:403 · pass 2 · new	dos	reproduced
DF-3063	Medium	7.1	ext2_zero_inode_table computes all_blks from the RAW s_inode_size field — REV0 (which also bypasses the feature gate) zeroes up to ~512MB of device blocks past the inode table on first create Base system — filesystems · sys/vfs/ext2fs/ext2_alloc.c:1251 · pass 2 · new	dos	reproduced
DF-4395	High	7.0	Heap OOB write in get_dcefclk_voltage_dependency_table pioneer path: allocation capped at min(ucNumEntries+1, 8) but copy loop runs raw ucNumEntries — up to 6916 bytes of VBIOS-controlled records past a 228-byte kernel heap object Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:721 · pass 2 · new	corruption	reproduced
DF-4467	Medium	7.0	Software XTS races on session-shared running tweak: silent ciphertext corruption and data-unit tweak reuse on multicore dm-crypt I/O Base system — drivers · sys/dev/disk/dm/crypt/dm_target_crypt.c:958 · pass 2 · new	dos	reproduced
DF-5083	Medium	7.0	ata_dmaload() mishandles bus_dmamap_load()==EINPROGRESS: busdma defers the load and later fires setprd into a dead stack frame (and re-loads the completed request's freed buffer) — kernel memory corruption + permanent channel wedge Base system — drivers · sys/dev/disk/nata/ata-dma.c:223 · pass 2 · new	dos	reproduced
DF-3487	Medium	6.8	ng_pppoe_rcvdata PRIMED branch: get_tag/scan_tags walk with unvalidated ph->length -> kernel heap OOB read disclosed in emitted PADO (DF-0414 sibling sink) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/pppoe/ng_pppoe.c:1194 · pass 2 · new	leak	reproduced
DF-3784	High	6.6	vbi_read() truncates the 64-bit read length to int → negative readsize bypasses both guards → uiomove() of (size_t)INT_MIN copies ~2 GiB of kernel memory to userspace Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1159 · pass 2 · new	leak	reproduced
DF-2828	Medium	6.6	Multi-threaded CKPT_THAW violates vmspace_exec()/pmap_replacevm()'s single-thread contract: deterministic INVARIANTS panic; released-vmspace UAF for other LWPs on production kernels Kernel memory corruption (UAF / OOB write) · sys/kern/kern_checkpoint.c:556 · pass 2 · new	panic	reproduced
DF-3513	High	6.5	NG_BT_ITEMQ_DRAIN uses flag-only NG_FREE_ITEM: every packet queued in an HCI conq at connection destruction permanently leaks ng_item + mbuf + node/hook references (unbounded kernel memory exhaustion) Privilege escalation (general use) · sys/netgraph7/bluetooth/hci/ng_hci_main.c:202 · pass 2 · new	dos	reproduced
DF-2710	Medium	6.5	Peer-freezable iocom reader: writer parked in fp_write with KDMSG_STATE_INTERLOCK set turns the 'dmrace' 1s-sleep loop into an indefinite cluster-link stall Base system — kernel core (kern) · sys/kern/kern_dmsg.c:1636 · pass 2 · new	dos	reproduced
DF-3515	Medium	6.5	kern_timeout _callout_cancel_or_stop returns 0 for inline-completed stops (violating the documented contract) -> netgraph7 ng_uncallout misreports every successful cancellation; ng_callout/ng_uncallout also leak callout items + node references (HCI command-complete machine permanently wedged) Base system — kernel core (kern) · sys/kern/kern_timeout.c:888 · pass 2 · new	dos	reproduced
DF-4476	Medium	6.5	IOCATADETACH/ATTACH/REINIT dispatched unserialized: double channel teardown (double bus_teardown_intr/bus_release_resource/lockuninit) -> sysref_put panic Base system — drivers · sys/dev/disk/nata/ata-all.c:369 · pass 2 · new	panic	reproduced
DF-5742	Medium	6.5	hci_mtap() taps into receive buffers with no flow control: sbappendaddr without any ssb_space/hiwat check — unprivileged unbounded consumer of the global mbuf pool (kernel-wide allocation failure, hard hang) Privilege escalation (general use) · sys/netbt/hci_socket.c:1003 · pass 2 · new	dos	reproduced
DF-5365	Medium	6.4	lapic_map() maps firmware-supplied Local APIC physical address with zero validation -> arbitrary-physical-address kernel read/write page at boot (MADT LocalApicAddr / MP apic_address never cross-checked against IA32_APICBASE) Base system — bus / platform / cpu · sys/platform/pc64/apic/lapic.c:1081 · pass 2 · new	memcorrupt	reproduced
DF-2775	Medium	6.3	sysctl_intrnames traverses every CPU's interrupt-handler lists unsynchronized → use-after-free read / kernel heap disclosure via hw.intrnames Kernel memory corruption (UAF / OOB write) · sys/kern/kern_intr.c:1100 · pass 2 · new	leak	reproduced
DF-4914	Medium	6.3	radeon_fbdev_init() failure leaves rdev->mode_info.rfbdev dangling (published before any fallible step, kfree'd on the error path without clearing) — production teardown radeon_fbdev_fini() then use-after-frees and double-kfrees it Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_fb.c:379 · pass 2 · new	panic	reproduced
DF-4925	Medium	6.3	amdgpu_fbdev_init() publishes adev->mode_info.rfbdev before the fallible drm_fb_helper_init() and kfrees it without clearing on error — dangling pointer → deferred double-free/UAF in production teardown (DF-4914 radeon_fb twin) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_fb.c:365 · pass 2 · new	panic	reproduced
DF-5273	Medium	6.3	cdioctl() drops an unmatched cam_periph_release() when cam_periph_hold(PCATCH) is signal-interrupted: periph refcount underflow -> premature free / UAF window Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_cd.c:1930 · pass 2 · new	peripheral refcount underflow (demonstrated 1 -> 0 -> -1 on a valid, open cd periph; earlier exploratory runs reached -3 and -5), one burned reference per signal-interrupted ioctl, deterministic; with device invalidation (unplug/kldunload) the CAM_PERIPH_INVALID && refcount==1 branch of cam_periph_release() frees periph+softc while fds remain open -> use-after-free window in cdioctl/cdclose between cam_extend_get() and cam_periph_lock(). Root-gated entry; the full UAF was not chased (racy), the underflow is deterministic.	reproduced
DF-5432	Medium	6.3	ioapic_map() of unvalidated firmware IOAPIC Address: arbitrary-physical-address kernel MMIO reads and writes at boot (DF-5365's IOAPIC twin) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_madt.c:619 · pass 2 · new	memcorrupt	reproduced
DF-3131	Low	6.3	msdosfs_mount() ignores the copyinstr(fspec) return and uses the then-uninitialized size as both offset and length in memset(f_mntfromname + size, 0, MNAMELEN - size) — garbage-indexed OOB write if the fspec string is raced out between nlookup and the copyin Base system — filesystems · sys/vfs/msdosfs/msdosfs_vfsops.c:281 · pass 2 · new	corruption	reproduced
DF-5051	Low	6.3	dal_vector_insert_at() performs no bounds check on position — kernel heap OOB write at a caller-chosen 32-bit element offset (latent library defect, primitive runtime-demonstrated) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/basics/vector.c:204 · pass 2 · new	panic	reproduced
DF-4605	Medium	6.2	amdgpu_atif_handler: port gutted the event guard into an empty if (#if 0) — unconditional fall-through dereferences adev->atif (NULL+0x12) on ATIF-less systems → kernel panic on first ACPI notify Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:375 · pass 2 · new	dos	reproduced
DF-3133	Medium	6.1	dirfs_node_chsize destroys the guest buffer cache/pager BEFORE the host truncate() is known to succeed — failed truncates (EFAULT on unlinked/over-length paths, EPERM by non-owner) silently discard acknowledged writes and desync the VM object; absolute_path NULL return never checked Base system — filesystems · sys/vfs/dirfs/dirfs_subr.c:778 · pass 2 · new	dos	reproduced
DF-3592	Medium	6.1	si_ib_parse() lacks packet-fits-in-IB validation -> OOB reads up to 6 dwords past the IB sub-allocation + WRITE_DATA (pkt->count - 2) underflow spin Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/si.c:4776 · pass 2 · new	dos	reproduced
DF-3590	Low	6.1	World-writable /dev/psm0 with zero privilege checks in psmioctl(): any local user can reprogram the PS/2 device, hold it hostage from moused/X (root gets EBUSY), and starve the shared i8042 keyboard port Privilege escalation (general use) · sys/dev/misc/psm/psm.c:2025 · pass 2 · new	dos	reproduced
DF-4965	Low	6.1	dce110 hw_translate offset_to_id returns success for all eight DDC-family offsets without writing *id — dal_gpio_service_create_irq switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6/7 into the 6-entry hpd_regs[] (OOB rodata read driving MMIO) Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dce110/hw_translate_dce110.c:143 · pass 2 · new	dos	reproduced
DF-5303	Low	6.1	DUMPDMA ioctl channel-bound off-by-one: dump_db() indexes ir[OHCI_DMA_IRCH] one past the array, type-confuses the fwohci_softc tail and walks it as a descriptor ring (panic / console heap leak); dump_dma() MMIO-reads past the 2KB register file Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci.c:372 · pass 2 · new	panic	reproduced
DF-3779	Medium	6.0	vmxnet3_rxq_eof() selects UNPOPULATED RX ring 1 from host rxcd->qid -> NULL-mbuf write -> guest kernel panic Base system — drivers · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2217 · pass 2 · new	panic	reproduced
DF-3780	Medium	6.0	vmxnet3_txq_eof() advances TX ring from unchecked host txcd->eop_idx -> permanent mbuf/cluster leak (unbounded) and TXRING_AVAIL desync Base system — drivers · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:1966 · pass 2 · new	dos	reproduced
DF-4423	Medium	6.0	vtblk_finish_bio() drops its error argument: detach mid-I/O completes unperformed transfers as SUCCESS — silent data fabrication plus stale kernel memory returned as file data Base system — drivers · sys/dev/virtual/virtio/block/virtio_blk.c:1202 · pass 2 · new	leak	reproduced
DF-3152	Low	6.0	volume-add trusts ioc->vol_size with no device-size validation; KKASSERT error paths and unconditional-success error overwrite → deterministic kernel panic (INVARIANTS) or silent half-added volume (production) Base system — filesystems · sys/vfs/hammer/hammer_volume.c:117 · pass 2 · new	panic	reproduced
DF-3301	Low	5.9	CARP HMAC key used raw — no KDF on SIOCSVH, stock ifconfig stores zero-padded ASCII passphrase as the SHA1-HMAC key Base system — network stack · sys/netinet/ip_carp.c:2476 · pass 2 · new	none	reproduced
DF-2679	High	5.8	NEWBUS device teardown races unprivileged sysctl readers: use-after-free read in sysctl_devices()/device_sysctl_handler() (panic + permanent hang from uid!=0) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_bus.c:3858 · pass 2 · new	dos	reproduced
DF-3134	Medium	5.8	dirfs_node_setpassive's check-then-close of dn_fd races dirfs_findfd's ref-then-use and all fd consumers — in-flight operations can use a CLOSED (and host-RECYCLED) descriptor against the wrong host file/directory Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_subr.c:849 · pass 2 · new	dos	reproduced
DF-5109	Medium	5.7	lockdrive() pid-based recursion admits second same-process thread into drive critical section (double vn_close / double Free → BADFREE2 panic) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumlock.c:59 · pass 2 · new	panic	reproduced
DF-3022	Medium	5.6	devfs lock-order inversion: VOP_NRESOLVE holds ncp across devfs_lock while destroy path holds devfs_lock across cache_inval_vp/cache_zap of the same ncp → unprivileged whole-system deadlock Base system — filesystems · sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new	dos	reproduced
DF-2680	Low	5.6	/dev/devctl FIOASYNC stores unreferenced curproc in devsoftc.async_proc; devclose never clears it -> ksignal() on freed struct proc (UAF write) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_bus.c:412 · pass 2 · new	dos	reproduced
DF-2834	Medium	5.5	Unbounded vmspace allocation in sys_vmspace_create: no per-process cap, each create pins a wired PML4 page + 8KB KVA + vmspace struct → unprivileged kernel-memory exhaustion DoS (requires vm.vkernel_enable=1) Privilege escalation (general use) · sys/vm/vm_vmspace.c:146 · pass 2 · new	dos	reproduced
DF-2926	Medium	5.5	Unbounded user plist × unconditional per-call leak in sys_vquotactl → kmalloc-type-limit panic: guaranteed unprivileged kernel panic (DF-0146 escalation) Base system — kernel core (kern) · sys/kern/vfs_quota.c:345 · pass 2 · new	panic	reproduced
DF-3056	Medium	5.5	dirfs_nrename never updates dn_parent on cross-directory rename — every subsequent path-based operation acts on the WRONG host file while fd I/O keeps hitting the original inode Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:907 · pass 2 · new	integrity	reproduced
DF-3064	Medium	5.5	ext2_valloc EEXIST path leaks the ext2_ihashget() vnode lock+vref — crafted bitmap makes the mount un-unmountable with uninterruptible D-state processes Base system — filesystems · sys/vfs/ext2fs/ext2_alloc.c:423 · pass 2 · new	dos	reproduced
DF-3117	Medium	5.5	Racing file creates against cross-parent msdosfs directory renames leaks mount/vnode references: umount(2) hangs forever and the system wedges (unprivileged local DoS) Base system — filesystems · sys/vfs/msdosfs/msdosfs_lookup.c:822 · pass 2 · new	dos	reproduced
DF-3143	Medium	5.5	hpfs_validateparent: no depth bound / cycle guard on the DE_DOWNLSN dive — unkillable kernel livelock and system-wide wedge via cyclic dirblk down-pointers Base system — filesystems · sys/vfs/hpfs/hpfs_subr.c:552 · pass 2 · new	dos	reproduced
DF-3182	Medium	5.5	tmpfs usermount memory cap is attacker-declared: size_max is never clamped to pages_limit for non-root mounts (vfs.usermount=1 → unbounded tm_pages_max/tm_nodes_max) Base system — filesystems · sys/vfs/tmpfs/tmpfs_vfsops.c:157 · pass 2 · new	dos	reproduced
DF-3207	Medium	5.5	nullfs_unmount() frees mnt_data while callers without unmount interlock can still reach it: kern_statfs/kern_fstatfs/sys_quotactl dereference a dead nullfs mount — deterministic NULL-deref panic (kernel DoS) triggered by an unprivileged user around umount -f; race-window UAF read of the freed null_mount Kernel memory corruption (UAF / OOB write) · sys/vfs/nullfs/null_vfsops.c:262 · pass 2 · new	panic	reproduced
DF-3788	Medium	5.5	BT848_SCAPAREA performs no validation: x_size=0 reaches build_dma_prog's horizontal-delay computation → integer division by zero → kernel panic Base system — drivers · sys/dev/video/bktr/bktr_core.c:1758 · pass 2 · new	dos	reproduced
DF-4097	Medium	5.5	XPT_RESET_DEV device reset is silently converted to a malformed opcode-0 CCB by btexecuteccb's no-data opcode clobber — HBA error reply then panics the kernel Base system — drivers · sys/dev/disk/buslogic/bt.c:1062 · pass 2 · new	panic	reproduced
DF-4098	Medium	5.5	btdone/btreset panic() on HBA-supplied btstat and reset-state bytes (hostile-controller panic family) Base system — drivers · sys/dev/disk/buslogic/bt.c:1517 · pass 2 · new	panic	reproduced
DF-4099	Medium	5.5	Unknown mailbox comp_code leaks the BCCB, dmamap and CAM command forever — btdone's comp_code switch has no default case after the timer was stopped Base system — drivers · sys/dev/disk/buslogic/bt.c:1449 · pass 2 · new	dos	reproduced
DF-4100	Medium	5.5	recovery BCCB is never marked BCCB_ACTIVE, so the BDR-completion recovery branch is dead code — every command timeout escalates to a full hard bus reset after a 2s freeze Base system — drivers · sys/dev/disk/buslogic/bt.c:852 · pass 2 · new	dos	reproduced
DF-4149	Medium	5.5	Zero-length iovec sends cuse_client_read/write into an infinite command loop; the looping reader becomes unkillable (survives SIGKILL) Base system — drivers · sys/dev/misc/cuse/cuse.c:1687 · pass 2 · new	dos	reproduced
DF-4639	Medium	5.5	ips: debug.ips.ignore_flush_cmd polarity inverted - the adapter cache-flush command is silently dropped on the DEFAULT configuration (fsync() durability broken) Base system — drivers · sys/dev/raid/ips/ips_commands.c:195 · pass 2 · new	none	reproduced
DF-5749	Medium	5.5	Unsynchronized softclock l2cap_rtx() vs netisr-port l2cap_detach()/l2cap_close(): double channel/request teardown — kernel page fault (supervisor WRITE), zone double-free, hard freeze (l2cap analog of DF-0724/5748, co-firing DF-0745's sink) Kernel memory corruption (UAF / OOB write) · sys/netbt/l2cap_upper.c:267 · pass 2 · new	panic	reproduced
DF-2682	High	5.3	sigio use-after-free: funsetown() kfrees struct sigio still dereferenced by lockless pgsigio() readers (socket/tty/kqueue SIGIO wakeups) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_descrip.c:1245 · pass 2 · new	panic	reproduced
DF-2677	Medium	5.3	SysV shmat() vs IPC_RMID TOCTOU: attach counted after blocking ops, RMID terminates a still-referenced VM object (vm_object_terminate2 panic) Base system — kernel core (kern) · sys/kern/sysv_shm.c:1025 · pass 2 · new	panic	reproduced
DF-3389	Medium	5.3	ip6a_dstia6 stores an uncounted in6_ifaddr pointer in the mbuf that outlives the address across the deferred transport-processing netmsg (UAF read) Kernel memory corruption (UAF / OOB write) · sys/netinet6/ip6_input.c:490 · pass 2 · new	dos	reproduced
DF-2977	Low	5.3	accf_http soparsehttpvers() restarts its scan at ssb_mb on every data arrival with no retained parse state — O(n^2) per connection, all on the netisr protocol thread; unauthenticated remote CPU/netisr exhaustion for any httpready-configured listener Base system — network stack · sys/net/accf_http/accf_http.c:237 · pass 2 · new	dos	reproduced
DF-2985	Low	5.3	sysent[] entry swaps are unsynchronized against unlocked syscall dispatch: non-atomic 24-byte struct assignment (register/deregister) races trap.c's separate sy_narg/sy_call loads (torn dispatch), and deregister has no in-flight quiesce — kldunload frees module text while a victim thread executes inside sy_call (UAF execution) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_syscalls.c:67 · pass 2 · new	panic	reproduced
DF-2988	Low	5.3	RB_SCAN concurrency contract overstates the machinery: deleting a node that is another concurrent scan's in-flight element is an unguarded use-after-free Kernel memory corruption (UAF / OOB write) · sys/kern/subr_rbtree.c:302 · pass 2 · new	corruption	reproduced
DF-4220	Low	5.3	build_evenly_distributed_points() with num_entries==0 writes 24 bytes past a kcalloc(3) heap object; num_entries==1 divides by zero (kernel #DE panic) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/modules/color/color_gamma.c:1077 · pass 2 · new	none	reproduced
DF-4383	Low	5.3	Unbounded softc/cdev/tag allocation from remote LNK_SPANs, and span-loss termination disabled (#if 0): devices never reclaimed, kldunload xdisk permanently EBUSY Base system — drivers · sys/dev/disk/xdisk/xdisk.c:429 · pass 2 · new	dos	reproduced
DF-4647	Low	5.3	acpi_fujitsu: in-flight CTLFLAG_ANYBODY sysctl handler executes on freed softc, freed sysctl oids and freed module text after detach — unprivileged-holdable UAF window (oid_running drain in kern_sysctl.c is dead code) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:340 · pass 2 · new	none	reproduced
DF-2820	Info	5.3	Double-free containment in _kfree_obj is INVARIANTS-only: the compiled-in KMALLOC_CHECK_DOUBLE_FREE bitmap and all ring-sanity checks are no-ops in production kernels, so a double free silently duplicates or drops free-ring pointers Kernel memory corruption (UAF / OOB write) · sys/kern/kern_kmalloc.c:959 · pass 2 · new	none	reproduced
DF-5282	Medium	5.2	ehci_init latches unvalidated device-controlled register geometry (CAPLENGTH/N_PORTS): every EOREAD4/EOWRITE4 lands at attacker-chosen in-BAR offsets, blind/mute interrupt handling live-locks the system on first port event, and OOB MMIO results on undersized-BAR hardware Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/ehci.c:308 · pass 2 · new	dos	reproduced
DF-5483	Low	5.2	_PCT/_PSS firmware-ABI trust: kernel writes firmware-chosen 32/16-bit values to firmware-chosen IO ports unattended at boot (ACPI-S5 machine poweroff demonstrated); world-readable members sysctl turns the status port into an unprivileged read oracle Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_pstate_machdep.c:430 · pass 2 · new	dos	reproduced
DF-3536	Medium	5.1	ng7 ng_cisco: disconnecting the downstream hook with the armed keepalive ng_callout leaks the timer ng_item + node reference (DF-3531's ng_tty twin) Base system — network stack · sys/netgraph7/cisco/ng_cisco.c:219 · pass 2 · new	leak	reproduced
DF-2776	Low	5.1	unregister_int dereferences the caller-supplied (possibly stale/freed) cookie before and after validation → freed-heap read and arbitrary-pointer %s print Base system — kernel core (kern) · sys/kern/kern_intr.c:425 · pass 2 · new	leak	reproduced
DF-3109	Low	5.1	hammer_init_cursor error contract is broken: unconditional KKASSERT(error==0), removed cleanup, and 12 callers ignore the error — INVARIANTS panic or production NULL-node cursor dereference (btree_search reads NULL left_bound) on any root-node load failure Privilege escalation (general use) · sys/vfs/hammer/hammer_cursor.c:156 · pass 2 · new	panic	reproduced
DF-3292	Low	5.1	SIOCS80211 MESH_RTCMD ADD/DELETE dereference the raw user-supplied ireq->i_data pointer in kernel (no copyin) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_mesh.c:3654 · pass 2 · new	panic	reproduced
DF-4996	Low	5.1	Child-attach-failure path runs ral_pci_detach() after the child already unwound itself: ieee80211_ifdetach() LIST_REMOVEs a never-attached ieee80211com → NULL-pointer write → kernel panic (unreachable double-free tail behind it) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ral/if_ral_pci.c:275 · pass 2 · new	panic	reproduced
DF-5001	Low	5.1	miibus_mediainit calls ifmedia_set() on an EMPTY media list → panic("ifmedia_set") at NIC attach — the hub owning the DF-4930/DF-4957/DF-4981 empty-media family panic (family fix belongs here) Base system — drivers · sys/dev/netif/mii_layer/mii.c:232 · pass 2 · new	panic	reproduced
DF-5669	Low	5.1	Deprecated ACPIIO_SETSLPSTATE ioctl bypasses the pc64 suspend-support gate and drives the unimplemented S2-S4 suspend path (stubbed machdep half), returning false success on failure Privilege escalation (general use) · sys/platform/pc64/acpica/acpi_machdep.c:60 · pass 2 · new	dos	reproduced
DF-3108	Medium	5.0	ufs_dirbad panic()s a RW-mounted UFS on any mangled directory entry — one flipped byte = reboot-loopable kernel panic (UFS instance of ext2's DF-3083) Base system — filesystems · sys/vfs/ufs/ufs_lookup.c:601 · pass 2 · new	panic	reproduced
DF-3267	Low	4.9	pf_map_addr()/pf_set_rt_ifp() dereference rpool->cur without NULL guard — reachable as a remote packet-path panic once a translation pool is emptied Base system — network stack · sys/net/pf/pf.c:2693 · pass 2 · new	panic	reproduced
DF-3178	Medium	4.8	hpfs_mountfs performs no super/spareblock census validation: unvalidated on-disk su_btotal panics the kernel at mount (bmind-list bread > MAXBSIZE), wires attacker-chosen kernel heap (32 MiB demonstrated per mount), and is echoed verbatim into statfs f_blocks Base system — filesystems · sys/vfs/hpfs/hpfs_vfsops.c:282 · pass 2 · new	panic	reproduced
DF-2642	Medium	4.7	zero_write() drops hammer2_chain_delete() failure: all-zero block overwrite silently succeeds while the old data chain survives the topology — reads resurrect pre-overwrite content after buffer-cache eviction Hammer2 · sys/vfs/hammer2/hammer2_strategy.c:1298 · pass 2 · new	none	reproduced
DF-2683	Medium	4.7	fsetown() publishes an uninitialized sigio into the owner list — exit1()/pgdelete() teardown consumes the half-born entry: NULL-page fault or wrong-list SLIST_REMOVE walk-off (plus funsetownlst livelock variant) Base system — kernel core (kern) · sys/kern/kern_descrip.c:1351 · pass 2 · new	panic	reproduced
DF-4101	Medium	4.7	Stale-callout race: callout_stop cannot cancel an in-progress bttimeout, which then fires BDR/hard-reset against a healthy reused CCB Base system — drivers · sys/dev/disk/buslogic/bt.c:839 · pass 2 · new	dos	reproduced
DF-4432	Medium	4.7	sln_rx() feeds a NULL mbuf to ifp->if_input() when m_devget() fails — guaranteed kernel panic (guard dropped from the rl(4) ancestor) Base system — drivers · sys/dev/netif/sln/if_sln.c:913 · pass 2 · new	panic	reproduced
DF-4544	Medium	4.7	One-sided OD count clamps: VBIOS counts size the od_feature_capabilities/od_settings_max/min heap allocations downward while vega20_hwmgr consumers index them by fixed driver enums — heap OOB reads at driver init with the leaked u32s printed to the world-readable OD_RANGE sysfs node Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823 · pass 2 · new	leak	reproduced
DF-4545	Medium	4.7	pptable init reports SUCCESS with NULL OD arrays: revision gate (ucODTableRevision != 1) skips all OD copies and five copy-helper -ENOMEM returns are ignored → unconditional NULL-deref in vega20_od8_set_feature_capabilities, kernel panic at amdgpu driver load Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823 · pass 2 · new	panic	reproduced
DF-4606	Medium	4.7	ata_timeout() mid-callback state_mtx window deadlocks the channel against synchronous callout_cancel (or double-completes the request) Base system — drivers · sys/dev/disk/nata/ata-queue.c:551 · pass 2 · new	dos	reproduced
DF-4636	Medium	4.7	radeon_acpi: ACPI_OBJECT type confusion and missing Buffer.Length validation in all four ATIF/ATCS return parsers — firmware-controlled kernel wild-pointer read and heap OOB read (panic) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_acpi.c:212 · pass 2 · new	dos	reproduced
DF-4942	Medium	4.7	offset_to_id accepts mmGPIOPAD_A with en up to 30; the DDC consumer dal_gpio_create_ddc ignores the id output and hands en to define_ddc_registers, indexing ddc_data_regs[8]/ddc_clk_regs[8] out of bounds — OOB const-array read whose garbage register descriptors then drive MMIO programming Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:164 · pass 2 · new	dos	reproduced
DF-5012	Medium	4.7	mfi_disk_strategy leaks bios on hw_crit_error / issuepend_done early returns — permanent unkillable D-state (DF-2066 systemic twin, this file) Base system — drivers · sys/dev/raid/mfi/mfi_disk.c:266 · pass 2 · new	dos	reproduced
DF-2693	Low	4.7	postsig() KASSERT panic: unlocked ps_sigact[] read races concurrent sigaction(SIG_IGN) from another LWP Base system — kernel core (kern) · sys/kern/kern_sig.c:2281 · pass 2 · new	panic	reproduced
DF-3453	Low	4.7	pfil COW hook-list free races pfil_run_hooks() walkers on threads netmsg_service_sync() never waits for (softclock via ip_mroute tbf_reprocess_q→ip_output; IFF_IDIRECT bridge interrupt threads) — use-after-free with indirect call through pfh->pfil_func; stock INVARIANTS kernel panics on the mroute softclock path Kernel memory corruption (UAF / OOB write) · sys/net/pfil.c:110 · pass 2 · new	panic	reproduced
DF-3591	Low	4.7	Legacy firmware size-check bypass in si_init_microcode() (err clobbered by later request_firmware success) -> heap OOB reads in constant-bounded legacy ucode loaders Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/si.c:1806 · pass 2 · new	kernleak	reproduced
DF-5484	Low	4.7	Raw rdmsr/wrmsr on fixed P-state MSRs (0x1a0/0x198/0x199, 0xc001006x) gated only by CPUID: fatal kernel #GP on CPUID-lying VMMs — DF-4735/DF-5155/DF-5160 class, first transition fires unattended at boot Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_pstate_machdep.c:227 · pass 2 · new	panic	reproduced
DF-2803	Medium	4.4	Unbounded udev event queue growth behind a slow/stalled initiated reader (no udev_evqlen cap, no backpressure) Base system — kernel core (kern) · sys/kern/kern_udev.c:515 · pass 2 · new	dos	reproduced
DF-3271	Medium	4.4	netgraph7 ng_ID_rehash panics INVARIANTS kernels under ordinary node churn (hashdestroy: hash not empty); ng_base.c:996 also passes the wrong mask to hashdestroy (latent OOB read) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/netgraph/ng_base.c:973 · pass 2 · new	panic	reproduced
DF-3379	Medium	4.4	pfsync sync engine is dead code: pfsyncif never initialized, RX dispatch never compiled, bulk updater never scheduled — silent total loss of pf HA state synchronization Base system — network stack · sys/net/pf/if_pfsync.c:90 · pass 2 · new	none	reproduced
DF-3500	Medium	4.4	ng_fec control plane violates the ifnet locking contract everywhere: constructor runs if_attach/ifnet_lock in netisr; rmnode->ng_fec_stop does an unbalanced ifnet_deserialize_all; delport calls member if_ioctl unserialized — three distinct INVARIANTS panics Base system — network stack · sys/netgraph/fec/ng_fec.c:454 · pass 2 · new	panic	reproduced
DF-5195	Medium	4.4	wait_scrn_saver_stop sleeps holding vga_token while its only wake path must take vga_token: CONS_SET/KDSETMODE/VT_ACTIVATE issued while an LKM screen saver has the console blanked deadlocks the console subsystem, and killing the caller leaves scrn_blanked permanently stuck (saver module unloadable forever, later saver-stop waiters sleep forever) Base system — drivers · sys/dev/misc/syscons/syscons.c:2720 · pass 2 · new	dos	reproduced
DF-2681	Low	4.4	bus_generic_delete_resource() dispatches BUS_DELETE_RESOURCE on itself instead of dev->parent: unbounded kernel recursion/livelock for any driver using the shipped generic default Base system — kernel core (kern) · sys/kern/subr_bus.c:3145 · pass 2 · new	dos	reproduced
DF-2744	Low	4.4	disk_dumpcheck(): media_blocks − reserved_blocks unsigned underflow defeats the crash-dump bounds check; DEV_BSIZE unit mismatch for non-512B media Kernel memory corruption (UAF / OOB write) · sys/kern/subr_disk.c:909 · pass 2 · new	none	reproduced
DF-2928	Low	4.4	Dead spin_lock_test_mode: debug.spin_lock_test=1 wedges a CPU in a critical section for 60s then panics INVARIANTS kernels (test-mode escape never fires) Base system — kernel core (kern) · sys/kern/kern_spinlock.c:88 · pass 2 · new	panic	reproduced
DF-2946	Low	4.4	kern.stathz boot tunable ingested with no validation → kernel integer-divide fault at statclock systimer registration (unbootable system) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_param.c:201 · pass 2 · new	panic	reproduced
DF-2948	Low	4.4	kern.ncallout fetched after the only clamp → int-overflowed callwheel sizing in swi_softclock_setup: zero-byte per-CPU allocations panic vm_map (latent 2^30-iteration OOB init loop; infinite boot loop on ≤2-CPU) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_param.c:327 · pass 2 · new	panic	reproduced
DF-3084	Low	4.4	doff_t (int32) truncation of crafted directory i_size >= 2^31 yields negative dp->i_offset -> ext2_write KASSERT panic on INVARIANTS kernels (EINVAL elsewhere) Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_lookup.c:424 · pass 2 · new	panic	reproduced
DF-3124	Low	4.4	iso_mountfs ignores iconv_open() failure: NULL im_d2l/im_l2d handles panic the kernel on the first lookup under a kiconv mount (convchr(NULL) NULL-deref) Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_vfsops.c:494 · pass 2 · new	panic	reproduced
DF-3132	Low	4.4	FAT32 active-FAT number pm_curfat (bpbExtFlags & FATNUM, 0..15) never validated against pm_FATs — crafted BPB relocates every FAT read AND write outside the FAT region (fatblock adds curfat*FATsecs), kernel-mediated disk corruption on a RW mount of a crafted image Base system — filesystems · sys/vfs/msdosfs/msdosfs_vfsops.c:409 · pass 2 · new	corruption	reproduced
DF-3144	Low	4.4	hpfs_cpinit mount-time livelock: 'while (cpicnt > 0)' never terminates when every cpisec carries s_cpicnt == 0 and s_next chains (self-loop) Base system — filesystems · sys/vfs/hpfs/hpfs_subr.c:282 · pass 2 · new	dos	reproduced
DF-3183	Low	4.4	Non-root tmpfs mounts take attacker-supplied root uid/gid (only mode is sanitized): forged directory ownership plus statfs f_owner overwrite breaks the unmount-ownership authorization (mounter lockout / arbitrary-uid unmount grant) Privilege escalation (general use) · sys/vfs/tmpfs/tmpfs_vfsops.c:142 · pass 2 · new	none	reproduced
DF-3367	Low	4.4	RTM_CHANGE with gateway==destination permanently leaks the rtentry (key chunk + ifa ref) and desynchronizes per-CPU routing tables; subsequent re-ADD of the same destination panics the kernel Base system — network stack · sys/net/route.c:1193 · pass 2 · new	dos	reproduced
DF-3395	Low	4.4	Interface rename (SIOCSIFNAME) fires ifnet_detach_event: silently and permanently unconfigures every vlan on the renamed parent (config-wipe DoS) Base system — network stack · sys/net/if.c:2206 · pass 2 · new	dos	reproduced
DF-3424	Low	4.4	in6_pcbsetlport() divide-by-zero on degenerate ephemeral port range — DF-0334's unfiled IPv6 twin (reproduced: one unpriv AF_INET6 bind panics) Privilege escalation (general use) · sys/netinet6/in6_src.c:472 · pass 2 · new	panic	reproduced
DF-4136	Low	4.4	ioctls that can throw without lock_config() panic the kernel: VINUM_MOVE onto a full/hot-spare drive is a one-ioctl panic Base system — drivers · sys/dev/raid/vinum/vinumconfig.c:105 · pass 2 · new	dos	reproduced
DF-4236	Low	4.4	rl(4): rapid IFF_DOWN/UP churn leaves TX completions permanently missed - recurring watchdog timeouts and multi-second TX stalls (reproduced on emulated rtl8139) Base system — drivers · sys/dev/netif/rl/if_rl.c:935 · pass 2 · new	dos	reproduced
DF-4546	Low	4.4	lm_detach on a zero-sensor attach (W83791SD) TAILQ_REMOVEs a never-installed ksensordev: NULL-pointer write plus global sensordev_list corruption, kernel panic on driver detach Base system — drivers · sys/dev/powermng/lm/lm78.c:590 · pass 2 · new	panic	reproduced
DF-4658	Low	4.4	plip: lpoutput resurrects IFF_RUNNING and drives the port without IFF_UP or ppbus ownership — cross-driver corruption & broken interface state Kernel memory leaks / uninitialized disclosure · sys/dev/netif/plip/if_plip.c:602 · pass 2 · new	dos	reproduced
DF-4803	Low	4.4	parityops()/parityrebuild() compute the transfer size with an overflowing 'stripesize << DEV_BSHIFT': one checkparity/rebuildparity ioctl on a >=2 GiB-stripe RAID-5 plex panics the kernel (kmem_slab_alloc exhaustion) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrevive.c:274 · pass 2 · new	panic	reproduced
DF-5423	Low	4.4	Root-hub usbconfig reset never returns: unbounded uninterruptible wait on the root hub's never-serviced re_enumerate_wait — kill -9-immune D4 process and whole-USB-bus wedge until reboot (u4b core, reproduced through the uftdi rig; the D4 hang the umodem pass-2 observed) Base system — bus / platform / cpu · sys/bus/u4b/serial/uftdi.c:315 · pass 2 · new	dos	reproduced
DF-5430	Low	4.4	MADT BSP-entry omission passes madt_lapic_probe, then KKASSERT(arg.bsp_found) panics the boot (production kernels silently mis-map cpu0) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_madt.c:375 · pass 2 · new	panic	reproduced
DF-5431	Low	4.4	IOAPIC topology (overlapping GSI bases, duplicate addresses, >16 entries) unvalidated at probe -> unconditional ioapic_add/ioapic_config boot panics Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_madt.c:615 · pass 2 · new	panic	reproduced
DF-5433	Low	4.4	No APIC-ID dedup in MADT CPU enumeration: duplicate entries create phantom AP slots and silently wedge SMP boot Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_madt.c:290 · pass 2 · new	dos	reproduced
DF-5722	Low	4.4	Resuming a DDB session entered from interrupt context (any breakpoint in clock/interrupt-path code) deterministically panics: td_critcount underflow at session exit Base system — bus / platform / cpu · sys/platform/pc64/x86_64/db_interface.c:160 · pass 2 · new	panic	reproduced
DF-2754	Info	4.4	sysctl kern.stackgap_random accepts unbounded negative values: ALIGN(-gap) up to 2GB silently places every exec's stack contents outside the stack mapping — system-wide exec SIGSEGV from a single root sysctl (validation gap) Base system — kernel core (kern) · sys/kern/kern_exec.c:159 · pass 2 · new	denial_of_service	reproduced
DF-2708	Medium	4.3	DMSG wire msgid discloses the kernel heap address of every kernel-initiated transaction state to the cluster peer (msgid = (uint64_t)(uintptr_t)state) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_dmsg.c:1804 · pass 2 · new	leak	reproduced
DF-2711	Low	4.3	Unbounded peer-driven kdmsg_state allocation: no quota on transactions a peer may open (kernel memory exhaustion) Base system — kernel core (kern) · sys/kern/kern_dmsg.c:898 · pass 2 · new	denial_of_service	reproduced
DF-3203	Low	4.3	krpc_call reply validation is vacuous at chain level and reads rpc accept-status 8 bytes past the validated region — uninitialized kernel-heap read of rp_status, value printed to console and used for control flow Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/krpc_subr.c:366 · pass 2 · new	leak	reproduced
DF-3204	Low	4.3	krpc_call leaks the reply mbuf chain on the RPC_PROGMISMATCH exit — reachable by spoofed replies, by DF-3203's stale read, and by legitimate v2-only servers during mountd version fallback Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/krpc_subr.c:391 · pass 2 · new	dos	reproduced
DF-3328	Low	4.3	One byte of uninitialized kernel heap broadcast over the air in every forwarded HWMP PERR (pperr->perr_ttl never initialized) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1743 · pass 2 · new	leak	reproduced
DF-3489	Low	4.3	HOST_UNIQ tag broadcasts sess_con kernel heap pointer on the wire to unauthenticated LAN peers Kernel memory leaks / uninitialized disclosure · sys/netgraph7/pppoe/ng_pppoe.c:1069 · pass 2 · new	leak	reproduced
DF-3493	Low	4.3	Raw sess_con kernel heap pointer broadcast on the LAN in PADI HOST_UNIQ / PADO AC_COOKIE tags (DF-3489 twin) Kernel memory leaks / uninitialized disclosure · sys/netgraph/pppoe/ng_pppoe.c:829 · pass 2 · new	leak	reproduced
DF-4322	Low	4.2	dsp_clone() funnels concurrently-running clone handlers through one shared `static struct cdev *dev` — an unprivileged open of /dev/dspN can be handed another card's clone cdev (reproduced), and the stale static can hand devfs a destroyed cdev under concurrent pcm_unregister (traced UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/dsp.c:2381 · pass 2 · new	none	reproduced
DF-2631	Medium	4.1	umount -f of a same-clid multi-device hammer2 cluster hangs in hammer2_thr_wait (h2twait) on unmodified images Hammer2 · sys/vfs/hammer2/hammer2_admin.c:461 · pass 2 · new	dos	reproduced
DF-4260	Medium	4.1	vr_stop() invokes the synchronous callout_stop() while holding if_serializer: permanent kernel deadlock (CPU-local timer death) against vr_tick() blocked on that serializer Base system — drivers · sys/dev/netif/vr/if_vr.c:1630 · pass 2 · new	dos	reproduced
DF-4275	Medium	4.1	epic_stop() calls synchronous callout_stop() while holding ifp->if_serializer while the 1s mii tick epic_stats_update() must first enter that serializer — AB-BA deadlock (DF-3715 family instance; wedge holds the MP lock and, via the watchdog path, netisr0) Base system — drivers · sys/dev/netif/tx/if_tx.c:1341 · pass 2 · new	dos	reproduced
DF-4327	Medium	4.1	sf_stop()'s blocking callout_stop() under the driver serializer AB-BA deadlocks against sf_stats_update(): permanent hang of ifnet serializer + softclock thread (DF-3715 family) Base system — drivers · sys/dev/netif/sf/if_sf.c:1344 · pass 2 · new	dos	reproduced
DF-2728	Low	4.1	lwkt_preempt() KKASSERT(gd->gd_processing_ipiq == 0) contradicts the designed preemption-from-framed-IPI path of lwkt_schedule_remote() — INVARIANTS kernels panic Base system — kernel core (kern) · sys/kern/lwkt_thread.c:1026 · pass 2 · new	panic	reproduced
DF-2729	Low	4.1	_lwkt_schedule() KKASSERT(TDF_MIGRATING == 0) contradicts _lwkt_enqueue()'s by-design TDF_MIGRATING swallow during push/pull migration windows — INVARIANTS kernels panic Base system — kernel core (kern) · sys/kern/lwkt_thread.c:1293 · pass 2 · new	panic	reproduced
DF-2777	Low	4.1	register_int check-then-create windows span blocking allocations: NULL info->i_thread dereference and re-arm of an already-armed emergency systimer under concurrent registration Base system — kernel core (kern) · sys/kern/kern_intr.c:308 · pass 2 · new	panic	reproduced
DF-3045	Low	4.1	bootpc trusts interface sdl_alen without bounding it to chaddr[16]/hexstr[64] — over-long link address from an IFT_ETHER driver overflows the outgoing packet in-struct and smashes a 64-byte stack buffer via hexncpy Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/bootp_subr.c:718 · pass 2 · new	panic	reproduced
DF-4127	Low	4.1	Divide-by-zero in rv6xx_calculate_spread_spectrum_clk_v: truncating second-division divisor at :541 (and zero ref_freq first division at :538) — rv6xx twin of DF-4120 Base system — drivers · sys/dev/drm/radeon/rv6xx_dpm.c:538 · pass 2 · new	dos	reproduced
DF-4751	Low	4.1	dm MOD_UNLOAD: unlocked dm_dev_counter check plus unpinned ops dispatch — kldunload racing a control ioctl executes freed module text (fatal trap 12) Base system — drivers · sys/dev/disk/dm/device-mapper.c:161 · pass 2 · new	panic	reproduced
DF-4781	Low	4.1	Unchecked M_NOWAIT contigmalloc in dcons_drv_init: NULL buffer passed to dcons_init() -> NULL+0x14 store panic at kldload Base system — drivers · sys/dev/misc/dcons/dcons_os.c:462 · pass 2 · new	panic	reproduced
DF-4782	Low	4.1	Static-console path never wires si_drv1: first write to /dev/dcons on a 'device dcons' kernel NULL-derefs in dcons_putc() Base system — drivers · sys/dev/misc/dcons/dcons_os.c:320 · pass 2 · new	panic	reproduced
DF-4784	Low	4.1	suspend state leaves bio queue accepting I/O with no consumer and no bound: kernel-memory exhaustion under sustained load Base system — drivers · sys/dev/disk/mmcsd/mmcsd.c:312 · pass 2 · new	denial_of_service	reproduced
DF-4943	Low	4.1	offset_to_id returns success for all DDC-family offsets without ever writing *id — dal_gpio_service_create_irq then switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6/7 into hpd_regs[6] (OOB) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:172 · pass 2 · new	dos	reproduced
DF-4945	Low	4.1	DCE12 copy of the uninitialized-id defect: offset_to_id returns success for all DDC-family offsets (165-189) without writing id — dal_gpio_service_create_irq switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles en=6/7 into the 6-entry hpd_regs[] (OOB) Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dce120/hw_translate_dce120.c:165 · pass 2 · new	dos	reproduced
DF-4946	Low	4.1	DCN10 copy of the uninitialized-id defect: offset_to_id returns success for all eight DDC-family offsets (165-189) without writing id — dal_gpio_service_create_irq switches on the uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6 (DDC_VGA) / en=7 (I2C_PAD) into the 6-entry hpd_regs[] (OOB) Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:165 · pass 2 · new	dos	reproduced
DF-4951	Low	4.1	vega12_pp_tables_uninitialize NULL-deref on second pptable_fini: hwmgr_hw_init err1/err2 already freed hwmgr->pptable while pm_en/dpm_enabled stay set, so the next hwmgr_hw_fini (second pp_table sysfs write via amd_powerplay_reset, driver teardown, GPU reset) faults at NULL+16 — kernel panic Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c:296 · pass 2 · new	panic	reproduced
DF-5102	Low	4.1	apple_fw_probe feeds kgetenv() NULL results to kfreeenv(): kfree(NULL) panics the kernel (kern_slaballoc.c:1407) when smbios kenv entries are absent Base system — drivers · sys/dev/apple/fw/apple_fw.c:107 · pass 2 · new	panic	reproduced
DF-2727	Info	4.1	cluster_callback() panics on residual/short cluster I/O instead of propagating an error to components Base system — kernel core (kern) · sys/kern/vfs_cluster.c:1127 · pass 2 · new	panic	reproduced
DF-2960	Info	4.1	kcollect_register pins no caller-module lifetime; kcollect_unregister unenforced — latent UAF (indirect call + strlen) for loadable-module consumers Kernel memory corruption (UAF / OOB write) · sys/kern/kern_collect.c:81 · pass 2 · new	none	reproduced
DF-5718	Info	3.9	kernel strcpy() invoked on overlapping src/dst by the netgraph text parser — restrict-contract violation whose correctness silently depends on strcpy.c's byte-forward implementation Base system — network stack · sys/netgraph/netgraph/ng_parse.c:1572 · pass 2 · new	none	reproduced
DF-2931	Medium	3.8	if_getanyethermac() type-confusion via uuid_node() leaks kernel driver-softc memory into unprivileged uuidgen(2) output (and returns wrong 'MAC' on vtnet/ena/oce) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_uuid.c:86 · pass 2 · new	leak	reproduced
DF-2648	Low	3.8	HAMMER2IOC_VERSION_GET and HAMMER2IOC_INODE_GET ignore the caps_priv_check result (privilege gate bypass) Hammer2 · sys/vfs/hammer2/hammer2_ioctl.c:86 · pass 2 · new	none	reproduced
DF-2793	Low	3.8	rtprio()/lwp_rtprio() omit PRISON_CHECK — jailed root can read any host process's realtime scheduling class and priority (cross-jail info leak) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_resource.c:582 · pass 2 · new	leak	reproduced
DF-5183	Low	3.8	wait_on_bit_timeout() passes Linux TASK_* state constants as tsleep(9) flags (TASK_INTERRUPTIBLE never maps to PCATCH: interruptible waits are silently unkillable) and truncates the unsigned long timeout to int (MAX_SCHEDULE_TIMEOUT → -1 → next-tick callout: 'infinite' waits are 1 Hz polling loops) Base system — drivers · sys/dev/drm/linux_wait.c:105 · pass 2 · new	dos	reproduced
DF-3294	Low	3.7	No rate limiting on ACKs sent in response to out-of-window segments (CVE-2016-5696 challenge-ACK family) Base system — network stack · sys/netinet/tcp_input.c:1782 · pass 2 · new	denial_of_service	reproduced
DF-3057	Medium	3.6	dirfs_write clobbers the bread() error and ignores bwrite(): a failed block read is still modified and the whole 16KB block persisted — stale/foreign buffer data written into the target file (readable back) and failures reported as success Kernel memory leaks / uninitialized disclosure · sys/vfs/dirfs/dirfs_vnops.c:740 · pass 2 · new	leak	reproduced
DF-4710	Medium	3.6	feed_eq_feed FXROUND/FXDIV align-overshoot at the SND_FXDIV_MAX boundary: reads/writes up to align-1 bytes past the caller's byte window and returns count+align-1 (sndbuf_acquire ring overflow; tmpbuf OOB write when the 64KB-exact allocation geometry holds) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_eq.c:461 · pass 2 · new	none	reproduced
DF-5707	Medium	3.6	Shared MINSTD state broadcast: observer-visible consumers (ipfw O_PROB, dummynet plr, syscons savers) let an unprivileged local user or on-path observer recover the kernel's global PRNG state and predict every other consumer's values (UFS i_gen/NFS file handles, NAT alias ports, CHAP challenges, IPv6 frag-ID base) Kernel memory leaks / uninitialized disclosure · sys/libkern/random.c:36 · pass 2 · new	leak	reproduced
DF-5604	Low	3.6	device_set_usb_desc uses shared per-udev scratch after dropping the enum lock — transiently unterminated buffer makes device_set_desc_copy's strlen/strcpy an OOB heap read disclosed via device_printf("<%s>") Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_util.c:110 · pass 2 · new	leak	reproduced
DF-3339	Low	3.4	pfr_add_tables() allocates the ktable and bumps rs->tables BEFORE the duplicate check of a DIOCRADDTABLES batch: duplicate element leaks the table and permanently desynchronizes the ruleset count (DIOCRGETTABLES -> ENOTTY until reboot) Base system — network stack · sys/net/pf/pf_table.c:1170 · pass 2 · new	dos	reproduced
DF-3507	Low	3.4	v1 twin of DF-3498: no cross-bundle exclusivity (second bundle re-enslaves a member, clobbering ac_netgraph which ng_ether(4) also owns), plus addport accepts the bundle's own/another fec ifnet -> choose_port TX recursion Base system — network stack · sys/netgraph/fec/ng_fec.c:362 · pass 2 · new	denial_of_service	reproduced
DF-5732	Low	3.4	DDB trap funnel defeats the db_nofault guard: recoverable DDB memory probes — including show registers' unconditional disasm of the DDB-writable $rip at db_print.c:68 — are routed through trap_fatal(), producing a spurious 'Fatal trap' crash banner with kernel state disclosure, a leaked gd_trap_nesting_level, and corrupted session-resume state Base system — libkern / libprop / ddb · sys/ddb/db_print.c:46 · pass 2 · new	dos	reproduced
DF-2684	Medium	3.3	World-readable sysctl kern.file exports raw kernel heap pointers (kinfo_file.f_file/f_data) and cross-user fd state (types/flags/offsets) to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/kern/kern_descrip.c:3464 · pass 2 · new	leak	reproduced
DF-2972	Medium	3.3	exec_shell_imgact() double-scan TOCTOU on the live first page: kernel reserves one interpreter line and copies another; stale recycled exec-args objcache bytes can be delivered to the interpreter as argv (kernel-heap info leak) Kernel memory leaks / uninitialized disclosure · sys/kern/imgact_shell.c:75 · pass 2 · new	leak	reproduced
DF-3531	Medium	3.3	ng7 ng_tty: closing the tty with a pending chand callout permanently leaks the ng_item + node reference (ng_uncallout twin of DF-3515/DF-3523) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/tty/ng_tty.c:453 · pass 2 · new	leak	reproduced
DF-5422	Medium	3.3	ucom/uftdi TX close race: write(2) of more than one 64-byte transfer followed by close(2) wedges the closer in uninterruptible ttywait forever and silently drops all but the first bulk-OUT packet (deterministic with an evil FTDI that NAKs bulk-OUT) Base system — bus / platform / cpu · sys/bus/u4b/serial/uftdi.c:390 · pass 2 · new	dos	reproduced
DF-2706	Low	3.3	kern.proc.pid.<pid> sysctl bypasses security.ps_showallprocs — unprivileged full kinfo_proc disclosure of any process (incl. root, plus kernel-heap pointers) Privilege escalation (general use) · sys/kern/kern_proc.c:1686 · pass 2 · new	leak	reproduced
DF-2733	Low	3.3	poll() silently truncates nfds to kern.maxfilesperproc*2 — ready descriptors beyond the clamp are dropped without error Base system — kernel core (kern) · sys/kern/sys_generic.c:1639 · pass 2 · new	none	reproduced
DF-2735	Low	3.3	socket_wait() leaks one file descriptor into the caller's fd table on every call (and on its error path) Kernel memory corruption (UAF / OOB write) · sys/kern/sys_generic.c:1699 · pass 2 · new	denial_of_service	reproduced
DF-2796	Low	3.3	World-readable sysctl kern.ipc.msqids dumps raw kernel msqid_ds array: live kernel heap pointers and other users' queue metadata without any permission check Kernel memory leaks / uninitialized disclosure · sys/kern/sysv_msg.c:1072 · pass 2 · new	leak	reproduced
DF-2819	Low	3.3	kmalloc_obj zone-limit accounting uses cacheline-aligned ks_objsize while callers must derive limits from unaligned sizeof — tmpfs inode quota exhausts (ENOSPC) at ~85% of the configured cap Kernel memory corruption (UAF / OOB write) · sys/kern/kern_kmalloc.c:899 · pass 2 · new	none	reproduced
DF-2823	Low	3.3	F_UNLCK of caller's own locks fails with ENOLCK when the uid POSIX-lock limit is reached (POSIX violation, lock-shedding wedge) Base system — kernel core (kern) · sys/kern/kern_lockf.c:510 · pass 2 · new	dos	reproduced
DF-2846	Low	3.3	CPU topology sysctl strings rendered while ncpus==1: hw.cpu_topology.members and per-cpu physical/core siblings are wrong on every SMP system; fix_amd_topology cpusync reaches only the BSP Base system — kernel core (kern) · sys/kern/subr_cpu_topology.c:563 · pass 2 · new	none	reproduced
DF-2889	Low	3.3	vm_contig_pg_clean color-queue validation is provably wrong: reclaims only color-0 pages, skipping 1023/1024 page queues — contigmalloc reclaim flush is ~99.9% ineffective Base system — virtual memory · sys/vm/vm_contig.c:194 · pass 2 · new	denial_of_service	reproduced
DF-2927	Low	3.3	debug.dump_modinfo sysctl is world-readable and discloses kernel pointers (kernel base, module load addresses, SSYM/ESYM, _DYNAMIC, ENVP, KERNEND) Privilege escalation (general use) · sys/kern/subr_module.c:373 · pass 2 · new	leak	reproduced
DF-2932	Low	3.3	Kernel v1 UUIDs disclose the host's real NIC MAC and exact wall-clock generation time to any unprivileged user (RFC 4122 sec 6 privacy exposure) Privilege escalation (general use) · sys/kern/kern_uuid.c:86 · pass 2 · new	leak	reproduced
DF-3024	Low	3.3	tmpfs_chtimes applies va_atime/va_mtime with no ownership/VA_UTIMES_NULL check — non-owner timestamp forgery (DF-3001 contract analog, locally reachable) Privilege escalation (general use) · sys/vfs/tmpfs/tmpfs_vnops.c:486 · pass 2 · new	none	reproduced
DF-3026	Low	3.3	tmpfs_write never re-checks APPEND/IMMUTABLE per write — flags set after open are defeated by pre-existing writable fds (UFS enforces APPEND per-write) Base system — filesystems · sys/vfs/tmpfs/tmpfs_vnops.c:268 · pass 2 · new	none	reproduced
DF-3079	Low	3.3	procfs Pmem exclusive-open latch: plain write-open+close permanently denies O_EXCL opens of /proc/<pid>/mem (EBUSY until vnode reclaim) Base system — filesystems · sys/vfs/procfs/procfs_vnops.c:186 · pass 2 · new	dos	reproduced
DF-3081	Low	3.3	Ungated /proc/<pid>/file and /exe readlink discloses every process's full executable path (root daemons included) to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/vfs/procfs/procfs_vnops.c:147 · pass 2 · new	leak	reproduced
DF-3085	Low	3.3	htree lookup misses existing entries whose hash sorts below the first dx entry (dx count/limit overlay used as an entry) — existing files unopenable/undeletable on valid indexed dirs Base system — filesystems · disputed · sys/vfs/ext2fs/ext2_lookup.c:380 · pass 2 · new	none	reproduced
DF-3115	Low	3.3	Unconditional kprintf() log flood in mbnambuf_write() from crafted — or merely long-LFN — FAT directories: unbounded kernel console/msgbuf spam from unprivileged directory churn Kernel memory leaks / uninitialized disclosure · sys/vfs/msdosfs/msdosfs_conv.c:1035 · pass 2 · new	denial_of_service	reproduced
DF-3159	Low	3.3	msdosfs_setattr→detrunc/deextend lack the va_size upper-bound check the write path has: ftruncate beyond FAT's 32-bit max silently drives deextend past the on-disk size field instead of EFBIG Kernel memory corruption (UAF / OOB write) · sys/vfs/msdosfs/msdosfs_denode.c:509 · pass 2 · new	corruption	reproduced
DF-3240	Low	3.3	Signed-overflow bypass of the buflen guard in procfs_domap(): wrapped sum survives the INT_MAX check, int-truncated sbuf, wild fault-protected kernel-side read Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_map.c:61 · pass 2 · new	none	reproduced
DF-3259	Low	3.3	/proc/<pid>/rlimit read has no per-op authorization: any local user reads any process's full rlimit table Privilege escalation (general use) · sys/vfs/procfs/procfs_rlimit.c:55 · pass 2 · new	none	reproduced
DF-3415	Low	3.3	in6_pcbconnect() reads sin6_addr before sa_len validation: heap OOB read past the user-copied sockaddr length decides connect()'s errno (DF-3357/DF-3372 read-before-validate family, v6 pcb core) Kernel memory leaks / uninitialized disclosure · sys/netinet6/in6_pcb.c:344 · pass 2 · new	leak	reproduced
DF-3477	Low	3.3	Unprivileged PSM bind: ng_btsocket_l2cap_bind() has no privilege check — any local user can occupy reserved Bluetooth service PSMs (SDP=1, RFCOMM=3) and hijack inbound connections Privilege escalation (general use) · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2037 · pass 2 · new	none	reproduced
DF-4048	Low	3.3	transmitter_control_v1_6 applies 16-bit deep-color conversions to the 32-bit ulSymClock field — truncated transmitter symbol clock for HDMI deep color > 655.35 MHz Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table.c:857 · pass 2 · new	none	reproduced
DF-5428	Low	3.3	UVCIOC_CTRL_QUERY copyin()s the already-staged kernel ioctl buffer: the XU control-query ioctl unconditionally returns EFAULT (dead feature) Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_v4l2.c:677 · pass 2 · new	none	reproduced
DF-5608	Low	3.3	cothread_wakeup()'s SIGINT vector forces a process-wide empty-handler latch that permanently disables the vkernel console's ^C handling Base system — bus / platform / cpu · sys/platform/vkernel64/platform/cothread.c:192 · pass 2 · new	none	reproduced
DF-3080	Info	3.3	/proc/0 makes kernel-internal proc0 (swapper) addressable and readable by unprivileged users (atopid("0") slips past the NO_PID guard into pfs_pfind(0)→&proc0) Privilege escalation (general use) · sys/vfs/procfs/procfs_vnops.c:798 · pass 2 · new	leak	reproduced
DF-5750	Info	3.3	l2cap_bind() has no channel-state check: a live LISTENING channel can be re-bound in place, mutating its advertised PSM under the sorted listener list (DF-5747 parity; no duplicate-PSM listener rejection either) Base system — network stack · sys/netbt/l2cap_upper.c:106 · pass 2 · new	none	reproduced
DF-5501	Low	3.2	passioctl() never re-checks securelevel: a /dev/passN fd opened before the raise keeps full raw-SCSI passthrough (incl. disk writes) at securelevel >= 2 Privilege escalation (general use) · sys/bus/cam/scsi/scsi_pass.c:335 · pass 2 · new	none	reproduced
DF-2611	Low	3.1	icmp6_redirect_output leaves target-link-layer-address option padding uninitialized (second leak site beyond DF-0329) Kernel memory leaks / uninitialized disclosure · sys/netinet6/icmp6.c:2496 · pass 2 · new	leak	reproduced
DF-4121	Medium	3.0	parse_sdvo_panel_data: unchecked BDB_SDVO_LVDS_OPTIONS panel_type (u8, 0-255) indexes BDB_SDVO_PANEL_DTDS -> OOB read up to ~4.6 KB past the block Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:363 · pass 2 · new	leak	reproduced
DF-4122	Medium	3.0	No block-size floor for fixed per-panel-array BDB consumers: parse_edp, parse_psr, parse_lfp_backlight read up to ~350 bytes past short/zero-size blocks Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:309 · pass 2 · new	leak	reproduced
DF-2881	Low	3.0	Duplicate-swap-device check compares vnodes, not devices — the same cdev swapped on twice via distinct devfs alias vnodes interleaves two swap stripes over the same physical blocks Base system — virtual memory · sys/vm/vm_swap.c:281 · pass 2 · new	corruption	reproduced
DF-2911	Low	3.0	l64_setdisklabel accepts internally inconsistent label geometry: d_pbase/d_pstop/d_bbase unvalidated, partitions may overlap the label+boot area, and d_bbase directly becomes ds_reserved (0 disables the label-area EROFS guard) Base system — kernel core (kern) · sys/kern/subr_disklabel64.c:278 · pass 2 · new	denial_of_service	reproduced
DF-3254	Low	3.0	hammer_ioc_dedup validates the forged data_offset zone AFTER hammer_btree_extract_data has already dereferenced it — privileged INVARIANTS-kernel panic (zone-0 KKASSERT) and attacker-steered in-volume wild read on production kernels (DF-3187 sink via the gated dedup entry point) Privilege escalation (general use) · sys/vfs/hammer/hammer_dedup.c:66 · pass 2 · new	panic	reproduced
DF-3447	Low	3.0	BPF_LD\|BPF_H\|BPF_ABS kernel mbuf path ignores m_xhalf() failure: out-of-range halfword load yields A=0 and the filter keeps running (fail-open) instead of rejecting the packet Base system — network stack · sys/net/bpf_filter.c:238 · pass 2 · new	none	reproduced
DF-4997	Low	2.9	sc_invalid written through the rt2560 union alias misses on rt2860-family devices: rt2860_softc dropped sc_tx_timer from the documented common prefix, so the glue writes sc_debug (offset 7404) and rt2860_softc.sc_invalid (7400) is never set — card-eject guards permanently dead Base system — drivers · sys/dev/netif/ral/if_ral_pci.c:205 · pass 2 · new	none	reproduced
DF-5708	Low	2.9	skrandom() lacks seed-domain validation: seeds congruent to 0 mod (2^31-1) — reachable via oce's skrandom(karc4random()) at p=3/2^32 — park the kernel PRNG on an absorbing fixed point returning the constant 0x7fffffff for the lifetime of the boot Base system — libkern / libprop / ddb · sys/libkern/random.c:38 · pass 2 · new	none	reproduced
DF-5182	Medium	2.8	wait_event() family evaluates the condition before tsleep_interlock() and autoremove_wake_function() unlinks entries on wakes that were never delivered: in-window wake is lost, stranded sleeper burns its full timeout and wait_event_timeout() returns 0 (timeout) while the condition is true Base system — drivers · sys/dev/drm/linux_wait.c:37 · pass 2 · new	dos	reproduced
DF-3432	Low	2.8	udp6_connect() reads sin6_addr before any sa_len validation: heap OOB read past the user-copied sockaddr decides connect(2)'s errno (DF-3357/3372/3415 family, udp6_usrreq.c instance) Privilege escalation (general use) · sys/netinet6/udp6_usrreq.c:596 · pass 2 · new	leak	reproduced
DF-2890	Low	2.5	vm_contig_pg_alloc verify/alloc loops lack the vm_page_count bound — oversized size with permissive high reads one element past the end of vm_page_array Kernel memory leaks / uninitialized disclosure · sys/vm/vm_contig.c:331 · pass 2 · new	denial_of_service	reproduced
DF-2944	Low	2.5	acct_process() leaks 9 bytes of uninitialized kernel stack into every accounting record (struct acct alignment padding) Base system — kernel core (kern) · sys/kern/kern_acct.c:198 · pass 2 · new	leak	reproduced
DF-2976	Low	2.5	Unprivileged SO_ACCEPTFILTER duplicate-attach race: two M_WAITOK allocations inside the check-then-store window of do_setopt_accept_filter() let concurrent setsockopt on a shared listener orphan struct so_accf chunks permanently — unbounded kernel heap exhaustion Base system — kernel core (kern) · sys/kern/uipc_socket.c:1999 · pass 2 · new	dos	reproduced
DF-3053	Low	2.5	nfsm_mbuftouio ignores copyout() fault — NFS read() reports full success with stale destination bytes Base system — filesystems · sys/vfs/nfs/nfsm_subs.c:1071 · pass 2 · new	none	reproduced
DF-3071	Low	2.5	tmpfs memory/node limit enforcement is check-then-act: tm_pages_used ENOSPC test races its atomic_add (and tm_nodes_inuse check races the TMPFS_LOCK'd increment) — concurrent growth can overshoot tmpfs limits Kernel memory corruption (UAF / OOB write) · sys/vfs/tmpfs/tmpfs_subr.c:1007 · pass 2 · new	none	reproduced
DF-3077	Low	2.5	Zone-end wrap check uses exact equality while unvalidated layer2->append_off / blockmap next_offset / hint can push next_offset past the zone boundary — allocations returned outside the requested zone on production kernels Base system — filesystems · sys/vfs/hammer/hammer_blockmap.c:137 · pass 2 · new	panic	reproduced
DF-4962	Low	2.5	amdgpu_i2c_get_byte() leaves *val uninitialized on failed transfers; router-select helpers then compute with and print the garbage byte Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:309 · pass 2 · new	infoleak	reproduced
DF-5073	Low	2.5	Uninitialized kernel-stack value exported to unprivileged users via world-readable hw.acpi.acline when firmware _PSR returns no object (DF-3793 root cause surfacing in acpi_acad) Privilege escalation (general use) · sys/dev/acpica/acpi_acad.c:111 · pass 2 · new	none	reproduced
DF-5719	Low	2.5	bcd.c lookup tables indexed without bounds: bcd2bin()/bin2bcd()/hex2ascii() macros permit out-of-bounds kernel .rodata reads with device/ioctl-supplied indices Kernel memory leaks / uninitialized disclosure · sys/libkern/bcd.c:9 · pass 2 · new	leak	reproduced
DF-2730	Info	2.5	lwkt_acquire() spins forever on a wedged owner cpu with no watchdog recovery (wedge-family hardening) Base system — kernel core (kern) · sys/kern/lwkt_thread.c:1394 · pass 2 · new	denial_of_service	reproduced
DF-2734	Info	2.5	mapped_ioctl: heap/stack buffer passed to fo_ioctl uninitialized for IOC_NONE-direction ioctls (kmalloc without M_ZERO, no bzero) Kernel memory leaks / uninitialized disclosure · sys/kern/sys_generic.c:674 · pass 2 · new	leak	reproduced
DF-2762	Info	2.5	sys_setgroups publishes the COW credential before mutating it: mid-copyin window exposes mixed old/new group sets to other threads, and a failing copyin leaves the credential partially mutated despite the error return Base system — kernel core (kern) · sys/kern/kern_prot.c:682 · pass 2 · new	—	reproduced
DF-2824	Info	2.5	POSIX EDEADLK not detected for F_SETLKW deadlock cycles spanning two (or more) files Base system — kernel core (kern) · sys/kern/kern_lockf.c:406 · pass 2 · new	dos	reproduced
DF-2913	Info	2.5	plimit COW swap stores p->p_limit without p->p_spin, leaving a theoretical ref-acquisition race window against cross-process readers (schedcpu) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_plimit.c:189 · pass 2 · new	none	reproduced
DF-2935	Info	2.5	Kernel-internal VOP_ACCESS(3-arg) callers silently get access(2)-style REAL-ID authorization semantics from vop_helper_access Privilege escalation (general use) · sys/kern/vfs_helper.c:88 · pass 2 · new	none	reproduced
DF-4913	Low	2.4	ath_hal_v14EepromAttach leaks the malloc'd HAL_EEPROM_v14 (~4.8KB, M_ATH_HAL) on all three post-malloc error returns — DF-4873 (ar9287) family twin Base system — drivers · sys/dev/netif/ath/ath_hal/ah_eeprom_v14.c:363 · pass 2 · new	leak	reproduced
DF-4956	Low	2.4	ath_hal_v4kEepromAttach leaks the malloc'd HAL_EEPROM_v4k (1152 B, M_ATH_HAL) on all three post-malloc error returns — third and final member of the eeprom-attach leak family (DF-4873 ar9287 / DF-4913 v14 / DF-1995 ar5210), verified live Base system — drivers · sys/dev/netif/ath/ath_hal/ah_eeprom_v4k.c:311 · pass 2 · new	leak	reproduced
DF-5584	Low	2.4	usb_idesc_foreach() uint8_t alt-index wraparound on configs with >256 alternate settings (missing upstream FreeBSD 6da5df47 fix) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_parse.c:135 · pass 2 · new	none	reproduced
DF-2804	Medium	2.3	Permanent kernel memory leak of undelivered udev event dictionaries on last-reader close (reap/abandon without prop_object_release) Base system — kernel core (kern) · sys/kern/kern_udev.c:534 · pass 2 · new	leak	reproduced
DF-5593	Medium	2.3	cam_sim_free() orphans the sim's ccb pool — deterministic kernel heap leak on every controller detach after I/O Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_sim.c:246 · pass 2 · new	leak	reproduced
DF-3033	Low	2.3	Kernel panic via unvalidated on-disk leaf->data_len used as getblk() size in hammer_io_direct_uncache_callback Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_io.c:1948 · pass 2 · new	panic	reproduced
DF-3145	Low	2.3	hpfs_cpinit error paths leak the hpm_cpdblk allocation (mount-failure memory exhaustion) Base system — filesystems · sys/vfs/hpfs/hpfs_subr.c:276 · pass 2 · new	leak	reproduced
DF-3261	Low	2.3	rule->set byte unvalidated at install (expected 0..31): 1 << f->set undefined behavior and broken set-disable/move semantics for sets >= 32 Base system — network stack · sys/net/ipfw/ip_fw2.c:4518 · pass 2 · new	denial_of_service	reproduced
DF-3297	Low	2.3	DIOCGETSRCNODES discloses raw kernel heap pointers (RB-tree links) through read-only /dev/pf Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_ioctl.c:2884 · pass 2 · new	leak	reproduced
DF-3338	Low	2.3	pfr_walktree()/PFRW_GET_ASTATS copies 4 uninitialized kernel-stack bytes per entry to userspace via DIOCRGETASTATS Kernel memory leaks / uninitialized disclosure · sys/net/pf/pf_table.c:1058 · pass 2 · new	leak	reproduced
DF-3410	Low	2.3	TUNSIFMODE ORs the raw unmasked user value into ifp->if_flags — validated value is the masked switch, injected value is the full word Base system — network stack · sys/net/tun/if_tun.c:731 · pass 2 · new	none	reproduced
DF-3418	Low	2.3	rtentry reference leak in in6_ifdetach_dispatch: rtpurelookup() reference never dropped when the ff02::1 lookup matches a route owned by another interface — permanent rtentry pinning and kernel memory leak on route churn Base system — network stack · sys/netinet6/in6_ifattach.c:844 · pass 2 · new	dos	reproduced
DF-3448	Low	2.3	sysctl_ip6_tempvltime() restores the wrong variable on rejection: failed net.inet6.ip6.tempvltime writes persist the invalid value AND clobber ip6_temp_preferred_lifetime Base system — network stack · sys/netinet6/in6_proto.c:437 · pass 2 · new	none	reproduced
DF-3465	Low	2.3	ipfw3 log-if subsystem is dead code wired to a signature-broken event handler: 'log' actions never log, log_if_lock is never initialized, and the ifnet_detach_event registration mis-invokes ip_fw3_log_clone_destroy with the cloner context as its ifp Base system — network stack · sys/net/ipfw3_basic/ip_fw3_log.c:213 · pass 2 · new	none	reproduced
DF-3504	Low	2.3	ng7 twin of DF-0512: finish_accept copies an unbounded sa (sa_len up to 255) into ng_ksocket_accept.addr declared as a fixed struct sockaddr Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ksocket/ng_ksocket.c:1250 · pass 2 · new	none	reproduced
DF-3506	Low	2.3	v1 twin of DF-3496: NGM_FEC_ADD_IFACE/DEL_IFACE treat msg->data as a NUL-terminated interface name with no arglen validation -> ifunit() strcmp and kprintf %s walk past the ng_mesg allocation Kernel memory leaks / uninitialized disclosure · sys/netgraph/fec/ng_fec.c:1172 · pass 2 · new	leak	reproduced
DF-3551	Low	2.3	mbuf+meta leak on the debug-hook data path: the only NG_FREE_DATA is gated on an unreachable condition (v1 twin of DF-0690) Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_sample.c:237 · pass 2 · new	dos	reproduced
DF-4302	Low	2.3	vkbd devfs clone unit numbers are never released on close — permanent unbounded unit/bitmap leak on the device's normal lifecycle Base system — drivers · sys/dev/misc/vkbd/vkbd.c:222 · pass 2 · new	dos	reproduced
DF-4659	Low	2.3	plip: sc_ifbuf leaked on every down/up cycle (and on BUS_SETUP_INTR failure) — unbounded kernel heap leak Kernel memory leaks / uninitialized disclosure · sys/dev/netif/plip/if_plip.c:306 · pass 2 · new	dos	reproduced
DF-4922	Low	2.3	dm_target_flakey_init() failure paths leak the dm_pdev reference and permanently pin the underlying device vnode Base system — drivers · sys/dev/disk/dm/flakey/dm_target_flakey.c:86 · pass 2 · new	leak	reproduced
DF-5468	Low	2.3	vga_pci_map_bios() ROM path is dead on spec-conformant devices: lazy pci_alloc_map() misclassifies the ROM BAR as I/O because the enable bit survives the sizing readback Base system — bus / platform / cpu · sys/bus/pci/vga_pci.c:217 · pass 2 · new	none	reproduced
DF-5626	Low	2.3	ppb_poll_bus() PPB_POLL path busy-spins max*10000 DELAY(1) iterations with no sleep, no signal checkpoint and no clamp on max — unkillable CPU-livelock windows (measured ~20s for the in-tree max=100 call) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_base.c:60 · pass 2 · new	dos	reproduced
DF-5721	Low	2.3	DDB software watchpoints (watch) are inert on x86_64 — pmap protection silently evaporates, watchpoint trap classification is dead code Base system — libkern / libprop / ddb · sys/ddb/db_run.c:199 · pass 2 · new	none	reproduced
DF-2749	Info	2.3	journal_wthread pad-skip accounting bug: total_acked += bytes counts all pending bytes instead of the pad size, inflating bytessent (MOUNTCTL_STATUS) Base system — kernel core (kern) · sys/kern/vfs_journal.c:220 · pass 2 · new	—	reproduced
DF-3543	Info	2.3	Per-link stats unreachable for links 1..63: linkNum == 0 typo in GET/CLR_STATS link selection Base system — network stack · sys/netgraph/one2many/ng_one2many.c:339 · pass 2 · new	none	reproduced
DF-4966	Info	2.3	dce110 id_to_offset DDC_DATA/I2C_PAD translation carries the shared DDC6 DATA mask 0x100, but DC_GPIO_I2CPAD_A defines only SCL=bit0 (0x1) and SDA=bit1 (0x2) — reserved-bit MMIO write and dead SDA bit on the I2C pad Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dce110/hw_translate_dce110.c:190 · pass 2 · new	none	reproduced
DF-5531	Info	2.3	Disabled bpf_peers_present early-out: tap kmallocs and copies every USB transfer payload even with no bpf listener (36-44x per-transfer overhead) Base system — bus / platform / cpu · sys/bus/u4b/usb_pf.c:362 · pass 2 · new	none	reproduced
DF-5555	Info	2.3	DF-5553's CDC-renumber misfire confirmed on the audio template: usb_make_raw_desc()'s (bLength>=5, type 0x24, subtype in {1,6}) heuristic fires on 9 of the 22 raw tables — AS_GENERAL bDelay corrupted 3->4 (iface 1) and 1->3 (iface 2) in every generated descriptor set; 7 interface-0 hits (bcdADC-hi, bUnitID/bSourceID) at zero delta today are silent audio-graph corruption under any nonzero-interface rebase Base system — bus / platform / cpu · sys/bus/u4b/template/usb_template_audio.c:96 · pass 2 · new	none	reproduced
DF-2720	Low	1.9	load_section truncated-file check bypassed by 64-bit wrap of (off_t)filsz + offset Base system — kernel core (kern) · sys/kern/imgact_elf.c:274 · pass 2 · new	none	reproduced
DF-2732	Low	1.9	readv/writev/extpreadv/extpwritev accept iovcnt==0 — POSIX EINVAL missing; uninitialized stack iovec pointer plumbed into fo_read/fo_write Base system — kernel core (kern) · sys/kern/sys_generic.c:195 · pass 2 · new	none	reproduced
DF-2792	Low	1.9	sys_ioprio_get(PRIO_PGRP) compares p_nice but assigns p_ionice — wrong (order-dependent) result and possible spurious ESRCH Base system — kernel core (kern) · sys/kern/kern_resource.c:366 · pass 2 · new	none	reproduced
DF-2971	Low	1.9	No common lock between linesw[] mutation and dispatch — register/deregister swap entries under tty_token while TIOCSETD (t_token+p_token) and driver read/write/ioctl paths read the table under unrelated locks, permitting torn multi-pointer swaps Base system — kernel core (kern) · sys/kern/tty_conf.c:97 · pass 2 · new	denial_of_service	reproduced
DF-3052	Low	1.9	nfsm_request_bio early-abort path leaks the kmalloc'd struct nfsm_info and never runs the done() callback Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfsm_subs.c:825 · pass 2 · new	leak	reproduced
DF-3269	Low	1.9	Uninitialized deflate_state.status read on the deflateInit2_ allocation-failure path: deflateEnd skips all cleanup, leaking every stream allocation Kernel memory leaks / uninitialized disclosure · sys/net/zlib.c:785 · pass 2 · new	leak	reproduced
DF-3505	Low	1.9	NGM_KSOCKET_INTERNAL_UPCALL is spoofable by any netgraph control-plane sender: out-of-band forced upcall invocation, widening the known DF-0511 teardown race into a hammerable window Base system — network stack · sys/netgraph/ksocket/ng_ksocket.c:848 · pass 2 · new	none	reproduced
DF-3533	Low	1.9	v1 ng_tty: ngt_open() error path leaves tp->t_sc dangling after synchronously freeing sc Base system — network stack · sys/netgraph/tty/ng_tty.c:225 · pass 2 · new	none	reproduced
DF-3577	Low	1.9	4-byte heap OOB read in iwn_read_firmware_tlv(): IWN_FW_TLV_PHY_CALIB dereferences *ptr without a len>=4 check Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwn/if_iwn.c:8315 · pass 2 · new	none	reproduced
DF-4123	Low	1.9	parse_mipi_sequence: 1-byte heap OOB read of the kmemdup'd sequence blob when MIPI_SEQ_ELEM_END is the final byte Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:1129 · pass 2 · new	leak	reproduced
DF-5653	Low	1.9	elcr_write_trigger(): unlocked read-modify-write of the global elcr_status shadow — concurrent legacy config_intr silently drops trigger-mode updates (measured 3,985 lost updates in a 2-second two-CPU run) Base system — bus / platform / cpu · sys/platform/pc64/icu/elcr.c:103 · pass 2 · new	none	reproduced
DF-2715	Info	1.9	Kernel-internal MSG_FNONBLOCKING/MSG_FBLOCKING state leaks into user-visible msg_flags on every recvmsg(2) from a non-blocking socket Kernel memory leaks / uninitialized disclosure · sys/kern/uipc_syscalls.c:996 · pass 2 · new	leak	reproduced
DF-2724	Info	1.9	NTP PLL discipline state is mutated by hardclock/pps interrupt paths with no lock excluded from sys_ntp_adjtime's ntp_lock — interleaved PLL transitions Base system — kernel core (kern) · sys/kern/kern_clock.c:749 · pass 2 · new	—	reproduced
DF-2726	Info	1.9	cluster_write() reads bp->b_bio2.bio_offset after bdwrite()/bawrite() released the buffer — type-stable use-after-free reads corrupting write-clustering heuristics Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_cluster.c:1340 · pass 2 · new	corruption	reproduced
DF-2757	Info	1.9	vn_stat's MNT_NOSYMFOLLOW symlink-mode adjustment is dead code and reads sb->st_mode before it is ever initialized Base system — kernel core (kern) · sys/kern/vfs_vnops.c:882 · pass 2 · new	—	reproduced
DF-2942	Info	1.9	sysref_activate's negative-space gate is ambiguous between initializing and terminating: an activate during the termination window resurrects the object and drives double (or unbounded) termination with zero layer diagnostics Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sysref.c:164 · pass 2 · new	none	reproduced
DF-2978	Info	1.9	do_setopt_accept_filter() saves the filter NAME as so_accept_filter_str instead of the user's af_arg — getsockopt(SO_ACCEPTFILTER) returns the name as the argument; latent divergence from FreeBSD (functional, dead in-tree) Base system — kernel core (kern) · sys/kern/uipc_socket.c:2043 · pass 2 · new	none	reproduced
DF-3556	Info	1.9	ng_ipfw is unbuildable dead code on this tree — DF-0735/DF-0736 cannot manifest on any buildable kernel Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_ipfw.c:44 · pass 2 · new	none (unbuildable dead code)	reproduced
DF-5353	Info	1.9	USB_TEMP_PHONE gadget template is compiled and advertised but unreachable: missing case in usb_temp_setup_by_index() Base system — bus / platform / cpu · sys/bus/u4b/template/usb_template.c:1346 · pass 2 · new	none	reproduced
DF-5628	Info	1.9	ppb_poll_bus() sleep arithmetic hz/100 rounds to 0 when the boot tunable kern.hz < 100: tsleep receives timo=0 and arms NO timeout — permanent unkillable park for the documented PPB_NOINTR sleeping poll (proven against production code at hz=50) Base system — bus / platform / cpu · sys/bus/ppbus/ppb_base.c:77 · pass 2 · new	dos	reproduced
DF-5648	Info	1.9	Shared isab_devclass unit-0 theft: acpi_isab claims the ACPI Processor Container as isab0/isa0, silently renumbering the real PCI-ISA bridge to isab1/isa1 — phantom empty ISA bus at unit 0; 'at isa0' hint misdirection and duplicate-instance double enumeration on hint-compiled kernels Base system — bus / platform / cpu · sys/bus/pci/isa_pci.c:60 · pass 2 · new	none	reproduced
DF-5652	Info	1.9	elcr_read_trigger/elcr_write_trigger: irq bounds enforced only by an INVARIANTS-only KASSERT with no signed lower bound — negative irq executes a C-undefined shift that aliases a real ISA bit and programs the live ELCR port; irq>=16 silently corrupts the shadow on production kernels Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/icu/elcr.c:57 · pass 2 · new	none	reproduced
DF-5654	Info	1.9	elcr_resume() is dead code (zero callers) and no resync path exists — ELCR hardware state is never restored after a reset event nor re-read after probe; divergences are structurally invisible to the kernel Base system — bus / platform / cpu · sys/platform/pc64/icu/elcr.c:75 · pass 2 · new	none	reproduced
DF-3046	Info	1.7	TAG_OVERLOAD consumed without length validation — zero-length overload option at the end of an options region reads one byte past the region and adopts an arbitrary overload value Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/bootp_subr.c:1283 · pass 2 · new	none	reproduced
DF-5553	Info	1.6	usb_make_raw_desc() CDC renumbering misclassifies the phone template's USB-Audio CS_INTERFACE descriptors: bDelay bytes rewritten 1->2 and 1->3 in generated descriptors Base system — bus / platform / cpu · sys/bus/u4b/template/usb_template_phone.c:107 · pass 2 · new	none	reproduced
DF-5713	Low	1.1	Kernel stack-smashing protection is a no-op: canary is an unseeded compile-time constant (0x00000aff) from a dead ABI, __stack_chk_guard/__stack_chk_fail absent from the kernel, and -fno-stack-protector is forced for all kernel/KLD code Base system — libkern / libprop / ddb · sys/libkern/stack_protector.c:36 · pass 2 · new	none	reproduced
DF-2656	Info	1.1	hammer2 zlib port drops zcalloc's zero-initialization: deflate window/state kmalloc'd unzeroed, leaving stale-heap reads whose output-independence rests on subtle invariants Hammer2 · sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:239 · pass 2 · new	—	reproduced
DF-2665	Info	1.1	Vendored LZ4 is upstream r97 (2013) — 13 years of upstream hardening absent (cross-reference; upstream-owned history) Hammer2 · sys/vfs/hammer2/hammer2_lz4.c:372 · pass 2 · new	—	reproduced
DF-2723	Info	1.1	pps_fetch_timeout() feeds user-supplied unnormalized tv_nsec into tstohz_low(), whose int truncation yields an attacker-chosen (possibly negative) sleep tick count Base system — kernel core (kern) · sys/kern/kern_clock.c:1609 · pass 2 · new	denial_of_service	reproduced
DF-2835	Info	1.1	sys_vmspace_create violates its own ABI contract: accepts id==NULL and silently ignores type/data instead of rejecting them Base system — virtual memory · sys/vm/vm_vmspace.c:146 · pass 2 · new	none	reproduced
DF-2852	Info	1.1	dev_dmmap/dev_dpsize don't preset a_result; dead dev_dclone never initializes a_name/a_namelen/a_cred/a_mode — uninitialized kernel stack passed to drivers by the dispatch shim Privilege escalation (general use) · sys/kern/kern_device.c:261 · pass 2 · new	none	reproduced
DF-2888	Info	1.1	vcnt()/vcnt_intr() accumulate u_int per-CPU counters into signed int, wrapping vm.stats.* exports negative after 2^31 aggregate events Base system — virtual memory · sys/vm/vm_meter.c:245 · pass 2 · new	none	reproduced
DF-2893	Info	1.1	sockbuf drop/flush family ignores M_SOLOCKED — latent use-after-free window against sorecvtcp's token-released uiomove loop Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_sockbuf.c:473 · pass 2 · new	none	reproduced
DF-2954	Info	1.1	vfs_unmount tears down quota accounting (VFS_ACDONE) before the filesystem unmount commits — failed unmounts leave a live mount with accounting already 'done' Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_vfsops.c:131 · pass 2 · new	none	reproduced
DF-2965	Info	1.1	brk/sbrk mappings are created RWX (VM_PROT_ALL as both prot and max_protection) — executable heap defeats future W^X policy Base system — virtual memory · sys/vm/vm_unix.c:137 · pass 2 · new	none	reproduced
DF-5672	Info	1.1	Stale MP-safety comment asserts a locked OR and cross-CPU manipulation of gd_spending where the code emits a nonlocked OR — safety rests on an unstated per-CPU invariant (pc64 twin of DF-5671) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/ipl_funcs.c:38 · pass 2 · new	none	reproduced
DF-5709	Info	1.1	HEX_NCPYLEN(s) does not parenthesize its argument — compound expressions mis-size caller buffers 3x undersize, latent linear overflow inside hexncpy Kernel memory corruption (UAF / OOB write) · sys/libkern/hexncpy.c:56 · pass 2 · new	none	reproduced
DF-3441	Low	0.8	div_bind() writes sin_addr = INADDR_ANY at offset 4..8 of the user bind sockaddr before any length validation (OOB write lands in own-chunk slab slack) Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_divert.c:472 · pass 2 · new	none	reproduced
DF-2700	Info	0.8	vfs_hang_addrlist() returns through 'out' while still holding NE_LOCK(nep) on the rn_inithead-failure and unsupported-sa_family paths Base system — kernel core (kern) · sys/kern/vfs_subr.c:2085 · pass 2 · new	denial_of_service	reproduced
DF-2767	Info	0.8	journal_status_vfs_journal index filter over-returns: requesting status for index k returns journals 0..k instead of only k Base system — kernel core (kern) · sys/kern/vfs_jops.c:476 · pass 2 · new	none	reproduced
DF-2837	Info	0.8	sysctl_handle_sb_max() maintains u_long sb_max through sizeof(int) transfers — 8-byte writes silently truncated by 4 GiB, sb_max can never represent its declared type Base system — kernel core (kern) · sys/kern/uipc_socket2.c:686 · pass 2 · new	none	reproduced
DF-2892	Info	0.8	alignment==0 passes the power-of-two check but means 'physical address 0' — guaranteed allocation failure after three full page-queue flush passes; plus copy-paste panic string in contigfree Base system — virtual memory · sys/vm/vm_contig.c:268 · pass 2 · new	none	reproduced
DF-3545	Info	0.8	downstream_hook.dlci never initialized to -1: downstream traffic misrouted into the DLCI branch and reflected back out the downstream hook; decode/demux branch is dead code Base system — network stack · sys/netgraph7/ng_sample.c:232 · pass 2 · new	none	reproduced
DF-4826	Info	0.8	amdgpu_acp.c is a dead translation unit: not in any build, unbuildable (missing shim headers), config-gated off — known findings DF-1907/DF-1908/DF-1909/DF-1910 are unreachable at runtime on DragonFly Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_acp.c:26 · pass 2 · new	none	reproduced
DF-4928	Info	0.8	corepower_probe family-0x06 model whitelist is a skip-guard, not a reject: non-family-06 Intel CPUIDs pass probing (attach then runs a raw rdmsr) — live-reproduced hardening gap Base system — drivers · sys/dev/powermng/corepower/corepower.c:165 · pass 2 · new	none	reproduced
DF-5329	Info	0.8	cam_periph_invalidate()'s underflow guard is dead code: `u_int32_t refcount < 0` never fires, so periph refcount underflows (DF-5273/DF-5327 classes) are silent Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_periph.c:576 · pass 2 · new	silent integrity failure: the CAM core's only periph-refcount underflow detector (cam_periph.c:576) provably never fires because refcount is u_int32_t and is compared < 0; underflowed periphs (DF-5273/DF-5327 classes) become silent zombies with no diagnostic	reproduced
DF-5618	Info	0.8	ig4 ACPI glue hardcodes sc->version = IG4_ATOM for every matched HID under the false comment 'All the HIDs matched are Atom SOCs' — Haswell-LP (INT33C2/33C3), Broadwell (INT3432/33) and Apollo Lake (808622C1) silicon is mis-programmed: HSW-only SWMODE/LTR init and the SKL+-class LTR path in ig4_iic.c are skipped Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_acpi.c:70 · pass 2 · new	none	reproduced
DF-5720	Info	0.8	ddb '/'-modifier parsing copies stale db_tok_string for numeric modifier tokens — the typed modifier is silently substituted with the previously lexed identifier (deterministically the command's own name) Base system — libkern / libprop / ddb · sys/ddb/db_command.c:364 · pass 2 · new	none	reproduced
DF-2690	Info	0.5	m_extadd() lacks the M_EXT precondition guard m_mclget() has — calling it on a cluster mbuf yields m_sharecount()/m_free() type confusion and a wrong-cache objcache_put Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_mbuf.c:1477 · pass 2 · new	—	reproduced
DF-2761	Info	0.5	sys_setlogin mutates s_login while holding p_token SHARED — data race with concurrent setlogin/getlogin produces torn login names Base system — kernel core (kern) · sys/kern/kern_prot.c:1290 · pass 2 · new	—	reproduced
DF-2818	Info	0.5	lwkt_token_init() on a live token silently drops a held exclusive; lwkt_token_uninit() performs no quiescence check Base system — kernel core (kern) · sys/kern/lwkt_token.c:914 · pass 2 · new	none	reproduced
DF-2822	Info	0.5	Latent boot-window OOB: csprng_pcpu aliases the single-element csprng_boot while APs are up, and read_random/add_buffer_randomness_src index it with unclamped gd_cpuid Kernel memory leaks / uninitialized disclosure · sys/kern/kern_nrandom.c:495 · pass 2 · new	none	reproduced
DF-2841	Info	0.5	vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors Base system — virtual memory · sys/vm/vm_swapcache.c:608 · pass 2 · new	none	reproduced
DF-2891	Info	0.5	contigmalloc_map silently ignores its map argument — kmap always allocates from kernel_map; a caller freeing via its own map corrupts the wrong vm_map Base system — virtual memory · sys/vm/vm_contig.c:527 · pass 2 · new	none	reproduced
DF-2919	Info	0.5	vfs_register() walks sysctl__vfs_children without SYSCTL_XLOCK while unlinking/relinking the iterated oid mid-loop Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_init.c:338 · pass 2 · new	none	reproduced
DF-2941	Info	0.5	_sysref_put accepts count==0 double-releases with no put-side floor guard; the only barrier is the debug-only KKASSERT whose flags read races the final-release sequence Base system — kernel core (kern) · sys/kern/kern_sysref.c:303 · pass 2 · new	none	reproduced
DF-2943	Info	0.5	Dead sysref machinery retained and exported: sysref_init (no callers) can produce objects whose final put objcache_puts non-objcache memory on production builds; allocsysid, SRC_MANAGEDINIT and SRF_SYSIDUSED are entirely unused Base system — kernel core (kern) · sys/kern/kern_sysref.c:105 · pass 2 · new	none	reproduced
DF-3550	Info	0.5	downstream_hook.dlci never initialized to -1 (v1 twin of DF-3545): downstream traffic misrouted into the DLCI branch and reflected back out the same downstream hook; decode/demux branch is dead code Base system — network stack · sys/netgraph/ng_sample.c:155 · pass 2 · new	none	reproduced
DF-3552	Info	0.5	ng_xxx_newhook bookkeeping defects: free-slot search missing break makes every DLCI hook fail ENOBUFS; sizeof/strlen off-by-one rejects single-digit names; parsed dlci never stored; debughook stale after disconnect Base system — network stack · sys/netgraph/ng_sample.c:210 · pass 2 · new	none	reproduced
DF-4944	Info	0.5	id_to_offset GPIO_ID_GPIO_PAD branch compares the derived mask against the pin-index bound GPIO_GPIO_PAD_MAX: valid pads 5..30 wrongly rejected; en≥32 hits the C11 6.5.7 UB shift and is accepted with a bogus mask Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:378 · pass 2 · new	none	reproduced
DF-4947	Info	0.5	id_to_offset GPIO_ID_DDC_DATA hardwires the DDC6DATA bit-8 mask (0x100) for every line including the I2C pad, whose SDA field is bit 1 (0x2) — translate and factory tables disagree; the pin would be driven on the wrong GPIO bit Base system — drivers · sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:211 · pass 2 · new	none	reproduced
DF-5616	Info	0.5	icu_ioapic_extint() accepts negative irq: guard lacks signed lower bound -> C-undefined shift feeds the live 8259 IMR; IMR written lockless and without icu_imen shadow sync (caller-gated, live-verified benign) Base system — bus / platform / cpu · sys/platform/pc64/icu/icu.c:167 · pass 2 · new	none	reproduced
DF-5625	Info	0.5	ppb_ecp_sync()/ppb_reset_epp_timeout() return indeterminate register garbage: interface declares int methods, the only implementations are void (C UB through the DEVMETHOD dispatch) Kernel memory corruption (UAF / OOB write) · sys/bus/ppbus/ppb_base.c:159 · pass 2 · new	none	reproduced
DF-5641	Info	0.5	isa_alloc_resource/isa_release_resource cast grandchild ivars via DEVTOISA unconditionally — type-confused (often NULL) resource-list pointer passed through, safe today only because resource_list_alloc/release early-forward on passthrough Kernel memory corruption (UAF / OOB write) · sys/bus/isa/x86_64/isa.c:85 · pass 2 · new	none	reproduced
DF-5711	Info	0.5	netmap_vale: bridge-name clamp off-by-one (IFNAMSIZ not IFNAMSIZ-1) leaves bdg_basename[IFNAMSIZ] unterminated Base system — network stack · sys/net/netmap/netmap_vale.c:331 · pass 2 · new	none	reproduced
DF-5730	Info	0.5	$radix/$maxoff/$maxwidth FCN_NULL writes accept any 64-bit value unvalidated — silent semantic corruption of the DDB expression language and symbol attribution (beyond DF-5724) Base system — libkern / libprop / ddb · sys/ddb/db_variables.c:48 · pass 2 · new	none	reproduced
DF-2864	Info	0.3	Per-candidate struct mount + syncer-thread leak and permanent vfc_refcount leak on failed root-mount attempts (mp overwritten next iteration; error path never drops mp->mnt_vfc->vfc_refcount) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_conf.c:435 · pass 2 · new	none	reproduced
DF-3054	Medium	—	dirfs_findfd() NULL return on over-length relative path is dereferenced by dirfs_getattr/dirfs_readlink/dirfs_alloc_file — vkernel panic from a deep path (unprivileged DoS) Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:389 · pass 2 · new	panic	reproduced
DF-3055	Medium	—	dirfs_nsymlink/dirfs_nmkdir execute the success path when dirfs_alloc_file() fails: dirfs_knote(*vpp==NULL) SIGSEGV, negative-cache of an existing name, and the real error clobbered by stale errno Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:1067 · pass 2 · new	panic	reproduced
DF-1216	High	8.8	METEORSETGEO + METEORSACTPIXFMT pixel-format mismatch yields OOB DMA write and OOB uiomove heap info-leak Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1084	leak:4177936	reproduced
DF-1410	High	8.8	Unauthenticated remote heap overflow in xe RX: missing upper-bound check on frame length before copying into 2KB mbuf cluster Kernel memory corruption (UAF / OOB write) · sys/dev/netif/xe/if_xe.c:752	leak:heap	reproduced
DF-1356	High	8.2	Heap overflow in AMR_CMD_PASS ioctl via unchecked cdb length Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr.c:825	panic	reproduced
DF-1499	High	8.2	Heap buffer overflow in NGM_TEXT_STATUS via status_chans + status_8370 Kernel memory corruption (UAF / OOB write) · sys/dev/misc/musycc/musycc.c:443	leak:heap	reproduced
DF-0457	High	8.1	Unchecked ph->length in PPPoE discovery: heap OOB read via tag-walk + heap info leak via echoed Relay-Session-Id (v1 twin of DF-0414) Kernel memory leaks / uninitialized disclosure · sys/netgraph/pppoe/ng_pppoe.c:925	leak:65535	reproduced
DF-0492	High	8.1	Lockless race on L2TP seq/window state: concurrent timer + remote packet processing -> UAF on xwin[] mbufs and node private data Kernel memory corruption (UAF / OOB write) · sys/netgraph/l2tp/ng_l2tp.c:1126	panic	reproduced
DF-1171	Critical	7.8	Intel MatrixRAID parser: OOB heap write on ar_softc via unclamped map->total_disks Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:2165	corruption	reproduced
DF-1076	High	7.8	Slave-controlled block-read count overflows fixed 32-byte sc->block_data buffer in ISR Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/ichsmb/ichsmb.c:575	panic	reproduced
DF-1172	High	7.8	LSI v2 parser: OOB write on static ata_raid_arrays[] via unvalidated meta->raid_number Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:2802	corruption	reproduced
DF-1173	High	7.8	Multiple metadata parsers: OOB write on ar_softc.disks[] via unvalidated disk_number Base system — drivers · sys/dev/disk/nata/ata-raid.c:1806	corruption	reproduced
DF-1189	High	7.8	ciss_notify_logical: unbounded bus/target from controller notify event yields kernel OOB read/write Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3931	corruption	reproduced
DF-1190	High	7.8	ciss_init_logical: unbounded CISS_LUN_TO_BUS/TARGET at attach yields kernel OOB write of pointers and objects Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:1386	panic	reproduced
DF-1191	High	7.8	ciss_cam_complete: controller-supplied sense_length overflows fixed-size csio->sense_data on CHECK_CONDITION Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3248	panic	reproduced
DF-1198	High	7.8	Heap buffer overflow via state_index/i index mismatch in radeon_atombios_parse_power_table_6 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_atombios.c:2704	panic	reproduced
DF-1282	High	7.8	OOB heap write via unchecked firmware-controlled DeviceIndex in _mapping_process_dpm_pg0 Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:2251	panic	reproduced
DF-1283	High	7.8	OOB heap write via unsigned underflow in slot arithmetic in _mapping_add_new_device/_mapping_add_new_pcie_device Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:1637	panic	reproduced
DF-1284	High	7.8	Unbounded scatter-gather loop overflows pmap->psg[17], tmpSg[512] stack, and PRD heap table Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/entry.c:2800	panic	reproduced
DF-1374	High	7.8	Unvalidated firmware DeviceIndex in _mapping_process_dpm_pg0 causes heap OOB write into mapping_table Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_mapping.c:1495	panic	reproduced
DF-1375	High	7.8	Unvalidated slot arithmetic in topology-event handling causes heap OOB write (underflow + num_slots overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_mapping.c:968	panic	reproduced
DF-1534	High	7.8	Unbounded recursion in atom_op_calltable causes kernel stack overflow Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/atom.c:624	panic	reproduced
DF-1535	High	7.8	Integer overflow in FB scratch bounds check enables heap OOB read/write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/atom.c:281	panic	reproduced
DF-1536	High	7.8	Unbounded PS operand index causes kernel stack OOB read/write via caller buffer Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/atom.c:224	panic	reproduced
DF-1542	High	7.8	amdgpu atom_op_calltable unbounded recursion causes kernel stack overflow Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/atom.c:610	panic	reproduced
DF-1543	High	7.8	amdgpu atom FB scratch bounds check integer overflow enables heap OOB read/write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/atom.c:270	panic	reproduced
DF-1544	High	7.8	amdgpu atom PS operand index unbounded -> kernel stack OOB read/write via caller buffer Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/atom.c:213	panic	reproduced
DF-1556	High	7.8	mps_config_get_raid_volume_pg0 missing MIN() guard on final bcopy — heap overflow from firmware-supplied PageLength Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_config.c:1084	panic	reproduced
DF-1557	High	7.8	mps_wd_config_pages writes DD_column_map via firmware-supplied PhysDiskMap with no bounds check — heap OOB write past end of mps_softc Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_config.c:460	panic	reproduced
DF-1585	High	7.8	Use-after-free of fbc->compressed_llb on second cleanup / driver unload Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_fbc.c:559	panic	reproduced
DF-1606	High	7.8	Kernel heap overflow via fixed-size cmi_order[128] array in /dev/hpcmi read path Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_hp/acpi_hp.c:147	panic	reproduced
DF-1662	High	7.8	i915: GEM context destroy ioctl double-close race -> refcount underflow -> UAF Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_context.c:278	panic	reproduced
DF-1664	High	7.8	twa: unbounded kvsprintf+strcpy into 98-byte parameter_data -> stack/heap overflow + format-string Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twa/tw_cl_misc.c:505	panic	reproduced
DF-1676	High	7.8	nvme: unvalidated device-controlled indices in nvme_poll_completions -> OOB write + RIP hijack Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nvme/nvme.c:713	panic	reproduced
DF-1692	High	7.8	amdgpu_debugfs: heap OOB read+write in amdgpu_debugfs_gpr_read via byte-offset/dword-index unit confusion Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:701	panic	reproduced
DF-1891	High	7.8	Unbounded ctlr->channels from AHCI CAP/PI registers: source-side of interrupt[] OOB (variant of DF-1716) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/chipsets/ata-ahci.c:101	panic	reproduced
DF-2059	High	7.8	Missing privilege check on SIOCGATHDIAG/SIOCGATHPHYERR/SIOCGATHSPECTRAL exposes raw HAL diagnostic surface to unprivileged users Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_ioctl.c:299	none	reproduced
DF-0139	Medium	7.8	SLEEPQ_HASH misplaced mask causes massive OOB index into sleepq_chains array Base system — kernel core (kern) · sys/kern/subr_sleepqueue.c:82	none	reproduced
DF-2427	High	7.6	Out-of-bounds array access in amd_Reselect when reselecting-ID byte decodes to no valid target Base system — drivers · sys/dev/disk/amd/amd.c:1829	panic	reproduced
DF-1184	High	7.5	Heap buffer overflow in arcmsr_Read_iop_rqbuffer_data_D: 128-byte kmalloc overwritten by firmware-controlled data_len Kernel memory corruption (UAF / OOB write) · sys/dev/raid/arcmsr/arcmsr.c:1446	corruption	reproduced
DF-1381	High	7.5	vge_newbuf RX-ring refill loop writes OOB when idx<VGE_RXCHUNK due to non-modular signed decrement Kernel memory corruption (UAF / OOB write) · sys/dev/netif/vge/if_vge.c:1162	panic	reproduced
DF-0710	Medium	7.5	sco_input uses while-loop (not if) for receive buffer check — oversized SCO packet hangs protocol thread in infinite loop Base system — network stack · sys/netbt/sco_socket.c:221	dos	reproduced
DF-1161	Medium	7.5	Unbounded els_cmd_ptrs[] index from IOC-supplied TransactionContext in FC ELS reply handler Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:2951	panic	reproduced
DF-1162	Medium	7.5	tgt_cmd_ptrs[rx_id] bounds check uses wrong limit in FC ABTS path Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:3004	panic	reproduced
DF-2285	Medium	7.5	Use-after-free in target teardown: fixed 500ms sleep before kfree(softc) does not drain in-flight CTIOs Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_targ_bh.c:402	panic	reproduced
DF-1395	High	7.4	Firmware-controlled size_of_struct in oce_read_mac_addr drives unbounded bcopy (heap overflow into softc) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_mbox.c:447	panic	reproduced
DF-0083	Medium	7.4	OOB write into cpu_topology_nodes[MAXCPU] during boot topology construction on high-CPU-count systems Kernel memory corruption (UAF / OOB write) · sys/kern/subr_cpu_topology.c:115	panic	reproduced
DF-0806	High	7.3	dirfs_readlink off-by-one heap overflow and OOB read via truncated symlink target Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vnops.c:1328	corruption	reproduced
DF-2060	High	7.3	Invalid free / non-heap kfree in ath_ioctl_diag when HAL diagcode replaces result pointer (ATH_DIAG_DYN + HAL_DIAG_REVS/FATALERR) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_ioctl.c:201	panic	reproduced
DF-2357	Medium	7.2	Wrong TX frame-size bound causes 16-byte overflow of USB DMA buffer Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_rum.c:438	none	reproduced
DF-1179	High	7.1	Heap OOB write in DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8] Kernel memory corruption (UAF / OOB write) · DF-1166 · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1200	corruption	reproduced
DF-1180	High	7.1	Heap OOB write in voltage-table builders: unbounded dep_table->count overflows entries[32] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1026	corruption	reproduced
DF-1286	High	7.1	SPROM rev4/5/8 TXPID parser reads kernel heap at negative array indices (unported offset constants) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bwn/siba/siba_core.c:1591	leak:32	reproduced
DF-1401	High	7.1	Missing bounds check on nonClockInfoIndex causes OOB read past NonClockInfoArray Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/trinity_dpm.c:1774	dos	reproduced
DF-1402	High	7.1	Missing bounds check on vce_states[].clk_idx causes OOB read past ClockInfoArray Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/trinity_dpm.c:1809	dos	reproduced
DF-1510	High	7.1	Unbounded autosense bcopy leaks kernel heap and corrupts the CCB Kernel memory leaks / uninitialized disclosure · sys/dev/disk/advansys/adwcam.c:383	leak:heap	reproduced
DF-1795	High	7.1	plip: heap overflow / OOB-read in lp_intr racing SIOCSIFMTU buffer swap Kernel memory corruption (UAF / OOB write) · sys/dev/netif/plip/if_plip.c:348	panic	reproduced
DF-0458	Medium	7.1	Heap over-read / info-leak / panic in L2CA_Ping: missing echo-data length validation Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c:1306	leak:65531bytes	reproduced
DF-1192	High	7.0	ciss_filter_physical: bus=CISS_EXTRA_BUS2(ea)-1 can be -1 -> OOB pointer write via ciss_physical[-1][target] Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:1551	panic	reproduced
DF-1296	High	7.0	Unchecked VBIOS UVD/VCE/ACP level counts cause heap OOB write past fixed-size SMC arrays Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1525	panic	reproduced
DF-1487	High	7.0	Out-of-bounds descriptor write in wb_encap when TX chain fills all 16 fragments under minimum frame length Kernel memory corruption (UAF / OOB write) · sys/dev/netif/wb/if_wb.c:1221	leak:heap	reproduced
DF-2062	High	7.0	dm_table_busy exports only SHARED lock primitive; dm_table_load_ioctl races on inactive TAILQ -> kernel list corruption / wild-pointer write Base system — drivers · sys/dev/disk/dm/dm_table.c:38	panic	reproduced
DF-0755	Medium	7.0	Unlocked global trace index tcp_debx races into runaway out-of-bounds write (TCPDEBUG-only) Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_debug.c:84	none	reproduced
DF-0774	Medium	7.0	Use-after-free in devfs_clone — clone handler freed during lock release window before nhandler call Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_core.c:2322	panic	reproduced
DF-2304	Medium	7.0	Double-free / UAF in fwohci_pci_add_child error path: detach deletes child then caller deletes it again Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci_pci.c:446	panic	reproduced
DF-2248	Low	7.0	min() truncates 64-bit size_t to 32-bit u_int then stores in signed int: negative loop count unbounded buffer overrun Kernel memory corruption (UAF / OOB write) · sys/libiconv/iconv_xlat.c:86	panic	reproduced
DF-1124	Medium	6.8	iwn5000_rx_calib_results: signed integer underflow on firmware length and unbounded heap copy from RX buffer Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwn/if_iwn.c:3353	leak:12288	reproduced
DF-2255	Medium	6.8	Stack buffer overflow in ar9300_eeprom_restore_internal_address via unchecked EEPROM compression length field Vendored third-party (contrib) · sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3892	dos	reproduced
DF-0410	High	6.7	Heap buffer overflow in ng_encode_string: buffer allocated by strlen(raw) but loop iterates attacker-controlled slen Kernel memory corruption (UAF / OOB write) · sys/netgraph7/netgraph/ng_parse.c:919	none	reproduced
DF-1503	High	6.7	SETFKEY signed-flen heap/static overflow via imin(-1, MAXFK) wrapped into u_char .len Kernel memory corruption (UAF / OOB write) · sys/dev/misc/kbd/kbd.c:1090	leak:heap	reproduced
DF-1529	High	6.7	hpt_create_array_v2 dereferences unvalidated Members[1..nDisk-1] as kernel pointers (arbitrary kernel memory write) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/gui_lib.c:571	leak:heap	reproduced
DF-1539	High	6.7	Heap buffer overflow in NGM_TEXT_STATUS handler via unbounded ksprintf into 1024-byte response Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mn/if_mn.c:352	leak:heap	reproduced
DF-1560	High	6.7	Heap buffer overflow in pp_dpm_set_pp_table via sysfs pp_table write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/amd_powerplay.c:676	panic	reproduced
DF-1563	High	6.7	Heap overflow via unbounded CAM scatter-gather count in hpt_scsi_io Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:715	leak:heap	reproduced
DF-1176	Medium	6.7	Unvalidated RLC firmware header fields cause integer overflow in kmalloc and OOB heap read/write Kernel memory corruption (UAF / OOB write) · DF-1133 · sys/dev/drm/amd/amdgpu/gfx_v9_0.c:691	panic	reproduced
DF-2015	Medium	6.7	vce_v1_0_load_fw trusts unvalidated firmware-blob fields (num/len/datasize) causing kernel heap OOB write and OOB read Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/vce_v1_0.c:158	none	reproduced
DF-1823	Low	6.7	aac_cam: unbounded sense-data bcopy heap overflow in aac_cam_complete (min(sense_len,sense_returned) not bounded to sizeof(sense_data)=32) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac_cam.c:608	none	reproduced
DF-1825	Low	6.7	evdev_mt: unbounded match_slot in SYN_MT_REPORT path causes OOB heap read/write and KKASSERT panic Kernel memory corruption (UAF / OOB write) · sys/dev/misc/evdev/evdev_mt.c:416	none	reproduced
DF-1400	High	6.6	Stack buffer overflow in wi_write_wep LUCENT WEP-key load (wk_keylen up to 16 copied into wi_keydat[14]) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/wi/if_wi.c:1751	panic	reproduced
DF-0453	High	6.5	Wrong session variable in rfcomm_session_newconn: timeout armed on listener not new session — memory leak + listener corruption DoS Base system — network stack · sys/netbt/rfcomm_session.c:423	panic	reproduced
DF-0508	High	6.5	L2CAP ConfigReq unknown-option echo inflates m_pkthdr.len past mbuf data -> remote kernel heap info leak Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c:599	leak:252	reproduced
DF-0802	Medium	6.5	Panic on malformed BOOTP/DHCP options from unauthenticated network reply during diskless boot — pre-auth remote DoS Base system — filesystems · sys/vfs/nfs/bootp_subr.c:1390	panic	reproduced
DF-1126	Medium	6.5	Infinite loop in response queue processing when target mode consumes multiple entries Base system — drivers · sys/dev/disk/isp/isp.c:5112	dos	reproduced
DF-2539	Medium	6.5	Unbounded loop in num_compl_pkts causes kernel panic from malformed Number Of Completed Packets event Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:891	panic	reproduced
DF-2541	Medium	6.5	Network input paths X_ipip_input and pim_input dereference viftable/last_encap_vif without mroute_token racing vif teardown to NULL deref or 5.5MB OOB read Kernel memory corruption (UAF / OOB write) · sys/net/ip_mroute/ip_mroute.c:1716	panic	reproduced
DF-2577	Low	6.5	ICMP PULLUP_TO(hlen+4) reads icmp_id at hlen+4..hlen+5: 2-byte mbuf backing-store over-read on crafted short ICMP packets Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3/ip_fw3.c:400	none	reproduced
DF-0524	High	6.4	Stored raw pointer to member ifnet with no refcount: UAF when member interface destroyed Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:408	panic	reproduced
DF-0907	High	6.4	Heap overflow in smbfs_mount: signed underflow in strncpy length when SMB username >= 76 chars Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_vfsops.c:170	panic	reproduced
DF-0529	Medium	6.4	Double-kfree/interior-pointer kfree in ng_fec_constructor error paths: heap corruption Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:1085	panic	reproduced
DF-2323	Medium	6.4	VPD error-cleanup loops use NULL sentinel without guaranteed terminator after krealloc shrink - OOB read and kfree of garbage pointers Kernel memory leaks / uninitialized disclosure · sys/bus/pci/pci.c:1225	corruption	reproduced
DF-2383	Medium	6.4	Use-after-free of softc in acpi_hp_notify vs. acpi_hp_detach (DF-2381 AcpiOsWaitEventsComplete no-op) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_hp/acpi_hp.c:591	panic	reproduced
DF-1312	Low	6.4	Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks Base system — drivers · sys/dev/raid/hptiop/hptiop.c:336	none	reproduced
DF-1394	Low	6.4	Heap OOB write in seq_open when more than 32 MIDI devices registered Kernel memory corruption (UAF / OOB write) · sys/dev/sound/midi/sequencer.c:541	none	reproduced
DF-2413	Low	6.4	Unbounded ccb_index from firmware LRAM into ccb_infos[] heap OOB read + attacker-influenced pointer deref Kernel memory leaks / uninitialized disclosure · sys/dev/disk/advansys/advansys.c:1106	panic	reproduced
DF-2599	Low	6.4	output_ifp stored without ifnet lifetime protection UAF on interface detach Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_source.c:623	none	reproduced
DF-1491	Info	6.4	Missing MIN() bound in mpr_config_get_raid_volume_pg0 allows firmware-controlled heap-buffer overrun into caller struct Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_config.c:1295	none	reproduced
DF-0786	Medium	6.3	Off-by-one heap overflow in ntfs_ntlookupattr: NUL terminator written one byte past kmalloc(namelen) Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/ntfs/ntfs_subr.c:826	corruption	reproduced
DF-1384	Low	6.3	TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers Kernel memory corruption (UAF / OOB write) · sys/dev/netif/nge/if_nge.c:1148	none	reproduced
DF-1262	Info	6.3	dsp_mmap (legacy d_mmap) performs unbounded vtophys() on user offset (dead code, latent critical) Base system — drivers · sys/dev/sound/pcm/dsp.c:2287	none	reproduced
DF-1473	High	6.1	u16 truncation in EventDataLength*4 size computation causes zero-size alloc panic and undersized-buffer OOB read Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas_lsi.c:136	panic	reproduced
DF-1696	High	6.1	mps_sas_lsi: u16 truncation of EventDataLength*4 panics on kmalloc(0) and yields OOB heap read Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas_lsi.c:128	panic	reproduced
DF-2061	Medium	6.1	Unprivileged heap OOB read / wild MMIO read via HAL_DIAG_REGS: ath_hal_getregdump indexes input without consulting its length Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_ioctl.c:189	panic	reproduced
DF-2270	Medium	6.1	Missing bounds check on cesr_element_type in chgetelemstatus allows OOB array index into sc_firsts/sc_counts Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ch.c:1066	dos	reproduced
DF-1603	High	6.0	Divide-by-zero panic via attacker-controlled blk_size=0 in virtio-blk config space Base system — drivers · sys/dev/virtual/virtio/block/virtio_blk.c:703	panic	reproduced
DF-0149	Medium	6.0	Signed-integer truncation in TLV walk size math allows backward/OOB pointer movement Base system — kernel core (kern) · sys/kern/subr_module.c:79	none	reproduced
DF-1164	Medium	6.0	CP/MEC/RLC firmware loaders OOB read via untrusted ucode_size_bytes Kernel memory leaks / uninitialized disclosure · DF-1119 · sys/dev/drm/amd/amdgpu/gfx_v7_0.c:2447	leak:unbounded	reproduced
DF-1177	Medium	6.0	rv_init_cp_jump_table: unbounded jt_size OOB write + NULL deref on missing mec2 firmware Kernel memory corruption (UAF / OOB write) · DF-1134 · sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1078	panic	reproduced
DF-2065	Medium	6.0	si_load_smc_ucode ignores limit and trusts firmware header offset/size fields without bounds checking -- heap OOB read and unbounded SMC SRAM write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/si_smc.c:211	panic	reproduced
DF-1313	Low	6.0	Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptiop/hptiop.c:1085	none	reproduced
DF-0645	Medium	5.9	NULL pointer dereference in div_packet() on re-injected divert packets (rcvif==NULL) Base system — network stack · sys/netinet/ip_divert.c:182	panic	reproduced
DF-2537	Low	5.9	ABTS RX_ID bound check uses IOC mpt_max_tgtcmds instead of actual tgt_cmd_ptrs array size (OOB read in FC target mode) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_cam.c:3004	none	reproduced
DF-2010	Low	5.8	Lockless read of isp->sessions[] in ic_action allows use-after-free of iSCSI session being torn down Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_cam.c:210	none	reproduced
DF-0663	Medium	5.7	SLIST_REMOVE on never-inserted element in newhook error paths corrupts list head Base system — network stack · sys/netgraph/ng_device.c:286	panic	reproduced
DF-1187	Low	5.7	arcmsr_build_srb 4GB-boundary split can overflow ARCMSR_CDB.u scatter list Kernel memory corruption (UAF / OOB write) · sys/dev/raid/arcmsr/arcmsr.c:974	panic	reproduced
DF-1248	Low	5.7	SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths Kernel memory leaks / uninitialized disclosure · sys/dev/netif/dc/if_dc.c:1744	none	reproduced
DF-2007	Low	5.7	amdgpu_sa_bo_manager_fini mutates lists without acquiring sa_manager->wq.lock -- UAF / list-corruption race with concurrent reader Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_sa.c:77	none	reproduced
DF-2049	Low	5.7	No synchronization: concurrent LOADTEST frees tbridge_testcase out from under running test kthread (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/tbridge/tbridge.c:240	panic	reproduced
DF-2376	Low	5.7	Fire-and-forget AcpiOsExecute battery tasks can run after detach using freed softc (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_cmbat.c:154	panic	reproduced
DF-0807	High	5.5	dirfs_readdir for-loop increment uses already-advanced dp — heap OOB read and memory disclosure Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vnops.c:1277	leak	reproduced
DF-1199	High	5.5	Integer underflow in radeon_atombios_get_asic_ss_info causes 1.4-billion-iteration OOB heap read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_atombios.c:1555	panic	reproduced
DF-1661	High	5.5	ipmi: size_t underflow in IPMICTL_RECEIVE_MSG_TRUNC copies unbounded kernel heap to user Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi.c:448	leak	reproduced
DF-1116	Medium	5.5	Integer divide-by-zero panic in fwdma_malloc_multiseg via esize==0 (FW_SSTBUF psize=0) Privilege escalation (general use) · sys/bus/firewire/fwdma.c:153	panic	reproduced
DF-1167	Medium	5.5	NULL deref / heap OOB read: cac_leakage_table indexed by unrelated SCLK count without bounds Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:673	panic	reproduced
DF-1174	Medium	5.5	Systemic divide-by-zero via zero width or interleave from crafted metadata Base system — drivers · sys/dev/disk/nata/ata-raid.c:157	panic	reproduced
DF-1175	Medium	5.5	Intel and nVidia parsers: unbounded config_size in checksum loop causes kernel OOB read / panic Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:2151	leak:64000+3584	reproduced
DF-2386	Medium	5.5	Unchecked AcpiEvaluateObject return causes NULL-pointer-dereference panic reachable from unprivileged user via CTLFLAG_ANYBODY sysctl Base system — drivers · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:276	panic	reproduced
DF-2426	Medium	5.5	Divide-by-zero panic via XPT_CALC_GEOMETRY with block_size == 0 Base system — drivers · sys/dev/disk/amd/amd.c:683	panic	reproduced
DF-2429	Medium	5.5	Divide-by-zero in XPT_CALC_GEOMETRY from unvalidated block_size (local DoS / panic) Base system — drivers · sys/dev/disk/buslogic/bt.c:1157	panic	reproduced
DF-2489	Medium	5.5	Divide-by-zero kernel panic from zero geometry in ad_attach/ad_describe Base system — drivers · sys/dev/disk/nata/ata-disk.c:147	panic	reproduced
DF-0765	Low	5.5	Wrong semaphore released in newblk_lookup race-avoided path — pagedep_in_progress instead of newblk_in_progress Base system — filesystems · sys/vfs/ufs/ffs_softdep.c:1017	none	reproduced
DF-1309	Low	5.5	Static buffer overflow in ath_ee_FillVpdTable via crafted EEPROM pdg power range >126 Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2427	none	reproduced
DF-1819	Low	5.5	ar5210_misc: NULL pointer write in HAL_DIAG_EEREAD via ar5210GetDiagState (unprivileged local DoS) Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:624	none	reproduced
DF-1840	Low	5.5	NULL-deref panic in amr_cam_complete when an INQUIRY CCB carries no data buffer Base system — drivers · sys/dev/raid/amr/amr_cam.c:557	none	reproduced
DF-1973	Low	5.5	KKASSERT in mlphy_service panics INVARIANTS kernels on every autoneg tick Base system — drivers · sys/dev/netif/mii_layer/mlphy.c:220	none	reproduced
DF-2067	Low	5.5	Unclamped si_iosize_max on syspd allows oversized bio to permanently stall controller Base system — drivers · sys/dev/raid/mfi/mfi_syspd.c:135	dos	reproduced
DF-2601	Low	5.5	snd_queue enqueue ignores ifq_maxlen unbounded kernel memory exhaustion DoS Base system — network stack · sys/netgraph7/ng_source.c:280	dos	reproduced
DF-0672	Medium	5.4	Uninitialized struct sockaddr_in passed to soconnect() in retarget path Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_trantcp.c:206	none	reproduced
DF-2567	Low	5.4	Use-after-free read of rqp->sr_flags in smb_t2_request_int error path Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_rq.c:740	none	reproduced
DF-0584	Info	5.4	ieee80211_ff_decap skips framelen validation: truncated frame delivery Base system — network stack · sys/netproto/802_11/wlan/ieee80211_superg.c:309	none	reproduced
DF-0659	Medium	5.3	ng_l2cap_discon_untimeout leaves AUTO_DISCON_TIMO flag set on timer-already-fired path, causing kernel panic via con_ref/con_unref cycle Base system — network stack · sys/netgraph7/bluetooth/l2cap/ng_l2cap_misc.c:223	panic	reproduced
DF-1120	Medium	5.3	Buddy allocator unbounded merge in ___sym_mfree causes heap OOB write past h[] array Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sym/sym_hipd.c:408	panic	reproduced
DF-1158	Medium	5.3	wpi_notif_intr RX index mask 0xfff wider than WPI_RX_RING_COUNT=64 can cause infinite softirq loop Base system — drivers · sys/dev/netif/wpi/if_wpi.c:2208	dos	reproduced
DF-2468	Medium	5.3	getSenseData leaks kernel heap into CCB sense buffer via unvalidated wire sense_len and mis-sized scratch buffer Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi_subr.c:152	leak	reproduced
DF-2533	Medium	5.3	xa_close leaks xdisk_lk and releases wrong lock on raced-destruction defensive paths Base system — drivers · sys/dev/disk/xdisk/xdisk.c:767	panic	reproduced
DF-0233	Low	5.3	Lockless SLIST traversal of domains list races with crit_enter-only writer Base system — kernel core (kern) · sys/kern/uipc_domain.c:137	none	reproduced
DF-0309	Low	5.3	Unbounded pending NOCACHE upcall entries: remote memory-exhaustion DoS when mrouter active Base system — network stack · sys/net/ip_mroute/ip_mroute.c:1266	dos	reproduced
DF-0750	Low	5.3	strncpy on binary MAC bytes silently truncates at 0x00 byte — radix key collision rule bypass Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_layer2/ip_fw3_layer2.c:127	none	reproduced
DF-2016	Low	5.3	Unguarded data_ptr dereference in INQUIRY rewrite path of mfip_done (local DoS / 1-byte heap OOB) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi_cam.c:339	none	reproduced
DF-2384	Low	5.3	Missing Buffer.Length check in acpi_hp_exec_wmi_command (heap OOB read of result[1]/result[2]) Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_hp/acpi_hp.c:838	leak	reproduced
DF-2534	Low	5.3	xa_strategy / xa_size dereference sc without lifetime lock racing xa_terminate_check free Kernel memory corruption (UAF / OOB write) · sys/dev/disk/xdisk/xdisk.c:801	leak	reproduced
DF-1617	Info	5.3	No local guard against intval==0 in ath_beacon_config STA timer math Base system — drivers · sys/dev/netif/ath/ath/if_ath_beacon.c:988	none	reproduced
DF-1165	Medium	5.2	Heap OOB read in drm_parse_tiled_block via undersized DisplayID tiled block Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_edid.c:5103	leak:16	reproduced
DF-0634	Medium	5.1	Heap out-of-bounds read in ng_tag_rcvdata() mbuf-tag matching Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_tag.c:525	leak:65535	reproduced
DF-1127	Medium	5.1	Missing bounds checks on BIOS-supplied array indices in si_parse_power_table (nonClockInfoIndex and VCE clk_idx) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/si_dpm.c:7253	leak	reproduced
DF-0899	Low	5.1	Cross-object heap over-read in devfs_rule_clear via non-NUL-terminated mntpoint Kernel memory leaks / uninitialized disclosure · sys/vfs/devfs/devfs_rules.c:194	panic	reproduced
DF-2407	Low	5.1	Signed/unsigned promotion in tpm_tis12_write makes a zero-length write read past the stack buffer into the TPM Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm.c:821	panic	reproduced
DF-1455	Info	5.1	Unvalidated completion context and ring log2 sizes from hypervisor-controlled shared DMA memory Base system — drivers · sys/dev/virtual/vmware/pvscsi/pvscsi.c:899	none	reproduced
DF-2279	Info	5.1	CAMIOCOMMAND accepts kernel-internal XPT function codes that operate on kernel-only objects Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_pass.c:474	leak	reproduced
DF-0317	Low	4.8	Unsynchronized global static shared across all WireGuard interfaces in wg_is_underload Base system — network stack · sys/net/wg/if_wg.c:1577	none	reproduced
DF-0408	Info	4.8	ip_optcopy validates IP-option lengths only with KASSERT (no-op on production): latent OOB read Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_output.c:1018	none	reproduced
DF-2066	Medium	4.7	mfi_syspd_strategy leaks bio on controller fault/reset permanently wedging I/O Base system — drivers · sys/dev/raid/mfi/mfi_syspd.c:249	dos	reproduced
DF-2367	Medium	4.7	AES T-table lookups are data-dependent leaking key material via cache timing (CCMP always dm-crypt/IPsec on non-AES-NI) Base system — crypto · sys/crypto/rijndael/rijndael-alg-fst.c:56	leak	reproduced
DF-2423	Medium	4.7	NULL-pointer dereference in ahci_pm_read/ahci_pm_write when CCB pool is exhausted Base system — drivers · sys/dev/disk/ahci/ahci_pm.c:976	panic	reproduced
DF-0891	Low	4.7	tmpfs_mount dereferences uninitialized root pointer before error check Kernel memory corruption (UAF / OOB write) · sys/vfs/tmpfs/tmpfs_vfsops.c:212	panic	reproduced
DF-0892	Low	4.7	tmpfs_root dereferences *vpp without checking tmpfs_alloc_vp error Base system — filesystems · sys/vfs/tmpfs/tmpfs_vfsops.c:424	panic	reproduced
DF-0944	Low	4.7	NULL vm_page dereference when OBJT_MGTDEVICE pager returns VM_PAGER_FAIL (latent; no in-tree driver triggers it) Base system — virtual memory · sys/vm/vm_fault.c:2033	panic	reproduced
DF-1422	Low	4.7	isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_pci.c:1629	none	reproduced
DF-1832	Low	4.7	NULL-pointer deref of intel_connector->encoder in HPD storm re-enable and poll-init workers Base system — drivers · sys/dev/drm/i915/intel_hotplug.c:233	none	reproduced
DF-1967	Low	4.7	NULL pointer dereference in dm_dp_add_mst_connector on fake-MST encoder allocation failure Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:346	none	reproduced
DF-1983	Low	4.7	Latent kfree() on embedded drm_framebuffer in amdgpufb_create error path (slab-corruption landmine) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_fb.c:255	none	reproduced
DF-1986	Low	4.7	Missing cleanup on agp_via_attach failure leaks /dev/agpgart with freed softc -> NULL-deref kernel panic Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp_via.c:180	none	reproduced
DF-1988	Low	4.7	radeon_sa_bo_manager_fini manipulates SA lists without holding wq.lock (race condition / potential UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_sa.c:82	none	reproduced
DF-2001	Low	4.7	NULL-pointer write in icintr if i2c peer delivers data before SIOCSIFFLAGS allocates the receive buffer Base system — drivers · sys/dev/netif/ic/if_ic.c:127	none	reproduced
DF-2006	Low	4.7	Heap OOB read in aibs_attach_sif when ACPI ?SIF returns a zero-element package Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/aibs/atk0110.c:169	none	reproduced
DF-2074	Low	4.7	mlxd_strategy dereferences stale/uninitialized bio_driver_info instead of dev->si_drv1 Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mlx/mlx_disk.c:161	panic	reproduced
DF-2355	Low	4.7	Unbounded linear search in mt7601_set_chan reads past mt7601_rf_chan[14] Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_mtw.c:3693	none	reproduced
DF-2385	Low	4.7	Package helpers index Elements[idx] with no bounds check; the apparent NULL guard is dead code (heap OOB read / info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_package.c:48	leak	reproduced
DF-2412	Low	4.7	Unbounded queue-number index into sense_buffers[] heap OOB read / kernel heap info leak Kernel memory leaks / uninitialized disclosure · sys/dev/disk/advansys/advansys.c:1185	none	reproduced
DF-2544	Low	4.7	Missing bounds check in devclass_alloc_unit permits heap underflow write / NULL-deref panic for negative non-wildcard unit Kernel memory corruption (UAF / OOB write) · sys/kern/subr_bus.c:1067	panic	reproduced
DF-2559	Low	4.7	Local NULL-deref panic when sbcreatecontrol fails in SO_PASSCRED path Base system — kernel core (kern) · sys/kern/uipc_usrreq.c:694	panic	reproduced
DF-2565	Low	4.7	in_delayed_cksum writes through unchecked m_pullup return and silently drops the (possibly reallocated) mbuf pointer Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_output.c:949	none	reproduced
DF-0678	Info	4.7	Missing NULL-node guard in ng_gif_input/ng_gif_input_orphan (latent panic; unreachable while file is dead code) Base system — network stack · sys/netgraph7/ng_gif.c:170	none	reproduced
DF-0913	Info	4.7	fuse_audit_length / fuse_get_ops panic kernel on unknown opcode Base system — filesystems · sys/vfs/fuse/fuse_util.c:229	none	reproduced
DF-2324	Medium	4.6	Capability list traversal lacks cycle detection - infinite loop DoS from malicious device with circular capability chain Base system — bus / platform / cpu · sys/bus/pci/pci.c:877	panic	reproduced
DF-2491	Medium	4.6	Divide-by-zero panic in CHS-mode ata_tf_write from device-controlled geometry Base system — drivers · sys/dev/disk/nata/ata-lowlevel.c:771	panic	reproduced
DF-1205	Low	4.6	Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach Kernel memory leaks / uninitialized disclosure · sys/dev/netif/de/if_de.c:2072	none	reproduced
DF-1308	Low	4.6	OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2108	none	reproduced
DF-1812	Low	4.6	nvme_admin: unvalidated NVMe namespace LBA sect_size causes divide-by-zero panic at attach Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:673	none	reproduced
DF-1813	Low	4.6	nvme_admin: admin request leak on IDENTIFY NAMESPACE failure leads to KKASSERT panic via admin-queue exhaustion Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:624	none	reproduced
DF-2321	Low	4.6	Unbounded idx extension loops in CISTPL_CFTABLE_ENTRY read past the declared tuple body Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:995	dos	reproduced
DF-2335	Low	4.6	Unbounded unvalidated PCI extended-capability loop in ehci_pci_take_controller (DoS via malicious/fuzzed controller) Base system — bus / platform / cpu · sys/bus/u4b/controller/ehci_pci.c:517	dos	reproduced
DF-2341	Low	4.6	NULL-deref panic in if_detach when async PHY-probe attach fails (ether_ifdetach on never-attached ifnet) Base system — bus / platform / cpu · sys/bus/u4b/net/usb_ethernet.c:232	panic	reproduced
DF-0267	Low	4.5	Race condition in fixed Huffman table initialization Base system — network stack · sys/net/zlib.c:4496	none	reproduced
DF-0951	Low	4.5	Missing vm_token on LIST_REMOVE in zinitna ZONE_INTERRUPT error path allows zlist corruption race with sysctl_vm_zone Kernel memory corruption (UAF / OOB write) · sys/vm/vm_zone.c:358	panic	reproduced
DF-0968	Low	4.5	rijndael_blockEncrypt CBC mode reads/writes full 16-byte block even when numBlocks==0 (non-block-aligned inputLen) Kernel memory corruption (UAF / OOB write) · sys/crypto/rijndael/rijndael-api-fst.c:93	leak	reproduced
DF-2606	Medium	4.4	Unvalidated bref->keybits from disk causes undefined behavior in shift operations throughout chain lookups Hammer2 · sys/vfs/hammer2/hammer2_chain.c:109	dos	reproduced
DF-0836	Low	4.4	smbfs_advlock missing break: SEEK_END always returns EINVAL, SEEK_CUR treated as SEEK_SET Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_vnops.c:905	none	reproduced
DF-0868	Low	4.4	Missing error check on hammer_init_cursor in mirror_write allows use of invalid cursor Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:362	panic	reproduced
DF-1288	Low	4.4	NULL-pointer dereference in mly_user_command error path when command pool exhausted Base system — drivers · sys/dev/raid/mly/mly.c:2883	none	reproduced
DF-1304	Low	4.4	mlx_user_command DCDB fixup writes dcdb_physaddr past undersized heap buffer Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mlx/mlx.c:1872	none	reproduced
DF-1372	Low	4.4	oce_handle_passthrough writes through direct user-pointer dereference (SMAP panic) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_if.c:1806	none	reproduced
DF-1822	Low	4.4	aac_cam: kernel panic via CAM_SCATTER_VALID flag on pass-through (local DoS) Base system — drivers · sys/dev/raid/aac/aac_cam.c:456	none	reproduced
DF-1838	Low	4.4	PSP firmware header fields used without bounds validation: heap overflow and OOB read on corrupt SOS/ASD firmware Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/psp_v3_1.c:126	none	reproduced
DF-1975	Low	4.4	Unconditional kprintf debug spam in i915_gem_evict_something leaks GTT layout and enables local log/console DoS Privilege escalation (general use) · sys/dev/drm/i915/i915_gem_evict.c:156	none	reproduced
DF-2004	Low	4.4	Missing zero-check on writable machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic Privilege escalation (general use) · sys/dev/acpica/acpi_timer.c:310	none	reproduced
DF-2009	Low	4.4	Negative uio_resid in led_write causes guaranteed kernel panic (OOB write to non-canonical address) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/led/led.c:232	none	reproduced
DF-2343	Low	4.4	Divide-by-zero and OOB read in umcs7840_calc_baudrate when rate==0 Privilege escalation (general use) · sys/bus/u4b/serial/umcs.c:1066	panic	reproduced
DF-2347	Low	4.4	Lockless check/use race on bus->ifp between usbpf_xfertap and clone/teardown causes NULL-deref/UAF panic Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_pf.c:362	panic	reproduced
DF-2360	Low	4.4	Unbounded f_reg()/f_rm() indexing crashes DDB: NULL-deref in Grp7 dispatch and wild-pointer deref via REX.R into 8-element tables Base system — bus / platform / cpu · sys/cpu/x86_64/misc/db_disasm.c:908	panic	reproduced
DF-2368	Low	4.4	Key-size validation is no-op KASSERT invalid keyBits silently yields Nr=0 and runaway loop / OOB read Kernel memory leaks / uninitialized disclosure · sys/crypto/rijndael/rijndael-alg-fst.c:734	panic	reproduced
DF-2381	Low	4.4	Use-after-free in detach: deferred ACPI notify callback runs on freed softc (AcpiOsWaitEventsComplete is a no-op in DragonFly) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:331	panic	reproduced
DF-2392	Low	4.4	Missing zero-validation on machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic Base system — drivers · sys/dev/acpica/acpi_timer.c:310	panic	reproduced
DF-2547	Low	4.4	Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion Base system — network stack · sys/netgraph7/ng_source.c:564	dos	reproduced
DF-2569	Low	4.4	Unconditional kernel panic on flush recursion depth limit instead of documented deferral Hammer2 · sys/vfs/hammer2/hammer2_flush.c:580	panic	reproduced
DF-2590	Low	4.4	Unchecked AcpiEvaluateObject return in acpi_panasonic_hkey_event causes NULL-deref panic Base system — drivers · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:403	panic	reproduced
DF-0409	Info	4.4	Unprivileged users can install IP source-route options (LSRR/SSRR) without privilege check Privilege escalation (general use) · sys/netinet/ip_output.c:1097	none	reproduced
DF-0454	Medium	4.3	Uninitialized kernel stack info leak in RPN response: param_mask never initialized for 1-byte RPN command Kernel memory leaks / uninitialized disclosure · sys/netbt/rfcomm_session.c:1227	leak:2bytes	reproduced
DF-1075	Medium	4.3	Multicast filter buffer allocated before device descriptor is read -> OOB write / kernel panic on interface up Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/if_kue.c:488	panic	reproduced
DF-1448	Low	4.3	24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID leaks FCP exchange Base system — drivers · sys/dev/disk/isp/isp_target.c:187	none	reproduced
DF-2579	Low	4.3	Silent uint16_t truncation of iv_swbmiss_period can yield zero (callout flood DoS) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_tdma.c:284	dos	reproduced
DF-0483	Info	4.3	No validation of attacker-supplied STP timer values from winning root bridge BPDU Base system — network stack · sys/net/bridge/bridgestp.c:393	none	reproduced
DF-0323	Low	4.2	ampdu_dispatch re-enters ieee80211_input while iterating rxa_m[] (re-entrancy) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ht.c:616	none	reproduced
DF-1344	Low	4.2	NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS740 floating-bus nulls ddc_bus but leaves shared_ddc=true) Base system — drivers · sys/dev/drm/radeon/radeon_connectors.c:1340	none	reproduced
DF-2369	Low	4.2	Multi-block CFB1 never advances input/outBuffer leaking plaintext and stale output as ciphertext for blocks > 1 Kernel memory leaks / uninitialized disclosure · sys/crypto/rijndael/rijndael-api-fst.c:153	none	reproduced
DF-2573	Medium	4.1	NULL deref / panic: SLIST_REMOVE on connection never inserted in error paths of ng_device_newhook Base system — network stack · sys/netgraph/ng_device.c:290	panic	reproduced
DF-0845	Low	4.1	Integer overflow in nslots computation with very large directories and elevated dirhash_maxmem — infinite loop hang Base system — filesystems · sys/vfs/ufs/ufs_dirhash.c:132	dos	reproduced
DF-1044	Low	4.1	vkernel busdma bounce-wait path panics via #ifdef notyet stub; return_bounce_pages wakes wrong map Base system — bus / platform / cpu · DF-1036 · sys/platform/vkernel64/platform/busdma_machdep.c:1094	panic	reproduced
DF-1992	Low	4.1	Divide-by-zero kernel panic via unvalidated VBIOS clock/spread-spectrum divisors in rv740_populate_sclk_value / rv740_populate_mclk_value Base system — drivers · sys/dev/drm/radeon/rv740_dpm.c:145	none	reproduced
DF-2409	Low	4.1	Use-after-free via un-drained discard_buffer_callout on device detach Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm20.c:138	panic	reproduced
DF-2454	Low	4.1	Buggy ksnprintf length tracking in dm_target_stripe_table/info overruns heap params buffer when output is truncated Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/striped/dm_target_striped.c:170	none	reproduced
DF-2457	Low	4.1	fd_detach stops only two of fd three callouts leaving fd_iotimeout armed over freed softc Kernel memory corruption (UAF / OOB write) · sys/dev/disk/fd/fd.c:1090	panic	reproduced
DF-2591	Low	4.1	Missing serial lock in acpi_panasonic_shutdown triggers KKASSERT panic on INVARIANTS kernels Base system — drivers · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:231	panic	reproduced
DF-0065	Info	4.1	OOB read of thread struct before panic in lwkt_reltoken assertion path (console-only, no userspace leak) Kernel memory leaks / uninitialized disclosure · sys/kern/lwkt_token.c:841	none	reproduced
DF-0247	Info	4.1	cpuid bounds check is KASSERT-only — compiled out in production kernels Base system — kernel core (kern) · sys/kern/subr_cpuhelper.c:45	none	reproduced
DF-0368	Info	4.1	lagg_clone_create error path calls if_free on embedded ifnet: latent double-free if protocol attach ever fails Kernel memory corruption (UAF / OOB write) · sys/net/lagg/if_lagg.c:304	none	reproduced
DF-0385	Info	4.1	config_red kfrees caller-owned possibly-embedded struct on red_lookup_depth==0 path: latent UAF — same as v1 Kernel memory corruption (UAF / OOB write) · sys/net/dummynet3/ip_dummynet3.c:1364	none	reproduced
DF-0801	Info	4.1	Missing NULL check on hammer2_inode_chain in xop_inode_connect — latent dead-code NULL deref Hammer2 · sys/vfs/hammer2/hammer2_xops.c:1488	none	reproduced
DF-1904	Info	4.1	snprintf_count returns UINT_MAX when called with bufSize==0 risking wild-pointer writes (latent: no caller in tree) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer_debug.c:48	none	reproduced
DF-1995	Low	4.0	ar5210Attach error path leaks HAL_EEPROM_v1 sub-allocation (missing ath_hal_eepromDetach) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5210/ar5210_attach.c:288	none	reproduced
DF-1632	Info	4.0	Boot-time kernel pointer leak via dev_info %p of fence cpu_addr Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_fence.c:861	none	reproduced
DF-2545	Info	4.0	devaddq() error path frees wrong variable leaking 1024 bytes of M_BUS on allocation pressure Base system — kernel core (kern) · sys/kern/subr_bus.c:585	—	reproduced
DF-2014	Low	3.9	radeon_gart_unbind GPU-page index t desyncs from CPU-page index p when a page slot is NULL, leaving stale DMA mappings in the GART table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_gart.c:254	none	reproduced
DF-0250	Info	3.9	Dead page-alignment computation: iolen computed but never applied Base system — kernel core (kern) · sys/kern/kern_physio.c:88	none	reproduced
DF-0345	Info	3.9	IP header checksum left stale after kernel records RR/TS options on locally-delivered packets Base system — network stack · sys/netinet/ip_input.c:1702	none	reproduced
DF-0413	Info	3.9	Primitive parse functions write to output buffer without checking *buflen: missing defense-in-depth bounds check Kernel memory corruption (UAF / OOB write) · sys/netgraph7/netgraph/ng_parse.c:332	none	reproduced
DF-0467	Info	3.9	Dead code in ip6_savecontrol: RTHDRDSTOPTS walk result discarded, RFC3542 semantics not implemented Base system — network stack · sys/netinet6/ip6_input.c:1173	none	reproduced
DF-0488	Info	3.9	Hash secret only 32-bit + sc_flags 8-bit near exhaustion: hardening gaps Base system — network stack · sys/netinet/tcp_syncache.c:118	none	reproduced
DF-2242	Info	3.9	Right-shift operator truncates operand to 32 bits (LP64 porting bug) Base system — libkern / libprop / ddb · sys/ddb/db_expr.c:216	—	reproduced
DF-0737	Low	3.7	Non-constant-time SMB1 signature verification via bcmp — timing side channel for byte-by-byte signature forgery Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_crypt.c:304	leak	reproduced
DF-1830	Low	3.7	isc_soc: so_recv douio block stores stale stack pointer and OOB SCSI buffer offset in pq->iov Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:446	none	reproduced
DF-0319	Info	3.7	Lockless torn reads of multi-word struct wg_endpoint in fast paths Base system — network stack · sys/net/wg/if_wg.c:746	none	reproduced
DF-0448	Info	3.7	Safety-critical checks rely on KASSERT/KKASSERT which are no-ops on production kernels without INVARIANTS Base system — network stack · sys/net/if_ethersubr.c:993	none	reproduced
DF-0656	Info	3.7	CCMP MIC verified with non-constant-time memcmp Base system — network stack · sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:642	none	reproduced
DF-2406	Info	3.7	No RDRAND online health tests (NIST SP 800-90B repetition / adaptive-proportion) Base system — drivers · sys/dev/crypto/rdrand/rdrand.c:159	—	reproduced
DF-0330	Low	3.6	Global mutable pointer used as qsort comparator state: latent cross-bundle race Base system — network stack · sys/netgraph7/ppp/ng_ppp.c:471	none	reproduced
DF-0885	Low	3.6	TOCTOU on np->n_fid/n_opencount in smbfs_getpages/smbfs_putpages fid confusion Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_io.c:455	none	reproduced
DF-0890	Low	3.6	hpfsnode h_gid initialized from hpm_uid (copy/paste typo) wrong group on all files Base system — filesystems · sys/vfs/hpfs/hpfs_vfsops.c:510	none	reproduced
DF-0969	Low	3.6	rijndael_padDecrypt MODE_ECB accepts invalid padLen==0 and rejects valid padLen==16 (asymmetric with CBC path, padding-oracle-prone) Base system — crypto · sys/crypto/rijndael/rijndael-api-fst.c:390	none	reproduced
DF-1351	Low	3.6	nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1 Kernel memory leaks / uninitialized disclosure · sys/dev/netif/nfe/if_nfe.c:1072	none	reproduced
DF-1373	Low	3.6	oce_check_ipv6_ext_hdr parses IPv6 ext header without m_pullup (OOB read on short TX mbuf) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_if.c:2167	none	reproduced
DF-1811	Low	3.6	cardbus_cis: UB in decode_tuple_bar 1<<(ffs(0)-1) when masked BAR probe value is zero Base system — drivers · sys/dev/pccard/cardbus/cardbus_cis.c:360	none	reproduced
DF-2018	Low	3.6	drm_is_current_master returns stale is_master flag instead of comparing master pointers, defeating DRM_MASTER privilege revocation Base system — drivers · sys/dev/drm/drm_auth.c:333	none	reproduced
DF-2364	Low	3.6	Silent 64-bit->32-bit length truncation when invoking chacha_encrypt_bytes Base system — crypto · sys/crypto/chachapoly.c:127	none	reproduced
DF-2387	Low	3.6	Unchecked SINF package index yields heap out-of-bounds read for short/malformed firmware packages Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:280	leak	reproduced
DF-0188	Info	3.6	No defense-in-depth privilege check; acl_cnt not bounds-validated pre-VOP Privilege escalation (general use) · sys/kern/kern_acl.c:74	none	reproduced
DF-1523	Info	3.6	ar5212GetNfAdjust sentinel-terminator bug: OOB read when channel == 0 Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5212_misc.c:769	none	reproduced
DF-0268	Low	3.5	No decompression bomb (zip bomb) protection Base system — network stack · sys/net/zlib.c:3209	dos	reproduced
DF-2256	Low	3.5	ar9300_calibration_data_read_array silently ignores read failures leaving stack buffer uninitialized Vendored third-party (contrib) · sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3697	none	reproduced
DF-2564	Low	3.5	Decompress path signed integer underflow from missing minimum packet size check Base system — network stack · sys/netgraph7/ng_pred1.c:468	dos	reproduced
DF-1405	Low	3.4	cuse_alloc_unit[] global arrays mutated under per-server lock instead of cuse_global_mtx Base system — drivers · sys/dev/misc/cuse/cuse.c:181	none	reproduced
DF-2017	Low	3.4	drm_setmaster_ioctl: disabled dev->master exclusivity check leaks master refcount and silently steals mastership Base system — drivers · sys/dev/drm/drm_auth.c:190	none	reproduced
DF-2399	Low	3.4	as_isopen boolean refcount mismatch causes cross-process memory wipe and device_unbusy on still-open device Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:781	corruption	reproduced
DF-0343	Info	3.4	IPv6 address configured while interface is down bypasses Duplicate Address Detection entirely Base system — network stack · sys/netinet6/in6.c:1070	none	reproduced
DF-1026	Info	3.4	cam_periph_unmapbufs silently drops copyout errors -> data loss / inconsistent result Base system — bus / platform / cpu · sys/bus/cam/cam_periph.c:829	none	reproduced
DF-2560	Medium	3.3	File refcount / unp_rights leak when ssb_appendcontrol fails on SOCK_STREAM SCM_RIGHTS Base system — kernel core (kern) · sys/kern/uipc_usrreq.c:766	leak	reproduced
DF-0757	Low	3.3	Global ifnet_mtx held across user-controlled copyin/copyout in sysctl_ifdata - unprivileged local DoS Base system — network stack · sys/net/if_mib.c:88	dos	reproduced
DF-0814	Low	3.3	tmpfs_chmod swallows vop_helper_chmod error and always returns success — POSIX contract violation Privilege escalation (general use) · sys/vfs/tmpfs/tmpfs_subr.c:1174	none	reproduced
DF-0837	Low	3.3	smbfs_strategy silently drops async buffer IO returning success without doing work Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/vfs/smbfs/smbfs_vnops.c:796	none	reproduced
DF-0840	Low	3.3	hammer_ioc_get_data uses signed comparison on user-supplied size — negative size yields SIZE_MAX copyout (EFAULT on x86-64) Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_ioctl.c:1080	leak	reproduced
DF-0856	Low	3.3	dirfs_alloc_file openat error path leaks dirfs node and parent refcount Base system — filesystems · sys/vfs/dirfs/dirfs_subr.c:182	none	reproduced
DF-0882	Low	3.3	OOB read in partition-map walk n_pm unbounded by descriptor size Kernel memory leaks / uninitialized disclosure · sys/vfs/udf/udf_vfsops.c:635	none	reproduced
DF-0954	Low	3.3	do_vmmeter_pcpu leaks kernel pointer v_lock_addr and token identifier to unprivileged users via vm.cpuN.vmmeter Kernel memory leaks / uninitialized disclosure · sys/vm/vm_meter.c:428	leak	reproduced
DF-0958	Low	3.3	Double vm_object reference in cdev_pager_allocate leaks device pager objects forever Base system — virtual memory · sys/vm/device_pager.c:131	dos	reproduced
DF-0961	Low	3.3	sys_sbrk does not enforce RLIMIT_VMEM (address-space limit), unlike sys_obreak Base system — virtual memory · sys/vm/vm_unix.c:107	none	reproduced
DF-1363	Low	3.3	MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls Base system — drivers · sys/dev/raid/mps/mps_user.c:765	none	reproduced
DF-1969	Low	3.3	GEM object reference leaked on radeonfb_create error path Base system — drivers · sys/dev/drm/radeon/radeon_fb.c:322	none	reproduced
DF-2020	Low	3.3	DRM magic auth tokens leaked to unprivileged users via sysctl hw.dri.N.clients (cross-file drm_sysctl.c) Privilege escalation (general use) · sys/dev/drm/drm_auth.c:58	none	reproduced
DF-2064	Low	3.3	32-bit integer overflow/underflow bypasses firmware truncation size check Base system — drivers · sys/dev/drm/i915/intel_uc_fw.c:83	none	reproduced
DF-2284	Low	3.3	sgwrite/sgread leak sg_rdwr + ccb + buf when read() is never matched; sgoninvalidate/sgcleanup never drain rdwr_done (memory exhaustion + invalidation UAF surface) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sg.c:169	leak	reproduced
DF-2334	Low	3.3	UAC2.0 Mixer Unit verifier reads d1->bNrChannels one byte past the validated length Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/audio/uaudio.c:3976	none	reproduced
DF-2391	Low	3.3	Uninitialized kernel stack leaked to unprivileged users via sysctl when ACPI get-method fails Privilege escalation (general use) · sys/dev/acpica/acpi_sony/acpi_sony.c:183	leak	reproduced
DF-2598	Low	3.3	NGM_SOURCE_GET_COUNTER reads msg->data without arglen validation heap OOB read Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_source.c:479	none	reproduced
DF-2600	Low	3.3	SETIFACE passes non-NUL-terminated msg->data to ifunit bounded heap OOB read Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_source.c:407	none	reproduced
DF-0169	Info	3.3	sysref_get has no refcount overflow guard Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sysref.c:66	none	reproduced
DF-0463	Info	3.3	Lockless write to seq->inproc in M_PREPEND failure path: data race Base system — network stack · sys/netgraph7/l2tp/ng_l2tp.c:957	none	reproduced
DF-0517	Info	3.3	IPV6_FW_GET leaks one unused mbuf per call + walks chain without lock Kernel memory corruption (UAF / OOB write) · sys/net/ip6fw/ip6_fw.c:1101	none	reproduced
DF-1077	Info	3.3	Panic backtrace writes raw kernel addresses to world-readable msgbuf Privilege escalation (general use) · sys/platform/pc64/x86_64/db_trace.c:211	none	reproduced
DF-1841	Info	3.3	Sense-data over-copy in amr_cam_complete leaks stale cross-command SCSI sense bytes Kernel memory leaks / uninitialized disclosure · sys/dev/raid/amr/amr_cam.c:451	none	reproduced
DF-2226	Info	3.3	Internalizer accepts empty <key></key> violating keysym non-empty invariant guarded by _PROP_ASSERT Privilege escalation (general use) · sys/libprop/prop_dictionary.c:1334	—	reproduced
DF-2306	Info	3.3	Unconditional PCI vendor/device ID disclosure to console in probe routine Kernel memory leaks / uninitialized disclosure · sys/bus/firewire/fwohci_pci.c:190	leak	reproduced
DF-0348	Info	3.1	Missing m_pullup for management frames: no guarantee frame header contiguous Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hostap.c:594	none	reproduced
DF-0364	Info	3.1	ieee80211_fix_rate and findrix iterate rs_rates without validating rs_nrates <= IEEE80211_RATE_MAXSIZE: missing defense-in-depth Base system — network stack · sys/netproto/802_11/wlan/ieee80211_proto.c:623	none	reproduced
DF-0971	Low	3.0	rc4_init reads key[0] before bounds check when keylen==0 (OOB read / NULL deref) Kernel memory leaks / uninitialized disclosure · sys/crypto/rc4/rc4.c:72	leak	reproduced
DF-1380	Low	3.0	Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel heap Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/atombios_encoders.c:2156	none	reproduced
DF-1412	Low	3.0	bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset Base system — drivers · sys/dev/drm/i915/intel_panel.c:1674	none	reproduced
DF-1833	Low	3.0	amdpm_bread returns unbounded slave-supplied block count, enabling OOB read and kernel-stack info leak Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/amdpm/amdpm.c:613	none	reproduced
DF-2330	Low	3.0	amdsmb_bread uses unbounded hardware byte-count for register indexing and out-param Kernel memory leaks / uninitialized disclosure · sys/bus/smbus/amdsmb/amdsmb.c:533	none	reproduced
DF-2372	Low	3.0	Undefined-behavior bit shift zeroes all 32-bit PCI config reads via ACPI Privilege escalation (general use) · sys/dev/acpica/Osd/OsdHardware.c:96	corruption	reproduced
DF-0049	Info	3.0	IPI ring/serial indices are signed int, incremented without wraparound handling (overflow after ~2^31 messages) Base system — kernel core (kern) · sys/kern/lwkt_ipiq.c:218	none	reproduced
DF-0123	Info	3.0	kernenv_next unbounded walk of bootloader static env Kernel memory leaks / uninitialized disclosure · sys/kern/kern_environment.c:510	none	reproduced
DF-0154	Info	3.0	KKASSERT-only invariants vanish on production kernels (UAF/queue-corruption risk) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_systimer.c:148	none	reproduced
DF-0299	Info	3.0	ng_bypass rewrites peer back-pointers without topology lock Base system — network stack · sys/netgraph7/netgraph/ng_base.c:1207	none	reproduced
DF-0342	Info	3.0	in6_update_ifa inconsistent error handling on multicast group joins Base system — network stack · sys/netinet6/in6.c:1144	none	reproduced
DF-0378	Info	3.0	SET_TICKS computes len8dn_hz in int: overflow for jumbo packets at high dn_hz -> shaper bypass Base system — network stack · sys/net/dummynet/ip_dummynet.c:431	none	reproduced
DF-0826	Info	3.0	deflate() emits zlib header and resets adler unconditionally — stream corruption for any non-single-shot caller Hammer2 · sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391	none	reproduced
DF-0943	Info	3.0	vm_page_alloc_contig silently ignores alignment, boundary, and low address constraints Base system — virtual memory · sys/vm/vm_page.c:2764	none	reproduced
DF-1147	Info	3.0	EEPROM read timeout detection broken by loop/check bound mismatch Base system — drivers · sys/dev/netif/bnx/if_bnx.c:438	none	reproduced
DF-1202	Info	3.0	scmmap under-bounds offset when framebuffer height*stride is 0 or overflows int Base system — drivers · sys/dev/misc/syscons/syscons.c:4089	none	reproduced
DF-1952	Info	3.0	Unbounded loop over displays[] in phm_store_dal_configuration_data (latent OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:294	none	reproduced
DF-2345	Low	2.9	INQUIRY EVPD response fabrication writes to CCB data buffer without validating dxfer_len Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/storage/umass.c:2326	none	reproduced
DF-0197	Info	2.9	sysctl_devstat copies full struct devstat including unset fields and padding Kernel memory leaks / uninitialized disclosure · sys/kern/subr_devstat.c:289	none	reproduced
DF-0335	Info	2.9	in_pcbportrange can invert hi<lo causing u_short underflow and out-of-range port binds Kernel memory corruption (UAF / OOB write) · sys/netinet/in_pcb.c:2533	none	reproduced
DF-0561	Info	2.9	hci_event ignores hci_event_hdr_t.length: per-spec bound for all variable-length events dropped (root cause) Base system — network stack · sys/netbt/hci_event.c:163	none	reproduced
DF-2365	Info	2.9	Decrypted but unauthenticated plaintext written back to mbuf before tag check Base system — crypto · sys/crypto/chachapoly.c:349	—	reproduced
DF-1792	Info	2.7	puc: dangling ivars pointer in attach error path - use-after-free of puc_device Kernel memory corruption (UAF / OOB write) · sys/dev/misc/puc/puc.c:327	panic	reproduced
DF-0538	Info	2.6	Type-confused stack buffer: char *addrbuf[NG_HOOKSIZ+4] is pointer array not byte array Base system — network stack · sys/netgraph7/socket/ng_socket.c:981	none	reproduced
DF-0760	Low	2.5	Unsynchronized per-CPU IP-ID swap lets duplicate IDs be emitted within 32768-call non-reuse window Base system — network stack · sys/netinet/ip_id.c:110	none	reproduced
DF-0809	Low	2.5	dirfs_getattr returns 0 unconditionally even when dirfs_node_stat fails — stale/uninitialized attributes Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:368	none	reproduced
DF-0833	Low	2.5	Integer truncation of uint64_t inf_len to int in udf_read and udf_readdir — files >2GB truncated Base system — filesystems · sys/vfs/udf/udf_vnops.c:391	dos	reproduced
DF-0905	Low	2.5	iroot inode lock leaked on early-exit path in hammer2_update_spans Hammer2 · sys/vfs/hammer2/hammer2_iocom.c:303	dos	reproduced
DF-0906	Low	2.5	TOCTOU on iocom conn_state in hammer2_volconf_update (XXX comment flags missing interlock) Hammer2 · sys/vfs/hammer2/hammer2_iocom.c:375	panic	reproduced
DF-0953	Low	2.5	Missed wakeup in relpbuf: pbuf pool sleepers not woken on first available buffer (I/O latency DoS) Base system — virtual memory · sys/vm/vm_pager.c:645	dos	reproduced
DF-0967	Low	2.5	AES raw key material left unzeroized on kernel stack in rijndael_makeKey Kernel memory leaks / uninitialized disclosure · sys/crypto/rijndael/rijndael-api-fst.c:36	leak	reproduced
DF-1808	Low	2.5	ar5211_misc: HAL_DIAG_RFGAIN ioctl leaks kernel rodata pointer via embedded currStep pointer in GAIN_VALUES Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680	none	reproduced
DF-1980	Low	2.5	_create_workqueue_common error path leaks wq->workers array and orphans already-scheduled worker threads Base system — drivers · sys/dev/drm/linux_workqueue.c:229	none	reproduced
DF-1984	Low	2.5	Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer (amdgpu) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_fb.c:213	none	reproduced
DF-2021	Low	2.5	Signed table_id bounds check allows negative-index OOB on smu_tables.entry[] Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c:41	none	reproduced
DF-2305	Low	2.5	bus_dma_tag_create failure returns without cleanup: leaks BAR IRQ and leaves interrupt handler registered Base system — bus / platform / cpu · sys/bus/firewire/fwohci_pci.c:320	leak	reproduced
DF-2394	Low	2.5	Ignored acpi_PkgInt32 return values leak uninitialized kernel stack via sysctl read Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442	leak	reproduced
DF-2403	Low	2.5	Uninitialized kernel-stack info leak via fanid sysctl on MMIO/T2 backend Kernel memory leaks / uninitialized disclosure · sys/dev/apple/smc/smc_sysctl.c:51	leak	reproduced
DF-2422	Low	2.5	Missing cdb_len validation in DISK I/O path allows OOB read on short CDB pointer Kernel memory leaks / uninitialized disclosure · sys/dev/disk/ahci/ahci_cam.c:1089	panic	reproduced
DF-2563	Low	2.5	Compress path heap buffer overflow via incorrect worst-case expansion bound Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_pred1.c:397	none	reproduced
DF-0051	Info	2.5	msgsnd lacks explicit MSGMAX upper-bound check; msg_ts (u_short) silently truncates when MSGMNB compiled > 65535 (latent panic) Base system — kernel core (kern) · sys/kern/sysv_msg.c:50	none	reproduced
DF-0091	Info	2.5	Lock-order inversion between sysctl_rman and rman_fini creates ABBA deadlock potential (rman_fini dead code) Base system — kernel core (kern) · sys/kern/subr_rman.c:155	none	reproduced
DF-0116	Info	2.5	copyin/copyout/uiomove_nofault clear TDF_NOFAULT unconditionally instead of save/restore Base system — kernel core (kern) · sys/kern/kern_subr.c:60	none	reproduced
DF-0122	Info	2.5	kgetenv_quad signed-shift overflow on magnitude-suffixed values Base system — kernel core (kern) · sys/kern/kern_environment.c:436	none	reproduced
DF-0126	Info	2.5	TIOCCONS privilege check skipped when a_cred is NULL Privilege escalation (general use) · sys/kern/tty_cons.c:486	none	reproduced
DF-0168	Info	2.5	Lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init) Base system — kernel core (kern) · sys/kern/kern_sysref.c:142	none	reproduced
DF-0314	Info	2.5	Inconsistent privilege enforcement: RFC3542 GET path lacks priv check present in RFC2292 path Privilege escalation (general use) · sys/netinet6/ip6_output.c:1942	none	reproduced
DF-0416	Info	2.5	TCP_MAXSEG minmss floor can raise t_maxseg above current negotiated value on small-MTU paths Base system — network stack · sys/netinet/tcp_usrreq.c:1613	none	reproduced
DF-0539	Info	2.5	ieee80211_node_dectestref implements non-atomic decrement-and-test: latent UAF trap Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_dragonfly.c:497	none	reproduced
DF-0937	Info	2.5	Write-path SSTOP check diverges from LSSTOP check used by fpregs/dbregs siblings Base system — filesystems · sys/vfs/procfs/procfs_regs.c:68	none	reproduced
DF-0959	Info	2.5	KASSERT in old_dev_pager_fault checks paddr instead of dev_dmmap return value, never fires Privilege escalation (general use) · sys/vm/device_pager.c:360	none	reproduced
DF-0960	Info	2.5	old_dev_pager_ctor truncates page count to unsigned int, skipping validation for huge sizes Base system — virtual memory · sys/vm/device_pager.c:316	none	reproduced
DF-1148	Info	2.5	RX return-ring buffer index validated only by KKASSERT (compiled out without INVARIANTS) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bnx/if_bnx.c:2812	none	reproduced
DF-1901	Info	2.5	Stubbed get_local_mem_info returns uninitialized output structure: latent info-leak if KFD wired up (CONFIG_HSA_AMD not defined) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354	none	reproduced
DF-2451	Info	2.5	Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert Base system — drivers · sys/dev/disk/dm/dm_pdev.c:106	panic	reproduced
DF-2582	Info	2.5	Unbounded shift and missing masklen=0 guard in table_append_dispatch yield wrong mask (logic bug UB) Base system — network stack · sys/net/ipfw3_basic/ip_fw3_table.c:161	corruption	reproduced
DF-0972	Low	2.4	PROBE_SERIAL_NUM_1 heap OOB read via device-controlled length in VPD unit serial number response Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_xpt.c:6309	leak	reproduced
DF-2337	Low	2.4	Uninitialized kernel-stack bytes leaked to userspace via uep FIFO during short-transfer packet reassembly Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/input/uep.c:225	leak	reproduced
DF-1104	Info	2.4	One-byte out-of-bounds stack read in get_pkt_len when parsing DIAG header at end of buffer Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/input/uep.c:127	none	reproduced
DF-0756	Low	2.3	Missing m_len bound check in discoutput AF_UNSPEC (BPF write) path corrupts obytes counter Kernel memory leaks / uninitialized disclosure · sys/net/disc/if_disc.c:117	none	reproduced
DF-0816	Low	2.3	Heap over-read in volume_list bcopy of kstrdup strings — leaks kernel heap via copyout Hammer2 · sys/vfs/hammer2/hammer2_ioctl.c:1439	leak	reproduced
DF-0896	Low	2.3	Resource leak on mount error paths leaks credential fuse_node and refcount Base system — filesystems · sys/vfs/fuse/fuse_vfsops.c:185	dos	reproduced
DF-0947	Low	2.3	swap_pager_reserve leaks unused tail of last bulk allocation Base system — virtual memory · sys/vm/swap_pager.c:764	dos	reproduced
DF-0950	Low	2.3	sys_mlockall done block unconditionally unwires, making MCL_CURRENT a silent no-op and undoing prior mlock() wiring Base system — virtual memory · sys/vm/vm_mmap.c:1089	dos	reproduced
DF-0956	Low	2.3	kmem_alloc_attr leaks KVA, kernel_object ref, and wired pages on partial vm_page_alloc_contig failure Base system — virtual memory · sys/vm/vm_kern.c:437	dos	reproduced
DF-0957	Low	2.3	kmem_alloc3/kmem_alloc_attr ignore vm_map_insert return; round_page() overflow to size=0 yields bogus non-zero addr Kernel memory corruption (UAF / OOB write) · sys/vm/vm_kern.c:219	panic	reproduced
DF-1446	Low	2.3	DSI host and device allocations leaked on init error path and encoder teardown Base system — drivers · sys/dev/drm/i915/vlv_dsi.c:1655	none	reproduced
DF-1500	Low	2.3	Unbounded ksprintf into fixed 8-byte schan.hookname in musycc_newhook Kernel memory corruption (UAF / OOB write) · sys/dev/misc/musycc/musycc.c:167	none	reproduced
DF-1816	Low	2.3	ppatomfwctrl: off-by-one stride in GPIO-pin lookup causes unconditional 7-byte OOB read past table allocation Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:183	none	reproduced
DF-1990	Low	2.3	TPM locality not relinquished on four error paths in tpmcrb_transmit Base system — drivers · sys/dev/crypto/tpm/tpm_crb.c:328	none	reproduced
DF-1991	Low	2.3	Non-interruptible polling in tpm_wait_for_u32 holds dev_lock for up to 40 seconds Base system — drivers · sys/dev/crypto/tpm/tpm_crb.c:246	none	reproduced
DF-2032	Low	2.3	Kernel stack info leak via TWS_IOCTL_GET_COMPATIBILITY_INFO (uninitialized driver_version tail) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/tws/tws_user.c:267	leak:19	reproduced
DF-2404	Low	2.3	Memory leak of sc->sc_rng_co callout array on driver detach Base system — drivers · sys/dev/crypto/rdrand/rdrand.c:126	none	reproduced
DF-2416	Low	2.3	Heap OOB read+write via unbounded sense_len in autosense bcopy Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/adwcam.c:1321	none	reproduced
DF-2465	Low	2.3	Stack over-read via strcmp/kprintf on non-NUL-terminated copyinstr result in i_setopt digest handling Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_subr.c:85	none	reproduced
DF-2546	Low	2.3	Missing arglen validation in NGM_SOURCE_GET_COUNTER allows uninitialized heap read Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_source.c:481	none	reproduced
DF-2574	Low	2.3	Memory leak of struct ngd_connection in ng_device_disconnect (unbounded kernel heap exhaustion) Base system — network stack · sys/netgraph/ng_device.c:411	dos	reproduced
DF-0255	Info	2.3	Non-atomic RMW on global synth_synced counter (race) Base system — kernel core (kern) · sys/kern/vfs_synth.c:49	none	reproduced
DF-0318	Info	2.3	Inconsistent atomic vs non-atomic access to wg_packet::p_state Base system — network stack · sys/net/wg/if_wg.c:508	none	reproduced
DF-0369	Info	2.3	lagg_port_ioctl fallback forwards ioctl to driver but always returns EINVAL discarding result Base system — network stack · sys/net/lagg/if_lagg.c:896	none	reproduced
DF-0447	Info	2.3	AF_ARP output case is dead code carrying latent uninitialized-read/OOB-read: mtod returns ether_header not arphdr after M_PREPEND Kernel memory leaks / uninitialized disclosure · sys/net/if_ethersubr.c:237	none	reproduced
DF-0461	Info	2.3	Potential signed integer overflow in kern_load burst-adaptation math Base system — network stack · sys/net/if_poll.c:1019	none	reproduced
DF-0531	Info	2.3	NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path: all packets silently dropped Base system — network stack · sys/netgraph/fec/ng_fec.c:1180	none	reproduced
DF-1219	Info	2.3	ACPIIO_DO_MCALL leaks kernel heap pointers via PACKAGE results (incomplete pointer fixup) Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi.c:3364	none	reproduced
DF-1293	Info	2.3	Unbounded rx_cons from hardware return descriptor used to index fixed-size rxdesc[256] array Base system — drivers · sys/dev/netif/age/if_age.c:1997	none	reproduced
DF-1427	Info	2.3	Broken sense-data copy in iir_intr GDT_GCF_IOCTL: duplicate data copy instead of sense copy Base system — drivers · sys/dev/raid/iir/iir.c:1621	none	reproduced
DF-2342	Low	2.1	Uninitialized kernel stack read via short/malformed CH341 control responses Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/uchcom.c:417	leak	reproduced
DF-2325	Low	2.0	Signed left-shift undefined behavior in BAR resource sizing when ln2size == 31 Base system — bus / platform / cpu · sys/bus/pci/pci.c:2644	none	reproduced
DF-2551	Medium	1.9	sys_fhopen() returns success (error=0) without valid file descriptor when regular file vnode lacks VM object Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:4933	panic	reproduced
DF-0738	Low	1.9	NTLM hashes DES key schedule MD4 state cleartext Unicode password not zeroized after use Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_crypt.c:70	leak	reproduced
DF-0966	Low	1.9	Raw key words me_key[4]/mo_key[4] left unzeroed on kernel stack after twofish_set_key returns Kernel memory leaks / uninitialized disclosure · sys/crypto/twofish/twofish.c:427	leak	reproduced
DF-1349	Low	1.9	EE_SPEED EEPROM byte used unbounded as index into eeprom_period[8] Kernel memory leaks / uninitialized disclosure · sys/dev/disk/amd/amd.c:2342	none	reproduced
DF-1421	Low	1.9	firmware_get() reference never released on attach-failure or detach (refcount leak) Base system — drivers · sys/dev/disk/isp/isp_pci.c:856	none	reproduced
DF-1817	Low	1.9	ppatomfwctrl: voltage LUT iteration bounds destination not source -> OOB read of VBIOS heap when gpio_entry_num exceeds actual LUT extent Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:110	none	reproduced
DF-1826	Low	1.9	intel_guc: intel_guc_fini leaves shared_data_vaddr dangling after freeing mapping -> UAF Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_guc.c:187	none	reproduced
DF-1835	Low	1.9	alpm_bread leaks uninitialized kernel stack via unchecked SMBus block-read length (variant of DF-1833) Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/alpm/alpm.c:606	none	reproduced
DF-1993	Low	1.9	ath_btcoex_ioctl copies uninitialized kernel heap to userspace (latent; function currently has no caller) Privilege escalation (general use) · sys/dev/netif/ath/ath/if_ath_btcoex.c:397	none	reproduced
DF-1996	Low	1.9	Off-by-one in amdgpu_gfx_kiq_acquire loop invokes test_bit / bit_to_queue with bit = -1 (undefined shift) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:211	none	reproduced
DF-2022	Low	1.9	Unbounded non-interruptible ACK-poll loop in xgpu_ai_mailbox_trans_msg wedges unkillable kernel thread Base system — drivers · sys/dev/drm/amd/amdgpu/mxgpu_ai.c:128	none	reproduced
DF-2031	Low	1.9	Resource leak in mfi_pci_attach when IRQ allocation fails (return bypasses cleanup) Privilege escalation (general use) · sys/dev/raid/mfi/mfi_pci.c:288	none	reproduced
DF-2063	Low	1.9	Unchecked adv_attach() return leaks all device resources and leaves interrupt handler active on half-initialized softc Base system — drivers · sys/dev/disk/advansys/adv_pci.c:289	none	reproduced
DF-2073	Low	1.9	ResetKeyCacheEntry MIC-clear path lacks runtime bounds check on entry+64 (HALASSERT inert in release) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar5212_keycache.c:86	panic	reproduced
DF-2373	Low	1.9	Kernel heap address leak via incomplete pointer fix-up in ACPIIO_DO_MCALL Package results Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi.c:3380	leak	reproduced
DF-2430	Low	1.9	Off-by-one NUL write past bt->model[5] in Inquire-Model parsing Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt.c:420	none	reproduced
DF-2438	Low	1.9	Signed integer overflow in delay tick computation produces negative/erratic delays for large user-supplied millisecond values Base system — drivers · sys/dev/disk/dm/delay/dm_target_delay.c:140	dos	reproduced
DF-2444	Low	1.9	dm_dev_create assigns freed dmv to *dmvp on insert-failure path Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_dev.c:264	none	reproduced
DF-2456	Low	1.9	FD_FORM formats with unbounded attacker nsecs over-reading fd_formb heap buffer via DMA/PIO Kernel memory corruption (UAF / OOB write) · sys/dev/disk/fd/fd.c:2311	none	reproduced
DF-2531	Low	1.9	Unclamped cdb_len over-reads 16-byte inline cdb_bytes and leaks kernel memory out parallel port Kernel memory leaks / uninitialized disclosure · sys/dev/disk/vpo/vpo.c:220	leak	reproduced
DF-2593	Low	1.9	Missing sopt_valsize validation causes OOB heap read in every set-mutation handler Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3/ip_fw3_set.c:105	none	reproduced
DF-2603	Low	1.9	Missing minimum-length check + u_short packetlen underflow in LMI packet parser kernel heap OOB read Kernel memory leaks / uninitialized disclosure · sys/netgraph7/lmi/ng_lmi.c:88	none	reproduced
DF-0068	Info	1.9	IBAA-only RNG mode (rand_mode==1) has no seeding-readiness gate before first output Base system — kernel core (kern) · sys/kern/kern_nrandom.c:700	none	reproduced
DF-0109	Info	1.9	l32_fixlabel partition loop lacks internal d_npartitions cap Base system — kernel core (kern) · sys/kern/subr_disklabel32.c:592	none	reproduced
DF-0160	Info	1.9	xio_init_kbuf silently truncates when kbytes exceeds XIO_INTERNAL_SIZE Kernel memory corruption (UAF / OOB write) · sys/kern/kern_xio.c:113	none	reproduced
DF-0172	Info	1.9	mpipe_free reads/writes mpipe->pending outside the lwkt_token Base system — kernel core (kern) · sys/kern/kern_mpipe.c:344	none	reproduced
DF-0175	Info	1.9	Integer overflow in NPROC macro via unbounded kern.maxusers Base system — kernel core (kern) · sys/kern/subr_param.c:56	none	reproduced
DF-0205	Info	1.9	Timeout conversion uses 32-bit int arithmetic that can overflow Base system — kernel core (kern) · sys/kern/kern_umtx.c:188	none	reproduced
DF-0206	Info	1.9	Dead code: offset computed and never used in both syscalls Base system — kernel core (kern) · sys/kern/kern_umtx.c:114	none	reproduced
DF-0213	Info	1.9	last_td tracking field uses non-atomic plain load/store racy on SMP Base system — kernel core (kern) · sys/kern/lwkt_serialize.c:112	none	reproduced
DF-0214	Info	1.9	handler_disable discards in-flight indicator from atomic_intr_handler_disable Base system — kernel core (kern) · sys/kern/lwkt_serialize.c:149	none	reproduced
DF-0218	Info	1.9	kcollect_setvalue divides by kcollect_samples without guard Base system — kernel core (kern) · sys/kern/kern_collect.c:128	none	reproduced
DF-0219	Info	1.9	kcollect_setscale/setvalue mutate shared state without kcollect_lock Base system — kernel core (kern) · sys/kern/kern_collect.c:124	none	reproduced
DF-0242	Info	1.9	TOCTOU: td_proc NULL check without holding kpsus_token Base system — kernel core (kern) · sys/kern/kern_kthread.c:190	none	reproduced
DF-0251	Info	1.9	PC_TO_INDEX u_quad_t overflow on 64-bit (correctness only, bounds check prevents OOB) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_prof.c:86	none	reproduced
DF-0377	Info	1.9	config_red error path kfrees struct that may be embedded member of dn_pipe: latent UAF/invalid-free Kernel memory corruption (UAF / OOB write) · sys/net/dummynet/ip_dummynet.c:1359	none	reproduced
DF-0440	Info	1.9	red_pkttime computed as int64 then stored into int: truncation/overflow for jumbo MTU or low m2 Kernel memory corruption (UAF / OOB write) · sys/net/altq/altq_hfsc.c:451	none	reproduced
DF-0459	Info	1.9	user_frac sysctl accepts any uint32 without range validation (documented 0-100) Base system — network stack · sys/net/if_poll.c:1116	none	reproduced
DF-0460	Info	1.9	status_frac / tx_frac sysctls have no upper bound: signed int overflow in ifpoll_compat_setup Base system — network stack · sys/net/if_poll.c:1497	none	reproduced
DF-0500	Info	1.9	Response handlers trust count/size fields without checking pcb->msg arglen: defense-in-depth gap Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917	none	reproduced
DF-0939	Info	1.9	Unbounded bcopy of sv_name into 256-byte stack buffer in procfs_dotype (latent; no in-tree sv_name >= 256B) Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_type.c:54	none	reproduced
DF-0980	Info	1.9	pmap_remove_pages skips cross-CPU TLB invalidation (cpu_invltlb only, no smp_invltlb) Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/pmap.c:5727	none	reproduced
DF-1025	Info	1.9	Kernel pointer/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU Privilege escalation (general use) · sys/bus/cam/cam_periph.c:888	none	reproduced
DF-1033	Info	1.9	REX.R prefix causes OOB read across all Group/FPU escape tables (f_reg returns 8..15 into 8-entry arrays) Kernel memory leaks / uninitialized disclosure · sys/cpu/x86_64/misc/db_disasm.c:908	none	reproduced
DF-1037	Info	1.9	Negative hw.ioapic.msi_start loader tunable causes OOB array index in MSI allocation Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/apic/ioapic_abi.c:753	none	reproduced
DF-1119	Info	1.9	Firmware header fields used as array indices without bounds checks (heap OOB read/write via corrupted ucode) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/cik.c:1873	none	reproduced
DF-1450	Info	1.9	Missing return after ASSERT_CRITICAL(false) in dc_link_set_drive_settings allows NULL deref fall-through Base system — drivers · sys/dev/drm/amd/display/dc/core/dc.c:429	none	reproduced
DF-1460	Info	1.9	init_device discards product-ID mismatch error and reads uninitialized cap on smbus failure Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/cyapa/cyapa.c:360	none	reproduced
DF-1627	Info	1.9	UB: 1<<session_idx executed before no-session guard when session_idx==-1 Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812	none	reproduced
DF-1630	Info	1.9	KKASSERT bounds checks on pl_links indexing are no-ops in production kernels Base system — drivers · sys/dev/acpica/acpi_pci_link.c:235	none	reproduced
DF-1836	Info	1.9	nsclpcsio unconditional TMS/VLM init writes to 8237A DMA controller when logical devices are disabled Base system — drivers · sys/dev/misc/nsclpcsio/nsclpcsio_isa.c:344	none	reproduced
DF-1847	Info	1.9	pin_mapped/pin_opened protected by two independent locks: mutual-exclusion race Base system — drivers · sys/dev/misc/gpio/gpio.c:196	none	reproduced
DF-1889	Info	1.9	Timeout-detection mismatch in e1000_load_firmware FW-reset wait loop Base system — drivers · sys/dev/netif/ig_hal/e1000_manage.c:508	none	reproduced
DF-1897	Info	1.9	mmhub_v1_0_get_clockgating missing return on SR-IOV VF path reads host-managed registers Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548	none	reproduced
DF-1941	Info	1.9	Detach does not drain AcpiOsExecute callbacks: stale softc use-after-free (latent, AcpiOsWaitEventsComplete is no-op stub) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_cmbat.c:154	none	reproduced
DF-2366	Info	1.9	rc4_init lacks keylen>0 validation reading key[0] 256 times for non-positive keylen Base system — crypto · sys/crypto/rc4/rc4.c:58	—	reproduced
DF-2405	Info	1.9	Harvested RDRAND output left unzeroed on the kernel stack Kernel memory leaks / uninitialized disclosure · sys/dev/crypto/rdrand/rdrand.c:163	leak	reproduced
DF-2441	Info	1.9	dmstrategy and dmdump dereference dev->si_drv1 without NULL check unlike dmsize and disk_ioctl_switch Base system — drivers · sys/dev/disk/dm/device-mapper.c:365	panic	reproduced
DF-2445	Info	1.9	strncpy of uuid without guaranteed NUL termination Kernel memory leaks / uninitialized disclosure · sys/dev/disk/dm/dm_dev.c:365	leak	reproduced
DF-2596	Info	1.9	Incorrect totlen update after packet truncation produces wrong xmitOctets statistics Base system — network stack · sys/netgraph/bpf/ng_bpf.c:415	—	reproduced
DF-0324	Info	1.7	HT cap/info IE parsers perform no own length validation (caller-trust fragile) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_ht.c:1418	none	reproduced
DF-0568	Info	1.7	ACL/SCO packet type and length validation only compiled under #ifdef DIAGNOSTIC Base system — network stack · sys/netbt/hci_link.c:431	none	reproduced
DF-2344	Info	1.5	Unchecked register read uses uninitialized stack for port-count decision in attach Base system — bus / platform / cpu · sys/bus/u4b/serial/umcs.c:301	none	reproduced
DF-0313	Info	1.3	Sticky Hop-by-Hop/Destination options un-settable: hardcoded priv=0 always returns EPERM for root Base system — network stack · sys/netinet6/ip6_output.c:2019	none	reproduced
DF-0215	Info	1.1	Wait-counter inc/dec can overflow into control bits (theoretical) Kernel memory corruption (UAF / OOB write) · sys/kern/lwkt_serialize.c:271	none	reproduced
DF-0230	Info	1.1	table_blocks computed before entries/entsz validation (fragile ordering) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskgpt.c:131	none	reproduced
DF-0231	Info	1.1	Buffer-size safety depends solely on KKASSERT debug assertions Base system — kernel core (kern) · sys/kern/subr_diskgpt.c:93	none	reproduced
DF-0252	Info	1.1	Theoretical cross-field torn-read between sys_profil multi-field update and addupc Base system — kernel core (kern) · sys/kern/subr_prof.c:68	none	reproduced
DF-0675	Info	1.1	BPF LSH/RSH shift amount unbounded: shift-by->=32 is undefined behavior Base system — network stack · sys/net/bpf_filter.c:443	none	reproduced
DF-1022	Info	1.1	Integer truncation in fw_xfer_alloc_buf (int -> u_int16_t pay_len) -> length/buffer mismatch for len > 0xFFFF (latent) Base system — bus / platform / cpu · sys/bus/firewire/firewire.c:949	none	reproduced
DF-1208	Info	1.1	intel_runtime_pm_get_if_in_use() returns true without taking wakeref on DragonFly, causing unbalanced put() underflow Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_runtime_pm.c:4039	none	reproduced
DF-1263	Info	1.1	dsp_oss_syncgroup frees inserted smrd without removing from sg->members on unreachable M_WAITOK error branch Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/dsp.c:2913	none	reproduced
DF-1747	Info	1.1	ttm_bo_util: ttm_bo_move_memcpy error path pairs wrong mem with new_iomap in cleanup Base system — drivers · sys/dev/drm/ttm/ttm_bo_util.c:243	panic	reproduced
DF-1930	Info	1.1	chn_removefeeder leaves stale parent pointer on new chain head (latent UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder.c:253	none	reproduced
DF-2240	Info	1.1	prop_array_add_uint{8 16 32 64} stores unsigned values via signed creator breaking roundtrip semantics Base system — libkern / libprop / ddb · sys/libprop/prop_array_util.c:187	—	reproduced
DF-0908	Low	0.8	size_t underflow in trailing-slash strip causes OOB access on empty mount path Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vfsops.c:137	none	reproduced
DF-0073	Info	0.8	Pointless cfi++ causes 1-element OOB read in DEBUG builds (elf_getfiles) Kernel memory leaks / uninitialized disclosure · sys/kern/kern_checkpoint.c:667	none	reproduced
DF-0332	Info	0.8	Statistics counters read without lock: torn 64-bit reads Base system — network stack · sys/netgraph7/ppp/ng_ppp.c:647	none	reproduced
DF-0427	Info	0.8	ip6_mrouter_set performs no explicit capability check: relies entirely on raw-socket attach privilege Privilege escalation (general use) · sys/netinet6/ip6_mroute.c:265	none	reproduced
DF-0553	Info	0.8	SIOCSETVLAN accepts reserved VLAN IDs (0 and 0xFFF) without validation Base system — network stack · sys/net/vlan/if_vlan.c:996	none	reproduced
DF-0721	Info	0.8	Build break: IFP2SP and SP2IFP macros referenced 12 times but never defined anywhere in sys/ Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_sppp.c:254	none	reproduced
DF-1379	Info	0.8	btexecuteccb SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt.c:836	none	reproduced
DF-1896	Info	0.8	intel_csr_ucode_fini kfree dmc_payload without NULLing pointer: dangling pointer (latent UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_csr.c:557	none	reproduced
DF-2273	Info	0.8	Unbounded strlen() on user-supplied cv_volid in chsetvoltag can read past the 33-byte field Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:1300	none	reproduced
DF-0982	Info	0.6	uaudio20_mixer_verify_desc FEATURE case under-validates bLength, allowing 1-3 byte OOB read in uaudio20_mixer_add_feature (defense-in-depth) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/audio/uaudio.c:4000	none	reproduced
DF-2371	Low	0.5	twofish_set_key performs no key-length validation enabling stack/struct OOB writes and mk_tab corruption on out-of-range key_len_bits Kernel memory corruption (UAF / OOB write) · sys/crypto/twofish/twofish.c:425	none	reproduced
DF-0104	Info	0.5	Boot-time ktr_buf/ktr_entries_mask publication relies on TSO (no explicit read-side barrier, x86-only safe) Base system — kernel core (kern) · sys/kern/kern_ktr.c:231	none	reproduced
DF-0127	Info	0.5	cndbctl uses unlocked static refcount Base system — kernel core (kern) · sys/kern/tty_cons.c:570	none	reproduced
DF-0131	Info	0.5	fp_mmap size arithmetic can wrap past SSIZE_MAX after signedness check Base system — kernel core (kern) · sys/kern/kern_fp.c:409	none	reproduced
DF-0153	Info	0.5	EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit; no bounds guard Kernel memory corruption (UAF / OOB write) · sys/kern/kern_spinlock.c:206	none	reproduced
DF-0184	Info	0.5	Lockless read of exec_res_id counter mutated under list lock Base system — kernel core (kern) · sys/kern/imgact_resident.c:138	none	reproduced
DF-0192	Info	0.5	Concurrent writer/reader cursor updates on msg_bufl unsynchronized Base system — kernel core (kern) · sys/kern/subr_log.c:153	none	reproduced
DF-0194	Info	0.5	vfs_mount caches mnt_cred with unlocked check-then-set Base system — kernel core (kern) · sys/kern/vfs_vfsops.c:89	none	reproduced
DF-0225	Info	0.5	Implicit undocumented locking contract on lwp_rtprio writes Base system — kernel core (kern) · sys/kern/kern_sched.c:175	none	reproduced
DF-0339	Info	0.5	tcp_new_isn last_offset signed int overflow-wrap on churn (UB / monotonicity erosion) Base system — network stack · sys/netinet/tcp_subr.c:1670	none	reproduced
DF-0398	Info	0.5	rt_setshims leaks previously allocated shims on partial allocation failure Base system — network stack · sys/net/route.c:1374	none	reproduced
DF-0466	Info	0.5	Potentially unaligned 64-bit write constructing transport AEAD nonce Base system — network stack · sys/net/wg/wg_noise.c:996	none	reproduced
DF-0550	Info	0.5	Ring-size computation uses 32-bit multiply without overflow check: latent heap overflow Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_mem2.c:927	none	reproduced
DF-0579	Info	0.5	Unbounded mbuf-to-stack copy in slstart BPF path: latent stack overflow Kernel memory corruption (UAF / OOB write) · sys/net/sl/if_sl.c:536	none	reproduced
DF-0647	Info	0.5	Module is dead code: cannot link because all engine symbols are defined only in non-compilable netflow.c Base system — network stack · sys/netgraph7/netflow/ng_netflow.c:188	none	reproduced
DF-0667	Info	0.5	ieee80211_compute_duration reads rt->info[rix] without bounding rix against IEEE80211_RATE_TABLE_SIZE (latent OOB read) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_phy.c:506	none	reproduced
DF-0711	Info	0.5	Build break: ADD_FILTER references undefined EVL_VLID_MASK macro — dead code not in any build Base system — network stack · sys/netgraph7/ng_vlan.c:218	none	reproduced
DF-0976	Info	0.5	pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/pmap.c:5074	none	reproduced
DF-1089	Info	0.5	ioapic_intsrc() indexes ioc_intsrc[] with only a debug-compiled-out bounds guard Base system — bus / platform / cpu · sys/platform/pc64/apic/ioapic.c:274	none	reproduced
DF-1102	Info	0.5	msi_setup/msi_map perform no bounds validation on intr/cpuid before indexing fixed-size arrays and programming the IDT Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/msi.c:430	none	reproduced
DF-1117	Info	0.5	re_rar_set reads 2 bytes past 6-byte MAC buffer via u_int32_t cast (benign OOB stack read) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/re/re.c:3903	none	reproduced
DF-1445	Info	0.5	ttm_mem_type_from_place omits upper-bound check vs TTM_NUM_MEM_TYPES before indexing bdev->man[8] Kernel memory leaks / uninitialized disclosure · sys/dev/drm/ttm/ttm_bo.c:62	none	reproduced
DF-1558	Info	0.5	HPD enable/disable are silent no-ops: register modification never written back Base system — drivers · sys/dev/drm/amd/display/dc/dce/dce_link_encoder.c:1366	none	reproduced
DF-1913	Info	0.5	hwmgr_hw_init preflight check dereferences hwmgr_func before its NULL guard (latent) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214	none	reproduced
DF-2244	Info	0.5	karc4random_buf charges only one run regardless of buffer length defeating keystream-limit reseed invariant Base system — libkern / libprop / ddb · sys/libkern/arc4random.c:152	none	reproduced
DF-2440	Info	0.5	_table() passes DM_MAX_PARAMS_SIZE instead of remaining buffer space to ksnprintf (latent OOB-write enabler) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/delay/dm_target_delay.c:183	—	reproduced
DF-2604	Info	0.5	Dead empty-body bounds check on DLCI in nglmi_rcvdata case 6 protected only by nglmi_checkdata Kernel memory leaks / uninitialized disclosure · sys/netgraph7/lmi/ng_lmi.c:689	—	reproduced
DF-1461	High	—	Premature kfree of persistent per-slot swdesc in txp_rxbuf_reclaim error path causes UAF and double-free Kernel memory corruption (UAF / OOB write) · sys/dev/netif/txp/if_txp.c:793	panic	reproduced
DF-2398	Low	—	Integer overflow in aperture bounds check in agp_generic_bind_memory Base system — drivers · sys/dev/agp/agp.c:520	corruption	reproduced

Tested — not reproduced 2344

These findings were tested with a proof-of-concept but the claimed impact did not manifest. Each finding’s verdict explains whether it is a false positive, already fixed on this kernel, unreachable, or the test was inconclusive.

ID	Sev	CVSS	Title	Impact	PoC
DF-5833	High	7.8	generic_elf_coredump note-size precompute race: LWP insertions between the DRYRUN and WRITE passes overflow the header reservation, the swallowed elf_putallnotes error leaves target->off past off_max, elf_puttextvp computes vnh_max from a size_t-underflowed (off_max - off), and cb_put_fp writes attacker-sized vn_hdr records past the kmalloc'd core-header buffer Kernel memory corruption (UAF / OOB write) · sys/kern/imgact_elf.c:1012	none	inconclusive
DF-5837	Low	6.3	cluster_wbuild installs the pbuf KVA window before validating it, with the first component exempt from the page guard and the window outside the bkvareset() protocol Base system — kernel core (kern) · sys/kern/vfs_cluster.c:1606	none	untested
DF-5791	Low	5.2	Async-attach thread races driver deregistration/device deletion: device_t has no refcount and device_detach() short-circuits DS_INPROGRESS to success, allowing device_set_driver() to free the softc/kobj while device_attach_thread() is inside DEVICE_ATTACH() Kernel memory corruption (UAF / OOB write) · sys/kern/subr_bus.c:2005	latent UAF write into freed softc/device	untested
DF-5798	Low	4.7	unmount_allproc_cb() mutates p->p_textnch without p->p_token, racing exec's drop/copy — namecache reference underflow to UAF potential Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_syscalls.c:777	none	not_reproduced
DF-5838	Low	4.7	cluster_collectbufs collects buffers matched against last_bp->b_bcount instead of blksize, breaking the documented size contract feeding VOP_REALLOCBLKS Base system — kernel core (kern) · sys/kern/vfs_cluster.c:1737	none	untested
DF-5841	Info	4.7	mapped_ioctl: IOC_VOID\|IOC_OUT commands copy out size bytes from the 128-byte on-stack ubuf.stkbuf — up to ~8KB kernel-stack overread primitive, gated only on fo_ioctl returning 0 Kernel memory leaks / uninitialized disclosure · sys/kern/sys_generic.c:674	none	not_reproduced
DF-5828	Info	4.3	Received-message CRCs (hdr_crc, aux_crc) are never validated Base system — kernel core (kern) · sys/kern/kern_dmsg.c:339	undetected message tampering by on-path attacker	untested
DF-5788	Low	3.6	kern_getcwd() reads fd_ncdir completely unlocked and walks the mount topology holding no mount reference — latent use-after-free racing chdir() and umount -f Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_cache.c:5076	none	not_reproduced
DF-5820	Low	3.6	hammer2_vop_nrename masks backend ENOENT as success and commits rename bookkeeping (tip nlink--/DELETING, iparent/name_key rewrite, cache_rename) against an unrenamed media topology Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:2165	none	not_reproduced
DF-5827	Low	3.1	freerd_state allocation prologue runs unlocked and is reachable from two threads concurrently — orphaned kdmsg_state leak Base system — kernel core (kern) · sys/kern/kern_dmsg.c:788	slow kernel-memory leak per lost race	untested
DF-5826	Info	3.1	Reader never validates DMSGF_SIZE against the base command — undersized extended headers reach command dispatch (latent type confusion) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_dmsg.c:348	latent type confusion	untested
DF-5832	Medium	2.5	NCF_WXOK cached-traversal flag resurrection race: chmod revocation of directory search permission can be undone by a concurrent in-flight naccess() and the stale grant is then honored indefinitely Base system — kernel core (kern) · sys/kern/vfs_nlookup.c:1616	none	not_reproduced
DF-5810	Low	2.5	vtruncbuf() caches the separately-allocated nc_name pointer across unlocked blocking work, then prints it (narrow UAF read) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_subr.c:531	none	untested
DF-5814	Low	2.5	vm_pageout_page(): object->flags use-after-free READ on the failed-vget error path — page hold parks the page on PQ_HOLD but pins neither the vm_object nor (on vget failure) the vnode Kernel memory corruption (UAF / OOB write) · sys/vm/vm_pageout.c:1254	none	untested
DF-5819	Low	2.5	hammer2_vop_nsymlink unconditionally discards the symlink-data write error ('/* XXX handle error */ error = 0;') Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:1847	none	not_reproduced
DF-5823	Low	2.5	KERN_PROC_PGRP/KERN_PROC_TTY sysctl filters dereference the p_pgrp->pg_session->s_ttyp->t_dev chain with no p_token/pgref — TOCTOU use-after-free read against pgrp teardown (dead p_session NULL guard) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_proc.c:1736	none	not_reproduced
DF-5786	Info	2.5	Kernel heap/buffer pointer disclosure to unprivileged dmesg readers via unconditional %p kprintf in hammer2 reptrack debug and check-failure paths Hammer2 · sys/vfs/hammer2/hammer2_chain.c:2266	kernel address disclosure to non-root dmesg readers	untested
DF-5813	Info	2.5	Four more raw vm_page_t-pointer kprintfs on attacker-triggerable pagedaemon race-recovery paths (rebusy A/B/C and the scan_cache find/busy warning) disclose kernel heap addresses into the world-readable msgbuf Base system — virtual memory · sys/vm/vm_pageout.c:1340	none	not_reproduced
DF-5821	Info	2.5	hammer2_vop_reclaim kprintf discloses vp/ip kernel pointers to the console/msgbuf Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:183	none	not_reproduced
DF-5840	Info	2.3	lwkt_rele() never wakes the td_refs drain pollers (tdreap/lwpwait2) — teardown latency and needless scheduler churn only Base system — kernel core (kern) · sys/kern/lwkt_thread.c:502	none	untested
DF-5800	Info	1.1	vm_map_delete() no-predecessor branch sets freehint hole_start=vm_map_max, silently disabling the freehint update for bottom-of-map holes (correctness defect, no reachable security impact) Base system — virtual memory · sys/vm/vm_map.c:3257	none	not_reproduced
DF-5805	Info	1.1	kern_sigtimedwait() violates the lwp_delsig()/lwp_sigmask locking contract (unlocked mask writes; lwp_delsig fromproc=1 without p->p_token) Base system — kernel core (kern) · sys/kern/kern_sig.c:1764	signal-delivery semantics races (POSIX correctness)	untested
DF-5804	Low	0.8	gsignal() leaks the pgfind() reference — permanent pgrp/session leak if ever called Base system — kernel core (kern) · sys/kern/kern_sig.c:898	latent pgrp leak (no in-tree callers)	untested
DF-4036	High	8.8	Unclamped VBIOS SCLK/MCLK DPM counts overflow polaris10 SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table entries[8][4] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1000 · pass 2 · new	none	inconclusive fixed
DF-4569	High	8.8	drm_ioctl() dispatches on cmd&0xff only — never validates the user ioctl command (size/dir/group) against the canonical table entry; port dropped upstream's cmd=ioctl->cmd + canonical-size guard: kernel stack OOB write via DRM_IOCTL_GET_STATS and kernel-stack disclosure oracle via any 0-returning unauthenticated ioctl Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_ioctl.c:801 · pass 2 · new	panic	inconclusive
DF-4587	High	8.8	ttm_bo_release_mmap drops an unowned OBJT_MGTDEVICE object reference on every BO revocation — premature vm_object termination under live mappings plus early ttm_bo_unref (kernel UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/ttm/ttm_bo_vm.c:821 · pass 2 · new	none	inconclusive
DF-5320	High	8.8	ucom unplug lifecycle UAF: driver softc kfree'd while the never-freed tty keeps dangling t_sc/t_oproc/t_param/t_stop and in-flight cdev dispatch follows si_drv1 into freed memory (multi-port adapters leave orphaned openable device nodes) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/serial/usb_serial.c:543 · pass 2 · new	none	not_reproduced
DF-3597	High	8.7	gfx_v8_0_parse_ind_reg_list: trailing-entry heap OOB read/write past the RLC register-list copy plus post-write BUG_ON panic Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:4001 · pass 2 · new	none	inconclusive
DF-3761	Medium	8.6	alc_rxintr() Rx walk has no work bound — the process_limit knob exists but is never read: a remote line-rate flood keeps the return ring perpetually non-empty so the interrupt handler loops forever holding the serializer (NIC + CPU livelock); FreeBSD bounds this loop, DFly msk(4) bounds its own Base system — drivers · sys/dev/netif/alc/if_alc.c:3236 · pass 2 · new	none	inconclusive
DF-3904	Medium	8.6	sk_rxeof() Rx walk has no work bound — for(;;) loop's only exit is the OWN bit, so a line-rate remote flood keeps the walk running forever under the card-global serializer (DF-3761 family) Base system — drivers · sys/dev/netif/sk/if_sk.c:1820 · pass 2 · new	none	inconclusive
DF-3907	Medium	8.6	xl_rxeof() interrupt-mode Rx walk has no work bound — the count>=0 budget exists but every interrupt-path caller passes -1, and non-905B chips goto-again restart the walk on uplist stall (DF-3761 family) Base system — drivers · sys/dev/netif/xl/if_xl.c:1960 · pass 2 · new	none	inconclusive
DF-3748	High	8.3	STA-mode AID→WCID truncation: rt2860_newassoc writes node pointer past wcid2ni[254] into txq[0] (remote OOB write via rogue AP) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ral/rt2860.c:885 · pass 2 · new	none	not_reproduced
DF-4654	Medium	8.2	twa: unchecked CAM cdb_len overflows the 16-byte firmware CDB field (heap/DMA-pool overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twa/tw_osl_cam.c:276 · pass 2 · new	none	not_reproduced
DF-3264	High	8.1	pf_state use-after-free: pf_send_tcp() drops pf_token mid-state-operation, letting the purge thread free the in-flight state Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf.c:2254 · pass 2 · new	none	not_reproduced
DF-5737	Medium	8.0	Event-context link teardown races the syscall transmit path with no shared locking -> use-after-free write in hci_acl_send (forged RESET completion / CREATE_CON status / discon_compl frees links a send(2) is still touching) Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_event.c:271 · pass 2 · new	none	untested
DF-3672	Medium	7.9	MPT_TAG_2_REQ production macro indexes tgt_cmd_ptrs[tag_id>>18] with no bounds check — user-controlled XPT_CONT_TARGET_IO tag_id gives heap OOB read + wild request_t* dereference Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_cam.c:4355 · pass 2 · new	none	inconclusive
DF-3619	High	7.8	Heap OOB write in ci_get_svi2_voltage_table: VBIOS dependency-table count (u8, up to 255) copied into fixed entries[32] before any trim Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/ci_dpm.c:2264 · pass 2 · new	none	inconclusive
DF-3683	High	7.8	Heap OOB write in phm_get_svi2_voltage_table_v0: VBIOS V0 dependency count (u8, up to 255) copied into fixed entries[32] before any trim Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:219 · pass 2 · new	none	inconclusive
DF-3684	High	7.8	Kernel stack overflow: smu7_get_sclks/smu7_get_mclks copy up to 255 VBIOS entries into amd_pp_clocks.clock[16]/latency[16] held in the caller's stack frame Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4613 · pass 2 · new	none	inconclusive
DF-3701	High	7.8	vega10 clock getters overflow the caller's 16-entry stack array: unbounded VBIOS dep-table counts (DF-3684 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4115 · pass 2 · new	none	inconclusive
DF-3703	High	7.8	vega10 ODN tables are fixed entries[8] but filled/iterated with unbounded VBIOS dep-table counts — heap overflow of struct vega10_hwmgr Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:310 · pass 2 · new	none	inconclusive
DF-3705	High	7.8	vega10 SMC PPTable populate loops write 8-entry SMC arrays (CksEnable/CksVidOffset, StaticVoltageOffsetVid, UvdDpmVoltageIndex, SocVid) with unbounded dep-table counts Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1700 · pass 2 · new	none	inconclusive
DF-3787	High	7.8	METEORSSIGNAL stores td->td_proc without a reference and video_close() never clears it → frame-completion interrupt ksignal()s a freed struct proc (UAF from interrupt context) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1485 · pass 2 · new	none	inconclusive
DF-3790	High	7.8	bktr_filter_detach() calls knote_insert() instead of knote_remove() → destroyed knote left on (or self-looped into) the VBI klist → KNOTE() from the frame interrupt dereferences freed memory / hard hang (root cause bktr_os.c, sink bktr_core.c:705) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:705 · pass 2 · new	none	inconclusive
DF-3796	High	7.8	ena_down tears down IO queues and frees RX buffers without draining the deferred RX cleanup task (mbuf UAF / double free) Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena.c:2611 · pass 2 · new	none	not_reproduced
DF-3838	High	7.8	32-bit wraparound family in evergreen CS surface-size validation ((slice+1)64 wrap → nby=0/layer_size=0; layer_sizemslice u32 product wrap; <<8 base-offset truncation vs 40-bit GPU addresses; htile nbxnby4 wrap; streamout <<8 and *4 wrapped before the u64 check) → CS validator bypass → GPU OOB read/write past BO, cross-process GPU memory corruption Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen_cs.c:404 · pass 2 · new	none	inconclusive
DF-3914	High	7.8	Unbounded firmware NumSlots heap OOB write in the direct-attached enclosure reservation path (_mapping_get_dev_info/_mapping_get_pcie_dev_info) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:1243 · pass 2 · new	none	not_reproduced
DF-4009	High	7.8	NVMe-encapsulated pass-thru: unvalidated u32 DataSize drives PRP walk past the 8MiB arena (deterministic OOB write); kmalloc result unchecked Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_user.c:904 · pass 2 · new	none	inconclusive
DF-4013	High	7.8	mps FW-diag state machine: shared DMA trio + stale per-type size yields OOB kernel disclosure, cross-type free, UAF read, and double free (DF-4008 mpr twin, worse) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_user.c:1376 · pass 2 · new	panic	inconclusive fixed
DF-4028	High	7.8	CS validator rewrites ib[0] after validation: cb_color_size_idx defaults to 0 (full r600 CS validator bypass) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_cs.c:309 · pass 2 · new	none	not_reproduced
DF-4031	High	7.8	Tracked offsets wrap in u32 while the GPU addresses 40 bits: streamout size raw*4 and base<<8 truncation validate the WRONG offset Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_cs.c:721 · pass 2 · new	none	not_reproduced
DF-4085	High	7.8	Unvalidated IOC-pg8 MaxNumPhysicalMappedIDs used as num_slots: heap OOB write in _mapping_process_dpm_pg0 reservation loop Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_mapping.c:1512 · pass 2 · new	none	not_reproduced
DF-4086	High	7.8	_mapping_get_ir_maprange off-by-one: end_idx == max_devices -> OOB reads and conditional 32-byte OOB write of mapping_table[] on IR events Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_mapping.c:221 · pass 2 · new	none	not_reproduced
DF-4092	High	7.8	Unvalidated IOC-pg8 MaxNumPhysicalMappedIDs used as num_slots: heap OOB write in mpr _mapping_process_dpm_pg0 reservation loop (twin of DF-4085) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:2216 · pass 2 · new	none	not_reproduced
DF-4093	High	7.8	mpr _mapping_get_ir_maprange off-by-one: end_idx == max_devices -> OOB reads and two 32-byte OOB write sinks on IR paths (twin of DF-4086) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_mapping.c:254 · pass 2 · new	none	not_reproduced
DF-4231	High	7.8	txp(4) trusts NIC-fed rxd->rx_len: unbounded m_copydata heap OOB read+write past mbuf clusters Kernel memory corruption (UAF / OOB write) · sys/dev/netif/txp/if_txp.c:676 · pass 2 · new	none	inconclusive
DF-4232	High	7.8	txp(4) walks device-fed ring cursors unvalidated: OOB descriptor walk via kernel pointer in DMA memory, wild rx_sd deref, non-terminating loops Base system — drivers · sys/dev/netif/txp/if_txp.c:658 · pass 2 · new	none	inconclusive
DF-4233	High	7.8	txp_init() ignores txp_rxring_fill() failure and enables RX over a stale buffer ring: firmware DMA into freed clusters + NULL deref Kernel memory corruption (UAF / OOB write) · sys/dev/netif/txp/if_txp.c:1127 · pass 2 · new	none	inconclusive
DF-4412	High	7.8	radeon_vm_get_bos() TOCTOU on vm->max_pde_used — kernel heap out-of-bounds write via racing GEM_VA/CS Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_vm.c:135 · pass 2 · new	none	not_reproduced
DF-4510	High	7.8	drm_syncobj: lockless drm_syncobj_fence_get() races drm_syncobj_replace_fence()'s outside-the-lock dma_fence_put() of the old fence — rcu_read_lock() is only preempt_disable() on DragonFly and the last put kfree()s synchronously, so a cross-CPU waiter kref_get()s freed memory and then dispatches through the freed fence's ops: unprivileged kernel heap UAF (read+write) via render-node syncobj ioctls on i915/amdgpu Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_syncobj.c:182 · pass 2 · new	none	inconclusive
DF-4531	High	7.8	drm_clients_info() walks dev->filelist under the wrong lock with a sleeping kmalloc between a count pass and an unbounded copy pass: concurrent open()/close() yields a kernel heap OOB write (or UAF read) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_file.c:268 · pass 2 · new	none	inconclusive
DF-4604	High	7.8	radeon_gem_va_ioctl: bo_va use-after-free — set_addr() drops the BO reservation internally, then radeon_gem_va_update_vm() dereferences bo_va unprotected while a racing GEM_CLOSE on the same DRM fd frees it Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_gem.c:693 · pass 2 · new	none	inconclusive
DF-4635	High	7.8	radeon_audio: enc_priv type confusion — radeon_encoder_lvds* consumed as radeon_encoder_atom_dig* on LCD-carrying digital encoders (eDP) → dig->pin/dig->afmt OOB read/write into the ADJACENT 288-byte slab chunk + wild MMIO deref Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_audio.c:262 · pass 2 · new	none	inconclusive
DF-4853	High	7.8	evergreen_hdmi_enable / evergreen_dp_enable consume lvds-typed enc_priv as radeon_encoder_atom_dig on the eDP dpms path: dig->afmt OOB read at +288 into the adjacent slab chunk → guard falls through → wild deref feeding six WREG32 MMIO sites + dig->afmt->enabled write-through (DF-4635/DF-4828 family, new sinks; corrects DF-4828's dpms-route dismissal) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen_hdmi.c:429 · pass 2 · new	none	inconclusive
DF-4864	High	7.8	amdgpu_vm_clear_bo() 64-byte IB overrun: the ATS root-PD clear emits two 10-dword set_pte_pde packets + SDMA pad (24 dwords) into a 16-dword (64-byte) SA sub-allocation — deterministic 32-byte kernel heap OOB write per GPU-VM create on every AMD Raven APU Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ring.c:107 · pass 2 · new	none	not_reproduced
DF-5292	High	7.8	Beacon mbuf write-after-free across disjoint lock domains: rum_update_beacon's unlocked ieee80211_beacon_update window vs m_freem in rum_newstate/rum_vap_delete Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_rum.c:2825 · pass 2 · new	none	inconclusive
DF-2949	Medium	7.8	cttyclose() takes its tty-vnode reference with vref() racing the terminal vrele() of concurrent ctty teardowns — vref: bad refcnt panic (INVARIANTS) / freelist vnode resurrection (stock) Kernel memory corruption (UAF / OOB write) · sys/kern/tty_tty.c:153 · pass 2 · new	none	not_reproduced
DF-3481	Medium	7.8	ng_ppp mutates its entire private state (frag TAILQ, qlen, mseq/xseq, activeLinks, conf) with zero synchronization across concurrent v1 execution contexts — double TAILQ_REMOVE/kfree/m_freem (UAF-class) if raced; empirically contained on stock socket-fed topologies but one feeder refactor away Kernel memory corruption (UAF / OOB write) · sys/netgraph/ppp/ng_ppp.c:1144 · pass 2 · new	none	not_reproduced
DF-3845	Medium	7.8	OCR return-to-CAM flush races the lock-free ISR completion path: only a 1-second DELAY heuristic separates two unsynchronized mrsas_cmd_done callers (double xpt_done / duplicated free-list entry); timeout callout re-arms 600 s on recycled commands Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas.c:2324 · pass 2 · new	none	inconclusive
DF-4054	Medium	7.8	SMU-firmware-fed DPM level count stored unclamped: vega12_setup_single_dpm_table fill loop writes past dpm_levels[16] — firmware-controlled linear heap overflow of the kzalloc'd vega12_hwmgr backend Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:481 · pass 2 · new	none	inconclusive fixed
DF-4148	Medium	7.8	UAF/double-free race: in-flight cuse_client_open vs final cuse_server_unref (async destroy_dev, refs++ after the final decrement) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/cuse/cuse.c:1509 · pass 2 · new	none	not_reproduced
DF-4255	Medium	7.8	agp_i915_write_gtt programs GTT PTEs into the MMADR register BAR (sc_res[0]) instead of GTTADR (sc_res[1]): GPU-register corruption incl. PGTBL_CTL hijack at PTE index 0x808, and OOB writes past the mapped MMADR resource for PTE indices >= 32768 Kernel memory corruption (UAF / OOB write) · sys/dev/agp/intel-gtt.c:998 · pass 2 · new	none	inconclusive
DF-4320	Medium	7.8	SIOCGATHDIAG/SIOCGATHPHYERR dispatched with no privilege check: unprivileged users get arbitrary device MMIO read/write (incl. plaintext WEP/TKIP keycache dump), EEPROM reads, and NULL-deref panics on ATH_DIAGAPI kernels Privilege escalation (general use) · sys/dev/netif/ath/ath/if_ath_ioctl.c:299 · pass 2 · new	none	inconclusive
DF-4439	Medium	7.8	drm_atomic_state holds no drm_device reference while nonblocking commits outlive the ioctl on system_unbound_wq — missing backport of Linux 4e076c73e4f6 (stable-fix use-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_atomic.c:77 · pass 2 · new	none	inconclusive
DF-4469	Medium	7.8	drm_crtc_helper_set_config() sizes save_connector_encoders with the racy num_connector while iterating the live list — concurrent DP-MST connector registration (spinlock-only) writes one pointer past the kcalloc'd array, and the fail path reads the OOB slot back into connector->encoder (heap OOB write + forged-pointer injection) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_crtc_helper.c:571 · pass 2 · new	none	inconclusive
DF-4497	Medium	7.8	sbsh: deactivate() drops xq/rq mbufs but leaves stale pointers - TXS/RXS/UFL processing after carrier loss (or after ifconfig down) double-frees / uses freed mbufs Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sbsh/if_sbsh.c:726 · pass 2 · new	none	inconclusive
DF-5033	Medium	7.8	UAF/OOB-read race in amdgpu_bo_list_get(): DragonFly's idr_find() is lockless while idr_grow() kfree()s the node array synchronously (Linux RCU-safe-idr assumption does not hold) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:167 · pass 2 · new	none	inconclusive
DF-5186	Medium	7.8	DRM_UNLOCKED dumb-buffer MAP_DUMB races the unsynchronized legacy GEM offset-hash publication: live-key free_unr double-free, same-node dual-bucket hlist link, and wrong-object resolution in the mmap path (cross-object / UAF-class mapping ceiling) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dumb_buffers.c:115 · pass 2 · new	none	inconclusive
DF-5371	Medium	7.8	Unlocked shared dmat->segments array across all load paths — concurrent loads on one tag corrupt each other's scatter/gather lists (vkernel never got pc64's bus_dma_tag_lock/BUS_DMA_CACHE_SEGMENTS fix) Base system — bus / platform / cpu · sys/platform/vkernel64/platform/busdma_machdep.c:314 · pass 2 · new	device-visible corrupted S/G lists (DF-5371) / 72B-per-failure leak (DF-5373)	untested
DF-5420	Medium	7.8	pmap_inval_smp()/pmap_inval_smp_cmpset() shortcut samples pmap->pm_active outside the CPULOCK_EXCL interlock (and takes none for non-PMAP_MULTI pmaps); originator also returns before target done-bits drain Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/pmap_inval.c:282 · pass 2 · new	none	not_reproduced
DF-2900	Low	7.8	procfs_rwmem ignores kmem_alloc_pageable failure — kva=0 reaches pmap_kenter_quick(0,pa), overwriting pml4[0] of the current user pmap (page-table pivot) plus uiomove on VA 0 Privilege escalation (general use) · sys/vfs/procfs/procfs_mem.c:101 · pass 2 · new	arbitrary_write	not_reproduced
DF-4629	Low	7.8	mpt_user: DMA page buffer freed on ioctl timeout while the deliberately-abandoned request still points at it — late IOC completion DMAs into freed kernel heap Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_user.c:259 · pass 2 · new	Kernel heap corruption by device DMA: late IOC completion writes up to len bytes into freed (reallocatable) heap	untested
DF-5143	Low	7.8	GFP_DMA32 <4GiB constraint for I965G/GM internal objects is dead code on DragonFly — shim alloc_pages ignores gfp_mask, so pre-gen6 32-bit GTT PTEs truncate >4GiB physical addresses and the GPU DMAs to aliased physical pages Base system — drivers · sys/dev/drm/i915/i915_gem_internal.c:72 · pass 2 · new	latent 8B OOB write on sub-word call / GPU DMA to aliased physical pages	untested
DF-3177	Medium	7.7	hpfs NFS file handles are a bare 32-bit LSN — generation field commented out of vptofh, no hpfid_len/ino validation in fhtovp, and vget accepts any sector whose first u32 is FN_MAGIC: forged handles turn attacker-written file content into live vnodes, composing into remote arbitrary-device R/W and heap corruption on exported mounts Privilege escalation (general use) · sys/vfs/hpfs/hpfs_vfsops.c:424 · pass 2 · new	none	untested
DF-3844	Medium	7.7	mrsas_issue_blocked_cmd times out and lets callers release mfi commands still owned by the firmware — late completions land on recycled commands, double-inserting them into the free pool (shared sc->chan ident wakes the wrong waiter) Base system — drivers · sys/dev/raid/mrsas/mrsas.c:2865 · pass 2 · new	none	inconclusive
DF-4671	Medium	7.7	bktr_mmap is re-executed at page-fault time and reads bktr->bigbuf/alloc_pages with no lock while METEORSETGEO's grow path kmem_free()s and reassigns the buffer — fault in the window maps pages via a dangling KVA pointer (stale mappings; ceiling: RW kernel-memory alias) Base system — drivers · sys/dev/video/bktr/bktr_os.c:677 · pass 2 · new	none	not_reproduced
DF-3881	High	7.6	Unbounded MST topology depth (LCT) -> OOB stack/heap writes and unbounded kernel recursion from malicious hub Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dp_mst_topology.c:1052 · pass 2 · new	none	not_reproduced
DF-3820	Low	7.6	aac(4) dereferences adapter-controlled completion/AIF indices with no bounds validation at five sites — malicious or faulty controller gets wild kernel pointers and unlink writes Base system — drivers · sys/dev/raid/aac/aac.c:853 · pass 2 · new	none	inconclusive
DF-3823	Low	7.6	asr_intr maps the adapter-posted FromFIFO reply offset into a kernel pointer with no validation — forged reply frame yields a forged ccb with LIST_REMOVE/callout_stop writes; FAIL path uses device-controlled MMIO offsets unbounded Base system — drivers · sys/dev/raid/asr/asr.c:2890 · pass 2 · new	none	inconclusive
DF-3388	High	7.5	wg peer teardown races in-flight noise consumers: wg_peer freed via uncounted r_arg and r_index re-linked after handshake_clear (use-after-free) Kernel memory corruption (UAF / OOB write) · sys/net/wg/wg_noise.c:596 · pass 2 · new	none	inconclusive
DF-3843	High	7.5	mrsas_sync_map_info writes firmware-controlled ldCount × 4-byte entries into a fixed 172,200-byte RAID-map DMA buffer — unbounded linear kernel heap overflow (computed bound size_sync_info is dead code) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas.c:3207 · pass 2 · new	none	inconclusive
DF-3886	High	7.5	drm_dp_sideband_msg_build msg[256] accumulation overrun: up to 61 hub-controlled bytes past msg_rx->msg (distinct sink from DF-1264) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dp_mst_topology.c:371 · pass 2 · new	none	not_reproduced
DF-3908	High	7.5	Kernel stack OOB write in tonga_program_memory_timing_parameters: VBIOS-controlled SCLK/MCLK DPM counts index fixed stack table arb_regs.entries[8][4] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1492 · pass 2 · new	none	inconclusive fixed
DF-3909	High	7.5	Heap OOB writes into smc_state_table.GraphicsLevel[8]/MemoryLevel[4] via unclamped VBIOS SCLK/MCLK DPM counts (incl. unguarded MemoryLevel[count-1] store) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:709 · pass 2 · new	none	inconclusive fixed
DF-3939	High	7.5	Kernel stack OOB write in ci_program_memory_timing_parameters: VBIOS SCLK/MCLK DPM counts index fixed stack table arb_regs.entries[8][6] (DF-3908 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1653 · pass 2 · new	none	inconclusive
DF-3940	High	7.5	Heap OOB writes into kzalloc'd struct ci_smumgr via unclamped VBIOS MCLK DPM count vs SMU7_MAX_LEVELS_MEMORY=6: MemoryLevel[6..7], unguarded MemoryLevel[count-1], mc_regs->data[6..7], mclk_levels[MemoryDpmLevelCount] (DF-3909 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1314 · pass 2 · new	none	inconclusive
DF-4000	High	7.5	Unclamped VBIOS SCLK/MCLK DPM counts overflow the iceland SMC state tables and the 384-byte stack MC-arb table: GraphicsLevel[8], MemoryLevel[4], arb_regs.entries[8][4] (kernel STACK), mc_regs.data[4] — DF-3908/3909/3939/3940 family with iceland's tighter mclk bound (count 5 suffices) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:980 · pass 2 · new	none	inconclusive fixed
DF-5246	High	7.5	Write-after-free race on run_vap::beacon_mbuf: run_update_beacon (ic lock) vs run_newstate/run_vap_delete (sc lock) - disjoint lock domains Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_run.c:4887 · pass 2 · new	none	inconclusive
DF-5254	High	7.5	Beacon mbuf use-after-free write: urtwn_update_beacon's unlocked ieee80211_beacon_update window races setup_beacon/vap_delete across disjoint lock domains Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_urtwn.c:2206 · pass 2 · new	none	inconclusive
DF-3547	Medium	7.5	Use-after-free of struct ngd_private in all cdevsw methods: disconnect frees priv immediately after DragonFly's asynchronous destroy_dev() Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_device.c:299 · pass 2 · new	none	build_failed
DF-3679	Medium	7.5	igb_rxeof trusts NIC-DMA'd descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len → heap OOB read up to 63,487 bytes past the 2046/2048-byte RX cluster (DF-3604/3639/3663/3667 family) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/igb/if_igb.c:2744 · pass 2 · new	none	inconclusive
DF-3713	Medium	7.5	em_rxeof trusts the 16-bit NIC descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len -> heap OOB read up to ~63.5KB past the 2048-byte RX cluster (positive direction of DF-1188) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/em/if_em.c:3692 · pass 2 · new	none	inconclusive
DF-3759	Medium	7.5	alc_rxeof trusts the controller-DMA'd 14-bit RRS frame length with no bound vs nsegs*alc_buf_size/MCLBYTES: heap OOB read up to ~14.3KB past a 2KB RX cluster (kernel heap info leak) and negative m_len (panic) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/alc/if_alc.c:3307 · pass 2 · new	none	inconclusive
DF-3782	Medium	7.5	vmxnet3_rxq_eof() RX completion walk has no work bound: interrupt-thread livelock holding the RXQ lock under a remote line-rate flood (DF-3761/3778 family, vmx(4) instance) Base system — drivers · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2201 · pass 2 · new	dos	inconclusive
DF-3990	Medium	7.5	RX walk has no work bound (ALE_PROC_* knobs are dead code) — serializer-held livelock on line-rate flood; ale_txeof takes the 16-bit TPD_CONS_IDX unmasked vs the 256-ring — TX over-reclaim of still-owned mbufs (DF-3761/3778/3934 family) Base system — drivers · sys/dev/netif/ale/if_ale.c:2026 · pass 2 · new	none	inconclusive
DF-4045	Medium	7.5	stge_rxeof trusts the NIC-DMA'd 16-bit RxDMAFrameLen with no per-buffer bound: jumbo-MTU FrameEnd claim yields m_len up to 9022 on the 2048-byte cluster (up to 6974-byte heap OOB read into delivered frames); framelen < rxlen yields negative tail m_len -> m_copydata unsigned count -> ~4GB bcopy panic Kernel memory leaks / uninitialized disclosure · sys/dev/netif/stge/if_stge.c:1606 · pass 2 · new	none	inconclusive
DF-5165	Medium	7.5	request_irq admits duplicate (irq,dev_id) registration and its failure path releases/NULLs pdev-global IRQ state owned by live registrations — armed handler left on released resource/MSI vectors (interrupt-time UAF), orphaned handler with dangling dev_id, NULL-resource crash on retry, double-release at teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_irq.c:75 · pass 2 · new	interrupt-context UAF / orphaned armed handler / cross-device teardown	untested
DF-5581	Medium	7.5	Intel graphics stolen-memory reservation is compiled out; drm/i915 trusts the unreserved firmware values and its only conflict guard is a no-op rman stub Base system — bus / platform / cpu · sys/bus/pci/x86_64/pci_early_quirks.c:264 · pass 2 · new	none	not_reproduced
DF-2740	Low	7.5	Inconsistent locking of linker shared state: sys_kldload userrefs++/id read outside kld_lock (UAF-write window), unlocked refs mutations, and unlocked linker_files/found_modules traversals racing KPI loaders Kernel memory corruption (UAF / OOB write) · sys/kern/kern_linker.c:814 · pass 2 · new	none	untested
DF-4259	Low	7.5	my_stop frees all RX/TX mbufs and zeroes descriptor rings without waiting for the TX/RX engines to go idle — trailing DMA into freed clusters (packet-controlled kernel heap corruption) Base system — drivers · sys/dev/netif/my/if_my.c:1651 · pass 2 · new	none	inconclusive
DF-5162	Low	7.5	bktr_mem stored-address registry is never invalidated when the METEORSETGEO grow path frees the frame buffer — driver reload reinstalls the freed KVA, bzeros ~3.5 MB and RISC-DMAs video into reallocated kernel memory (write-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_mem.c:103 · pass 2 · new	none	not_reproduced
DF-3938	Info	7.5	Latent device-controlled-length memcpy in ena_com_get_hash_function(): keys_num (u32 in device-DMA buffer) << 2 as copy size Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2354 · pass 2 · new	none	inconclusive
DF-3520	High	7.4	Negative-length bcopy in ng_pptpgre ack processing: one in-window ack converts the DF-0596 window violation into an unbounded kernel OOB read+write Kernel memory corruption (UAF / OOB write) · sys/netgraph/pptpgre/ng_pptpgre.c:641 · pass 2 · new	none	not_reproduced
DF-3962	High	7.4	mvfrey CCB-timeout callout runs iop_intr without the adapter lock, racing the locked hard-IRQ drain: double srb completion (double free to freelist + double xpt_done → CAM UAF); plus 60s DELAY busy-loop in softclock and the timed-out CCB is never completed Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptiop/hptiop.c:2647 · pass 2 · new	none	not_reproduced
DF-4066	High	7.4	ti_rxeof indexes the mbuf chain arrays with the NIC-DMA'd uint16_t return-descriptor ti_idx and no bounds check: OOB pointer read used as struct mbuf (wild-pointer stores at :1690 + if_input type confusion) and OOB 8-byte NULL write up to +512KB past the chain arrays inside struct ti_softc Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ti/if_ti.c:1638 · pass 2 · new	none observed (hardware-gated); source-level: kernel OOB write (8-byte NULL store up to +512KB past chain array) + wild-pointer mbuf writes + type confusion into ether_input via NIC-DMA'd uint16_t descriptor index	inconclusive
DF-5258	High	7.4	sc_epq[MTW_BULK_RX] is a zero-length array: the 6 TX endpoint queues alias 14 KB of live mtw_softc fields; every ifconfig-up stamps over them and every channel change (sc_chan_group) forges the upper dword of epq[0].tx_data[3].ni, a live ieee80211_node pointer Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:4466 · pass 2 · new	none	inconclusive
DF-3518	Medium	7.4	ng_pptpgre priv UAF: rmnode kfree(priv) races in-flight rcvdata/rcvmsg dispatched inline without a node reference Kernel memory corruption (UAF / OOB write) · sys/netgraph/pptpgre/ng_pptpgre.c:437 · pass 2 · new	none	not_reproduced
DF-3519	Medium	7.4	Non-atomic node->refs++ / priv->timers++ in ng_pptpgre timer start vs ng_unref — lost update frees live ng_node (UAF) Kernel memory corruption (UAF / OOB write) · sys/netgraph/pptpgre/ng_pptpgre.c:768 · pass 2 · new	none	not_reproduced
DF-3934	Medium	7.4	RX walk has no work bound (AGE_PROC_* knobs are dead code) and 16-bit CMB producer indices are not masked to ring sizes — serializer-held livelock DoS and TX over-reclaim Base system — drivers · sys/dev/netif/age/if_age.c:2149 · pass 2 · new	none	inconclusive
DF-3961	Medium	7.4	SG-capacity heap overflow: firmware-fed max_sg_count writes scatter-gather entries past the 34-entry capacity of srb->req[600] into srb->hba/ccb/next/dma_map (itl non-highmem, mv, mvfrey paths) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptiop/hptiop.c:2471 · pass 2 · new	none	not_reproduced
DF-5242	Medium	7.4	xpt_release_device() uses non-joining callout_stop before kfree(device) — xpt_release_devq_timeout can already be blocked on CAM_SIM_LOCK(device->sim) and then operate on the freed cam_ed (UAF; upstream defers the free) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:4790 · pass 2 · new	heap OOB comparison oracle / race-gated UAF / accounting drift	untested
DF-4421	Low	7.4	ich_pci_attach() publishes the 0666 /dev/mixerN (mixer_init) before five failure paths whose bad: unwind frees the AC97 codec and softc — dangling mixer cdev UAF on open/ioctl (DF-4156/4193/4299/4334/4344 family, 6th instance, widest window in family) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/ich.c:1031 · pass 2 · new	none	inconclusive
DF-4726	Low	7.4	aureal: BAR loop stores tags/handles for up to 6 BARs into au->st[3]/au->sh[3] — OOB kernel write over sh[], parent_dmat and lock at attach (crafted-PCI-device threat model) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/aureal.c:571 · pass 2 · new	none	untested
DF-4568	Info	7.4	CT teardown frees the shared CT page while GuC interrupts are still enabled and guc->handler still points at CT code — interrupt-context use-after-free read+write of the released descriptor mapping Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_guc_ct.c:898 · pass 2 · new	none	untested
DF-4321	Medium	7.3	ath_hal_getregdump(): signed/unsigned comparison break + unchecked do-while first write => unbounded attacker-length kernel-heap overflow with attacker-known register values Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ah.c:848 · pass 2 · new	none	inconclusive
DF-4836	Medium	7.3	Firmware-facing frame->hdr.sge_count never reconciled with the validated user_ioc->sge_count: FW consumes stale SGEs (device DMA to freed ioctl buffers) and can read its SGL past the 1024-byte frame allocation Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_ioctl.c:205 · pass 2 · new	corruption	untested
DF-4854	Low	7.3	vega10_ih: unvalidated device-DMA'd IH wptr (DF-4843 twin) — permanent amdgpu interrupt-thread spin on misaligned wptr, plus 20-byte OOB ring read via RB_OVERFLOW recovery Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/vega10_ih.c:194 · pass 2 · new	dos	untested
DF-3911	Medium	7.2	mpt_download_fw consumes the IOC-uploaded firmware image with zero validation: unchecked ImageSize and unbounded ext-image walk give wild kernel reads streamed to the device / page-fault panic Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt.c:2467 · pass 2 · new	none	inconclusive fixed
DF-3018	Low	7.2	spec VOP dispatch (devfs_spec_read/write/ioctl/kqfilter, D_QUICK close) calls dev_d* on vp->v_rdev with no cdev reference and the vnode unlocked — vfs_timestamp(&node->atime) after teardown is a UAF write if the device dies during the dispatch Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_vnops.c:1099 · pass 2 · new	none	not_reproduced
DF-4759	Low	7.2	Module teardown is unsynchronized: vinum_inactive() TOCTOU vs vinumopen(), the state > volume_down gap skips open-but-down volumes, and VF_OPEN/VF_DAEMONOPEN are refcount-free booleans (UAF-class teardown window) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinum.c:171 · pass 2 · new	none	untested
DF-4567	Info	7.2	CTB ring math trusts GuC-firmware-written descriptor fields with only compiled-out GEM_BUG_ON validation — desc->size==0 gives divide-by-zero panic, inflated size/tail gives FW-offset wild write past the 1-page CT object Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_guc_ct.c:324 · pass 2 · new	none	untested
DF-3749	High	7.1	wcid2ni[] never cleared on node free → TX-status drain use-after-free (hostap remote) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ral/rt2860.c:887 · pass 2 · new	none	not_reproduced
DF-3882	High	7.1	drm_dp_mst_handle_down_rep txmsg use-after-free race vs drm_dp_mst_wait_tx_reply timeout kfree Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dp_mst_topology.c:2337 · pass 2 · new	none	not_reproduced
DF-4444	High	7.1	DragonFly-only drm_vma_node_unmap() cannot revoke a single user mapping: user CPU PTEs into the physical GGTT aperture survive VMA unbind/evict/fence-steal/object-free and read+write whatever object later reuses the aperture range (unprivileged cross-object/cross-user GPU memory access) Base system — drivers · sys/dev/drm/i915/i915_vma.c:857 · pass 2 · new	none	inconclusive
DF-4791	High	7.1	ttm_shrink ↔ ttm_bo_swapout unbounded recursion: the TTM memory-accounting shrinker re-enters itself through the lazy page-populate of the very BO it is swapping out — attacker-controlled nesting depth exhausts the 16KiB kernel stack Base system — drivers · sys/dev/drm/ttm/ttm_memory.c:502 · pass 2 · new	none	not_reproduced
DF-3686	Medium	7.1	Zero-count DPM tables (ignored setup failures) drive unsigned index 0xFFFFFFFF into dpm_levels[]: wild read/write ~48 GB out plus OOB reads and divide-by-zero across OD paths Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3588 · pass 2 · new	none	inconclusive
DF-3712	Medium	7.1	2-byte DMA heap overflow in em(4) RX when MTU in (1500, 2028]: ETHER_ALIGN front-trim coexists with RCTL_LPE long-frame reception on 2048-byte hardware buffers Kernel memory corruption (UAF / OOB write) · sys/dev/netif/em/if_em.c:3378 · pass 2 · new	none	inconclusive
DF-3930	Medium	7.1	mly_cam_complete() INQUIRY rewrite writes vendor/product/revision at data_ptr[8..36) regardless of dxfer_len — heap OOB write via short pass(4) INQUIRY CCB on a logical device Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:2341 · pass 2 · new	none	not_reproduced
DF-4008	Medium	7.1	mpr diag-buffer registration: shared DMA trio + stale per-type size yields OOB kernel disclosure, cross-type free, and NULL-deref/UAF Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_user.c:1508 · pass 2 · new	none	inconclusive
DF-4429	Medium	7.1	radeon_verify_access returns 0 unconditionally: GEM ownership check dropped — any video-group user can mmap every other user's GPU buffer objects Privilege escalation (general use) · sys/dev/drm/radeon/radeon_ttm.c:234 · pass 2 · new	Any local user in group video can mmap and read/write every other user's radeon GEM buffer object (Xorg scanout contents, other users' textures/uploads) by sweeping mmap offsets on /dev/dri/cardN: radeon_verify_access (radeon_ttm.c:234) is an unconditional 'return 0'; the drm_vma_node_verify_access ownership check that upstream radeon and the in-tree sibling amdgpu_ttm.c:311-325 perform was dropped in this port. Kernel-internal BOs (ttm_bo_type_kernel) carry no vma node and are not exposed; ceiling is user GEM objects.	untested
DF-2990	High	7.0	newblk hash chains mutated without the softdep lock: lock-free insert/lookup races locked remove+kfree on shared chains (list corruption, UAF write into freed M_NEWBLK, 'lost block' panics) Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_softdep.c:1003 · pass 2 · new	none	not_reproduced
DF-3188	High	7.0	Unlocked pfsm RB-tree lookup-vs-final-remove race: hammer_load_pseudofs/hammer_rel_pseudofs lack any serialization — UAF + double free + RB tree corruption, sprayable unprivileged via the ungated HAMMERIOC_GET_PSEUDOFS on a nonexistent PFS Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_pfs.c:68 · pass 2 · new	none	not_reproduced
DF-3629	High	7.0	iwm_rx_tx_cmd: firmware-supplied qid indexes sc->txq[IWM_MAX_QUEUES=31] with no bounds check - OOB ring access, NULL writes at OOB offsets, wild node deref (iwm twin of DF-1122) Base system — drivers · sys/dev/netif/iwm/if_iwm.c:3598 · pass 2 · new	none	inconclusive
DF-3699	High	7.0	lkpi queue_work() per-CPU double-enqueue: unprivileged irq-vs-waitboost race on rps->work corrupts the system workqueue STAILQs Privilege escalation (general use) · sys/dev/drm/i915/i915_irq.c:1838 · pass 2 · new	none	inconclusive
DF-3813	High	7.0	mpr_wait_command()/mpr_request_polled() miss the realloc check on the concurrent-reinit wakeup/poll path — use-after-free on struct mpr_command Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr.c:3578 · pass 2 · new	none	inconclusive
DF-3880	High	7.0	dsp_oss_syncstart use-after-free: lksleep drops the syncgroup lock mid-walk; timeout wake resumes SLIST_FOREACH over sm/sg freed by a concurrent SYNCSTART Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/dsp.c:3027 · pass 2 · new	none	not_reproduced
DF-4014	High	7.0	mps_user_pass_thru frees the in-flight command and its DMA buffer the instant mps_wait_command() times out (use-after-free with device DMA writeback) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_user.c:975 · pass 2 · new	none	inconclusive
DF-4927	High	7.0	radeon_sa_bo_next_hole leaves dangling borrowed fence pointers across inner-loop iterations → UAF write, UAF read, and double kfree in radeon_sa_bo_new (missing upstream fix 0381ac3ca2e7) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_sa.c:267 · pass 2 · new	none	inconclusive fixed
DF-5013	High	7.0	mfi LD lifetime UAF: device_delete_child frees the mfi_disk softc under open descriptors and in-flight bios (AEN offline path has no gate at all) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mfi/mfi_disk.c:178 · pass 2 · new	none	not_reproduced
DF-5049	High	7.0	mfi syspd lifetime UAF: AEN PD removal (MR_EVT_PD_REMOVED) deletes the syspd locklessly with no gate and mfi_syspd_detach frees the softc under open descriptors and bios parked on the controller bioq (DF-5013's syspd twin) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mfi/mfi_syspd.c:155 · pass 2 · new	none	not_reproduced
DF-5259	High	7.0	Beacon mbuf use-after-free write: mtw_update_beacon manipulates rvp->beacon_mbuf with no MTW_LOCK (the port dropped FreeBSD's RUN_LOCK), racing m_freem in mtw_newstate(S_RUN)/mtw_vap_delete under the disjoint sc-lock domain Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:3855 · pass 2 · new	none	inconclusive
DF-2692	Medium	7.0	lwpsignal() writes p->p_sigacts->ps_frominfo[] on the token-swapped delivery path holding only the lwp token, racing kern_execve()'s sigacts replacement/free (UAF write) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sig.c:1425 · pass 2 · new	none	untested
DF-2842	Medium	7.0	vnode_pager_reference() lacks the vp↔object interlock — TOCTOU use-after-free on vm_object ref_count Kernel memory corruption (UAF / OOB write) · sys/vm/vnode_pager.c:203 · pass 2 · new	none	not_reproduced
DF-3394	Medium	7.0	vlan SIOCGIFMEDIA uses an unpinned parent ifnet pointer across a serializer drop: UAF (indirect if_ioctl call through freed ifnet) racing privileged parent destroy Kernel memory corruption (UAF / OOB write) · sys/net/vlan/if_vlan.c:951 · pass 2 · new	none	not_reproduced
DF-3800	Medium	7.0	mprsas_realloc_targets resizes the target array to stale pre-reset IOC facts and never updates sassc->maxtargets while the mapping layer is rebuilt from new facts: heap OOB write past sassc->targets[] (and past mapping_table[] in the opposite direction) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas.c:3911 · pass 2 · new	none	not_reproduced
DF-3928	Medium	7.0	Unvalidated firmware channel counts overflow mly_cam_sim[6] and mly_btl[6][16] at attach (~4KB pointer writes + ~290KB strided flag writes past the softc) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:1947 · pass 2 · new	none	not_reproduced
DF-3929	Medium	7.0	mly_done() completion slot has no lower-bound check: command_id 0 indexes mly_command[-1] — OOB field writes + TAILQ pointer writes + indirect call through firmware-fed memory Base system — drivers · sys/dev/raid/mly/mly.c:1535 · pass 2 · new	none	not_reproduced
DF-4007	Medium	7.0	eb_move_to_gpu error path double-unreserves vmas: pin/fence/GEM-object refcount underflow → UAF Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem_execbuffer.c:1864 · pass 2 · new	none	inconclusive fixed
DF-4069	Medium	7.0	Unclamped VBIOS SCLK DPM count overflows GraphicsLevel[8] in vegam_populate_all_graphic_levels (heap OOB write past vegam_smumgr) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:886 · pass 2 · new	none	inconclusive
DF-4070	Medium	7.0	Unclamped VBIOS MCLK DPM count overflows MemoryLevel[4] in vegam_populate_all_memory_levels — count=5 already OOB Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1047 · pass 2 · new	none	inconclusive
DF-4071	Medium	7.0	Kernel STACK overflow in vegam_program_memory_timing_parameters: unclamped sclk x mclk counts fill a 640B stack SMU75_Discrete_MCArbDramTimingTable (entries[8][4]) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1291 · pass 2 · new	none	inconclusive
DF-4157	Medium	7.0	ADC DMA-ring completion feed uses the raw APU CURPTR register as its only bound — desync/power-state race yields unbounded kernel OOB write Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/maestro.c:1066 · pass 2 · new	none	untested
DF-4191	Medium	7.0	sdhci_start_data treats bus_dmamap_load()==EINPROGRESS as a plain failure: the deferred sdhci_adma2_getaddr callback stays armed against the shared ADMA2 descriptor table (and the map against a freed buffer) — potential mid-transfer descriptor rewrite -> controller DMA to stale addresses Base system — drivers · sys/dev/disk/sdhci/sdhci.c:1326 · pass 2 · new	none	untested
DF-4356	Medium	7.0	postclose teardown order reversed: amdgpu_vm_fini before amdgpu_ctx_mgr_fini (DF-port divergence) - VM page tables freed under still-live context jobs (device-side UAF / GPU loss) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1073 · pass 2 · new	none	inconclusive
DF-4566	Medium	7.0	VCN rings ship with zero CS ib validation — no .parse_cs hook, userspace decode messages (session handle, fb buffer addresses/sizes) reach firmware unvalidated Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vcn.c:465 · pass 2 · new	none	untested
DF-5064	Medium	7.0	drm_device_detach never unregisters or releases the drm_device: /dev/dri minors stay live and dispatch into unloaded driver-module memory after kldunload (UAF-class) plus unbounded drm_device leak; i915 never runs any driver teardown Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dragonfly.c:251 · pass 2 · new	none	not_reproduced
DF-5191	Medium	7.0	sio_pccard_detach mutates com->gone/com->tp/com->ibuf and calls ttyclose without tty_token, racing siopen/sioclose/siosetwater into kernel heap UAF and double-free of com->ibuf Kernel memory corruption (UAF / OOB write) · sys/dev/serial/sio/sio_pccard.c:117 · pass 2 · new	none	not_reproduced
DF-5260	Medium	7.0	Deferred mtw_cmdq entries hold raw vap/ni pointers; mtw_vap_delete frees the mtw_vap without draining sc->cmdq_task - mtw_update_beacon_cb/mtw_newassoc_cb/mtw_key_set_cb execute on freed objects Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:909 · pass 2 · new	none	inconclusive
DF-5262	Medium	7.0	Lockless mtw_cmdq[] ring: producers store .func before the args with no barrier while mtw_cmdq_cb consumes concurrently under MTW_LOCK (which producers never take) - torn publish executes callbacks with stale pointers Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:1937 · pass 2 · new	none	inconclusive
DF-2959	Low	7.0	ucom_get_data TX path passes unclamped request length to clist_qtob — latent heap OOB write past USB page-cache segment (consumer-side defect found in tty_subr.c pass-2 API sweep) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/serial/usb_serial.c:1898 · pass 2 · new	none	untested
DF-2961	Low	7.0	kobj_class_free() reclaims the compiled ops table with no grace period while the lock-free dispatch hot path reads it (force multiplier turning any consumer refcount slip into a freed function-pointer table call) Kernel memory corruption (UAF / OOB write) · sys/kern/subr_kobj.c:179 · pass 2 · new	corruption	not_reproduced
DF-3316	Low	7.0	tcp_pcblist marker-dance walks per-cpu inpcb lists from a preemptible user thread with no synchronization — DF-3315's non-atomic advance race, here with fully unprivileged churn (UAF read/write on struct inpcb) Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_subr.c:1271 · pass 2 · new	none	not_reproduced
DF-3588	Low	7.0	Double free of adev->pm.dpm.ps on allocation-failure path in si_parse_power_table (plus leak of already-parsed si_ps states) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/si_dpm.c:7256 · pass 2 · new	OOM-gated double free	untested
DF-3811	Low	7.0	intel_ddi_init error path kfrees intel_dig_port while a fully-registered DP connector still references it (OOM-gated UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_ddi.c:3863 · pass 2 · new	none	untested
DF-4156	Low	7.0	agg_attach() error path frees the AC97 codec while the 0666 /dev/mixerN mixer_init() created survives — post-failure mixer ioctl UAF through freed kobj Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/maestro.c:1894 · pass 2 · new	none	untested
DF-4334	Low	7.0	via_attach() pcm_register()-failure path destroys the AC97 codec while the 0666 /dev/mixerN mixer_init() created survives — dangling mixer devinfo UAF on open/ioctl Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/via8233.c:1335 · pass 2 · new	none	untested
DF-4344	Low	7.0	atiixp_chip_post_init mixer_init/pcm_register error-path asymmetry leaves a live 0666 /dev/mixerN over freed codec+softc — UAF on open/ioctl and NULL-deref suspend (DF-4156 family, 5th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/atiixp.c:1085 · pass 2 · new	none	inconclusive
DF-4457	Low	7.0	cmi_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc — UAF on open/ioctl (DF-4156 family, 7th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/cmi.c:986 · pass 2 · new	none	inconclusive
DF-4504	Low	7.0	t4dwave: attach-failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec/tr_info — mixer-UAF family (9th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/t4dwave.c:882 · pass 2 · new	none	untested
DF-4537	Low	7.0	cs4281: attach-failure path after mixer_init() leaves a live 0666 /dev/mixerN over freed codec/softc - mixer-UAF family (10th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/cs4281.c:845 · pass 2 · new	none	untested
DF-4550	Low	7.0	als_pci_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc — dangling mixer devinfo UAF on open/ioctl (DF-4156 family, 11th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/als4000.c:842 · pass 2 · new	none	not_reproduced
DF-4610	Low	7.0	nm_pci_attach failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc — mixer-UAF family, 13th instance (DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537/4550) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/neomagic.c:695 · pass 2 · new	none	untested
DF-4724	Low	7.0	aureal: attach failure after mixer_init() leaves the live 0666 /dev/mixerN over the freed au softc — DF-4156 mixer-UAF family, 15th instance (premise live-verified on the guest) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/aureal.c:634 · pass 2 · new	none	untested
DF-4743	Low	7.0	via_attach(): five failure paths after mixer_init() free the AC97 codec while the 0666 /dev/mixerN survives — dangling mixer devinfo UAF on unprivileged open/ioctl (DF-4156 mixer-UAF family, 16th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/via82c686.c:548 · pass 2 · new	none	untested
DF-3585	High	6.8	Heap OOB write in si_get_svi2_voltage_table (and lowSMIO sink in si_populate_smc_voltage_table): BIOS dependency-table count (u8, up to 255) copied into fixed entries[32]/lowSMIO[32] arrays Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/si_dpm.c:4410 · pass 2 · new	none	inconclusive
DF-3981	High	6.8	login_callout never cancelled when sbp_dev is freed (stale-LUN invalidation, !VALID_LUN loop, post_explore GC) — softclock fires sbp_login_callout on the kfree'd sdev and runs sbp_mgm_orb writes into freed slab + fwdma_free'd ORB pages Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sbp/sbp.c:625 · pass 2 · new	none	inconclusive
DF-3736	Medium	6.8	emx_rxeof trusts the 16-bit NIC descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len -> heap OOB read up to ~63.5KB past the 2046/2048-byte RX cluster (DF-3713 em(4) twin) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/emx/if_emx.c:3369 · pass 2 · new	none	inconclusive
DF-3887	Medium	6.8	VBIOS usVoltageIndex (USHORT 0..65535) OOB heap write in sumo_construct_vid_mapping_table — up to 5 chosen-offset 16-bit-pair writes into/after the kv_power_info heap object Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/kv_dpm.c:167 · pass 2 · new	none	inconclusive
DF-4107	Medium	6.8	vge_rxeof trusts the NIC-DMA'd 14-bit RX descriptor length with no MCLBYTES clamp: single-fragment path sets m_len/pkthdr.len up to 16379 on a 2048-byte cluster (~14KB heap OOB read into if_input/BPF) and signed-underflows to -4 for BUFSIZ<4 (DF-3604/4055/4083 family) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/vge/if_vge.c:1268 · pass 2 · new	none	untested
DF-2904	Low	6.8	mbr_extended()'s signed int slice counter can wrap negative after 2^31 accepted EBR entries, defeating the `slice >= MAX_SLICES` guard → OOB write of attacker-controlled ds_offset/ds_size before dss_slices[] Kernel memory corruption (UAF / OOB write) · sys/kern/subr_diskmbr.c:423 · pass 2 · new	none	untested
DF-3402	Low	6.8	slstart drains sc_fastq/ifsq under tty locks while sloutput fills them under the ifsq serializer — no common lock, concurrent ifqueue corruption Kernel memory corruption (UAF / OOB write) · sys/net/sl/if_sl.c:494 · pass 2 · new	none	not_reproduced
DF-3644	High	6.7	Heap OOB write in ci_get_svi2_voltage_table: VBIOS dependency-table count (u8, up to 255) copied into fixed entries[32] before any trim Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ci_dpm.c:2159 · pass 2 · new	none	inconclusive
DF-3739	High	6.7	BIOS-count-driven OOB pointer write past rdev->i2c_bus[16] in radeon_atombios_i2c_init Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_atombios.c:172 · pass 2 · new	none	inconclusive
DF-3740	High	6.7	Stack buffer overflow in radeon_atom_get_mclk_range_table: uncapped (u8) num_entries fill of mclk[16] into a caller stack local Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_atombios.c:3938 · pass 2 · new	none	inconclusive
DF-3698	Medium	6.7	cu_info walkers index bitmap[4][4]/ao_cu_bitmap[4][4] with unclamped max_shader_engines/max_sh_per_se taken from gpu_info firmware or VBIOS → heap OOB write + read Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/gfx_v9_0.c:937 · pass 2 · new	none	not_reproduced
DF-3704	Medium	6.7	vega10_odn_edit_dpm_table signed-compare lets negative user 'long' pass the bounds check -> wild kernel write (DF-3687 twin) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4884 · pass 2 · new	none	inconclusive
DF-3966	Medium	6.7	rxeof trusts the device-fed 12-bit RX frame length against a 2048-byte cluster: m_len up to 4095 → up to 2047-byte OOB read past the mbuf cluster into ieee80211_input (kernel heap disclosure / parser crash) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ral/rt2661.c:1101 · pass 2 · new	none	not_reproduced
DF-4067	Medium	6.7	ti_rxeof trusts the NIC-DMA'd 16-bit return-descriptor ti_len with no bound vs the backing buffer: std-ring m_len up to 65535 on a 2048-byte cluster (63489-byte heap OOB read into delivered frames), jumbo up to 56513 bytes past a 9024-byte slot — DF-3604/3989/4024/4045/4055 family, ti(4) instance Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ti/if_ti.c:1636 · pass 2 · new	none observed (hardware-gated); source-level: kernel heap OOB read up to 63489 bytes past a 2048-byte std cluster (65535 on u16 ti_len) delivered into received frames via BPF/sockets; jumbo path up to 56513 bytes past a 9024-byte slot incl. past the contigmalloc block; page-fault panic variant	inconclusive
DF-4967	Medium	6.7	radeon_gart_bind/unbind take a 32-bit `unsigned offset`: GTT aperture offsets >= 4 GiB truncate and alias GART entries across buffer objects (cross-process GPU data redirection) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_gart.c:241 · pass 2 · new	none	untested
DF-5293	Medium	6.7	Deferred rum_cmdq entry holds a raw struct ieee80211vap *; rum_vap_delete() frees the rum_vap without draining sc->cmdq_task - rum_update_beacon_cb/rum_set_beacon execute on freed memory Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_rum.c:2830 · pass 2 · new	none	inconclusive
DF-5294	Medium	6.7	rum_ratectl_task re-arms rvp->ratectl_ch unconditionally; the re-armed callout survives rum_vap_delete's drain order and fires on the freed rum_vap (post-free callout/task cycle) Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_rum.c:3140 · pass 2 · new	none	inconclusive
DF-3805	Low	6.7	Unbounded csio->cdb_len bcopy into the 32-byte MPI2 CDB field overflows the request frame in the req_frames DMA pool Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas.c:2102 · pass 2 · new	none	not_reproduced
DF-3920	Low	6.7	OsSendCommand bcopy's user-controlled cdb_len (<=255) into UCHAR Cdb[16] - kernel stack overflow Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/entry.c:2771 · pass 2 · new	none	not_reproduced
DF-4019	Low	6.7	debugfs amdgpu_iomem: upstream page-ownership check is #if 0'd, turning the debug file into arbitrary physical-memory read/write for debugfs holders Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2424 · pass 2 · new	debugfs amdgpu_iomem: the upstream page-ownership check is #if 0'd ('XXX DRAGONFLY - dev_mapping NULL atm'), so the file gives its holder arbitrary physical-memory read/write by llseek+read/write (only pfn_valid is checked).	untested
DF-4001	High	6.6	Unclamped VBIOS SCLK/MCLK DPM counts overflow fiji SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1026 · pass 2 · new	none	inconclusive fixed
DF-4002	High	6.6	Unclamped VBIOS MM-dependency count overflows fiji UvdLevel[8]/VceLevel[8]/AcpLevel[8] SMC arrays Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1433 · pass 2 · new	none	inconclusive fixed
DF-4307	Medium	6.6	adw_intr walks device-fed 32-bit completion tokens (areq_ba/next_ba) through unchecked acbbotov/carrierbotov pointer arithmetic — OOB kernel read/write and interrupt livelock Base system — drivers · sys/dev/disk/advansys/adwcam.c:1280 · pass 2 · new	none	untested
DF-3688	Low	6.6	Unbounded sprintf loops in smu7_print_clock_levels overflow the 4096-byte sysfs page buffer once the VBIOS DPM count exceeds ~233 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4428 · pass 2 · new	none	inconclusive
DF-4027	High	6.5	sili deferred timeout hands a port-owned ccb (state ATA_S_ONCHIP) back to poll callers which sili_ata_put_xfer() it — ccb/slot double lifecycle: reissue on an active slot, stale sili_unload_prb of the new command's live dmamap, and double CAM completion Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili.c:1359 · pass 2 · new	none	not_reproduced
DF-4404	High	6.5	u32 integer overflow in amdgpu_uvd_cs_msg_decode defeats DPB/ctx buffer size validation — UVD runs physical addressing, so undersized decode sessions GPU-DMA past validated buffers (cross-process VRAM/GTT corruption) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524 · pass 2 · new	none	inconclusive
DF-3158	Medium	6.5	deget() publishes the denode in the global hash before taking its reference (refcnt store outside the token): SMP TOCTOU permits duplicate denodes for one directory entry Base system — filesystems · sys/vfs/msdosfs/msdosfs_denode.c:308 · pass 2 · new	none	not_reproduced
DF-3360	Medium	6.5	pf scrub max-mss: 2-byte stack OOB read/write past opts[40] in pf_normalize_tcpopt() via malformed MSS option Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_norm.c:1915 · pass 2 · new	none	not_reproduced
DF-3576	Medium	6.5	Remote kernel panic: division by zero in iwn_set_timing() via AP beacon with bintval=0 (net80211 stores the invalid value anyway) Base system — drivers · sys/dev/netif/iwn/if_iwn.c:5596 · pass 2 · new	panic	inconclusive
DF-4221	Medium	6.5	pvscsi_process_completion() writes through a NULL ccb on duplicate/spurious device completion (missing guard its own timeout handler has) Base system — drivers · sys/dev/virtual/vmware/pvscsi/pvscsi.c:903 · pass 2 · new	none	inconclusive
DF-4362	Medium	6.5	Atomic-ioctl out-fence path leaks a struct file per commit against the port's stubbed fd/sync_file shims: get_unused_fd_flags() really allocates while fd_install/fput/put_unused_fd are no-op stubs and sync_file_create() returns NULL — permanent nfiles exhaustion (system-wide ENFILE DoS until reboot) Privilege escalation (general use) · sys/dev/drm/drm_atomic_uapi.c:1048 · pass 2 · new	dos	untested
DF-4413	Medium	6.5	radeon_vm_bo_set_addr() commits the mapping before page-table allocation — allocation failure leaves NULL page tables and the next update panics in radeon_vm_update_ptes() Base system — drivers · sys/dev/drm/radeon/radeon_vm.c:519 · pass 2 · new	none	not_reproduced
DF-4458	Medium	6.5	drm_gem_mmap_single passes the user-controlled mmap length and in-object offset (bits 0..39 of the fake offset) to the GEM device pager with no bounds check — the only upstream clamp is dead in #if 0 Base system — drivers · sys/dev/drm/drm_gem.c:1082 · pass 2 · new	none	inconclusive
DF-4564	Medium	6.5	radeon: dropped radeon_bo_unreserve() in radeon_driver_open_kms permanently holds the IB-pool BO reservation — first DRM close (and every later open) hangs uninterruptible, wedging the GPU for all users Base system — drivers · sys/dev/drm/radeon/radeon_kms.c:662 · pass 2 · new	dos	not_reproduced
DF-4607	Medium	6.5	4x-timeout DANGER1 direct completion races the real completion: concurrent ata_completed -> UAF + double objcache_put Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-queue.c:140 · pass 2 · new	none	not_reproduced
DF-4882	Medium	6.5	Reachable KASSERT panic in ath_rate_ctl_start() from a zero-length Supported Rates IE beacon — remote DoS on default (INVARIANTS) DragonFly kernels with ath+onoe+IBSS Base system — drivers · sys/dev/netif/ath/ath_rate/onoe/onoe.c:285 · pass 2 · new	none	inconclusive
DF-5108	Medium	6.5	lockrange() commits pos one past plex->lock[PLEX_LOCKS] when the table fills while a conflicted requester sleeps (16-byte heap OOB write + usedlocks overrun defeating the == fullness checks) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumlock.c:139 · pass 2 · new	memcorrupt	not_reproduced
DF-5223	Medium	6.5	rv770_copy_dma under-reserves the DMA ring for radeon_sync_rings() semaphore waits: with two pending cross-ring fences, 16 dwords are written past the reserved window, overwriting un-executed GPU commands (user-reachable rv770 twin of DF-1943) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rv770_dma.c:59 · pass 2 · new	none	not_reproduced
DF-5266	Medium	6.5	MTW_AID2WCID hashes 64 station AIDs into 8 WCIDs: in hostap with >8 stations the 9th+ pairwise key overwrites a colliding station's key slot, and downlink frames are then encrypted with ANOTHER station's key (cross-station confidentiality break on WPA2-Enterprise) Privilege escalation (general use) · sys/bus/u4b/wlan/if_mtw.c:37 · pass 2 · new	none	untested
DF-3863	Low	6.5	u32 truncation of nptes in amdgpu_vm_bo_update_mapping undersizes the update IB; amdgpu_vm_update_ptes then emits an unbounded command stream past its end (kernel heap overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1807 · pass 2 · new	none	not_reproduced
DF-4235	Low	6.5	rl(4): any RX-error frame triggers a full adapter re-init in interrupt context under the ifnet serializer (remote per-frame DoS amplifier) Base system — drivers · sys/dev/netif/rl/if_rl.c:1028 · pass 2 · new	none	inconclusive
DF-4488	Low	6.5	vo destruction runs under the 'video' serial only while all vo sysctl handlers run under 'video_output' only — use-after-free race on vo/vo_levels with an unprivileged 'levels' reader Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_video/acpi_video.c:300 · pass 2 · new	none	untested
DF-4513	Low	6.5	vmbus: vmbus_msghc_wait_result blocks uninterruptibly with no timeout - a silent or malicious Hyper-V host permanently wedges device attach at boot (and later wedges vmbus_msghc_ctx_destroy/kldunload too) Base system — drivers · sys/dev/virtual/hyperv/vmbus/vmbus.c:517 · pass 2 · new	Permanent boot-hang / sticky msghc wedge with no panic or recovery (availability twin of DF-1668's memory corruption)	untested
DF-3607	Medium	6.4	ncr(4): timeout daemon completes an nccb still armed in the chip's DSA — later phase-mismatch resumes DMA from stale/reused scatter descriptors (memory corruption) or wedges the HBA Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ncr/ncr.c:5148 · pass 2 · new	none	inconclusive
DF-3660	Medium	6.4	isp_detach() never terminates or reaps the per-channel FC kthreads nor stops ldt/gdt callouts; isp_pci_detach() then frees the lock, isp_param and bus resources they still use - teardown use-after-free Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_freebsd.c:159 · pass 2 · new	none	not_reproduced
DF-3661	Medium	6.4	isp_attach_chan() cam_simq_release()s the shared devq once per channel while isp_attach held only one reference - premature cam_devq free + write-after-free on multi-channel adapters Base system — drivers · sys/dev/disk/isp/isp_freebsd.c:95 · pass 2 · new	none	not_reproduced
DF-3812	Medium	6.4	isp_add_wwn_entry / isp_del_wwn_entry index FCPARAM(isp, chan) with an unchecked firmware-controlled channel (raw in_vpidx) — kernel heap OOB read/write up to ~17.8 MB past isp_param; isp_del_all_wwn_entries off-by-one admits chan == nchan Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_library.c:2398 · pass 2 · new	none	inconclusive
DF-4029	Medium	6.4	SET_RESOURCE VALID_BUFFER relocates with 8-dword stride into 7-dword resource slots (validated/executed desync) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_cs.c:1953 · pass 2 · new	none	not_reproduced
DF-4083	Medium	6.4	sis_rxeof trusts the 12-bit DMA-written RX descriptor length (SIS_RXBYTES = (sis_ctl & 0xFFF) - 4, up to 4091) into m_len/m_pkthdr.len of a 2048-byte cluster with no clamp: up to ~2 KB kernel heap OOB read delivered to the network stack/BPF (DF-3604 length-trust family) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/sis/if_sis.c:1374 · pass 2 · new	none	untested
DF-4178	Medium	6.4	twe_immediate_request timeout releases a request still posted to the controller and linked on twe_busy — late completion double-processes the reused request (TAILQ corruption / biodone of in-flight bio) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twe/twe.c:1003 · pass 2 · new	none	inconclusive
DF-4341	Medium	6.4	Unserialized ISR/netgraph concurrency over per-channel descriptor rings: UAF writes, hook write-after-free, descriptor double-free, and device DMA into freed mbufs (ignored channel-zap status) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mn/if_mn.c:1329 · pass 2 · new	none	inconclusive
DF-4414	Medium	6.4	radeon_vm_fini() DragonFly rewrite spins forever when radeon_bo_reserve() fails — unkillable kernel livelock (upstream single-pass merely leaks) Base system — drivers · sys/dev/drm/radeon/radeon_vm.c:1250 · pass 2 · new	none	not_reproduced
DF-4614	Medium	6.4	ips command-queue lifecycle double-free/UAF: unchecked ips_cmdqueue_init at ips.c:414 plus unconditional, non-NULLing kfree in ips_cmdqueue_free (also frees under live commands on detach) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips.c:116 · pass 2 · new	none	not_reproduced
DF-4762	Medium	6.4	fwe_stop() frees RX bulkxfer chunks and their mbufs while fwohci_rbuf_update()/fwe_as_input() still manipulate or walk them — teardown race causes UAF write/read and mbuf double-free Kernel memory corruption (UAF / OOB write) · sys/dev/netif/fwe/if_fwe.c:258 · pass 2 · new	none	inconclusive
DF-4884	Medium	6.4	Double-free of adev->bios when amdgpu_get_bios() fails: every VBIOS read method kfrees without NULLing and amdgpu_device_fini() frees the dangling pointer again on the probe-failure teardown path Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_bios.c:116 · pass 2 · new	none	not_reproduced
DF-4910	Medium	6.4	Unsynchronized aconnector->dc_sink teardown: lockless dm_dp_destroy_mst_connector (destroy work) races mode_config.mutex-held dm_dp_mst_get_modes check-then-set — dc_sink leaked with dangling dc_sink->priv, remote-sink slot exhaustion makes the known DF-1966 NULL-deref panic deterministic, plus UAF-read windows Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:232 · pass 2 · new	none	untested
DF-5247	Medium	6.4	Deferred run_cmdq entries outlive the vap/node they point at: run_vap_delete frees run_vap without draining sc->cmdq_task Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_run.c:1030 · pass 2 · new	none	inconclusive
DF-3278	Low	6.4	bridge_fragment() re-header loop double-frees the fragment chain and UAF-reads freed mbufs when any M_PREPEND(M_NOWAIT) fails Kernel memory corruption (UAF / OOB write) · sys/net/bridge/if_bridge.c:4386 · pass 2 · new	none	not_reproduced
DF-3732	Low	6.4	ciss_init_pci: unvalidated firmware transport_offset maps ciss_perf outside the BAR window; ciss_init_perf writes through it Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:694 · pass 2 · new	none	inconclusive
DF-3733	Low	6.4	ciss_periodic re-arms after unlock vs callout_stop in ciss_free -> post-free callout execution (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:3431 · pass 2 · new	none	inconclusive
DF-3756	Low	6.4	tulip_srom_decode() unbounded media-info pointer walk: OOB WRITE past tulip_softc.tulip_mediainfo[10] into the softc tail and kernel heap Kernel memory corruption (UAF / OOB write) · sys/dev/netif/de/if_de.c:2080 · pass 2 · new	none	inconclusive
DF-3923	Low	6.4	hpt_attach bus_setup_intr failure kfree()s the newbus-owned IAL_ADAPTER_T softc while it stays linked on gIal_Adapter (use-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/entry.c:2026 · pass 2 · new	none	not_reproduced
DF-4076	Low	6.4	Unvalidated chip-reported IOCRequestFrameSize sizes every request slot; all request builders write fixed sizeof(struct) with no minimum check Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps.c:750 · pass 2 · new	none	inconclusive
DF-4193	Low	6.4	es_pci_attach error path after mixer_init leaves a live /dev/mixerN pointing at freed codec/es (UAF on open/ioctl) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/es137x.c:1810 · pass 2 · new	es_pci_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed codec/es (UAF on open/ioctl). Attach-failure precondition only (IRQ/dma-tag/pcm_register failure after mixer_init) - not user-triggerable on demand. Same family as DF-4156 (maestro).	untested
DF-4274	Low	6.4	twa(4) deferred-busdma passthru error path returns the request to the free queue twice — queue corruption and cross-thread request reuse (latent UAF/double-free; sibling of twe DF-4178) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twa/tw_osl_freebsd.c:1282 · pass 2 · new	none	untested
DF-4611	Low	6.4	nm_init() programs ring/coeff buffers from unvalidated card-provided buftop — cbuf/rbuf/pbuf/acbuf wrap to ~4G offsets used by nm_wrbuf() and sndbuf_setup() Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/neomagic.c:576 · pass 2 · new	none	untested
DF-4628	Low	6.4	bxt_exec_gpio: function-static bxt_gpio_table caches devm-allocated gpio_descs across device unbind/rebind — use-after-free on gpiod_set_value Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_dsi_vbt.c:304 · pass 2 · new	UAF write (gpiod_set_value mutates desc->flags/value) on first panel-enable after rebind; potentially exploitable if the freed chunk is reclaimed	untested
DF-4963	Low	6.4	snd_hdspe attach has no error unwind: failed attach leaks snd lock/IRQ/DMA resources and leaves hdspe_intr live on a dead device — after kldunload the IRQ vector dispatches into unmapped module text Base system — drivers · sys/dev/sound/pci/hdspe.c:293 · pass 2 · new	corruption	untested
DF-5326	Low	6.4	mp_bootaddress() integer underflow on degenerate base-memory size corrupts the kernel physical memory map Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mp_machdep.c:212 · pass 2 · new	none	untested
DF-2645	Medium	6.3	Flush-driven indirect collapse contradicts its own skip guard: concurrent child COW-modify during hammer2_chain_indirect_maintenance leaves a live child, tripping the unconditional repchange emptiness KKASSERT (panic) or orphaning the subtree (silent data loss) Hammer2 · sys/vfs/hammer2/hammer2_flush.c:1039 · pass 2 · new	none	not_reproduced
DF-3000	Medium	6.3	hammer_vop_write UIO_NOCOPY (putpages/msync) path: bqrelse(bp) followed by bread(&bp) makes breadnx reuse the RELEASED buffer; write-out then runs on an unlocked free-queued buffer (guaranteed panic('buffer is not busy') + buffer-recycle race window); identical pattern in hammer2 Base system — filesystems · sys/vfs/hammer/hammer_vnops.c:690 · pass 2 · new	none	not_reproduced
DF-3093	Medium	6.3	MSDOSFS_LOCK_MP expands to nothing: the free-cluster allocator (clusteralloc/chainalloc/usemap_alloc + pm_inusemap scan) is unsynchronized on SMP — double-allocation/cross-linked files (release) or KASSERT panic (INVARIANTS) Base system — filesystems · sys/vfs/msdosfs/msdosfs_fat.c:340 · pass 2 · new	none	not_reproduced
DF-3116	Medium	6.3	msdosfs_rename() restores stale de_fndoffset/de_fndcnt after dropping the target-directory lock — createde() blindly overwrites a concurrently-created dirent (TOCTOU) Base system — filesystems · sys/vfs/msdosfs/msdosfs_lookup.c:314 · pass 2 · new	none	not_reproduced
DF-3118	Medium	6.3	Signed 32-bit flusher sequence ring misorders all completion/mis-sequencing comparisons past 2^31; wrapped state causes permanently stuck flush group and self-sustaining synchronous-finalize storm (system wedge) Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_flusher.c:114 · pass 2 · new	dos	inconclusive
DF-3345	Medium	6.3	lagg_lacp_detach drops the lagg WLock mid-detach while sc_* protocol callbacks remain installed: ioctl re-entry into half-torn-down LACP state (incl. unprivileged SIOCGLAGG) Kernel memory corruption (UAF / OOB write) · sys/net/lagg/if_lagg.c:1085 · pass 2 · new	none	not_reproduced
DF-3604	Medium	6.3	bce_rx_intr trusts NIC-DMA'd l2_fhdr_pkt_len with no MCLBYTES bound: heap OOB read up to ~63.5KB past the 2048-byte RX cluster, and unsigned underflow to ~4GB m_len (guaranteed panic) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bce/if_bce.c:4396 · pass 2 · new	none	inconclusive
DF-3630	Medium	6.3	iwm_handle_rxb: PAGE_SIZE sc_cmd_resp copy from possibly-offset response packet reads up to ~4KB past the 4096-byte RX cluster; iwm_alive_fn v3 fallback reads fixed struct without payload-length check Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm.c:5511 · pass 2 · new	none	inconclusive
DF-3639	Medium	6.3	bnx_rxeof trusts NIC-DMA'd return-ring bge_len with no MCLBYTES bound: heap OOB read / kernel info leak up to ~63.5KB past the 2048-byte RX cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bnx/if_bnx.c:2848 · pass 2 · new	none	inconclusive
DF-3663	Medium	6.3	bge_rxeof trusts NIC-DMA'd return-ring bge_len with no MCLBYTES/jumbo bound: heap OOB read / kernel info leak up to ~63.5KB past the RX cluster (OOB write on i386 ALIGNBUG path) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bge/if_bge.c:3138 · pass 2 · new	none	inconclusive
DF-3765	Medium	6.3	32-bit multiply overflow in r100_cs_track_check() PW=1 vertex-array bound (esize * max_indx * 4) -> CS validator bypass -> GPU OOB index/vertex fetch Base system — drivers · sys/dev/drm/radeon/r100.c:2326 · pass 2 · new	leak	inconclusive
DF-3766	Medium	6.3	(value + 1) 32-bit wrap in r100_cs_track_check_pkt3_indx_buffer() bypasses the PACKET3_INDX_BUFFER offset check -> GPU OOB index fetch up to ~4GB past the BO Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r100.c:1909 · pass 2 · new	leak	inconclusive
DF-3849	Medium	6.3	dc_rxeof trusts the NIC-DMA'd 14-bit RX frame length with no bound against the 2040-byte posted cluster: heap OOB read up to ~14 KB handed to the stack, and negative m_len on FRAMESZ<4 (DF-3604 family, dc(4) instance) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/dc/if_dc.c:2523 · pass 2 · new	none	inconclusive
DF-3933	Medium	6.3	Single-segment RX frame length taken unclamped from the return descriptor: m_len/m_pkthdr.len up to 65535 on a 2046-byte cluster — heap OOB read (kernleak) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/age/if_age.c:2000 · pass 2 · new	none	not_reproduced
DF-3973	Medium	6.3	Ignored btc_dpm_init failure leaves dangling rdev->pm.dpm.ps and un-NULLed dyn_state pointers: double free in btc_dpm_fini (two paths) plus eg_pi/ps_priv leaks — btc twin of DF-3645/3755/3955 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/btc_dpm.c:2574 · pass 2 · new	none	inconclusive
DF-4024	Medium	6.3	re_rxeof trusts the NIC-DMA'd 14-bit GFRAGLEN (RE_RXBYTES) with no bound vs MCLBYTES: single-fragment m_len up to 16379 on a 2048-byte cluster -> 14,331-byte heap OOB read into delivered frames; multi-fragment m_pkthdr.len past the fragment chain -> m_copydata NULL-walk panic — DF-3604/3759/3933/3989 family, re(4) instance Kernel memory leaks / uninitialized disclosure · sys/dev/netif/re/if_re.c:1142 · pass 2 · new	none	inconclusive
DF-4211	Medium	6.3	mpt_refresh_raid_vol frees a request on ETIMEDOUT that is still queued to the IOC and on request_pending_list → request-pool double-link / cross-command use-after-free Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_raid.c:1327 · pass 2 · new	none	untested
DF-4253	Medium	6.3	SATA-ID timeout recovery frees in-flight commands (SMID reuse confusion), can Target-Reset the wrong target, and overwrites targ->tm without NULL check Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas_lsi.c:992 · pass 2 · new	none	inconclusive
DF-4371	Medium	6.3	Dangling rdev->pm.dpm.dyn_state entries pointers after error-path kfree in r600_parse_extended_power_table — r600_free_extended_power_table at teardown kfrees them again (heap double free; root site shared by all six DPM family callers) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_dpm.c:939 · pass 2 · new	none	not_reproduced
DF-4398	Medium	6.3	tws_scsi_err_complete touches the ccb after xpt_done (callout_stop on a surrendered ccb) — CAM ccb use-after-free race on every error completion Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_cam.c:593 · pass 2 · new	panic	inconclusive
DF-4400	Medium	6.3	tws_intr_resp invokes req->cb with no busy-state/completer validation — firmware replay of an in-range req_id double-completes surrendered ccbs or calls a NULL cb (distinct from DF-1590's index OOB) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_cam.c:1161 · pass 2 · new	panic	inconclusive
DF-5021	Medium	6.3	dp_retrain_link_dp_test walks dc->current_state with no lock and no state reference while concurrent atomic commits release it — use-after-free driven by unauthenticated HPD-RX automated-test input from a malicious DP sink Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_link_hwss.c:274 · pass 2 · new	kernel UAF/NULL-deref per finding	untested
DF-2725	Low	6.3	cluster_rbuild() under-counts component pages vs the pbuf's embedded xio_pages[]/KVA window — latent OOB pointer write + PTE install past MAXPHYS window for non-page-tiling VFS geometry Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_cluster.c:954 · pass 2 · new	none	not_reproduced
DF-3719	Low	6.3	Firmware load: registration-metadata size drives an unbounded SRAM PIO copy (*limit initialized to sram_size then blindly overwritten) and short-inflate copies uninitialized kernel heap to the NIC Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mxge/if_mxge.c:685 · pass 2 · new	none	inconclusive
DF-3891	Low	6.3	Double free of adev->pm.dpm.ps (and leak of parsed ps_priv states) on the kzalloc-failure path of kv_parse_power_table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/kv_dpm.c:2750 · pass 2 · new	none	inconclusive
DF-4317	Low	6.3	lge_jref() check-then-increment runs without the jslot serializer: racing lge_jfree() recycles the slot onto the free list with inuse==1 — double ownership of a 9KB RX jumbo cluster (DF-1384 nge twin) Base system — drivers · sys/dev/netif/lge/if_lge.c:810 · pass 2 · new	none	untested
DF-4725	Low	6.3	aureal: bad: unwind frees au BEFORE bus_teardown_intr (live IRQ handler over freed softc — UAF write in au_intr) and releases NULL reg[] entries after a mid-list BAR failure (NULL-deref panic) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/aureal.c:599 · pass 2 · new	none	untested
DF-4977	Low	6.3	cardbus_detach_card ignores device_detach/device_delete_child failures and pci_freecfg's the child devinfo anyway: surviving child keeps freed ivars (UAF) while its bus resources are ripped out from under the running driver Kernel memory corruption (UAF / OOB write) · sys/dev/pccard/cardbus/cardbus.c:236 · pass 2 · new	none	untested
DF-5274	Low	6.3	cdgetccb() stores its result in a function-static 'union ccb *' — concurrent callers on different SIM locks can receive the same ccb (double xpt_release_ccb) or leak one Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_cd.c:1384 · pass 2 · new	CCB double-release UAF family (DF-5274) / attach-time leak (DF-5275)	untested
DF-4828	High	6.2	r600_hdmi_buffer_status_changed / r600_hdmi_update_audio_settings consume lvds-typed enc_priv as radeon_encoder_atom_dig on the audio-work walk: dig->afmt OOB read at +288 into the adjacent slab chunk → wild deref + last_buffer_filled_status write-through (DF-4635 family, new sinks, interrupt-driven trigger) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_hdmi.c:283 · pass 2 · new	none	inconclusive
DF-3902	Low	6.2	sioclose() gone-path double-free of com->ibuf: kfree guarded by '!= NULL' but pointer never NULLed — every further close on the detached unit re-frees the same M_DEVBUF block Kernel memory corruption (UAF / OOB write) · sys/dev/serial/sio/sio.c:1475 · pass 2 · new	none	inconclusive
DF-3967	Low	6.2	tx_intr STA_CSR4 completion desync: qid 5-15 garbage mapped to the mgt ring, results matched to the driver's stat cursor rather than a device index, unguarded txq->queued-- underflow defeating the ring-full gate, and m leaked on the ni==NULL path Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ral/rt2661.c:896 · pass 2 · new	none	not_reproduced
DF-3706	Medium	6.1	vega10_setup_default_pcie_table reads bios entries[1] past the allocation when the VBIOS PCIE table has a single state (NUM_LINK_LEVELS=2) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1232 · pass 2 · new	none	inconclusive
DF-3872	Medium	6.1	mfi_check_for_sscd() dereferences NULL cm_data on MFI_CMD DCMD CFG_ADD with zero data_len (and heap-OOB-reads short buffers, bypassing pre/post checks) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi.c:2679 · pass 2 · new	dos	inconclusive
DF-3915	Medium	6.1	Wild OOB read (and NVRAM garbage write) in _mapping_commit_enc_entry via unvalidated enclosure start_index ingested from DPM pg0 (num_slots==0 bypasses DF-1282) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:129 · pass 2 · new	none	not_reproduced
DF-4075	Medium	6.1	mps_request_polled has no timeout cancellation: mps_update_events prints a NULL reply (NULL-deref panic) and callers free still-posted commands that late-complete against freed/reallocated cm state Base system — drivers · sys/dev/raid/mps/mps.c:1724 · pass 2 · new	none	inconclusive
DF-4424	Medium	6.1	Negotiated SEG_MAX smaller than a MAXPHYS transfer overflows the per-queue sglist: KASSERT panic on INVARIANTS kernels, truncated/mislabeled descriptor chain in production Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/virtio/block/virtio_blk.c:582 · pass 2 · new	none	not_reproduced
DF-4447	Medium	6.1	VCE two-pass parse desynchronization: amdgpu_vce_cs_reloc patches the NEXT command's len/cmd header via in-IB dword aliasing — attacker-synthesized command stream skips loop-1 validation and len=0 causes an infinite in-kernel loop in the CS ioctl Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vce.c:656 · pass 2 · new	dos	untested
DF-4452	Medium	6.1	Wild out-of-bounds read in acpi_pci_link_choose_irq(): unbounded _PRS extended-IRQ values and FADT SciInterrupt used as index into pci_link_interrupt_weights[256] Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_pci_link.c:1010 · pass 2 · new	none	not_reproduced
DF-4500	Medium	6.1	radeon_uvd CS parser/hardware desync: stale-or-unset DATA0/DATA1 dword indices patch the validated IB and make the UVD engine consume unvalidated GPU addresses Base system — drivers · sys/dev/drm/radeon/radeon_uvd.c:583 · pass 2 · new	none	untested
DF-5479	Medium	6.1	efi_enter()/efi_leave(): per-CPU CR4.SMEP disable with no critical section or CPU pinning (the comment claims one) — preempt+migrate inside the runtime window leaves the source CPU with SMEP permanently off and the migrated firmware call SMEP-fault-looping with efi_lock held forever Base system — bus / platform / cpu · sys/platform/pc64/x86_64/efirt.c:327 · pass 2 · new	none	inconclusive
DF-3689	Low	6.1	Heap OOB read via unvalidated u8 vddInd/vddcInd from VBIOS indexing the voltage-lookup tables Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1858 · pass 2 · new	none	inconclusive
DF-3821	Low	6.1	Unvalidated GETCOMMPREF geometry: aac_max_fib_size of zero divides by zero at attach (boot panic); sizes below the 28-byte FIB header make the unconditional header copyin overflow the undersized FIB slots Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac.c:1802 · pass 2 · new	none	inconclusive
DF-4172	Low	6.1	iir_intr: unvalidated controller completion index reads/writes up to 2 gdt_ccb entries past sc_gccbs[124] (OOB dispatch, SLIST corruption, wild gc_ccb/gc_ucmd derefs) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir.c:1580 · pass 2 · new	none	untested
DF-4889	Low	6.1	iir_pci_attach drives the i960 MPR register layout at fixed offsets 0x2c-0x3fc0 with no BAR0 size validation — short BAR0 => MMIO reads/writes past the resource mapping (panic or up to ~12KB wild zero-write) before the magic read-back can reject the card Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir_pci.c:186 · pass 2 · new	Out-of-bounds device-memory (MMIO) access from a short BAR0: kernel page-fault panic or up to ~12KB bulk zero-write past the resource mapping, before the magic read-back check; requires crafted/broken PCIe hardware with the probed Intel/ICP IDs (CWE-125/CWE-787 device-memory variant)	untested
DF-5781	Low	6.1	hci_route_lookup walks hci_unit_list and unit->hci_links with no synchronization against attach/detach (crit_enter-only) and privileged hci_disable teardown — UAF reads and 6-byte freed-heap disclosure via getsockname Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_misc.c:65 · pass 2 · new	none	untested
DF-3383	Medium	6.0	bpfdetach() frees only the FIRST bpf_if of an interface: leftover entries (wlan radiotap) keep bif_ifp/bif_driverp pointing at the freed ifnet -> UAF writes/reads on later close or rebind; bp==NULL branch dereferences NULL instead of reporting Kernel memory corruption (UAF / OOB write) · sys/net/bpf.c:1566 · pass 2 · new	none	not_reproduced
DF-3598	Medium	6.0	gfx_v8_0_init_microcode ignores amdgpu_ucode_validate() result for the RLC firmware (asymmetric size gate) Base system — drivers · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1082 · pass 2 · new	none	inconclusive
DF-3645	Medium	6.0	UAF + double free of rdev->pm.dpm.{ps,priv}: ci_parse_power_table/ci_dpm_init free and leave dangling pointers, and radeon_pm_init_dpm ignores the dpm.init failure Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ci_dpm.c:5620 · pass 2 · new	none	inconclusive
DF-3697	Medium	6.0	RLC v2_1 save-restore-list offset/size fields parsed without any bounds check → wild-pointer memcpy (OOB kernel heap read / panic) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/gfx_v9_0.c:516 · pass 2 · new	none	not_reproduced
DF-3852	Medium	6.0	Voltage-GPIO MMIO register index taken raw from VBIOS and executed by r100_pm_misc() — arbitrary in-BAR register RMW and out-of-BAR MM_INDEX writes (up to 0x3FFFC) Base system — drivers · sys/dev/drm/radeon/radeon_combios.c:2748 · pass 2 · new	none	inconclusive
DF-3859	Medium	6.0	vega20_odn_edit_dpm_table VDDC_CURVE: one-sided signed bounds check (input_index > 2) lets negative user index through -> OOB read of od8_settings_array with values disclosed via pr_info (DF-3704 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2678 · pass 2 · new	none	not_reproduced
DF-3983	Medium	6.0	sbp_orb_pointer fw_asyreq-failure branch xpt_done()s the CCB while leaving the OCB queued on sdev->ocbs, timeout-armed and dmamap-loaded — later timeout/device completion fires a second xpt_done on the stale ccb and/or duplicate-frees the OCB Base system — drivers · sys/dev/disk/sbp/sbp.c:1175 · pass 2 · new	none	inconclusive
DF-3631	Low	6.0	iwm_read_firmware TLV walk: size_t underflow on len -= roundup2(tlv_len,4) (and datasize < header) walks the parser past the firmware image Base system — drivers · sys/dev/netif/iwm/if_iwm.c:607 · pass 2 · new	none	inconclusive fixed
DF-3687	Low	6.0	Signed-compare bypass in smu7_odn_edit_dpm_table: negative sysfs level passes the bounds check and wraps to a u32 wild write index Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4854 · pass 2 · new	none	inconclusive
DF-3695	Low	6.0	ata_raid_delete frees the ar_softc without draining in-flight I/O — use-after-free in ata_raid_done/strategy Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:1281 · pass 2 · new	none	untested
DF-3720	Low	6.0	Unvalidated firmware-returned SRAM offsets used as kernel write pointers (lanai TX/RX rings, intr_coal_delay_ptr, irq_claim/irq_deassert, RSS table and key): OOB MMIO writes past the BAR mapping on a hostile device; int16_t ring-mask truncation on device ring sizes Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mxge/if_mxge.c:1207 · pass 2 · new	none	inconclusive
DF-3824	Low	6.0	ASR_init_message writes the mandatory sense SGL element 8 bytes past asr_action's 512-byte stack buffer when one CCB spans >=58 physical runs; the adapter-derived ha_SgSize limit is computed and never used Kernel memory corruption (UAF / OOB write) · sys/dev/raid/asr/asr.c:1812 · pass 2 · new	none	inconclusive
DF-4174	Low	6.0	gdtexecuteccb: unbounded physical scatter/gather copy — CAM_SCATTER_VALID\|CAM_SG_LIST_PHYS CCBs with sglist_cnt > GDT_MAXSG overflow the 324-byte gccb->gc_cmd (pass(4)-reachable heap overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir.c:876 · pass 2 · new	none	untested
DF-4399	Low	6.0	Passthrough SGL written at user-controlled offset: gcmd->size (u8, verbatim from TWS_IOCTL_FIRMWARE_PASS_THROUGH) used as SGL destination offset — lands on neighboring request's header_desc Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_cam.c:1034 · pass 2 · new	panic	inconclusive
DF-4704	Low	6.0	get_pixel_size() integer-divides depth by 8 and the blit/fill dispatch falls through to 32-bit ops — 8bpp KMS console gets 4-byte/pixel writes on a 1-byte/pixel stride (OOB writes past the framebuffer mapping) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/sckmsrndr.c:138 · pass 2 · new	Kernel page faults / adjacent-memory corruption on the first console clear at 8bpp KMS console (4-byte writes on a 1-byte stride); root/boot-config gated	untested
DF-5025	Low	6.0	ipsd open/detach TOCTOU: detach can free the ipsdisk softc under an open descriptor — ipsd_close/strategy then write freed memory (DF-5013 pattern in ips) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips_disk.c:92 · pass 2 · new	none	not_reproduced
DF-3480	Medium	5.9	so_rcv mutation from the SWI task without the sockbuf token: ng_btsocket_l2cap_data_input's sbappendrecord() races soreceive's ssb_token-protected unlink surgery (lost wakeups / torn record chains / potential freed-mbuf write) Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1455 · pass 2 · new	none	not_reproduced
DF-3482	Medium	5.9	ng_ppp_mp_strategy uses the file-scope global compareLatencies as kqsort comparator state and clears it to NULL on exit — the DF-0330 twin is LIVE in v1 wherever unfuneled transmit contexts exist (ng_iface output): NULL-index kernel panic Base system — network stack · sys/netgraph/ppp/ng_ppp.c:363 · pass 2 · new	none	inconclusive
DF-3778	Medium	5.9	jme_rxeof() RX walk has no work bound on the interrupt path (count=-1 at all three call sites): a remote line-rate small-packet flood keeps the ring perpetually non-empty so the interrupt handler loops forever holding the serializer — NIC + CPU livelock, whole-interface wedge on legacy/MSI (DF-3761/alc family, jme(4) instance) Base system — drivers · sys/dev/netif/jme/if_jme.c:2494 · pass 2 · new	none	inconclusive
DF-3074	Low	5.9	nfs_mountdiskless() double-frees the dup_sockaddr() on mountnfs() failure (mountnfs's bad: path frees nm_nam via nfs_free_mount, then haderror kfrees it again) Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_vfsops.c:767 · pass 2 · new	none	not_reproduced
DF-4722	Low	5.9	ath_tdma_update passes the 0xff rateCodeToIndex sentinel into ath_hal_pkt_txtime — OOB read of rates->info[255] (64-entry table) and possible divide-by-zero panic from a received TDMA beacon Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_tdma.c:407 · pass 2 · new	none	untested
DF-2786	Medium	5.8	mtx_abort_link stale-state double-unlink: mtx_delete_link leaves MTX_LINK_LINKED_* set on an unlinked link until an unlocked IDLE reset, letting a racing abort write through dangling next/prev (UAF-write / wait-queue poisoning) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_mutex.c:914 · pass 2 · new	none	not_reproduced
DF-2896	Medium	5.8	cnwrite() constty use-after-free: unsynchronized constty->t_dev captured without a reference and dispatched through dev_doperate() after a sleepable log_console() walk, while an unprivileged user (default UCONSOLE) controls the cdev's lifetime Kernel memory corruption (UAF / OOB write) · sys/kern/tty_cons.c:465 · pass 2 · new	none	not_reproduced
DF-2923	Medium	5.8	vq_vptomp check-then-use race on vp->v_pfsmp → mount use-after-free with indirect call through freed memory Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_quota.c:420 · pass 2 · new	none	not_reproduced
DF-3862	Medium	5.8	amdgpu_device_gpu_recover dereferences the timed-out job across the multi-second GPU reset although the fence-completion path can already have kfree'd it (UAF, concurrent-reinit family) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_device.c:3414 · pass 2 · new	none	not_reproduced
DF-4335	Medium	5.8	twa CL: tw_cli_get_param/tw_cli_set_param re-queue a request after ETIMEDOUT — FREE_Q double-insert (unwalkable queue, spin under gen_lock) or BUSY_Q+FREE_Q dual membership (request reuse under live firmware DMA) Base system — drivers · sys/dev/raid/twa/tw_cl_io.c:804 · pass 2 · new	none	untested
DF-4584	Medium	5.8	radeon_bo_get_surface_reg steals surface registers from other BOs under no lock: NULL-deref panic and 4-byte UAF write into freed radeon_bo slab Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_object.c:609 · pass 2 · new	none	inconclusive
DF-4783	Medium	5.8	mmcsd_detach() does not exclude or drain the data path: strategy/open callers race lockuninit() and the newbus softc free (DF-4646 family) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mmcsd/mmcsd.c:209 · pass 2 · new	none	not_reproduced
DF-3315	Low	5.8	in_pcblist_range walks non-shared pcbinfo (ripcbinfo) with no synchronization; non-atomic marker advance vs same-cpu netisr pcb teardown yields UAF read/write and list corruption Kernel memory corruption (UAF / OOB write) · sys/netinet/in_pcb.c:2452 · pass 2 · new	none	not_reproduced
DF-3656	Low	5.8	Error-path UAF: amdgpu_dm init failure paths kfree registered i2c adapters / connectors / encoders / planes that remain in DRM core lists Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4080 · pass 2 · new	none	inconclusive
DF-4216	Low	5.8	dc_submit_i2c indexes dc->links[] with an unvalidated, wrong-domain index (DDC line number from VBIOS): NULL/wild deref panic and silent wrong-connector DDC routing Base system — drivers · sys/dev/drm/amd/display/dc/core/dc.c:1742 · pass 2 · new	none	untested
DF-4468	Low	5.8	ess_attach() pcm_register-failure unwind kfrees sc while the 0666 /dev/mixerN that mixer_init() published survives — dangling mixer devinfo UAF on open/ioctl (DF-4156 family, 8th instance) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/solo.c:1045 · pass 2 · new	none	inconclusive
DF-4486	Low	5.8	REPROBE destroy path leaves the per-output ACPI notify handler registered against freed memory (AcpiRemoveNotifyHandler(NULL) is a no-op) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_video/acpi_video.c:386 · pass 2 · new	none	untested
DF-3310	Medium	5.7	Port change on a running wg interface re-runs lockinit() on the live so_lock and closes/swaps the UDP sockets without holding it Base system — network stack · sys/net/wg/if_wg.c:974 · pass 2 · new	none	not_reproduced
DF-3311	Medium	5.7	Interface down/destroy tears down tasks/queues/softc while the receive upcall can still re-enqueue them (sockets closed last): late handshake/decrypt task fires on freed softc Privilege escalation (general use) · sys/net/wg/if_wg.c:2166 · pass 2 · new	dos	inconclusive
DF-3429	Medium	5.7	DWDS discovery frames staged on ic_stageq are leaked forever on age-out: ieee80211_node_timeout discards the mbuf list returned by ieee80211_ageq_age (remote kernel memory-exhaustion DoS) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_wds.c:321 · pass 2 · new	none	inconclusive
DF-3593	Medium	5.7	Duplicate firmware TX-done re-completes a freed TX slot: NULL-deref/KASSERT panic and TX-ring accounting underflow Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn.c:5996 · pass 2 · new	panic	inconclusive
DF-3594	Medium	5.7	bwn_intr_noise missing re-entry guard: 9th noise-sample interrupt writes 4 bytes past noi_samples into mac_phy Kernel memory corruption (UAF / OOB write) · sys/dev/netif/bwn/bwn/if_bwn.c:5198 · pass 2 · new	panic	inconclusive
DF-3716	Medium	5.7	mxge_rx_done_big trusts the NIC-DMA'd 16-bit completion length with no posted-cluster bound: heap OOB read up to ~63.5KB past the 2/4KiB RX cluster (DF-3604/3639/3663/3679/3713 family) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/mxge/if_mxge.c:2345 · pass 2 · new	none	inconclusive
DF-3931	Medium	5.7	Detach/shutdown lifetime: self-rescheduling mly_periodic can survive callout_stop and in-flight commands are never drained — use-after-free after mly_free() Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:1397 · pass 2 · new	none	not_reproduced
DF-4023	Medium	5.7	Dangling rdev->pm.dpm.ps after kzalloc-failure kfree in rv7xx_parse_power_table (:2308): ignored rv770_dpm_init error -> double free in rv770_dpm_fini at unload/reboot + leak of parsed ps_priv states — shared root site of DF-3645/3755/3955/3973, rv770-dispatch instance Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rv770_dpm.c:2306 · pass 2 · new	none	inconclusive
DF-4110	Medium	5.7	tl_intvec_rxeof trusts device-written 16-bit tlist_frsize: unbounded mbuf length on an MCLBYTES cluster (OOB read propagated up the network stack) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/tl/if_tl.c:1405 · pass 2 · new	none	untested
DF-4113	Medium	5.7	nge_rxeof trusts device-written 16-bit descriptor BUFLEN: unbounded mbuf length on the jumbo minicluster (OOB read propagated up the network stack) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/nge/if_nge.c:1225 · pass 2 · new	none	untested
DF-4117	Medium	5.7	Dangling rdev->pm.dpm.ps after swallowed cypress_dpm_init failure: double free in cypress_dpm_fini at unload/reboot (cypress dispatch of the DF-4023/DF-3973 family) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/cypress_dpm.c:2050 · pass 2 · new	none	inconclusive
DF-4162	Medium	5.7	radeon_pm.c:1448 discards radeon_dpm_init() return (and the asic *_init files discard radeon_pm_init's): the root enabler of the six-file NULL-boot_ps / dangling-ps family — central hub fix consolidating DF-4022/3972/4117/4118/4124/4125/4143/4144 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_pm.c:1448 · pass 2 · new	none	inconclusive
DF-4503	Medium	5.7	ahci_pm_read/write recycle the ata_xfer while the command is still programmed on the chip (deferred timeout returns ATA_S_ONCHIP): CCB freed and re-issuable while chip owns the slot -> ahci_ata_cmd_done KKASSERT panic or cross-command completion corruption Base system — drivers · sys/dev/disk/ahci/ahci_pm.c:976 · pass 2 · new	none	inconclusive
DF-5218	Medium	5.7	dc_sink retain/release contract violated by DM forced-connector paths: emulated_link_detect strands references (permanent ~1KB dc_sink leak per forced-detect cycle) and update_connector_after_detect branch A releases a borrowed dc_sink (premature free with dangling link->local_sink, or kref_put UAF write + dc_sink_free double-free on freed slab after EDID-change detect) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_sink.c:68 · pass 2 · new	none	inconclusive
DF-2709	Low	5.7	hammer2_volconf_update() uses iocom->conn_state unlocked across a peer-driven drop (TOCTOU): kdmsg_lnk_conn_reply mutates conn_state without msglk Base system — kernel core (kern) · sys/kern/kern_dmsg.c:231 · pass 2 · new	none	not_reproduced
DF-3153	Low	5.7	volume-del on a volume hosting UNDO-zone big-blocks: bare KKASSERT(0) panics INVARIANTS kernels; on production kernels the case falls through and bzero()s live undo FIFO entries (silent crash-recovery corruption) Base system — filesystems · sys/vfs/hammer/hammer_volume.c:554 · pass 2 · new	none	untested
DF-3171	Low	5.7	mfsclose() deactivates the MFS I/O server on ANY device close — no finality check (speculative: would destroy_dev/kfree the serving mfsnode under a live mount if a non-final close ever slips through) Kernel memory corruption (UAF / OOB write) · sys/vfs/mfs/mfs_vfsops.c:136 · pass 2 · new	none	not_reproduced
DF-3628	Low	5.7	Unvalidated VBT backlight.controller used as power-sequencer register index (out-of-range MMIO writes on BXT) Base system — drivers · sys/dev/drm/i915/intel_dp.c:864 · pass 2 · new	none	inconclusive
DF-3875	Low	5.7	mfi_intr bounds reply-queue contexts by mfi_max_fw_cmds but mfi_commands[] is allocated MIN(128, mfi_max_fw_cmds) -> OOB command object under firmware misbehavior Base system — drivers · sys/dev/raid/mfi/mfi.c:1228 · pass 2 · new	none	inconclusive
DF-3963	Low	5.7	mv family queue-pointer registers used unmasked: device-fed outbound_tail/inbound_head index inbound_q/outbound_q[512] MMIO — OOB bus-space read and 8-byte OOB MMIO write up to ~32GB past BAR2 Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptiop/hptiop.c:229 · pass 2 · new	none	not_reproduced
DF-4163	Low	5.7	radeon_pm_fini_dpm never cancels pm.dpm.thermal.work nor clears dpm_enabled while the thermal IRQ outlives pm_fini: post-fini UAF in radeon_dpm_thermal_work_handler Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_pm.c:1690 · pass 2 · new	none	inconclusive
DF-4173	Low	5.7	iir_shutdown: shared flush ucmd freed (wrong malloc type) while still queued/in flight, and re-queued for the next drive while a gccb owns it — use-after-free at shutdown Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir.c:1493 · pass 2 · new	none	untested
DF-4223	Low	5.7	Attach error-path asymmetry: double bus_dmamap_destroy (double kfree of M_DEVBUF maps) and callout_drain/bus_dmamap_destroy walked through a NULL hcb array Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vmware/pvscsi/pvscsi.c:615 · pass 2 · new	none	inconclusive
DF-4286	Low	5.7	acpi_thinkpad LED async task (AcpiOsExecute) not drained on detach — use-after-free of the softc Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:391 · pass 2 · new	use-after-free of acpi_thinkpad softc (read/write + AcpiEvaluateObject with handles loaded from freed memory) racing kldunload/devctl-detach against /dev/led/thinklight toggles; root-only, hardware-gated	inconclusive
DF-4328	Low	5.7	sf_attach() bus_setup_intr() failure path double-invokes ether_ifdetach() and passes a NULL intr cookie to bus_teardown_intr() Base system — drivers · sys/dev/netif/sf/if_sf.c:777 · pass 2 · new	none	untested
DF-4352	Low	5.7	dce110_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:588 · pass 2 · new	none	untested
DF-4405	Low	5.7	amdgpu_uvd sw_init/resume trust unvalidated firmware ucode extent fields (ucode_size_bytes/ucode_array_offset_bytes) — sw_init bo_size u32 wrap, resume ~4GiB OOB read past the firmware blob and underflowed OOB memset_io (DF-1946 family instance) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:250 · pass 2 · new	none	inconclusive
DF-4438	Low	5.7	mrsas_cam_attach error paths free sim_0/sim_1 without clearing sc pointers — attach_fail_cam unwind re-frees via mrsas_cam_detach: cam_sim_path() UAF read, second xpt_bus_deregister, cam_sim_free() double-free into M_CAMSIM (plus devq refcount underflow) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas_cam.c:150 · pass 2 · new	none	inconclusive
DF-4495	Low	5.7	dce100_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319/4352/4375 family twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce100/dce100_resource.c:573 · pass 2 · new	none	untested
DF-4512	Low	5.7	vmbus: selected/registered vmbus cputimer never stopped or deregistered on detach - per-tick reload runs on the freed vmbus_softc and through unloaded module text (UAF write + dangling call target) after kldunload Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/hyperv/vmbus/vmbus.c:280 · pass 2 · new	Per-tick UAF write (8-byte host-influenced value into freed softc) + call through unloaded module text after kldunload	untested
DF-4543	Low	5.7	agp: /dev/agpgart cdev outlives chipset detach - dangling si_drv1 UAF on open fds, plus free_cdev unit-vs-minor mismatch leaves a stale node Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:240 · pass 2 · new	none	not_reproduced
DF-4719	Low	5.7	Pending AAC_EVENT_CMFREE fires after aac_cam_detach freed the sim -> xpt_release_simq/xpt_done through freed objects (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac_cam.c:165 · pass 2 · new	none	untested
DF-4908	Low	5.7	ath_descdma_setup() returns error==0 (success) after tearing everything down when the ath_buf array kmalloc fails — and the unvalidated RWTUN hw.ath.*buf sysctls feeding it make the failure deterministic (and can truncate bsize into a small kmalloc walked OOB by the setup loop) Base system — drivers · sys/dev/netif/ath/ath/if_ath_descdma.c:272 · pass 2 · new	panic	untested
DF-4909	Low	5.7	__drm_legacy_pci_free consumes never-initialized tag/map: the DF port broke the _DRM_CONSISTENT map's alloc/free contract — drm_pci_alloc's descriptor is kfree'd at addmap, the rmmap path forges it on the stack with only vaddr/busaddr/size, and the DF bus_dma teardown then runs bus_dmamap_unload/bus_dmamem_free/bus_dma_tag_destroy on uninitialized stack pointers while the real tag/map/DMA memory leak permanently Base system — drivers · sys/dev/drm/drm_pci.c:152 · pass 2 · new	corruption	untested
DF-4916	Low	5.7	amdgpu_virt_init_data_exchange: host-controlled pf2vf_size drives a 1 KB memset (and the header reads) past the kmap'ed fw VRAM reservation — no validation that the region contains the 64 KB-offset exchange area Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_virt.c:402 · pass 2 · new	none	not_reproduced
DF-5057	Low	5.7	mlxd lifetime TOCTOU: MLX_DETACH_DRIVE checks MLXD_OPEN then sleeps in mlx_flush before device_delete_child; mlxd_detach has no recheck and no in-flight drain — softc freed under racing open fds / in-flight bios (DF-5025/DF-5046 family, last LD sibling) Base system — drivers · sys/dev/raid/mlx/mlx_disk.c:98 · pass 2 · new	none	untested
DF-5301	Low	5.7	TOCTOU: uhub_child_location_string()/uhub_child_pnpinfo_string() dereference sc->sc_udev->hub after a device_is_attached() guard that stays true while uhub_detach() frees and NULLs it (NULL-deref panic / UAF read) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_hub.c:1668 · pass 2 · new	none	not_reproduced
DF-5442	Low	5.7	Cross-CPU MTRR reprogram race: amd64_mrstore() fire-and-forget IPI vs amd64_mrfetch() immediate rewrite of the shared mr_desc[] array leaves a persistent per-CPU memory-type desync (torn descriptor generation) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/amd64_mem.c:289 · pass 2 · new	none	not_reproduced
DF-4829	Info	5.7	md(4) mdstrategy_malloc sector-array growth uses 32-bit sector number and 32-bit size arithmetic: wrapped growth kmalloc(0)/(undersized chunk) -> ZERO_LENGTH_PTR bcopy / heap overflow + wild write (LATENT — unreachable behind dscheck) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/md/md.c:253 · pass 2 · new	none	not_reproduced
DF-4893	Info	5.7	Dead AH_DEBUG_ALQ block: unlocked global `ath_hal_alq` TOCTOU — use-after-free of `struct alq` if ever compiled (latent, triple-unreachable on stock DF) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ah_osdep.c:230 · pass 2 · new	none	untested
DF-3029	Medium	5.6	fuse_io_thread lost-wakeup window (no tsleep interlock between empty-queue check and sleep) can strand a bio indefinitely Base system — filesystems · sys/vfs/fuse/fuse_vnops.c:1682 · pass 2 · new	none	not_reproduced
DF-3667	Medium	5.6	ix_rxeof trusts NIC-DMA'd descriptor length with no rx_mbuf_sz bound: unbounded m_len/m_pkthdr.len → heap OOB read up to 63,487 bytes past the RX cluster (DF-3604/3639/3663 family) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ix/if_ix.c:2974 · pass 2 · new	none	inconclusive
DF-4030	Medium	5.6	u32 (size + offset) wraparound defeats VALID_BUFFER BO bound check (+ forced-size underflow) Base system — drivers · sys/dev/drm/radeon/r600_cs.c:2001 · pass 2 · new	none	not_reproduced
DF-4032	Medium	5.6	Texture mipmap BO bounds check is commented out (GPU OOB mip walk past mipmap BO) Base system — drivers · sys/dev/drm/radeon/r600_cs.c:1399 · pass 2 · new	none	not_reproduced
DF-4046	Medium	5.6	stge_stop() deadlocks the callout subsystem against stge_tick (AB-BA): synchronous callout_stop() issued while holding the driver serializer vs a tick callback parked in lwkt_serialize_enter — mechanism PROVEN on the guest via protocol replica; stge_tick re-arms UNCONDITIONALLY under the lock Base system — drivers · sys/dev/netif/stge/if_stge.c:1758 · pass 2 · new	none	inconclusive
DF-4415	Low	5.6	atkbdc drain/poll loops reset their budget on every received byte with no overall cap — unbounded kernel busy-loop under i8042/AUX data flood (empty_both_buffers got the cap, these four did not) Base system — drivers · sys/dev/misc/kbd/atkbdc.c:865 · pass 2 · new	none	not_reproduced
DF-4511	Low	5.6	acpi_wmi: _WDG result consumed unvalidated — NULL-deref boot panic on missing Return; ACPI_OBJECT union type-confusion memcpy on non-Buffer _WDG return Base system — drivers · sys/dev/acpica/acpi_wmi/acpi_wmi.c:725 · pass 2 · new	Boot-time NULL-deref panic on missing Return; type-confused wild memcpy read with contents rendered via world-readable /dev/wmistat	untested
DF-4617	Low	5.6	hdacc_stream_intr/hdacc_stream_free index codec->streams[dir][stream] with an unvalidated controller-derived stream tag — negative DF-4115 BSS tags dispatch through an OOB-read device_t (wild indirect call) Base system — drivers · sys/dev/sound/pci/hda/hdacc.c:665 · pass 2 · new	none	not_reproduced
DF-4630	Low	5.6	mpt_user: shared static user_handler_id over a global reply-handler table — detaching one controller unregisters mpt_user_reply_handler for all others, leaking requests until pool exhaustion Base system — drivers · sys/dev/disk/mpt/mpt_user.c:90 · pass 2 · new	Storage DoS: each RAID_ACTION on the surviving controller leaks one of 512 request slots until ENOMEM takes down all mpt I/O including disk traffic	untested
DF-3589	Medium	5.5	Unprivileged kernel panic: CTLFLAG_ANYBODY psm sysctls allow the smoother divisor product div_x*multiplicator to wrap to zero (divide-by-zero in psmsmoother) Base system — drivers · sys/dev/misc/psm/psm.c:4337 · pass 2 · new	none	not_reproduced
DF-3653	Medium	5.5	NULL pointer dereference in amdgpu_dm_atomic_commit_tail() via update_stream_scaling_settings() with NULL dc_stream_state (underscan path) Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4882 · pass 2 · new	none	inconclusive
DF-3665	Medium	5.5	Divide-by-zero (#DE panic) in evergreen_latency_watermark(): zero available_bandwidth from tiny user mode clocks, u32 fixed-point wrap of mclk/sclk, or zero VBIOS clocks Base system — drivers · sys/dev/drm/radeon/evergreen.c:2048 · pass 2 · new	dos	inconclusive
DF-3685	Medium	5.5	NULL-subtable dereference family at backend init: V1 parser treats mm/lookup/PowerTune subtables as optional, smu7 derefs them unconditionally with ignored error returns Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1842 · pass 2 · new	none	inconclusive
DF-3702	Medium	5.5	vega10 backend-init NULL-derefs optional pptable subtables (tdp/mm/lookup/dep tables) — missing-offset VBIOS panics the kernel (DF-3685 twin) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:269 · pass 2 · new	none	inconclusive
DF-3763	Medium	5.5	r100_cs_track_cube() NULL-pointer dereference via unbound cube-face BOs -> kernel panic from unprivileged CS ioctl (pre-R300) Base system — drivers · sys/dev/drm/radeon/r100.c:2143 · pass 2 · new	panic	inconclusive
DF-3828	Medium	5.5	Divide-by-zero family in DCE11 display watermark math: dce_v11_0_latency_watermark divides by available_bandwidth and disp_clk before any guard (DF-3665 twin) Base system — drivers · sys/dev/drm/amd/amdgpu/dce_v11_0.c:908 · pass 2 · new	none	not_reproduced
DF-3839	Medium	5.5	SET_RESOURCE SQ_TEX_VTX_VALID_BUFFER bound-check bypass: (size + offset) added in u32 (+ forced-size underflow) → GPU vertex fetch up to ~4 GB past the BO Base system — drivers · sys/dev/drm/radeon/evergreen_cs.c:2416 · pass 2 · new	none	inconclusive
DF-3857	Medium	5.5	Divide-by-zero in dce_v10_0_latency_watermark: divides by available_bandwidth/disp_clk before any guard (DF-3828 DCE11 twin) Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/dce_v10_0.c:882 · pass 2 · new	none	not_reproduced
DF-3858	Medium	5.5	vega20_get_sclk_od/get_mclk_od: count-1 underflow wild read (+34 GB) and DIV_ROUND_UP divide-by-zero on zero golden clock via world-readable pp_sclk_od/pp_mclk_od (DF-3686/DF-3707 twins) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1326 · pass 2 · new	none	not_reproduced
DF-3869	Medium	5.5	Zero-divisor (#DE kernel panic) in calculate_bandwidth: exact-zero divisor at dce_calcs.c:839 from UABI-legal degenerate modes, plus u32 division-by-zero at :1945 Privilege escalation (general use) · sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:839 · pass 2 · new	dos	inconclusive
DF-3871	Medium	5.5	MFI_CMD ioctl: devclass_get_softc() result used without NULL check -> one-ioctl kernel NULL-deref panic Base system — drivers · sys/dev/raid/mfi/mfi.c:2953 · pass 2 · new	dos	inconclusive
DF-3873	Medium	5.5	mfi ioctl handlers dereference user ioctl buffers without copyin/copyout -> trap_fatal panic on unmapped args (and kernel writes through raw user pointers) Base system — drivers · sys/dev/raid/mfi/mfi.c:2909 · pass 2 · new	dos	inconclusive
DF-3878	Medium	5.5	Divide-by-zero family in DCE8 display watermark math: dce_v8_0_latency_watermark divides by available_bandwidth and disp_clk before any guard (DF-3828 DCE11 / DF-3857 DCE10 twin) Base system — drivers · sys/dev/drm/amd/amdgpu/dce_v8_0.c:817 · pass 2 · new	none	not_reproduced
DF-3946	Medium	5.5	dce110_apply_ctx_for_surface programs a front end for a head pipe whose plane was detached (plane_state NULL) -> kernel NULL-deref panic Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2743 · pass 2 · new	none	inconclusive
DF-3993	Medium	5.5	User-selected UVD/VCE CS ring dereferences NULL asic->ring[] slot on asic families whose dispatch table lacks the ring — kernel panic from unprivileged CS ioctl Base system — drivers · sys/dev/drm/radeon/radeon_asic.c:214 · pass 2 · new	panic	inconclusive
DF-4042	Medium	5.5	Hostile SCSI target panics the kernel via MESSAGE REJECT of the driver's own MSG_ABORT/MSG_NOOP: amdsentmsg panic("Inconsistent msg buffer") Base system — drivers · sys/dev/disk/amd/amd.c:1435 · pass 2 · new	none	inconclusive fixed
DF-4043	Medium	5.5	amdsettags panic("Implement me!") reached when a target rejects a tagged command (MESSAGE REJECT handling) Base system — drivers · sys/dev/disk/amd/amd.c:846 · pass 2 · new	none	inconclusive fixed
DF-4044	Medium	5.5	amdparsemsg MSG_DISCONNECT writes through NULL active_srb after an unexpected reselection Base system — drivers · sys/dev/disk/amd/amd.c:1218 · pass 2 · new	none	inconclusive fixed
DF-4183	Medium	5.5	amdgpu fb creation never validates framebuffer size against the backing GEM object (twin of DF-4181; covers BOTH legacy DCE and DC scanout stacks) — display engine scans out megabytes past a tiny BO, disclosing adjacent VRAM on the physical display Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_display.c:506 · pass 2 · new	none	inconclusive
DF-4217	Medium	5.5	ae_stop_rxmac()/ae_stop_txmac() decrement their idle-wait loop counter (i--): a non-idle device busy-wedges the kernel thread forever, timeout branch unreachable Base system — drivers · sys/dev/netif/ae/if_ae.c:288 · pass 2 · new	none	inconclusive
DF-4219	Medium	5.5	ae_rx_intr() for(;;) descriptor walk has no work bound: a device that keeps AE_RXD_UPDATE set livelocks the interrupt handler holding ifp->if_serializer (DF-3990 family) Base system — drivers · sys/dev/netif/ae/if_ae.c:643 · pass 2 · new	none	inconclusive
DF-4225	Medium	5.5	Divide-by-zero (kernel panic) in drm_mode_vrefresh: user-supplied umode with htotal*vtotal == 0 (mod 2^32) passes drm_mode_validate_basic and wraps den to zero Base system — drivers · sys/dev/drm/drm_modes.c:783 · pass 2 · new	dos	untested
DF-4262	Medium	5.5	CS ioctl with num_chunks==0 returns early success, amdgpu_cs_ib_fill dereferences NULL parser->entity — unprivileged kernel panic Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:114 · pass 2 · new	none	untested
DF-4263	Medium	5.5	Duplicate BO_HANDLES/FENCE/SYNCOBJ_OUT chunks overwrite parser state, permanently leaking bo_list + all BO refs, user-fence BO refs, and syncobj refs Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:88 · pass 2 · new	none	untested
DF-4370	Medium	5.5	amdgpu_bo_placement_from_domain walks up to 6 domain entries into placements[AMDGPU_BO_MAX_PLACEMENTS=3] and BUG_ONs: unprivileged GEM_CREATE with domains=VRAM\|GTT\|CPU panics the kernel; domains=0x3f writes places[3..5] OOB (over bo->placement/bo->tbo) before the panic Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_object.c:139 · pass 2 · new	none	not_reproduced
DF-4373	Medium	5.5	Divide-by-zero in dce_transform_get_max_num_of_supported_lines: prescaler_on + fully-off-CRTC plane (or underscan-inset stream dst) yields pixel_width==0 — ASSERT is WARN_ON-only, integer #DE kernel panic from an unprivileged atomic TEST_ONLY check Base system — drivers · sys/dev/drm/amd/display/dc/dce/dce_transform.c:675 · pass 2 · new	none	not_reproduced
DF-4390	Medium	5.5	NULL request-descriptor dereference in mfi_tbolt_send_frame for PD_SCSI_IO with READ_10/WRITE_10 CDBs - any I/O to a Thunderbolt system PD panics the kernel Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:1156 · pass 2 · new	none	not_reproduced
DF-4526	Medium	5.5	ar5416AniControl NULL-pointer dereference when driven before the first channel reset (ah_curani == NULL): kernel panic via HAL_DIAG_ANI_CMD Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:184 · pass 2 · new	none	not_reproduced
DF-4576	Medium	5.5	amdgpu_gem: GEM_VA MAP/REPLACE commits page tables for the entire attacker-chosen range before amdgpu_vm_bo_map() validates the mapping — every failed map strands ~(map_size>>18) bytes of page-table BOs until fd close; unprivileged render-node GTT/kernel exhaustion (cross-process GPU wedge) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gem.c:638 · pass 2 · new	none	untested
DF-4580	Medium	5.5	radeon_cs_parser_init: fully attacker-controlled u32 num_chunks/length_dw drive unbounded wired GFP_KERNEL allocations — on DragonFly GFP_KERNEL is M_WAITOK without M_NULLOK, so failure is panic('malloc limit exceeded')/panic('kernel_map ran out of space') or an eternal unkillable vm_wait() loop (local kernel DoS); latent NULL-return path would additionally crash radeon_cs_parser_fini via parser->chunks[i] Base system — drivers · sys/dev/drm/radeon/radeon_cs.c:287 · pass 2 · new	none	not_reproduced
DF-4582	Medium	5.5	rs690 watermark fixed-point divide-by-zero via pixel-clock 2^20 wrap: dfixed_const(1048576 kHz) == 0 → do_div by zero → kernel panic (trap 18), reachable from an unprivileged DRM master via DRM_IOCTL_MODE_SETCRTC on RS690/RS740/RS780/RS880 Base system — drivers · sys/dev/drm/radeon/rs690.c:326 · pass 2 · new	panic	inconclusive fixed
DF-4608	Medium	5.5	NULL-pointer dereference panic in radeon_vce_cs_reloc when a VCE command stream is submitted without a relocation chunk Base system — drivers · sys/dev/drm/radeon/radeon_vce.c:478 · pass 2 · new	dos	untested
DF-4696	Medium	5.5	Divide-by-zero (#DE kernel panic) in dpp1_dscl_calc_lb_num_partitions: UABI-legal off-CRTC plane yields recout.width==0 (line_size==0 → 816/0 at :439, also :440/:441) — DCN10 commit-path twin of DF-4373 Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c:411 · pass 2 · new	none	not_reproduced
DF-4819	Medium	5.5	i915 GEM shrinker is dead code: never registered with any memory-reclaim path — purgeable/unbound GPU buffer pages are never reclaimed under system memory pressure (DF-4507 family) Base system — drivers · sys/dev/drm/i915/i915_gem_shrinker.c:313 · pass 2 · new	none	untested
DF-2843	Low	5.5	vnode_pager_generic_putpages() undirties pages on short writes — silent stale-data substitution (write-side DF-2663 family) Base system — virtual memory · sys/vm/vnode_pager.c:771 · pass 2 · new	none	untested
DF-3242	Low	5.5	ufs_check_export hands out &np->netc_anon after dropping NE_LOCK — concurrent export update (mount -u MNT_DELEXPORT) frees the netcred while nfsrv_fhtovp still reads the embedded credential across a window that includes VFS_FHTOVP disk I/O: UAF read feeding garbage uid/groups into the NFS root-squash mapping Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_vfsops.c:246 · pass 2 · new	leak	not_reproduced
DF-3396	Low	5.5	netmap_mem_rings_create cleanup path leaks every allocated packet buffer: repeated failing ring creation permanently drains the global buffer pool (latent — module does not build on DFly) Base system — network stack · sys/net/netmap/netmap_mem2.c:987 · pass 2 · new	none	build_failed
DF-3633	Low	5.5	iwm_notif_intr: 12-bit closed_rb_num compared against 256/512-entry ring positions - non-terminating interrupt-context loop, hard system hang (iwm twin of DF-3581) Base system — drivers · sys/dev/netif/iwm/if_iwm.c:5710 · pass 2 · new	none	inconclusive
DF-3819	Low	5.5	aac_ioctl_send_raw_srb sleeps on channel NULL while its CMFREE callback wakes channel &cm — permanent unkillable process when the FIB pool is exhausted Privilege escalation (general use) · sys/dev/raid/aac/aac.c:3094 · pass 2 · new	none	not_reproduced
DF-4015	Low	5.5	mps_user_command leaks one mps_command per timed-out MPSIO_MPS_COMMAND (shared pool exhaustion starves the storage stack) Base system — drivers · sys/dev/raid/mps/mps_user.c:705 · pass 2 · new	mps_user_command leaks one mps_command per timed-out MPSIO_MPS_COMMAND (goto Ret skips RetFreeUnlocked) - operator drains the finite command pool shared with SCSI I/O -> ENOMEM for management ioctls and eventual I/O starvation of the boot disk.	untested
DF-4245	Low	5.5	dpt_get_conf ready-wait is an unbounded, interrupts-disabled spin driven only by HBA register values — hostile status shape hangs the kernel at attach Base system — drivers · sys/dev/raid/dpt/dpt_scsi.c:498 · pass 2 · new	none demonstrated on guest (no DPT hardware); source-level impact: unbounded crit-section MMIO spin at attach → kernel hang (boot-time DoS) from hostile/faulty HBA status	untested
DF-4355	Low	5.5	Four unbounded MMUCR_BUSY busy-waits (two in hard interrupt context) plus no-exit device-driven loops: unrecoverable system hang on SMC91xx glitch or PCMCIA ejection Base system — drivers · sys/dev/netif/sn/if_sn.c:275 · pass 2 · new	none	untested
DF-4425	Low	5.5	VIRTIO_BLK_F_MQ with device-reported num_queues=0: modulo-by-zero panic in vtblk_attach before any validation Base system — drivers · sys/dev/virtual/virtio/block/virtio_blk.c:292 · pass 2 · new	none	not_reproduced
DF-4670	Low	5.5	ar5416GetDiagState: HAL_DIAG_CHECK_HANGS dereferences args==NULL when the ioctl omits ATH_DIAG_IN — NULL-deref panic (DF-1521 sibling, in-file) Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5416/ar5416_misc.c:543 · pass 2 · new	Unprivileged local kernel panic on ath(4)+ATH_DIAGAPI machines while DF-4320's missing priv check stands; NULL read at fixed address 0 - pure DoS	untested
DF-4843	Low	5.5	Unvalidated device-DMA'd IH wptr (alignment never checked, only masked) + unbounded amdgpu_ih_process ring walk — a misaligned wptr can never equal the 16-byte-stepping rptr, permanently hard-spinning the amdgpu interrupt thread (all GPU interrupt delivery dead) Base system — drivers · sys/dev/drm/amd/amdgpu/tonga_ih.c:196 · pass 2 · new	dos	untested
DF-3092	Info	5.5	fillinusemap() tail-marking loop compares a cluster number against a word-index bound (never executes) and chainlength()'s word-relative clamp misses — phantom "free" clusters beyond pm_maxcluster drive usemap_alloc KASSERT panic on INVARIANTS kernels Kernel memory corruption (UAF / OOB write) · sys/vfs/msdosfs/msdosfs_fat.c:320 · pass 2 · new	none	not_reproduced
DF-4018	Info	5.5	amdgpu userptr machinery is dead-but-armed: usertask is never set, so re-enabling GEM_USERPTR instantly NULL-derefs in amdgpu_ttm_tt_get_user_pages; gup shim has an inverted KKASSERT; ttm->sg is freed without NULLing (double-free shape) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:834 · pass 2 · new	amdgpu userptr machinery is dead-but-armed: usertask never set (#if 0) so re-enabling GEM_USERPTR instantly NULL-derefs at amdgpu_ttm.c:834 (guard after deref); gup shim has an inverted KKASSERT; pin failure path kfrees ttm->sg without NULLing (double-free shape); bind-error paths leak pinned pages.	untested
DF-4003	Medium	5.4	fiji_populate_cac_table overflows BapmVddcVid{Lo,Hi}Sidd[16] and OOB-reads vddc_voltage_table.entries[32] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:772 · pass 2 · new	none	inconclusive fixed
DF-4004	Medium	5.4	fiji clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1706 · pass 2 · new	none	inconclusive fixed
DF-3404	Low	5.4	parse_beacon VENDOR branch stores pre-draft HT-info IE into scan->htcap instead of scan->htinfo (copy-paste typo) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_input.c:652 · pass 2 · new	none	not_reproduced
DF-3830	Low	5.4	trm_detach frees I/O port, SRB array and DMA tags before bus_teardown_intr and SIM deregistration, with no drain of in-flight CCBs — use-after-free / permanent CAM wedge on kldunload Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:3696 · pass 2 · new	none	inconclusive
DF-3832	Low	5.4	trm_eepromBuf[unit] indexed by unbounded adapter unit — 128-byte OOB read+write of adjacent kernel globals at attach with a 5th Tekram card Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:212 · pass 2 · new	none	inconclusive
DF-4850	Low	5.4	amrr ath_rate_getxtxrates() writes hardware rate codes into ath_rc_series.rix (rate-table INDEX) fields and clobbers the correct series-0 index — wrong-entry rt->info[] derefs on every multi-rate-retry frame, HT mis-programming on 11n HALs, and a second OOB read sink when compounded with DF-1931 Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_rate/amrr/amrr.c:135 · pass 2 · new	none	untested
DF-3184	High	5.3	procfs_exit() writes pfs->pfs_pid through a pfsnode a concurrent vnode reclaim may already have kfree()'d (use-after-free write, 4-byte OR at offset 20 in the M_PROCFS zone) Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_subr.c:542 · pass 2 · new	none	not_reproduced
DF-3582	High	5.3	Type-confused FCPARAM() write in RQCS_RESET_OCCURRED handler: on dual-bus SCSI cards a routine bus reset performs a 32-bit RMW ~21 KB past the 408-byte isp_param heap allocation Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp.c:6105 · pass 2 · new	none	inconclusive
DF-2719	Medium	5.3	Coredump each_segment traverses the vm_map RB-tree unlocked while a pre-counted-'stopped' sibling LWP can still be mutating it (UAF read race) Kernel memory corruption (UAF / OOB write) · sys/kern/imgact_elf.c:1193 · pass 2 · new	none	not_reproduced
DF-2924	Medium	5.3	cmd_get_usage_all walks accounting RB trees without ac_spin → RB_NEXT traversal cycle (unkillable kernel spin) and torn 64-bit reads Base system — kernel core (kern) · sys/kern/vfs_quota.c:183 · pass 2 · new	none	not_reproduced
DF-3673	Medium	5.3	mpt_timeout() uses the CCB after xpt_done() hands it back — callout_stop() does not interlock against the in-progress timeout callback (freed/recycled CCB -> wild deref or wrong-request abort) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_cam.c:1240 · pass 2 · new	none	inconclusive
DF-3735	Medium	5.3	r600_pm_init_profile hardcodes clock-mode indices without num_clock_modes validation — default-config OOB heap read of per-state clock_info Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r600.c:685 · pass 2 · new	none	inconclusive
DF-3750	Medium	5.3	Raw-xmit path lacks TXWI pool-empty guard → NULL-pointer write panic under Tx saturation Base system — drivers · sys/dev/netif/ral/rt2860.c:1536 · pass 2 · new	none	not_reproduced
DF-3757	Medium	5.3	tulip_txput_setup() ring-full guard off-by-one (`ri_free == 1`): ri_free underflows to -1 and the setup frame is programmed over a chip-owned TX descriptor Privilege escalation (general use) · sys/dev/netif/de/if_de.c:3631 · pass 2 · new	none	not_reproduced
DF-3760	Medium	5.3	alc_stop()/alc_tick() AB-BA deadlock: self-re-arming tick callout blocks on the driver serializer while alc_stop calls the synchronous callout_stop() holding it — permanent kernel wedge on ifconfig down/MTU change/detach/suspend (DF-3715 family, independent instance) Base system — drivers · sys/dev/netif/alc/if_alc.c:3414 · pass 2 · new	none	inconclusive
DF-3894	Medium	5.3	XPT_RESET_DEV allocates from the normal command pool but frees via the high-priority list, and underflows tm_count: both pools' accounting corrupted, TM simq-freeze discipline permanently disabled (DF-1223 twin) Base system — drivers · sys/dev/raid/mps/mps_sas.c:2765 · pass 2 · new	none	not_reproduced
DF-3945	Medium	5.3	CVE-2019-14615 carried: Gen9 indirect-context WA batch lacks the EU residual-state cleardown PIPE_CONTROL (cross-context GPU info leak on SKL/KBL/BXT/GLK/CFL) Kernel memory leaks / uninitialized disclosure · CVE-2019-14615 · sys/dev/drm/i915/intel_lrc.c:1581 · pass 2 · new	none	not_reproduced
DF-4037	Medium	5.3	polaris10_populate_cac_table overflows BapmVddcVid{Lo,Hi,Hi2}Sidd[16] and OOB-reads vddc_voltage_table.entries[32] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:712 · pass 2 · new	none	inconclusive fixed
DF-4038	Medium	5.3	polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<NUM_VFT_COLUMNS] when the count is lower Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1555 · pass 2 · new	none	inconclusive fixed
DF-4152	Medium	5.3	Object-table walks dereference unvalidated VBIOS u16 offsets and stride unbounded/unchecked sizes — OOB kernel heap reads at attach (amdgpu twin of DF-3745) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:318 · pass 2 · new	none	inconclusive
DF-4154	Medium	5.3	amdgpu_atombios_init_mc_reg_table: zero-stride reg_data walk never terminates; unbounded block walk and unvalidated offsets read past the VBIOS buffer (amdgpu twin of DF-3741) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:1607 · pass 2 · new	none	inconclusive
DF-4155	Medium	5.3	amdgpu_atombios_lookup_voltage_object_v3: zero usSize strides forever; walk bounded only by an unvalidated usStructureSize (hang / OOB read at DPM init) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:1415 · pass 2 · new	none	inconclusive
DF-4693	Medium	5.3	sili_pm: pm_read/pm_write recycle the ata_xfer while the chip still owns the slot — deferred poll timeout returns ATA_S_ONCHIP and the accessors put the ccb back on the free list with ap_expired processing pending Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili_pm.c:657 · pass 2 · new	none	inconclusive
DF-4694	Medium	5.3	sili_pm_softreset polls with sili_quick_timeout whose sole-active KKASSERT is violated by co-active PM-target commands — XPT_RESET_DEV enters softreset without draining the port Base system — drivers · sys/dev/disk/sili/sili_pm.c:450 · pass 2 · new	none	inconclusive
DF-4844	Medium	5.3	drm_sched_entity_fini dependency cleanup check-then-uses entity->dependency while drm_sched_entity_clear_dep NULLs it unsynchronized from fence-signaling context — dma_fence_remove_callback(NULL/stale) NULL-deref lockmgr panic or UAF (tight-window TOCTOU, beyond DF-1927's scheduler-thread race) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/scheduler/sched_entity.c:279 · pass 2 · new	none	untested
DF-4971	Medium	5.3	mfip_detach frees the CAM sim without draining mfi_cam_ccbq or clearing mfi_cam_start: queued passthrough ccbs leak permanently (unkillable hang) and are later dispatched through the stale callback into deregistered/freed CAM state Base system — drivers · sys/dev/raid/mfi/mfi_cam.c:142 · pass 2 · new	none	inconclusive
DF-5249	Medium	5.3	Lockless sc->cmdq[] ring: producers store .func before args with no barrier and consumer reads are unordered; torn publish yields func(NULL), 16-slot wrap yields type-confused callbacks and silently lost commands Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_run.c:1041 · pass 2 · new	none	inconclusive
DF-5309	Medium	5.3	usb_fifo_open() curr_cpd single-owner check is unlocked — concurrent opens of the same ugen endpoint bypass EBUSY and yield two live owners on one fifo Base system — bus / platform / cpu · sys/bus/u4b/usb_dev.c:701 · pass 2 · new	single-owner invariant break -> concurrent-setup entry / latent dangling curr_cpd	untested
DF-2906	Low	5.3	Unchecked mbuf allocations in mb_init/mb_reserve/mb_put_mem/md_init — NULL-pointer kernel panic under allocation failure Base system — kernel core (kern) · sys/kern/libmchain/subr_mchain.c:75 · pass 2 · new	panic	not_reproduced
DF-3013	Low	5.3	_hammer_ip_reseek() KKASSERTs on an EDEADLK-capable seek: INVARIANTS panic (or silent early iteration-EOF on release builds) when the btree re-seek deadlocks Base system — filesystems · sys/vfs/hammer/hammer_object.c:1443 · pass 2 · new	none	not_reproduced
DF-3014	Low	5.3	hammer_ip_sync_record_cursor() error path frees the bulk record's data reservation on retryable EDEADLK and ignores hammer_blockmap_finalize() failure — double-finalize / blockmap accounting corruption on the flush retry Base system — filesystems · sys/vfs/hammer/hammer_object.c:1256 · pass 2 · new	none	not_reproduced
DF-3072	Low	5.3	tmpfs_alloc_vp KKASSERT(!TMPFS_VNODE_DOOMED) at subr.c:402 is an unguarded race window: NFS fhtovp lookups on an unlinked file during inactive's DOOMED..reclaim interval panic INVARIANTS kernels Kernel memory corruption (UAF / OOB write) · sys/vfs/tmpfs/tmpfs_subr.c:395 · pass 2 · new	none	not_reproduced
DF-3265	Low	5.3	Recursive exclusive lockmgr panic ('locking against myself') in pf_state_key_attach under pf_state_item allocation failure Base system — network stack · sys/net/pf/pf.c:915 · pass 2 · new	panic	not_reproduced
DF-3275	Low	5.3	Non-constant-time authentication compares: PAP password and CHAP response checked with early-exit bcmp Base system — network stack · sys/net/sppp/if_spppsubr.c:4077 · pass 2 · new	none	not_reproduced
DF-3348	Low	5.3	Unlocked/wrong-lock readers of the port list vs lagg_port_destroy: unlocked lagg_sysctl_active walk, and port if_ioctl/if_output/if_lagg torn down without the port serializer Privilege escalation (general use) · sys/net/lagg/if_lagg.c:763 · pass 2 · new	none	not_reproduced
DF-3600	Low	5.3	sq_edc_source_names[] indexed by unbounded 3-bit SQ_EDC_INFO.SOURCE field: OOB rodata pointer handed to %s Base system — drivers · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6811 · pass 2 · new	none	inconclusive
DF-3608	Low	5.3	ncr(4) on >4GB amd64 systems: all chip DMA descriptors are 32-bit but filled from unrestricted 64-bit vtophys() — silent address truncation drives transfers to wrong physical memory Base system — drivers · sys/dev/disk/ncr/ncr.c:4149 · pass 2 · new	none	inconclusive
DF-3718	Low	5.3	mxge_tx_done walks the TX ring toward the unvalidated NIC send_done_count: premature TX-buffer free (device DMA-after-free) and permanent interrupt-context spin under tx/main serializers Base system — drivers · sys/dev/netif/mxge/if_mxge.c:2369 · pass 2 · new	none	inconclusive
DF-3737	Low	5.3	emx_tx_collect walks the TX ring toward an unvalidated TDH register value: out-of-range write-back (0xFFFFFFFF on surprise removal) -> all TX buffers freed (DMA-after-free window) then KKASSERT panic / permanent serializer-held spin (DF-3714 em(4) twin) Base system — drivers · sys/dev/netif/emx/if_emx.c:2817 · pass 2 · new	none	inconclusive
DF-4095	Low	5.3	emu_intr2 tests and calls sc->mpu_intr/sc->mpu without the lock, racing emu_muninit + mpu401_uninit's kfree at detach — heap UAF on struct mpu401 Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/emu10k1.c:1196 · pass 2 · new	none	inconclusive
DF-4300	Low	5.3	vkbd_dev_close check-then-sleep TASK handshake can miss the drain task's wakeup and pin the kernel mplock indefinitely (system-wide device-I/O stall until signalled) Base system — drivers · sys/dev/misc/vkbd/vkbd.c:307 · pass 2 · new	none	not_reproduced
DF-4323	Low	5.3	pcm_unregister() can complete while dsp_clone() sleeps in PCM_WAIT (which holds no SD_F_BUSY), leaving the woken handler to run snd_clone_alloc(NULL)/snd_clone_disabled on freed state and PCM_RELEASE on the freed d->lock — NULL-deref / lock use-after-free panic Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/sound.c:1165 · pass 2 · new	dsp_clone validates under PCM_LOCK and only then does PCM_WAIT/ACQUIRE	untested
DF-4419	Low	5.3	Use-after-free race: unprivileged bktr ioctls race privileged msp_detach and write into the freed msp3400c struct (no locking, admitted by 'XXX mutex lock required') Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/msp34xx.c:1206 · pass 2 · new	UAF write into freed M_DEVBUF block via msp_wake_thread racing msp_detach during kldunload; heap corruption ceiling on dedicated allocation, realistically panic	untested
DF-4562	Low	5.3	mpssas_add_device/mpssas_volume_add re-initialize a target slot without checking the asynchronous removal is still in flight (INREMOVAL flag cleared under an outstanding TM; TAILQ_INIT over possibly-linked command lists) Base system — drivers · sys/dev/raid/mps/mps_sas_lsi.c:653 · pass 2 · new	none	untested
DF-4789	Low	5.3	mpr_print_sgl walks the request-frame SGL unbounded, dereferences a possibly-NULL chain, and hexdumps a fixed 128 bytes — unconditional console path on firmware MPI2_IOCSTATUS_INVALID_SGL Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_table.c:547 · pass 2 · new	none	untested
DF-4868	Low	5.3	mps_print_sgl walks the request-frame SGL unbounded, dereferences a possibly-NULL chain, and hexdumps fixed 128 bytes — unconditional console path on firmware MPI2_IOCSTATUS_INVALID_SGL (chain deref sits in the only walk, unlike the mpr twin) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_table.c:449 · pass 2 · new	none	untested
DF-4901	Low	5.3	cz_ih (Carrizo/Stoney APU): unvalidated device-DMA'd IH wptr — 4th instance of the DF-4843/4854/4887 family: a misaligned wptr permanently hard-spins the amdgpu interrupt thread, and the RB_OVERFLOW +16 recovery imports the bad phase, parking rptr within 12 bytes of ring end for an up-to-12-byte OOB read past the zero-slack 64 KiB GTT ring BO Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/cz_ih.c:192 · pass 2 · new	dos	untested
DF-4902	Low	5.3	iceland_ih (Topaz): 5th and last unfiled instance of the unvalidated-wptr IH family — byte-identical to cz_ih.c in all vulnerable logic (permanent ithread spin on misaligned wptr + RB_OVERFLOW phase-import ring-end OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/iceland_ih.c:192 · pass 2 · new	dos	untested
DF-5170	Low	5.3	evergreen_copy_dma discards radeon_sync_resv()/radeon_sync_rings() returns — Evergreen/Cayman twin of DF-4871/DF-5089: DMA copy committed without cross-ring ordering on sync failure, silent bo data corruption Base system — drivers · sys/dev/drm/radeon/evergreen_dma.c:130 · pass 2 · new	none	untested
DF-5338	Low	5.3	kern_trap() broken fall-through for unhandled kernel-mode traps (T_PROTFLT/T_SEGNPFLT/T_BPTFLT/T_TRCTRAP): NULL p/lp deref for kernel threads, trapsignal(lp, i=0) sig-0 OOB read/call, and handler-returns-to-faulting-instruction livelock — pc64 ends these cases in trap_fatal Kernel memory leaks / uninitialized disclosure · sys/platform/vkernel64/x86_64/trap.c:636 · pass 2 · new	NULL-deref recursion / sig-0 OOB indirect call / silent livelock on any vkernel kernel fault	untested
DF-5681	Low	5.3	Kernel _PROP_ONCE_RUN cmpset-once has no completion barrier: first concurrent prop_number use races the interned-tree lazy init (lockmgr on mid-lockinit lock, rbt_ops still NULL) Base system — libkern / libprop / ddb · sys/libprop/prop_number.c:167 · pass 2 · new	none	not_reproduced fixed
DF-5693	Low	5.3	prop_bool singleton lazy-init shares the kernel cmpset-once with no completion barrier: concurrent first-ever <true/> internalize can hand out a NULL-typed, stale-valued, or refcount-corrupted TRUE/FALSE singleton (DF-2225/DF-5681 class, third instance) Base system — libkern / libprop / ddb · sys/libprop/prop_bool.c:111 · pass 2 · new	none	not_reproduced fixed
DF-3987	High	5.2	Poisoned cur_link_settings.lane_count outlives link training: dp_test_send_phy_test_pattern OOB stack WRITE past lane_settings[4] (~3KB span) and hpd_rx_irq_check_link_loss_status OOB stack READ past the 6-byte union hpd_irq_data Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1772 · pass 2 · new	none	inconclusive
DF-4337	High	5.2	atom_context has no bios_size: every VBIOS offset dereference in the ATOM interpreter and master-table parsers is unbounded (OOB heap read up to 128KB; interpreter executes past the image) — central hub fix for the DF-4104/4152/4289 family Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/atom.c:1194 · pass 2 · new	none	inconclusive
DF-4345	High	5.2	amdgpu atom_context has no bios_size: every VBIOS offset dereference in the ATOM interpreter and master-table parsers is unbounded (OOB heap read up to 128KB; interpreter executes past the image) — central hub fix port of DF-4337 to the amdgpu twin Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/atom.c:268 · pass 2 · new	none	inconclusive
DF-4288	Medium	5.2	VRAM_Info MC-register-table path: unvalidated VBIOS NULL/offset/stride — NULL-deref panic, OOB read walk, and stride-0 infinite loop at attach Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:148 · pass 2 · new	none	inconclusive
DF-4289	Medium	5.2	SS-assignment walk bounded only by the table's own usStructureSize — up to 64KB OOB read past the ATOM table Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1231 · pass 2 · new	none	inconclusive
DF-4773	Medium	5.2	apple_smc: detach frees sensor-key state while its per-device sysctl oids stay registered until device_delete — post-detach UAF read / NULL-ioport panic window (DF-4647 family) Kernel memory corruption (UAF / OOB write) · sys/dev/apple/smc/smc_sysctl.c:169 · pass 2 · new	leak	inconclusive
DF-3618	Low	5.2	ath_vap_delete second TX drain races live taskqueue workers before kfree(avp) — author-acknowledged use-after-free window on vap teardown Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath.c:1785 · pass 2 · new	none	inconclusive
DF-3669	Low	5.2	ix_detach never terminates the self-re-arming per-ring tx_gc_timer: pending callout fires on freed tx_rings → use-after-free (write into freed slab + callout-queue corruption) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ix/if_ix.c:373 · pass 2 · new	none	inconclusive
DF-3681	Low	5.2	igb_detach never terminates the self-re-arming sc->timer and per-ring tx_gc_timer (callout_stop only, which does not interlock against an in-progress callback): re-arm after detach → use-after-free on freed softc/rings and, under kldunload, execution of unmapped module text Kernel memory corruption (UAF / OOB write) · sys/dev/netif/igb/if_igb.c:327 · pass 2 · new	none	inconclusive
DF-3822	Low	5.2	aac_detach frees the container list with no aac_container_lock while the still-live interrupt path aac_handle_aif and the aac_query_disk ioctl traverse it — use-after-free race Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac.c:679 · pass 2 · new	none	inconclusive
DF-3955	Low	5.2	Double free of rdev->pm.dpm.ps (and leak of parsed ps_priv states) on the kzalloc-failure path of kv_parse_power_table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/kv_dpm.c:2675 · pass 2 · new	none	inconclusive
DF-4082	Low	5.2	oce_tx returns 0 (success) when oce_insert_vlan_tag fails on !M_WRITABLE mbufs: the dequeued mbuf is leaked and the packet silently dropped while oce_start_locked believes it was sent Base system — drivers · sys/dev/netif/oce/oce_if.c:833 · pass 2 · new	none	untested
DF-4276	Low	5.2	cbb_detach() deletes the bridge children before stopping the slot event thread — cbb_insert/cbb_removal operate on freed child devices (UAF race), and the RUNNING-flag startup window lets detach free the softc under a live thread Kernel memory corruption (UAF / OOB write) · sys/dev/pccard/pccbb/pccbb.c:285 · pass 2 · new	none	not_reproduced
DF-4312	Low	5.2	dcn10_link_encoder_create indexes 4-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source values (−1 and 4..9 / −1 and 4..7 / 4..6) — OOB kernel reads that become wild-MMIO register bases Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:744 · pass 2 · new	none	inconclusive
DF-4319	Low	5.2	dce80_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source (DF-4312 family) Base system — drivers · sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:661 · pass 2 · new	none	untested
DF-4332	Low	5.2	Read-only GUI ioctls walk live array state with no driver lock while DELETE_ARRAY frees it - use-after-free race (panic or kernel-pointer copyout) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/gui_lib.c:163 · pass 2 · new	none	inconclusive
DF-4375	Low	5.2	dce112_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319/4352 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:577 · pass 2 · new	none	inconclusive
DF-4615	Low	5.2	ips_copperhead_reinit ignores ips_copperhead_queue_init's return: freed status queue left dangling → interrupt-context UAF read/write; every forced reinit also leaks the previous queue mapping Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips.c:630 · pass 2 · new	none	not_reproduced
DF-4677	Low	5.2	cmx_detach lifetime holes: dying is checked unlocked before CMX_LOCK (TOCTOU across lockuninit) and registered knotes are never detached from sc->kq.ki_note — knote cleanup after softc free is a use-after-free Kernel memory corruption (UAF / OOB write) · sys/dev/misc/cmx/cmx.c:265 · pass 2 · new	cmx_detach lifetime holes: unlocked dying TOCTOU across lockuninit, and registered knotes never detached from ki_note - post-free knote cleanup is a UAF write	untested
DF-4707	Low	5.2	amr_pci_detach's EBUSY guard is defeated: AMR_STATE_OPEN is cleared on ANY close (not last) and is TOCTOU-open — kldunload frees the softc while a /dev/amr0 descriptor still references it via dev->si_drv1 (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr_pci.c:365 · pass 2 · new	none	inconclusive
DF-4875	Low	5.2	afd_describe(): ksprintf of device-controlled u64 mediasize into char[16] — deterministic 1-byte NUL stack overflow at attach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-fd.c:446 · pass 2 · new	none	untested
DF-5116	Low	5.2	dcons_crom_detach NULLs post_busreset with no synchronization against fw_busreset's unlocked check-then-call dispatch running in the fwohci interrupt handler — a physical bus reset racing kldunload executes dcons_crom_post_busreset on freed softc: interrupt-context UAF write (bzero of sc->unit + crom_add_* stores) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/dcons/dcons_crom.c:196 · pass 2 · new	none	untested
DF-5250	Low	5.2	run_key_set defers a raw ieee80211_key pointer that can be node-embedded (pairwise) and freed before run_key_set_cb executes - UAF read/write including k->wk_pad write Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_run.c:2368 · pass 2 · new	UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252)	untested
DF-5656	Low	5.2	USB dynamic dispatch unload hooks use a fixed 1-second tsleep as the only grace between live consumers and freed module text Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_dynamic.c:113 · pass 2 · new	none	not_reproduced
DF-3649	Medium	5.1	Wild OOB kernel read in ci_get_std_voltage_value_sidd when the CAC leakage table count is 0: idx=(u16)(count-1)=65535 past a ZERO_LENGTH_PTR that passes the entries!=NULL guard Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:2374 · pass 2 · new	none	inconclusive
DF-3650	Medium	5.1	OOB read in ci_parse_power_table's VCE state fill: clk_idx (ucClockInfoIndex & 0x3f) indexes clockInfo[] without the ucNumEntries bound used everywhere else Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/ci_dpm.c:5654 · pass 2 · new	none	inconclusive
DF-3835	Medium	5.1	bwn_phy_lp_calc_rx_iq_comp divides by hardware-controlled ie_ipwr under a sum-only guard (ie_ipwr==0 with ie_qpwr>=2 passes) — kernel #DE panic from the init/60s calibration path Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2340 · pass 2 · new	none	inconclusive
DF-4068	Medium	5.1	ti_rxeof/ti_txeof/ti_handle_events terminate on raw equality with NIC-DMA'd 32-bit producer/consumer words: one out-of-range word makes the loop condition unsatisfiable — interrupt-context livelock with host interrupts masked and the ifnet serializer held (DF-3761 unbounded-walk family, ti(4) instance) Base system — drivers · sys/dev/netif/ti/if_ti.c:511 · pass 2 · new	none observed (hardware-gated); source-level: hard CPU livelock with host interrupts masked and ifnet serializer held (permanent DoS of the system) from a single out-of-range DMA'd 32-bit producer/consumer word; txeof variant also underflows sc->ti_txcnt per spin	inconclusive
DF-4179	Medium	5.1	twe_add_unit off-by-one: TWEIO_ADD_UNIT with unit==16 passes `unit > TWE_MAX_UNITS` and writes one struct past twe_drive[16] (OOB write into softc + ghost disk with unit truncated to 0) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twe/twe.c:212 · pass 2 · new	none	inconclusive
DF-4502	Medium	5.1	ahci_pm_softreset leaks the error-CCB reservation on final-retry second-FIS failure: stuck AP_F_ERR_CCB_RESERVED + permanently zeroed ap_active/ap_sactive -> port I/O wedge and KKASSERT panic on next error recovery/probe Base system — drivers · sys/dev/disk/ahci/ahci_pm.c:805 · pass 2 · new	none	inconclusive
DF-4613	Medium	5.1	ips_timeout performs the forced adapter reinit while holding queue_lock and then tsleeps forever on a completion only the lock-blocked interrupt handler can deliver — permanent watchdog-path deadlock (timer twin of DF-2163) Base system — drivers · sys/dev/raid/ips/ips.c:337 · pass 2 · new	none	not_reproduced
DF-4814	Medium	5.1	parse_csr_fw bounds its stepping-search loop with attacker-controlled package_header->num_entries while the walked array is fixed fw_info[20]: unbounded kernel heap OOB read (panic / OOB dmc_offset) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_csr.c:134 · pass 2 · new	code-level: kernel heap OOB read -> page-fault panic (DoS) plus OOB-read dmc_offset steering further fw->data indexing; kernel path not executable on the audit guest (only display device is QEMU std-VGA 0x1234:1111, parse_csr_fw gated on gen9+ HAS_CSR hardware); the exact parse loop + packed structs were replicated and executed on the guest, faulting past the buffer in both variants (run.log)	untested
DF-4987	Medium	5.1	tws_passthru trusts driver_pkt.buffer_length with no bound: arbitrary-size M_ZERO kernel alloc, EFBIG ignored → command submitted with truncated SGL, protected-dmamap EINPROGRESS panic on >4GB-RAM hosts, unkillable 60s sleep + controller-wide reset Base system — drivers · sys/dev/raid/tws/tws_user.c:117 · pass 2 · new	none	not_reproduced
DF-3606	Low	5.1	MSI-X allocation failure silently falls back to one MSI/legacy vector while rx_ring_cnt stays >1: RSS rings 1..N are configured but never serviced — traffic blackhole on BCM5709/5716 Base system — drivers · sys/dev/netif/bce/if_bce.c:6748 · pass 2 · new	RSS rings un-serviced traffic blackhole	untested
DF-3834	Low	5.1	Inverted KASSERT in bwn_phy_lp_tblinit_r2 asserts rev < 2 although it is only ever called for rev >= 2 — deterministic panic at PHY init on INVARIANTS kernels (upstream-inherited) Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2742 · pass 2 · new	none	inconclusive
DF-4120	Low	5.1	Second divide-by-zero window in cypress_populate_mclk_value: clk_s truncating to 0 makes (clk_s * 625) a zero divisor at :567 (sibling of DF-1387, different expression and condition) Base system — drivers · sys/dev/drm/radeon/cypress_dpm.c:565 · pass 2 · new	none	inconclusive
DF-4227	Low	5.1	cyapa detach/module-unload leaves open fds, blocked readers and kqueue hooks on a vanished softc — NULL-deref panic / dispatch through freed module ops Kernel memory corruption (UAF / OOB write) · sys/dev/smbus/cyapa/cyapa.c:545 · pass 2 · new	none	untested
DF-4272	Low	5.1	dcn_bw_notify_pplib_of_wm_ranges dereferences unchecked res_pool->pp_smu (kzalloc-failure NULL) — probe-time panic on DCN1 Base system — drivers · sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1401 · pass 2 · new	none	untested
DF-4273	Low	5.1	twa(4) firmware-passthrough buffer_length completely unvalidated: unbounded kernel kmalloc/copyin (memory-exhaustion DoS) and silent no-payload execution for lengths >= 0xFFFFFE01 Base system — drivers · sys/dev/raid/twa/tw_osl_freebsd.c:927 · pass 2 · new	none	inconclusive
DF-4287	Low	5.1	acpi_thinkpad attach: kfreeenv(NULL) on the nosmbios path → panic("trying to free NULL pointer") when exactly one SMBIOS env var is unset Base system — drivers · sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:622 · pass 2 · new	boot-time / attach-time kernel panic (kfree of NULL pointer) on ThinkPad firmware with a partial SMBIOS Type-1 table; no user interaction	inconclusive
DF-4555	Low	5.1	dce_aux: ignored acquire() failure + unconditional release_engine() closes NULL ddc — near-NULL deref panic under AUX/GPIO contention Base system — drivers · sys/dev/drm/amd/display/dc/dce/dce_aux.c:53 · pass 2 · new	none	not_reproduced
DF-4813	Low	5.1	ata_marvell_edma_allocate() dereferences ch->dma unconditionally (work_bus/work/work_tag): NULL-pointer panic when ata_dmaalloc() failed at channel attach — DF-4809 class, but in ->allocate (marvell is the only nata chipset whose allocate touches ch->dma) Base system — drivers · sys/dev/disk/nata/chipsets/ata-marvell.c:209 · pass 2 · new	none	untested
DF-4930	Low	5.1	atphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → DragonFly panic("ifmedia_set") at attach Base system — drivers · sys/dev/netif/mii_layer/atphy.c:135 · pass 2 · new	none	not_reproduced
DF-5003	Low	5.1	truephy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (4th leaf of the DF-4930/DF-4957/DF-4981 family) Base system — drivers · sys/dev/netif/mii_layer/truephy.c:171 · pass 2 · new	none	not_reproduced
DF-5077	Low	5.1	acphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (6th leaf of the DF-4930/4957/4981/5003/5053 family; hub DF-5001) Base system — drivers · sys/dev/netif/mii_layer/acphy.c:169 · pass 2 · new	none	not_reproduced fixed
DF-5105	Low	5.1	amdgpu_do_test_moves success path leaks all n pinned+reserved+referenced GTT test BOs (~entire GTT) with reservation locks held forever Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_test.c:92 · pass 2 · new	none	not_reproduced
DF-5120	Low	5.1	vtrnd_harvest runs unbounded virtqueue_poll() busy-wait inside the periodic softclock callout — a stalled host entropy backend permanently hangs the guest kernel Base system — drivers · sys/dev/virtual/virtio/random/virtio_random.c:215 · pass 2 · new	none	untested
DF-3463	Low	5.0	gre decapsulation leaves m->m_pkthdr.rcvif pointing into gre_softc while ip_reass can hold the fragment chain far past if_detach's netmsg_service_sync barrier — post-destroy reassembly processes the packet through freed gre_softc memory (delayed UAF reads in ip_input) Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_gre.c:184 · pass 2 · new	none	not_reproduced
DF-4130	Low	5.0	Firmware-controlled NIC_CREATE_WQ response db_offset used unvalidated as MMIO write offset on every TX doorbell Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_mbox.c:1710 · pass 2 · new	none	not_reproduced
DF-3476	Medium	4.8	DLC teardown deadlock: untimeout() called under pcb->pcb_lock races the DLC timeout callback blocking on pcb_lock - DragonFly's synchronous callout_stop() turns the overlap into a permanent non-interruptible AB-BA wedge (softclock thread + task/user thread halted) Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3554 · pass 2 · new	dos	untested
DF-3365	Low	4.8	sta_entry lifetime: three additional unlocked-use windows beyond DF-0395/0396 — PICK1ST match_bss after TABLE_UNLOCK, select_bss result used/joined after unlock, roam/assoc sta_lookup uses Base system — network stack · sys/netproto/802_11/wlan/ieee80211_scan_sta.c:397 · pass 2 · new	none	not_reproduced
DF-3772	Low	4.8	Hardware-fed CI/SACT consistency KKASSERT (and CI==0 asserts) panic on chipset misbehavior the driver documents and recovers from elsewhere Base system — drivers · sys/dev/disk/ahci/ahci.c:2622 · pass 2 · new	none	not_reproduced
DF-3773	Low	4.8	ahci_beg_exclusive_access() drain loop never processes deferred timeouts -> permanent port wedge with the port lock held Base system — drivers · sys/dev/disk/ahci/ahci.c:2266 · pass 2 · new	none	not_reproduced
DF-4723	Low	4.8	ath_tdma_settimers computes DBA/SWBA alerts with 32-bit (nexttbtt<<3) while nexttbtt is the full TSF-derived TU value — inconsistent timer wrap corrupts beacon timers after ~6.2 days of continuous TDMA operation (the in-file unaudited wrap TODO) Base system — drivers · sys/dev/netif/ath/ath/if_ath_tdma.c:144 · pass 2 · new	none	untested
DF-5110	Low	4.8	SATA hotplug connect tasks are unsynchronized and never drained at channel teardown: racing ATTACH/DETACH tasks yield NULL-softc panic or duplicate disk children Base system — drivers · sys/dev/disk/nata/ata-sata.c:45 · pass 2 · new	NULL-deref panic / duplicate disk children	untested
DF-2646	Medium	4.7	hammer2_flush_core LOST CHILD3 panics on the NULL->non-NULL parent transition (unconditional KKASSERT / hammer2_chain_unlock(NULL)) Hammer2 · sys/vfs/hammer2/hammer2_flush.c:681 · pass 2 · new	none	inconclusive
DF-2649	Medium	4.7	NULL parent->data dereference in hammer2_bulkfree_scan's PFSROOT kprintfs when a PFS-root chain fails to load with a non-CHECK error Hammer2 · sys/vfs/hammer2/hammer2_bulkfree.c:143 · pass 2 · new	none	not_reproduced
DF-2660	Medium	4.7	hammer2_sync_insert() TOCTOU re-lookup races concurrent same-key creates on mounted rw clusters: KKASSERT(chain == NULL) panics INVARIANTS kernels (duplicate-key chain_create on production) Hammer2 · sys/vfs/hammer2/hammer2_synchro.c:741 · pass 2 · new	none	not_reproduced
DF-2712	Medium	4.7	bsd4_kick_helper issues IPIs/wakeups while holding the global bsd4_spin: FIFO-full liveloop enables same-cpu schedclock recursion into the spinlock (whole-system wedge), unprivileged-triggerable when usched_bsd4 is active Base system — kernel core (kern) · sys/kern/usched_bsd4.c:1590 · pass 2 · new	none	not_reproduced
DF-3012	Medium	4.7	hammer(1) in-memory record permanently leaked when hammer_blockmap_reserve() fails in hammer_ip_add_bulk() (and on the namekey-exhaustion ENOSPC path of hammer_ip_add_direntry) Kernel memory leaks / uninitialized disclosure · sys/vfs/hammer/hammer_object.c:711 · pass 2 · new	none	not_reproduced
DF-3096	Medium	4.7	mount -u ronly→rw transition: RW internal state, FWRITE device opens, and recovered-volume-header media writes are not rolled back when stage2 recovery fails Base system — filesystems · sys/vfs/hammer/hammer_vfsops.c:478 · pass 2 · new	none	untested
DF-3193	Medium	4.7	fuse_unmount() frees fmp under in-flight statfs/statvfs: FUSE is MPSAFE (VFS_MPLOCK no-op) and fuse_statfs/statvfs take no fmp reference, so a forced umount plus daemon fd-close kfree's fmp while a statfs thread sleeps on its IPC — the wake/timeout path locks and walks freed (recycled) kernel memory Kernel memory corruption (UAF / OOB write) · sys/vfs/fuse/fuse_vfsops.c:190 · pass 2 · new	none	not_reproduced
DF-3194	Medium	4.7	nfs_nget/nfs_nget_nonblock race-loser paths vx_put() a never-connected VNON vnode — vx_put forces VREF_FINALIZE for VNON, vnode_terminate runs VOP_INACTIVE, and nfs_inactive dereferences v_data == NULL at nfs_node.c:393 → guaranteed kernel panic whenever the duplicate-validation branch executes (unprivileged local race on any NFS mount) Base system — filesystems · sys/vfs/nfs/nfs_node.c:194 · pass 2 · new	none	not_reproduced
DF-3208	Medium	4.7	cd9660 ihash publish-before-validate: vget_internal leaves the half-initialized iso_node in the hash on every post-publish error path; a concurrent cd9660_ihashget blocked in vget wakes with the orphaned VNON vnode (i_mnt == NULL, i_devvp == NULL) and returns it as SUCCESS — NULL-deref panic in cd9660_getattr/read on first use Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_node.c:118 · pass 2 · new	none	not_reproduced
DF-3239	Medium	4.7	p_fd NULL-deref/UAF in vn_fullpath()->cache_fullpath() against an exiting target read via /proc/pid/map Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_map.c:181 · pass 2 · new	none	not_reproduced
DF-3303	Medium	4.7	free_bw_list() runs unschedule_bw_meter() on bw_meter_timers[] without mroute_token (del_mfc / del_bw_upcall DELETE_ALL) — race vs bw_meter_process panic/UAF Kernel memory corruption (UAF / OOB write) · sys/net/ip_mroute/ip_mroute.c:1115 · pass 2 · new	none	inconclusive
DF-3584	Medium	4.7	isp_control() ISPCTL_RESET_DEV/ABORT_CMD index fcp->isp_dev_map[tgt] without validating tgt; the CAM glue packs bus<<16 into tgt so every channel>0 device reset reads ~108 KB out of bounds Base system — drivers · sys/dev/disk/isp/isp.c:4522 · pass 2 · new	none	inconclusive
DF-3620	Medium	4.7	Wild OOB kernel read in ci_get_std_voltage_value_sidd when CAC leakage table count==0 (ZERO_LENGTH_PTR passes the entries!=NULL guard) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/ci_dpm.c:2487 · pass 2 · new	none	inconclusive
DF-3621	Medium	4.7	Integer divide-by-zero in spread-spectrum programming when VBIOS SS rate == 0 (or truncates to 0 via /=100) Base system — drivers · sys/dev/drm/amd/amdgpu/ci_dpm.c:3337 · pass 2 · new	none	inconclusive
DF-3622	Medium	4.7	Integer divide-by-zero on zero MPLL reference clock in ci_calculate_mclk_params (usMemoryReferenceClock stored unchecked) Base system — drivers · sys/dev/drm/amd/amdgpu/ci_dpm.c:2977 · pass 2 · new	none	inconclusive
DF-3623	Medium	4.7	NULL-pointer dereference of adev->pm.dpm.boot_ps when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state Base system — drivers · sys/dev/drm/amd/amdgpu/ci_dpm.c:5297 · pass 2 · new	none	inconclusive
DF-3657	Medium	4.7	XPT_ABORT passes the abort CCB itself to ISPCTL_ABORT_CMD - every SCSI command abort fails (upstream passes accb) Base system — drivers · sys/dev/disk/isp/isp_freebsd.c:4541 · pass 2 · new	none	not_reproduced
DF-3700	Medium	4.7	synchronize_irq() is an empty lkpi stub: interrupt-drain barriers in i915_irq.c are void (MMIO after power-well off, work resurrected after cancel_work_sync) Base system — drivers · sys/dev/drm/i915/i915_irq.c:3710 · pass 2 · new	none	inconclusive
DF-3738	Medium	4.7	callout_stop(&sc->timer) under main_serialize deadlocks against emx_timer's blocking lwkt_serialize_enter (AB-BA): emx_stop/emx_intr_body/emx_npoll_status vs the 1 Hz emx_timer — mechanism PROVEN on the guest kernel via protocol replica; fix validated at protocol level (DF-3715 em(4) twin) Base system — drivers · sys/dev/netif/emx/if_emx.c:1914 · pass 2 · new	none	inconclusive fixed
DF-3744	Medium	4.7	Unbounded LVDS mode-patch record walk and fake-EDID copy read past the VBIOS image buffer (conditional userspace EDID leak) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_atombios.c:1706 · pass 2 · new	none	inconclusive
DF-3758	Medium	4.7	tulip_rx_intr() RX-replenish path panics on bus_dmamap_load_mbuf() failure instead of backing off (local DoS) Base system — drivers · sys/dev/netif/de/if_de.c:3134 · pass 2 · new	none	not_reproduced
DF-3801	Medium	4.7	mprsas_resetdev_complete dereferences a NULL task-management reply: XPT_RESET_DEV outstanding during a Diag Reset panics the kernel Base system — drivers · sys/dev/raid/mpr/mpr_sas.c:3392 · pass 2 · new	none	not_reproduced
DF-3802	Medium	4.7	mprsas_send_abort/mprsas_send_reset early -1 returns are ignored by every caller: targ->tm stays set forever, the timed-out CCB is never completed (unkillable I/O hang) and the high-priority TM leaks Base system — drivers · sys/dev/raid/mpr/mpr_sas.c:1609 · pass 2 · new	none	not_reproduced
DF-3807	Medium	4.7	mskc_handle_events(): 'continue' on a status LE naming an unattached port skips the loop's only consumer-index advance -> permanent mskc_intr() drain spin with the serializer held and the IRQ never re-enabled Base system — drivers · sys/dev/netif/msk/if_msk.c:3174 · pass 2 · new	none	inconclusive
DF-3814	Medium	4.7	Reallocating diag reset tears down all interrupt handlers and never re-establishes them — controller permanently dead (hang/panic DoS) Base system — drivers · sys/dev/raid/mpr/mpr.c:801 · pass 2 · new	none	inconclusive
DF-3818	Medium	4.7	NVMe PRP page pool exhaustion: NULL dereference / KASSERT panic above 2048 concurrent native-SGL NVMe I/Os (unprivileged local DoS) Base system — drivers · sys/dev/raid/mpr/mpr.c:2716 · pass 2 · new	none	inconclusive
DF-3860	Medium	4.7	gpu_info firmware payload pointer built from unvalidated ucode_array_offset_bytes — kernel heap OOB read feeding AMDGPU_INFO disclosure and the DF-3698 walkers Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_device.c:1354 · pass 2 · new	none	not_reproduced
DF-3864	Medium	4.7	amdgpu_vm_init error paths dereference vm->root.base.bo before amdgpu_vm_bo_base_init assigns it — NULL-pointer panic on a render-node-reachable error path (unprivileged DoS) Privilege escalation (general use) · sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3097 · pass 2 · new	none	not_reproduced
DF-3892	Medium	4.7	cm_callout is callout_init_mp (lock-free) but mpssas_scsiio_timeout asserts and manipulates mps_lock-protected state: deterministic KKASSERT panic on the first SCSI IO timeout (stock INVARIANTS/GENERIC kernels), lock-free race with interrupt completion otherwise Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas.c:1490 · pass 2 · new	none	not_reproduced
DF-3893	Medium	4.7	mpssas_resetdev_complete dereferences a NULL task-management reply: XPT_RESET_DEV outstanding during a Diag Reset panics the kernel (DF-3801 twin) Base system — drivers · sys/dev/raid/mps/mps_sas.c:2799 · pass 2 · new	none	not_reproduced
DF-3895	Medium	4.7	mpssas_send_abort/mpssas_send_reset early -1 returns are ignored by every caller: targ->tm wedged forever, TM leaked, timed-out CCBs never returned to CAM, simq frozen for the life of the adapter (DF-3802 twin) Base system — drivers · sys/dev/raid/mps/mps_sas.c:1303 · pass 2 · new	none	not_reproduced
DF-3922	Medium	4.7	hpt_timeout (takes driver_lock) vs callout_stop under driver_lock: DragonFly's synchronous callout_stop creates an AB-BA sleep deadlock - permanent storage wedge Base system — drivers · sys/dev/raid/hptmv/entry.c:2629 · pass 2 · new	none	not_reproduced
DF-3935	Medium	4.7	age_stop() (serializer held) vs age_tick (blocking lwkt_serialize_enter): AB-BA callout deadlock — DF-3715 family instance, mechanism PROVEN on the guest via replica (stopper stuck D5 wchan 'costp') Base system — drivers · sys/dev/netif/age/if_age.c:2194 · pass 2 · new	none	inconclusive
DF-3941	Medium	4.7	cxm(4): cxm_read() consumes the DMA ring with no serialization — a stale ring offset paired with a different buffer underflows `size - offset` (size_t) and uiomove()s past the 61440-byte DMA buffer; read/write desync also discloses never-DMA'd (uninitialized) kernel heap via read(2) Kernel memory corruption (UAF / OOB write) · sys/dev/video/cxm/cxm.c:2262 · pass 2 · new	leak	inconclusive
DF-3989	Medium	4.7	ale_rxeof trusts the controller-DMA'd 14-bit RRS frame length with no bound vs page/max_frame_size: m_devget heap OOB read up to ~14.8KB past the DMA Rx page into delivered mbufs (kernel heap info leak) — DF-3604/3759/3933 family, ale instance Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ale/if_ale.c:2204 · pass 2 · new	none	inconclusive
DF-3991	Medium	4.7	ale_stop() (serializer held) vs ale_tick() (blocking lwkt_serialize_enter in a self-re-arming NON-MP callout): AB-BA deadlock against synchronous callout_stop — permanent kernel wedge + softclock starvation; mechanism PROVEN on the guest via protocol replica (DF-3715/3760/3935 family) Base system — drivers · sys/dev/netif/ale/if_ale.c:2263 · pass 2 · new	none	inconclusive
DF-4051	Medium	4.7	nfe_stop() deadlocks the callout subsystem against nfe_tick (AB-BA): synchronous callout_stop() issued while holding the driver serializer vs a tick callback parked in lwkt_serialize_enter — mechanism PROVEN on the guest via nfe-shaped replica (DF-3715/4025/4046 family instance) Base system — drivers · sys/dev/netif/nfe/if_nfe.c:636 · pass 2 · new	dos	inconclusive
DF-4153	Medium	4.7	amdgpu_atombios_get_clock_info stores VBIOS reference clocks unchecked — zero reference_freq reaches PLL/SS divisions (#DE panic) (amdgpu twin of DF-3742) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:592 · pass 2 · new	none	inconclusive
DF-4159	Medium	4.7	xe_intr() RX livelock: packet-drop paths 'continue' without releasing the packet to the card — permanent hard hang Base system — drivers · sys/dev/netif/xe/if_xe.c:742 · pass 2 · new	dos	untested
DF-4161	Medium	4.7	Missing !conn_state->crtc guard in intel_panel_set_backlight: unprivileged hw.backlight_level sysctl write NULL-derefs to_intel_crtc(NULL)->pipe in vlv_set_backlight (VLV/CHV) Base system — drivers · sys/dev/drm/i915/intel_panel.c:1148 · pass 2 · new	none	inconclusive
DF-4164	Medium	4.7	radeon_unmap_vram_bos walks rdev->gem.objects without gem.mutex while unprivileged GEM create/close list_add/kfree the same list: UAF read / list corruption race in the PM clock-change path Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_pm.c:146 · pass 2 · new	none	inconclusive
DF-4194	Medium	4.7	drm_mode_create_tile_group() ERR_PTR vs NULL contract mismatch poisons connector->tile_group — wild-pointer kref_put/deref at four sites (kernel panic) Base system — drivers · sys/dev/drm/drm_connector.c:1917 · pass 2 · new	panic	untested
DF-4196	Medium	4.7	Lock-free vblank->hwmode.crtc_clock = 0 store in drm_crtc_vblank_off() races the reloaded divisor in drm_calc_vbltimestamp_from_scanoutpos() — TOCTOU integer divide-by-zero (#DE kernel panic) Base system — drivers · sys/dev/drm/drm_vblank.c:618 · pass 2 · new	dos	inconclusive
DF-4218	Medium	4.7	ae_tick() (non-MP, self-re-arming, blocking lwkt_serialize_enter) vs ae_stop() (sync callout_stop under the serializer): permanent AB-BA deadlock (DF-3715 family) Base system — drivers · sys/dev/netif/ae/if_ae.c:232 · pass 2 · new	none	inconclusive
DF-4237	Medium	4.7	sili(4): sili_cam_probe() dereferences unchecked sili_ata_get_xfer() NULL — kernel panic when a port reprobe runs against a saturated ccb pool (IDENTIFY write at :290, NCQ-renegotiation read at :372) Base system — drivers · sys/dev/disk/sili/sili_cam.c:289 · pass 2 · new	none	not_reproduced
DF-4303	Medium	4.7	bfe_stop() can deadlock the callout subsystem against bfe_tick (AB-BA): sync callout_stop under the serializer waits forever for a callback blocked on that serializer — interface + one softclock CPU wedged (DF-3715 family) Base system — drivers · sys/dev/netif/bfe/if_bfe.c:1494 · pass 2 · new	none	inconclusive
DF-4304	Medium	4.7	bfe_rxeof/bfe_txeof completion walks trust the 12-bit DMA current-descriptor field with no range validation and no work bound: encodable off-ring index 511 (byte offsets 4088..4095) makes the interrupt loop non-terminating — serializer-held livelock / KKASSERT panic Base system — drivers · sys/dev/netif/bfe/if_bfe.c:1064 · pass 2 · new	none	inconclusive
DF-4310	Medium	4.7	ste_stop()/ste_intr STATS_OFLOW issue the synchronous callout_stop() while holding if_serializer while the 1 Hz non-MP ste_stats_update callback must first block in lwkt_serialize_enter on that serializer — AB-BA deadlock (DF-3715 family), plus STOP-override timer resurrection at detach (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ste/if_ste.c:790 · pass 2 · new	dos	inconclusive
DF-4314	Medium	4.7	GPU-reset vs overlay-off lifetime race: intel_overlay_reset() clears overlay->crtc while an in-flight overlay-off retire still dereferences it — NULL+offset kernel write or GEM_BUG_ON panic Base system — drivers · sys/dev/drm/i915/intel_overlay.c:373 · pass 2 · new	none	not_reproduced
DF-4316	Medium	4.7	lge_stop() callout_stop-under-serializer AB-BA deadlock: lge_tick() parks on if_serializer every stop-path caller holds (DF-3715 family) — permanent kernel hang + CPU-wide callout starvation Base system — drivers · sys/dev/netif/lge/if_lge.c:984 · pass 2 · new	none	inconclusive
DF-4365	Medium	4.7	pcn_stop()/pcn_tick() AB-BA callout deadlock: synchronous callout_stop() under the ifnet serializer vs the 1 Hz self-re-arming non-MPSAFE tick parked in blocking lwkt_serialize_enter — DF-3715 family, pcn(4) instance (mechanism PROVEN on guest via protocol replica) Base system — drivers · sys/dev/netif/pcn/if_pcn.c:879 · pass 2 · new	none	inconclusive
DF-4369	Medium	4.7	hpt_timeout()/os_cmddone() completion race: non-synchronizing callout_stop() frees the PCOMMAND while the timeout handler dereferences it (UAF -> wild ldm_reset_vbus -> panic) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:411 · pass 2 · new	none	not_reproduced
DF-4374	Medium	4.7	Sysctl read handlers unlock before touching the HAL and never test sc_invalid — racing device_detach frees the HAL object and unmaps the BARs before the oids are removed, giving an unprivileged reader a use-after-free panic Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_sysctl.c:256 · pass 2 · new	none	not_reproduced
DF-4433	Medium	4.7	sln_mii_cmd() busy-waits on SL_MIISTAT_BUSY with no timeout while holding the interface serializer — unprivileged SIOCGIFMEDIA turns a wedged PHY/PCI readback into a permanent serializer-held kernel busy loop Base system — drivers · sys/dev/netif/sln/if_sln.c:389 · pass 2 · new	Unkillable kernel busy-loop holding the interface serializer (SIOCGIFMEDIA path) / wedged interrupt thread (media_intr path); permanent network DoS	untested
DF-4461	Medium	4.7	amdtemp_gettemp17to19h KASSERTs on mutable CCD-valid hardware state — unprivileged sysctl read or the periodic sensor task panics stock INVARIANTS kernels Base system — drivers · sys/dev/powermng/amdtemp/amdtemp.c:960 · pass 2 · new	none	not_reproduced
DF-4507	Medium	4.7	ttm_page_alloc: TTM page pools have no memory-pressure reclamation — the vm_lowmem eventhandler is never invoked anywhere in the kernel and register_shrinker does not exist Base system — drivers · sys/dev/drm/ttm/ttm_page_alloc.c:442 · pass 2 · new	none	untested
DF-4621	Medium	4.7	amdgpu_dm debugfs: OR-combined valid_input accepts invalid DP lane_count; stored unvalidated and consumed by a lane_settings[LANE_COUNT_DP_MAX=4] write loop -> stack OOB write (LATENT: file not compiled) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:195 · pass 2 · new	none	untested
DF-4643	Medium	4.7	dce_virtual's crtc_irq .set callback invokes the DragonFly hrtimer_cancel emulation, which may sleep (taskqueue_drain) and migrate CPUs, while amdgpu_irq_update holds adev->irq.lock — atomic-context contract violation, display-irq stall/lock-protocol hazard Base system — drivers · sys/dev/drm/amd/amdgpu/dce_virtual.c:715 · pass 2 · new	none	untested
DF-4692	Medium	4.7	sili_pm: sili_pm_read/sili_pm_write/sili_pm_set_feature dereference unchecked sili_ata_get_xfer() NULL — kernel panic when any PM register access runs against an exhausted ccb pool Base system — drivers · sys/dev/disk/sili/sili_pm.c:549 · pass 2 · new	none	inconclusive
DF-4763	Medium	4.7	Unchecked M_PREPEND(M_NOWAIT) failure in fwe_as_output() NULL-derefs the already-freed mbuf — guaranteed kernel panic under mbuf pressure Base system — drivers · sys/dev/netif/fwe/if_fwe.c:506 · pass 2 · new	none	inconclusive
DF-4874	Medium	4.7	afd_detach() in-flight teardown race: UAF of afd_softc/struct disk + shared dscheck/dsgone disk-layer race — twin of reproduced DF-4797 (ad) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-fd.c:134 · pass 2 · new	none	untested
DF-4915	Medium	4.7	DragonFly port removed upstream's in_interrupt() guard from amdgpu_virt_kiq_rreg/wreg: unconditional console kprintf per SR-IOV MMIO access and msleep() from hardirq context on KIQ fence timeout Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_virt.c:162 · pass 2 · new	none	not_reproduced
DF-5220	Medium	4.7	Use-after-free: execlists engine-init failure kfree()s the engine while engine->timeline.link is still on gt.timelines; the unwind's neighbor list_del writes kernel pointers into the freed chunk Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_timeline.c:28 · pass 2 · new	none	inconclusive
DF-5462	Medium	4.7	Lockless cam_extend array: ptopen/ptclose/ptstrategy/ptioctl UAF read races ptctor's cam_extend_set growth (kfree of ea->ps) — kernel pointer used from freed memory Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_pt.c:153 · pass 2 · new	none	not_reproduced
DF-5594	Medium	4.7	devq lifetime is anchored to the sim refcount, not to the peripherals queued on it — devq freed with cam_ed allocation slots still queued (contradicts cam_sim.c's own comment) Base system — bus / platform / cpu · sys/bus/cam/cam_sim.c:236 · pass 2 · new	none	untested
DF-2610	Low	4.7	icmp6_redirect_input dereferences stale ip6/nd_rd pointers after IP6_EXTHDR_CHECK may reallocate the mbuf (latent UAF read) Kernel memory corruption (UAF / OOB write) · sys/netinet6/icmp6.c:2160 · pass 2 · new	none	not_reproduced
DF-2638	Low	4.7	hammer2_inode_chain_sync clears RESIZED/MODIFIED before the backend sync and never restores them on error — silent metadata loss Hammer2 · sys/vfs/hammer2/hammer2_inode.c:1718 · pass 2 · new	none	untested
DF-2641	Low	4.7	Latent unguarded chain->data derefs in xop_nrename/xop_unlink/chain_sync (539 lacks even the error check its siblings have; 670-678/1618 are NULL-offset WRITE variants after modify-succeeds-with-NULL) Hammer2 · sys/vfs/hammer2/hammer2_xops.c:539 · pass 2 · new	none	untested
DF-2688	Low	4.7	OOM kill block operates on bigproc without p_token and without liveness revalidation (TOCTOU vs concurrent exit) Kernel memory corruption (UAF / OOB write) · sys/vm/vm_pageout.c:1826 · pass 2 · new	none	untested
DF-2901	Low	4.7	hammer2 bulkfree scan uses kmem_alloc_swapbacked() result unchecked — NULL bitmap reaches bzero(NULL, size) panic in cbinfo_bmap_init; path is unprivileged via the ungated HAMMER2IOC_BULKFREE_SCAN/ASYNC ioctls Hammer2 · sys/vfs/hammer2/hammer2_bulkfree.c:569 · pass 2 · new	panic	not_reproduced
DF-2939	Low	4.7	dev_pager_dealloc runs cdev_pg_dtor before unlinking the object from dev_pager_object_list (and outside dev_pager_mtx): racing cdev_pager_allocate for the same handle clobbers the fresh object's si_object, making the later old_dev_pager_dtor KKASSERT(dev->si_object) a reachable panic Base system — virtual memory · sys/vm/device_pager.c:211 · pass 2 · new	panic	not_reproduced
DF-2951	Low	4.7	sysctl_hostname dereferences p->p_ucred up to four times with no p_spin/crhold and not via td_ucred — racy freed-credential read (cratom_proc can crfree the cred between load and deref), wild pr_host[256] copyout; DF-2868-class sibling with a jailed-root trigger Kernel memory corruption (UAF / OOB write) · sys/kern/kern_mib.c:221 · pass 2 · new	none	not_reproduced
DF-2992	Low	4.7	flush_pagedep_deps: bwrite(inodedep->id_buf) dereferences id_buf after dropping the softdep lock — diverges from the file's own copy-first discipline (softdep_update_inodeblock), micro-window UAF read / NULL deref Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_softdep.c:4655 · pass 2 · new	panic	not_reproduced
DF-3020	Low	4.7	devfs_allocv failure ignored: devfs_spec_open and devfs_vop_nlookupdotdot use the vp unconditionally → vn_unlock(NULL)/NULL-fp panic under vnode exhaustion Base system — filesystems · sys/vfs/devfs/devfs_vnops.c:535 · pass 2 · new	none	not_reproduced
DF-3021	Low	4.7	devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has → NULL-deref panic when the device node was torn down under an open fd Base system — filesystems · sys/vfs/devfs/devfs_vnops.c:1432 · pass 2 · new	none	not_reproduced
DF-3025	Low	4.7	tmpfs_nlink LINK_MAX check-then-increment race across different directories can push tn_links past LINK_MAX → KKASSERT panic (INVARIANTS) / nlink contract breach Base system — filesystems · sys/vfs/tmpfs/tmpfs_vnops.c:1209 · pass 2 · new	none	not_reproduced
DF-3065	Low	4.7	ext2_reallocblks feeds unclamped attacker-controlled pref (crafted i_db[]/indirect values via ext2_blkpref) into dtog() as the cg index — OOB heap reads of e2fs_gd[]/e2fs_maxcluster[]/e2fs_clustersum[] and wild device I/O (root-sysctl-gated) Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_alloc.c:302 · pass 2 · new	none	not_reproduced
DF-3094	Low	4.7	extendfile panics on FAT I/O error mid-extend (bread failure of the FAT block hits a KKASSERT instead of returning the error) Base system — filesystems · sys/vfs/msdosfs/msdosfs_fat.c:400 · pass 2 · new	none	not_reproduced
DF-3196	Low	4.7	nfs_nget_nonblock revalidation restart retains a stale vp across vput(vp); goto loop — any execution of the NFSTOV(np) != vp branch double-vputs the same vnode (refcount underflow → premature vnode recycling / assert panic); the adjacent retry path's own comment states the rule this restart forgot Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_node.c:271 · pass 2 · new	none	untested
DF-3231	Low	4.7	Transaction starters ignore hammer_get_root_volume failure — trans->rootvol==NULL flows into ~25 ondisk derefs and hammer_rel_volume(NULL): kernel NULL-deref panic when root-volume-header reload I/O fails (KKASSERT is the only guard) Base system — filesystems · sys/vfs/hammer/hammer_transaction.c:53 · pass 2 · new	panic	not_reproduced
DF-3302	Low	4.7	add_mfc() uses mfc_find() result before taking mroute_token — UAF-write race against del_mfc() kfree Kernel memory corruption (UAF / OOB write) · sys/net/ip_mroute/ip_mroute.c:976 · pass 2 · new	none	not_reproduced
DF-3435	Low	4.7	check_keep_state dereferences an unchecked kmalloc(..., M_NULLOK) result - NULL-page write panic when the M_IPFW3_STATE type limit is reached Base system — network stack · sys/net/ipfw3_basic/ip_fw3_state.c:319 · pass 2 · new	none	not_reproduced
DF-3467	Low	4.7	check_uid/check_gid dereference an unreferenced, unlocked inpcb on the output path — use-after-free read race against in_pcbdetach()->kfree(inp) Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_layer4/ip_fw3_layer4.c:120 · pass 2 · new	none	not_reproduced
DF-3492	Low	4.7	pppoe_ticker dereferences hook->private/sp->neg unconditionally and races ng_pppoe_disconnect freeing the session — NULL-deref/UAF panic (DF-3488 twin) Kernel memory corruption (UAF / OOB write) · sys/netgraph/pppoe/ng_pppoe.c:1490 · pass 2 · new	none	untested
DF-3510	Low	4.7	ng_socket: unsynchronized priv->node / priv->datasock reads in ngc_send/ngd_send/ngs_connect/ngs_disconnect/ngs_rcvdata race mtx-protected teardown — NULL-deref/UAF panic Kernel memory corruption (UAF / OOB write) · sys/netgraph7/socket/ng_socket.c:310 · pass 2 · new	none	not_reproduced
DF-3517	Low	4.7	v1 ng_socket: ngsock/ngpcb lifetime entirely unsynchronized across socket threads, netisr and synchronous-dispatch contexts — NULL-deref/UAF race (DF-3510 ng7 twins, worse: no locks at all, refs-blind kfree) Kernel memory corruption (UAF / OOB write) · sys/netgraph/socket/ng_socket.c:257 · pass 2 · new	none	untested
DF-3529	Low	4.7	ng_ether control-plane teardown frees priv without synchronizing against BGL-held data-path callbacks (speculative UAF) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ether/ng_ether.c:313 · pass 2 · new	none	untested
DF-3570	Low	4.7	MP_ReadOtherFunPciEConfigSpace never reads RE_CSIDR (constant 0xffffffff return) -> NULL CMAC bus_space handle dereference at re(4) attach on RTL8168FP/RTL8117, plus PCIe config RMW clobbering on all CSIAR users Base system — drivers · sys/dev/netif/re/re.c:31163 · pass 2 · new	none	not_reproduced
DF-3579	Low	4.7	NULL-deref panic in iwn_ampdu_tx_done(): TX_DONE on an aggregation queue with no bound session (sc->qid2tap[qid]==NULL) Base system — drivers · sys/dev/netif/iwn/if_iwn.c:3600 · pass 2 · new	panic	untested
DF-3581	Low	4.7	Non-terminating RX loop in iwn_notif_intr(): 12-bit firmware closed_count vs 64-slot ring Base system — drivers · sys/dev/netif/iwn/if_iwn.c:3900 · pass 2 · new	dos	untested
DF-3595	Low	4.7	sc_curmac left NULL after failed band-switch/hw-reset while RUNNING: bwn_stop/bwn_detach/bwn_suspend NULL-deref panic Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn.c:4764 · pass 2 · new	panic	inconclusive
DF-3596	Low	4.7	Unbounded device-register polling under BWN_LOCK in bwn_intr_pmq and bwn_core_start: permanent unkillable wlan-subsystem wedge Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn.c:5172 · pass 2 · new	dos	inconclusive
DF-3603	Low	4.7	Unbounded exponential backtracking in hdaa_audio_trace_as_out/trace_dac DAC-assignment search — kernel livelock at attach/reconfig with hostile codec topology Base system — drivers · sys/dev/sound/pci/hda/hdaa.c:3595 · pass 2 · new	attach-time livelock with hostile codec	untested
DF-3632	Low	4.7	NVM sections parsed at fixed word offsets against firmware-returned lengths (exact-size kmallocs) - heap OOB reads incl. regulatory[0x507] LAR read requiring >=2576 bytes Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm.c:2251 · pass 2 · new	none	inconclusive
DF-3655	Low	4.7	NULL dereference via WARN_ON(!status->plane_count) immediately after WARN_ON(!status) in amdgpu_dm_atomic_commit_tail() Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4889 · pass 2 · new	none	inconclusive
DF-3662	Low	4.7	wpi(4): divide-by-zero in wpi_get_power_index() — interpolate() divisor is the difference of two unvalidated int8 EEPROM TX-power sample bytes (wpi twin of DF-3578) Base system — drivers · sys/dev/netif/wpi/if_wpi.c:3812 · pass 2 · new	panic	inconclusive
DF-3668	Low	4.7	ix_txeof/ix_txgc loop on unvalidated NIC TX-head index: out-of-range write-back → infinite interrupt-context spin (KKASSERT panic on INVARIANTS, soft-lockup otherwise) Base system — drivers · sys/dev/netif/ix/if_ix.c:2368 · pass 2 · new	none	inconclusive
DF-3674	Low	4.7	mpt_scsi_reply_handler / mpt_scsi_tgt_reply_handler dereference req with no NULL check while mpt_intr dispatches handlers with req=NULL on out-of-range IOC context Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:2649 · pass 2 · new	none	inconclusive
DF-3680	Low	4.7	igb_txeof/igb_txgc loop on unvalidated NIC TX-head index: out-of-range 32-bit write-back → infinite interrupt-context spin holding tx_serialize (KKASSERT panic on INVARIANTS after one ring wrap; permanent soft-lockup otherwise) Base system — drivers · sys/dev/netif/igb/if_igb.c:2186 · pass 2 · new	none	inconclusive
DF-3707	Low	4.7	vega10_get_sclk_od/get_mclk_od divide by zero when the golden top clock is 0 (crafted VBIOS) — world-readable sysfs trigger Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4540 · pass 2 · new	none	inconclusive
DF-3714	Low	4.7	em_tx_collect walks the TX ring toward an unvalidated TDH register value: out-of-range write-back -> all TX buffers freed (DMA-after-free) then KKASSERT panic / permanent serializer-held spin; same class in the 82547 TDT walk Base system — drivers · sys/dev/netif/em/if_em.c:3284 · pass 2 · new	none	inconclusive
DF-3771	Low	4.7	ahci_port_free() teardown use-after-free: armed per-CCB timeout callouts never cancelled and in-flight CCBs never failed before kfree Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ahci/ahci.c:997 · pass 2 · new	none	not_reproduced
DF-3774	Low	4.7	Unchecked NULL from ahci_ata_get_xfer() in ahci_set_feature() and ahci_read_log() (ahci.c instances of the DF-2420/DF-2423 class) -> kernel panic Base system — drivers · sys/dev/disk/ahci/ahci.c:4057 · pass 2 · new	none	not_reproduced
DF-3810	Low	4.7	skl_calc_wrpll_link divides by p0p1p2*5 with no zero guard — QDIV_MODE=1 with QDIV_RATIO=0 readback panics the kernel (#DE) Base system — drivers · sys/dev/drm/i915/intel_ddi.c:1322 · pass 2 · new	none	untested
DF-3816	Low	4.7	dev.mpr.N.dump_reqs sysctl: unlocked walk of live command/chain lists (UAF read) plus fixed 128-byte reads past device-sized frames Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr.c:1904 · pass 2 · new	none	inconclusive
DF-3831	Low	4.7	No CCB timeout handler (callout block #if 0'd, 'XXX Need a timeout handler') plus ignored bus_dmamap error — lost commands wedge the SIM queue forever Base system — drivers · sys/dev/disk/trm/trm.c:470 · pass 2 · new	none	inconclusive
DF-3833	Low	4.7	Stale completion after bus-reset recovery: trm_Interrupt dereferences NULL pActiveDCB/pActiveSRB (KASSERT only guards INVARIANTS), and trm_SRBdone's going-list unlink walk has no termination Base system — drivers · sys/dev/disk/trm/trm.c:1339 · pass 2 · new	none	inconclusive
DF-3842	Low	4.7	Firmware ring indices used unmasked: iwi_tx_intr/iwi_rx_intr termination depends on a raw CSR-read index; an out-of-range value → non-terminating interrupt loop holding IWI_LOCK + wlan serializer (hard hang) and txq->queued int underflow Base system — drivers · sys/dev/netif/iwi/if_iwi.c:1681 · pass 2 · new	none	inconclusive
DF-3855	Low	4.7	ext-TMDS init parser desynchronisation: non-IGP case-0 record missing 'index += 4' — value/terminator bytes re-executed as MMIO commands Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_combios.c:2955 · pass 2 · new	none	inconclusive
DF-3866	Low	4.7	emu_intr_unregister() uses caller-controlled slot index with no bounds check -> OOB read + four-field NULL write cluster at ihandler[-1] (NULLs sc->reg, sc->irq, sc->ih) Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pci/emu10kx.c:948 · pass 2 · new	none	inconclusive
DF-3867	Low	4.7	emu_intr() NULL-check and indirect call of ihandler[].irq_func are unsynchronized against emu_intr_unregister() -> call through NULL function pointer (panic) Base system — drivers · sys/dev/sound/pci/emu10kx.c:995 · pass 2 · new	none	untested
DF-3874	Low	4.7	Firmware-controlled list counts drive walks past fixed arrays: pdlist->count>240, ld_count>64, evt count>15 -> heap OOB reads and console disclosure Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi.c:1331 · pass 2 · new	leak	inconclusive
DF-3877	Low	4.7	MFI_DCMD_LD_DELETE post-check assumes the volume still exists: AEN-driven deletion during the DCMD round-trip hits KASSERT('volume dissappeared')/NULL->ld_dev deref Base system — drivers · sys/dev/raid/mfi/mfi.c:2625 · pass 2 · new	none	inconclusive
DF-3884	Low	4.7	drm_dp_mst_topology_mgr_destroy/suspend never flush tx_work: pending work can run after teardown (DF-3699 family) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dp_mst_topology.c:3254 · pass 2 · new	race-window NULL panic / teardown UAF	untested
DF-3897	Low	4.7	WarpDrive validation accepts NumPhysDisks == 0: guaranteed integer divide-by-zero panic in mpssas_direct_drive_io on the first qualifying READ/WRITE Base system — drivers · sys/dev/raid/mps/mps_sas.c:2190 · pass 2 · new	none	not_reproduced
DF-3918	Low	4.7	Allocation-failure path in mpr_mapping_allocate_memory kfrees NULL (panic on DragonFly) / stale pointers; mpr_mapping_initialize return ignored by both callers Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_mapping.c:2177 · pass 2 · new	logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919)	untested
DF-3926	Low	4.7	siba_cc_power_init (reached unconditionally from siba_core_resume -> siba_cc_resume) dereferences scc->scc_dev with no NULL check - panic on resume when scan found no ChipCommon core Base system — drivers · sys/dev/netif/bwn/siba/siba_core.c:1042 · pass 2 · new	none	not_reproduced
DF-3937	Low	4.7	ena_com_admin_destroy() dereferences comp_ctx four lines before its NULL check — OOM-gated NULL-deref panic in the ena(4) attach path Base system — drivers · sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1581 · pass 2 · new	none	inconclusive
DF-4033	Low	4.7	NULL radeon_encoder dereference family in connector property handlers and monitor-bpc path Base system — drivers · sys/dev/drm/radeon/radeon_connectors.c:159 · pass 2 · new	none	not_reproduced
DF-4034	Low	4.7	radeon_connector_get_edid dereferences ddc_bus->has_aux with ddc_bus==NULL (unprivileged GETCONNECTOR DoS) Base system — drivers · sys/dev/drm/radeon/radeon_connectors.c:309 · pass 2 · new	none	not_reproduced
DF-4035	Low	4.7	OOM NULL-deref family: unchecked drm_cvt_mode() results in radeon_tv_get_modes and radeon_add_common_modes Base system — drivers · sys/dev/drm/radeon/radeon_connectors.c:549 · pass 2 · new	none	not_reproduced
DF-4040	Low	4.7	polaris10 VCE/UVD/CAC level population NULL-derefs when the PowerPlay table omits usMMDependencyTableOffset / usVddcLookupTableOffset Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:712 · pass 2 · new	none	inconclusive fixed
DF-4074	Low	4.7	NULL mm_dep_table dereference panics: V1 parser leaves the subtable NULL (usMMDependencyTableOffset==0) and vegam_update_uvd/vce_smc_table deref it unconditionally Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:340 · pass 2 · new	none	inconclusive
DF-4104	Low	4.7	LVDS_Info parsed at unvalidated VBIOS data_offset: fixed 0x2C-byte struct reads run past the image-sized BIOS heap buffer (parse_data_header performs no bounds check; atom_context has no bios_size) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/atombios_encoders.c:2081 · pass 2 · new	none	untested
DF-4111	Low	4.7	tl_start ignores tl_encap() failure: mbuf chain leak, NULL-mbuf BPF tap (panic with listener), non-READY list chained into TX Base system — drivers · sys/dev/netif/tl/if_tl.c:1773 · pass 2 · new	none	untested
DF-4180	Low	4.7	twe_done indexes twe_lookup[TWE_Q_LENGTH=255] with the controller-supplied 8-bit response_id — id 255 reads one pointer past the array (into twe_drive[0]) and dereferences it as a request (wild read + write) Base system — drivers · sys/dev/raid/twe/twe.c:1199 · pass 2 · new	none	inconclusive
DF-4198	Low	4.7	get_bytes_per_element() returns 0 for dm_444_8/dm_mono_8 and unhandled enum values -> integer divide-by-zero (#DE kernel panic) at get_surf_rq_param():641 for linear surfaces, dead-code #DE at :745, and dml_log2(0)=-127 UB-shift garbage programming Base system — drivers · sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:44 · pass 2 · new	dos	inconclusive
DF-4200	Low	4.7	NULL function-pointer call: encoder_funcs->detect invoked without check in amdgpu_connector_dp_detect DP-bridge branch — external (Travis/Nutmeg) encoders ship helper funcs without .detect Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1386 · pass 2 · new	none	not_reproduced
DF-4201	Low	4.7	NULL amdgpu_encoder / enc_priv dereference family after best_encoder() in the two scaling-mode property handlers and amdgpu_connector_get_monitor_bpc (radeon DF-4033 twin) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:139 · pass 2 · new	none	not_reproduced
DF-4202	Low	4.7	Unchecked drm_cvt_mode() NULL results: mode->type write through NULL in amdgpu_connector_lcd_native_mode (:406) and drm_mode_probed_add(NULL) list_add in amdgpu_connector_add_common_modes (:460) (radeon DF-4035 twin) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:405 · pass 2 · new	none	not_reproduced
DF-4214	Low	4.7	RAID reply-handler deregistration is not refcounted across mpt(4) controllers: detaching one controller strands the other's RAID actions (request leak → unkillable hang) Base system — drivers · sys/dev/disk/mpt/mpt_raid.c:135 · pass 2 · new	none	untested
DF-4215	Low	4.7	construct() OOM failure path dereferences NULL current_state / NULL dc->ctx in destruct() → GPU-probe NULL-deref panic instead of graceful fallback Base system — drivers · sys/dev/drm/amd/display/dc/core/dc.c:519 · pass 2 · new	none	untested
DF-4252	Low	4.7	mprsas_fw_work IR-event early return leaks fw_event allocation and strands the startup refcount (discovery can never complete) Base system — drivers · sys/dev/raid/mpr/mpr_sas_lsi.c:327 · pass 2 · new	none	untested
DF-4298	Low	4.7	Lock-order inversion: kbd_token acquired before kb_lock in kbd.c cdev/register paths versus kb_lock before kbd_token in the syscons/vkbd ioctl paths (AB-BA deadlock) Base system — drivers · sys/dev/misc/kbd/kbd.c:802 · pass 2 · new	none	untested
DF-4313	Low	4.7	dcn10 construct() OOM error path: dcn10_pp_smu_create() result never checked — NULL pp_smu dereferenced via dcn_bw_notify_pplib_of_wm_ranges (probe-time panic); dcn10_create_resource_pool leaks the pool allocation on construct failure Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1350 · pass 2 · new	none	inconclusive
DF-4336	Low	4.7	twa CL: tw_cl_reset_ctlr has no entry guard — MPSAFE watchdog callout and passthru-timeout ioctl threads run the reset state machine concurrently Base system — drivers · sys/dev/raid/twa/tw_cl_io.c:1049 · pass 2 · new	none	untested
DF-4354	Low	4.7	sn_attach() ignores sn_activate() failure: rman_get_cpuid(NULL) guaranteed kernel panic during attach, plus register writes into ISA DMA-controller ports 0x00-0x0F Base system — drivers · sys/dev/netif/sn/if_sn.c:164 · pass 2 · new	none	untested
DF-4367	Low	4.7	Dispatch entries bypassing hwmgr->smu_lock (pp_get_power_profile_mode, pp_set_clockgating_by_smu, pp_dpm_powergate_gfx/mmhub/acp/sdma) race the smu_lock-protected pp_table reset path that frees the hwmgr backend Base system — drivers · sys/dev/drm/amd/powerplay/amd_powerplay.c:873 · pass 2 · new	Unlocked powerplay dispatch entries race the smu_lock-protected pp_table reset that frees the hwmgr backend: NULL-deref panic or freed-slab disclosure to an unprivileged reader.	untested
DF-4385	Low	4.7	oce_img_flashing_required bcmp's the image CRC at a fixed ~1.31 MB offset with no fw->datasize check — sibling OOB-read site missed by DF-1573 Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_sysctl.c:458 · pass 2 · new	none	untested
DF-4392	Low	4.7	mfi_process_fw_state_chg_isr dereferences sc->mfi_aen_cm before its NULL check - OCR with no AEN outstanding NULL-derefs (and uses an unvalidated pool index) Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:1298 · pass 2 · new	The OCR completion path kfrees and indexes through mfi_aen_cm BEFORE the NULL guard	untested
DF-4393	Low	4.7	Unbounded firmware-status spin and 20-second busy-wait in the OCR path execute in the watchdog callout while holding mfi_io_lock - single stuck firmware wedges softclock and all card I/O Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:1275 · pass 2 · new	The OCR path busy-waits 20 seconds then spins indefinitely on the RSR bit with no timeout; invoked from the reset holding mfi_io_lock in callout context - a firmware that never clears the bit parks the softclock thread forever with the lock held, permanently stalling all callouts system-wide	untested
DF-4401	Low	4.7	Unguarded tws_reset re-entry: unlocked state check races the TWS_RESET_START transition — KASSERT panic (INVARIANTS) or leaked xpt_freeze_simq count freezing the adapter forever (twa sibling DF-4336) Base system — drivers · sys/dev/raid/tws/tws_cam.c:1203 · pass 2 · new	dos	inconclusive
DF-4403	Low	4.7	Error paths permanently strand reserved request slots and hang CAM ccbs: AEN/param channels die; map-failed ccb is on no queue and can never be completed Base system — drivers · sys/dev/raid/tws/tws_cam.c:807 · pass 2 · new	dos	inconclusive
DF-4426	Low	4.7	UINT8 loop-variable wraparound in CMI enumeration causes infinite loop while holding the global hp lock (local DoS; also amplifies cmi_order[] overflow) Base system — drivers · sys/dev/acpica/acpi_hp/acpi_hp.c:1145 · pass 2 · new	dos	not_reproduced
DF-4431	Low	4.7	hubp1_program_tiling: log_2() of gfx9 tiling config uses ilog2, and ilog2(0)==-1 programs NUM_PIPES/NUM_BANKS/etc. to FIELD MAX (GPU-hang class, hw-config-gated) Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:133 · pass 2 · new	Misprogrammed DCSURF_ADDR_CONFIG (fields set to max) -> display-pipe hang on DCN1 hw with zeroed/garbage GB_ADDR_CONFIG readback	untested
DF-4448	Low	4.7	dce120 construct(): ipps/transforms NULL checks index slot [i] while allocation went to slot [j] — on Vega20 with harvested pipes the check trips on a never-written kzalloc slot and kills the entire display pool init (spurious false-failure) Base system — drivers · sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1049 · pass 2 · new	none	untested
DF-4459	Low	4.7	drm_gem_init: unchecked mm kzalloc (NULL-deref panic under kernel OOM), partial-failure leaks, and dangling dev->mm_private on the drm_ht_create failure path Base system — drivers · sys/dev/drm/drm_gem.c:139 · pass 2 · new	none	inconclusive
DF-4498	Low	4.7	sbsh: frames with total length 1-4 bytes cause an unbounded repack loop in encap_frame() - permanent kernel spin holding the interface serializer Base system — drivers · sys/dev/netif/sbsh/if_sbsh.c:636 · pass 2 · new	none	inconclusive
DF-4501	Low	4.7	radeon_uvd_send_msg NULL-deref panic: radeon_fence_ref(ib.fence) executed when radeon_ib_schedule() failed and left ib.fence NULL Base system — drivers · sys/dev/drm/radeon/radeon_uvd.c:763 · pass 2 · new	none	untested
DF-4508	Low	4.7	e1000_i210: e1000_release_swfw_sync_i210 acquires the SWSM hardware semaphore in an unbounded empty-body loop on every NVM/PHY release path — a stuck SMBI bit pins the calling thread forever Base system — drivers · sys/dev/netif/ig_hal/e1000_i210.c:146 · pass 2 · new	Calling thread pinned in-kernel forever on stuck SMBI/SWSM semaphore (surprise removal, wedged fw); interface wedged under serializer	untested
DF-4509	Low	4.7	twa(4): tw_cli_drain_aen_queue() re-queues a firmware-owned request into FREE_Q on ETIMEDOUT — request left dual-linked in BUSY_Q/PENDING_Q + FREE_Q (request handed out twice, internal DMA buffer re-assigned, crossed completions; third site of the DF-4335/DF-4274/DF-1814 class) Base system — drivers · sys/dev/raid/twa/tw_cl_misc.c:353 · pass 2 · new	none	inconclusive
DF-4551	Low	4.7	als_intr registered before channels exist (and kept after they are freed): IRQ in the attach/detach window runs chn_intr(NULL)/chn_intr(freed) — NULL-deref/UAF panic; als_resource_free releases the I/O region before tearing down the handler Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/als4000.c:648 · pass 2 · new	none	not_reproduced
DF-4558	Low	4.7	MOD_UNLOAD ignores device_delete_child() failure and unconditionally kfrees the external softc while free_softc() can leave the cam_sim registered — post-kldunload use-after-free (lockmgr on freed+uninited state_lock) on the still-reachable SIM Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-cam.c:894 · pass 2 · new	none	not_reproduced
DF-4575	Low	4.7	adw_idle_cmd_send: single RISC command mailbox shared across sim-lock, callout and lock-free ISR contexts without serialization — raced status word panics the kernel (or BDRs the wrong target); any chip wedge during timeout recovery ends in an unconditional panic after a 10-second interrupts-disabled spin Base system — drivers · sys/dev/disk/advansys/adwlib.c:850 · pass 2 · new	Kernel DoS: 10s interrupts-disabled spin then unconditional panic on raced mailbox (or wedged chip during timeout recovery); torn param can BDR the wrong target	untested
DF-4602	Low	4.7	Unconditional per-ioctl failure diagnostics + full chain rebuild per SETFMT/SPEED/CHANNELS give an unprivileged user an unbounded kernel console print rate; a one-shot guest-wide starvation/livelock was observed during such storms (inconclusive) Base system — drivers · sys/dev/sound/pcm/feeder_chain.c:150 · pass 2 · new	dos	inconclusive
DF-4705	Low	4.7	ar5210GetDiagState HAL_DIAG_EEREAD dereferences args==NULL when SIOCGATHDIAG omits ATH_DIAG_IN — kernel page-fault panic (DF-4670 family; sibling of DF-1819, distinct deref) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:633 · pass 2 · new	none	inconclusive
DF-4713	Low	4.7	amdgpu_irq: amdgpu_irq_dispatch/amdgpu_irq_update call the optional .process/.set callbacks with no NULL guard while every sibling path validates them — dce_virtual registers a .process==NULL crtc_irq (num_types=7) at LEGACY/229, one stray IV away from a hardirq NULL-call panic Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_irq.c:436 · pass 2 · new	none demonstrated (hardware-gated: guest has no AMD GPU, amdgpu never binds); realistic ceiling is a hardirq NULL function-pointer call => kernel panic (local DoS) if an IH vector ever reaches a .process-less registered source (dce_virtual crtc_irq, LEGACY/229, num_types=7) or if a num_types>0 .set-less source is ever registered and the GPU-reset resume helper runs	untested fixed
DF-4720	Low	4.7	XPT_ABORT/XPT_TERM_IO are decorative stubs and aac_timeout() only logs: timed-out CAM CCBs and their FIBs leak permanently until the command pool is exhausted (controller-wide I/O wedge) Base system — drivers · sys/dev/raid/aac/aac_cam.c:526 · pass 2 · new	none	untested
DF-4730	Low	4.7	apple_smc_sms_intr() unconditionally reads the ISA int-port via ASMC_INTPORT_READ while MMIO-backend devices have sc->sc_ioport == NULL — NULL resource deref → panic in interrupt context Base system — drivers · sys/dev/apple/smc/smc_io.c:609 · pass 2 · new	none	untested
DF-4732	Low	4.7	Sleepable lockmgr acquisition from the GPU interrupt dispatch path: DM_IRQ_TABLE_LOCK in amdgpu_dm_irq_immediate_work/amdgpu_dm_irq_schedule_work runs lockmgr(LK_EXCLUSIVE) inside the serialized DRM ithread (DragonFly port divergence) Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:305 · pass 2 · new	none	untested
DF-4753	Low	4.7	cxm_msp_* audio-decoder path runs with zero serialization: unprivileged ioctls sleep ~0.5s in cxm_msp_wait_for_lock while cxm_detach (kldunload) frees the softc — use-after-free (DF-4419 cxm twin; cxm_open is_opened TOCTOU folded) Kernel memory corruption (UAF / OOB write) · sys/dev/video/cxm/cxm_msp34xxx.c:588 · pass 2 · new	panic	inconclusive
DF-4770	Low	4.7	intel_dp_mst_atomic_check dereferences drm_atomic_get_new_crtc_state() result without NULL check (latent NULL-deref panic, currently masked by earlier drm-core NULL sinks) Base system — drivers · sys/dev/drm/i915/intel_dp_mst.c:123 · pass 2 · new	panic	untested
DF-4787	Low	4.7	dal_gpio_service_open calls define_ddc_registers/define_hpd_registers on the create_*() result before the NULL check — deterministic NULL-deref panic when DDC/HPD pin allocation fails Base system — drivers · sys/dev/drm/amd/display/dc/gpio/gpio_service.c:245 · pass 2 · new	none	untested
DF-4804	Low	4.7	amdsbwd hardware watchdog is never deactivated on reboot/halt (nor on panic by default): shutdown handler #if 0'd and no framework hook fires — default-auto-armed 30s timer hard-resets machines mid-POST/dump and can reset-loop long-boot hosts Base system — drivers · sys/dev/misc/amdsbwd/amdsbwd.c:112 · pass 2 · new	dos	untested
DF-4809	Low	4.7	ata_ahci_reset() dereferences ch->dma unconditionally: NULL-pointer panic when ata_dmaalloc() failed at channel attach Base system — drivers · sys/dev/disk/nata/chipsets/ata-ahci.c:466 · pass 2 · new	none	untested
DF-4821	Low	4.7	radeon_ring_backup() uses the hardware rptr as the first ring index without ptr_mask — bogus GPU/writeback value gives a wild kernel OOB read (panic) during GPU reset Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_ring.c:299 · pass 2 · new	panic	untested
DF-4872	Low	4.7	ar9287FillCapabilityInfo never enforces 2GHz-only Kiwi-2 silicon: GMODE divergence re-adds 11A/11NA wireless modes the EEPROM layer explicitly denies, and 5GHz channel edges are inherited — 5GHz channels admitted on 2GHz-only silicon (enabler of the DF-4793 NULL-pier panic) Base system — drivers · sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:433 · pass 2 · new	none	untested
DF-4878	Low	4.7	dal_i2caux_release_engine(): unsynchronized engine state — engine->ddc NULL-wipe race ends in dal_ddc_close(NULL) NULL-deref panic (DAL2 mutex dropped) + wrong-owner pin close Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/i2caux.c:420 · pass 2 · new	none	untested
DF-4883	Low	4.7	ASSERT-only domain validation in the DC fixed-point library: dc_fixpt_log diverges into an integer 0/0 (#DE, kernel panic) for nonpositive arguments; exp/mul/sqr/from_fraction overflow-and-UB siblings Base system — drivers · sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:378 · pass 2 · new	none	inconclusive
DF-4887	Low	4.7	cik_ih: unvalidated device-DMA'd IH wptr — DF-4843/DF-4854 twin on the 16-byte CIK grid: a misaligned wptr permanently hard-spins the amdgpu interrupt thread, and the RB_OVERFLOW recovery preserves the bad phase so wptr∈[0xFFE4..0xFFEF]\|OVERFLOW parks rptr at [0xFFF4..0xFFFF] → up to 12-byte OOB read past the zero-slack 64 KiB GTT ring BO Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/cik_ih.c:190 · pass 2 · new	dos	untested
DF-4897	Low	4.7	complete_raid5_write() computes and commits RAID-4/5 parity from FAILED (undefined) first-phase reads — garbage parity written to stable storage; the corruption survives retries and later surfaces as silently corrupt recovery reads Base system — drivers · sys/dev/raid/vinum/vinuminterrupt.c:194 · pass 2 · new	persistent silent on-disk RAID-4/5 parity corruption from a single failed component read: complete_raid5_write() XORs undefined (non-zeroed malloc) buffer contents of failed reads into the parity block and writes it to stable storage; the corruption survives daemon retries (retry XORs against the poisoned parity) and later surfaces as corrupt reconstructed data with no error indication	untested
DF-4979	Low	4.7	SSIF READ_START retry loop retries ENXIO/EBUSY forever — unbounded kthread livelock DoS via stuck/malicious BMC (distinct site from DF-2026) Base system — drivers · sys/dev/misc/ipmi/ipmi_ssif.c:186 · pass 2 · new	dos	untested
DF-4981	Low	4.7	jmphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → DragonFly panic("ifmedia_set") at attach (DF-4930/DF-4957 family) Base system — drivers · sys/dev/netif/mii_layer/jmphy.c:119 · pass 2 · new	none	not_reproduced
DF-5020	Low	4.7	dp_enable_link_phy reassigns pipes to a possibly-NULL dp_clock_source and calls program_pix_clk through it unguarded — latent NULL function-pointer call on DCE112/DCE120/DCN10 whose resource constructs skip the dp_clock_source NULL check; planted NULL also dereferenced by dp_retrain_link_dp_test Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_link_hwss.c:65 · pass 2 · new	kernel UAF/NULL-deref per finding	untested
DF-5028	Low	4.7	NULL-pointer dereference of radeon_encoder->enc_priv in dce6_audio_get_pin() encoder walk (dce6_afmt.c:104-105) Base system — drivers · sys/dev/drm/radeon/dce6_afmt.c:104 · pass 2 · new	none	not_reproduced
DF-5046	Low	4.7	idad_detach frees the idad softc under open descriptors and in-flight bios — DF-5013/DF-5025 family detach UAF Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ida/ida_disk.c:302 · pass 2 · new	none	untested
DF-5048	Low	4.7	Bios submitted to a wedged IDA controller park forever — unkillable D-state issuers and unbounded bio_queue (DF-5026 pattern) Base system — drivers · sys/dev/raid/ida/ida_disk.c:172 · pass 2 · new	none	untested
DF-5058	Low	4.7	Bios submitted to a never-completing mlx controller park on mlx_bioq forever — unkillable D-state issuers and unbounded bioq growth (DF-5048/DF-5026 family, mlx instance) Base system — drivers · sys/dev/raid/mlx/mlx_disk.c:156 · pass 2 · new	none	untested
DF-5115	Low	4.7	ips_pci_detach clears sc->configured before ips_adapter_free can return EBUSY: one failed detach permanently corrupts the state machine — retried detaches silently succeed without ips_pci_free, leaving the adapter IRQ handler registered against softc freed at module-unload unit destruction (interrupt-context UAF read/write), and ips_pci_shutdown permanently skips the cache flush Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips_pci.c:202 · pass 2 · new	none	untested
DF-5136	Low	4.7	vbt_sdvo_panel_type consumed as an unvalidated element index into the VBT BDB_SDVO_PANEL_DTDS table (dvo_timing + index) — root-set OOB read incl. negative offsets Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/i915_params.c:68 · pass 2 · new	none	untested
DF-5140	Low	4.7	iwm_notification_wait_free() frees the wait structure with no drain of threads still sleeping in iwm_wait_notification(); the only guard is a KASSERT compiled out on non-INVARIANTS kernels, so a detach racing an in-flight waiter operates on freed memory Kernel memory corruption (UAF / OOB write) · sys/dev/netif/iwm/if_iwm_notif_wait.c:108 · pass 2 · new	stalled control threads / detach-race UAF write	untested
DF-5157	Low	4.7	ath LED blink callout is re-armed by draining tx-completion tasks AFTER ath_stop()'s single cancel — no drain in ath_detach, callout fires into freed softc/HAL (use-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_led.c:166 · pass 2 · new	none	untested
DF-5212	Low	4.7	cxm(4) REMOTE_GETKEY: cxm_ir_key() tsleeps 50 ms inside an unserialized ioctl while cxm_detach frees the softc and destroys sc->iicbus — use-after-free (IR-path twin of DF-4753/DF-3941 family) Kernel memory corruption (UAF / OOB write) · sys/dev/video/cxm/cxm_ir.c:114 · pass 2 · new	panic	inconclusive
DF-5280	Low	4.7	pci_devq mutated without pci_token (pci_read_device/pci_freecfg) while PCIOCGETCONF walks the list under pci_token — use-after-free read race Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci.c:576 · pass 2 · new	VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281)	untested
DF-5283	Low	4.7	cpu_mwait_cx_hint() NULL-pointer dereference when deep-sleep inhibition is active on a MONITOR-without-MWAIT-EXT CPU (latent kernel panic) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/machdep.c:1133 · pass 2 · new	hard hang/panic in idle loop	untested
DF-5323	Low	4.7	Second M_WAITOK-sleep-reachable-inside-critical-section site: fw_bus_probe() holds crit_enter() across fw_bus_explore()'s device kmalloc(M_WAITOK\|M_ZERO) (distinct from known DF-1021/fw_get_tlabel) Base system — bus / platform / cpu · sys/bus/firewire/firewire.c:1239 · pass 2 · new	sleep-inside-critical-section livelock hazard	untested
DF-5341	Low	4.7	mptable_map() adopts firmware pap/base_table_length with no 'PCMP' signature, no MPFPS/MPCTH checksum, and no PA-range validation — arbitrary-physical-address kernel read and parse at boot Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:512 · pass 2 · new	none	untested
DF-5480	Low	4.7	EFI system-table / runtime-table ingestion is signature-only: th_crc32 never verified, efi_systbl_phys not range-checked before PHYS_TO_DMAP, st_rt never validated against the RT-mapped regions (firmware-fed ring-0 call targets), memory-map blob ingested without size cross-checks Base system — bus / platform / cpu · sys/platform/pc64/x86_64/efirt.c:399 · pass 2 · new	none	inconclusive
DF-5528	Low	4.7	fwohci_pci_detach() swallows child-detach failure, force-deletes the firewire child and returns unconditional success — orphaned attached child + live callouts over unmapped BAR/freed DMA rings once a firewire-bus child vetoes detach (latent panic/UAF, lying kldunload) Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci_pci.c:350 · pass 2 · new	none	untested
DF-2844	Info	4.7	vnode_pager_haspage() divides by mnt_stat.f_iosize without a zero guard (autofs leaves f_iosize=0) Base system — virtual memory · sys/vm/vnode_pager.c:259 · pass 2 · new	none	untested
DF-3563	Info	4.7	chacha_encrypt_bytes() leaves final partial-block plaintext in tmp[64] on the kernel stack (wg outbound packet tails via chachapoly) Base system — crypto · sys/crypto/chacha20/chacha.c:116 · pass 2 · new	latent stack plaintext residue (wg outbound tails)	untested
DF-3571	Info	4.7	Unbounded register busy-wait in re_reset() (MACFG_38/39/50-53) can hard-lock the kernel thread with the ifnet serializer held Base system — drivers · sys/dev/netif/re/re.c:7678 · pass 2 · new	hardware-gated thread+serializer hang	untested
DF-3658	Info	4.7	XPT_GET/SET_TRAN_SETTINGS index isp_devparam[tgt]/isp_dev_map[tgt] with unchecked CCB target_id (sym DF-3574 / ncr DF-3609 class) Base system — drivers · sys/dev/disk/isp/isp_freebsd.c:4585 · pass 2 · new	none	not_reproduced
DF-3948	Info	4.7	dce110_enable_per_frame_crtc_position_reset dereferences triggered_crtc_reset.event_source without NULL check (dead path today) Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2320 · pass 2 · new	none	untested
DF-4886	Info	4.7	phm_start_thermal_controller is the only phm_* dispatcher in hardwaremanager.c without PHM_FUNC_CHECK — unchecked hwmgr->adev (:238), hwmgr->hwmgr_func (:240) and stores through unchecked adev (:249-250): latent kernel NULL-deref (DF-1913/DF-4831 family) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:234 · pass 2 · new	panic	untested
DF-5198	Info	4.7	fire_saver(): set_video_mode() return value ignored — on failure vid aliases the stale 32KB text window and the 64000-byte blit (repeated every 25 Hz tick) overruns it into 0xC0000+ (DF-5114/DF-5197 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/fire/fire_saver.c:69 · pass 2 · new	none	not_reproduced
DF-5304	Info	4.7	fwohci_irx_disable/fwohci_itx_disable free DMA buffers after a fixed 1-tick tsleep without confirming the OHCI context halted (device-write UAF window into freed memory) Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci.c:1269 · pass 2 · new	device-driven heap UAF window on non-compliant hardware	untested
DF-5524	Info	4.7	Unchecked device_add_child in iicsmb_attach: a failed smbus allocation leaves sc->smbus NULL and the next slave-mode interrupt dereferences it via smbus_intr(NULL,...) Base system — bus / platform / cpu · sys/bus/iicbus/iicsmb.c:156 · pass 2 · new	NULL-deref panic on slave interrupt / system-down on stray event	untested
DF-3586	Medium	4.6	NULL-pointer dereference in si_dpm_enable when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state (boot_ps unvalidated) Base system — drivers · sys/dev/drm/amd/amdgpu/si_dpm.c:6783 · pass 2 · new	none	inconclusive
DF-3587	Medium	4.6	Wild OOB kernel read in btc_find_voltage when voltage-table count==0: entries[(u32)(count-1)] computes a ~31 GB wild index (0xffffffff) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/si_dpm.c:3214 · pass 2 · new	none	inconclusive
DF-3626	Medium	4.6	Unbounded sink-driven go_again retry loop in intel_dp_check_mst_status livelocks the DP hotplug workqueue (MST HPD DoS) Base system — drivers · sys/dev/drm/i915/intel_dp.c:4294 · pass 2 · new	none	inconclusive
DF-3654	Medium	4.6	hpd_lock pairing asymmetry in handle_hpd_rx_irq(): link-type flip inside handler strands the lock (permanent hang) or releases an unheld lock Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:1209 · pass 2 · new	none	inconclusive
DF-3682	Medium	4.6	Divide-by-zero kernel panic in drm_gtf_mode_complex() via unvalidated secondary-GTF parameters from crafted EDID Base system — drivers · sys/dev/drm/drm_edid.c:2066 · pass 2 · new	panic	not_reproduced
DF-3885	Medium	4.6	drm_pick_crtcs exponential recursion: (CRTCs+1)^connectors kernel CPU burn holding fb_helper->lock via hub-inflated connector count Base system — drivers · sys/dev/drm/drm_fb_helper.c:2422 · pass 2 · new	dos	inconclusive
DF-3888	Medium	4.6	num_levels==0 count-1 underflow: kv_dpm_get_sclk (:2938) and kv_set_valid_clock_range (:1791/:1817) read levels[0xFFFFFFFF] ~48 GB out (panic; unprivileged ioctl trigger) Base system — drivers · sys/dev/drm/amd/amdgpu/kv_dpm.c:2938 · pass 2 · new	none	inconclusive
DF-3889	Medium	4.6	boot_ps NULL dereference in kv_dpm_disable (kv_update_current_ps(adev, NULL) -> kv_get_ps(NULL)) when the VBIOS power table has no BOOT-classified state — panic on suspend/detach Base system — drivers · sys/dev/drm/amd/amdgpu/kv_dpm.c:1400 · pass 2 · new	none	inconclusive
DF-3988	Medium	4.6	dc_link_dp_set_test_pattern NULL-pointer dereference on inactive pipe (pipes[i].stream->sink unchecked) plus wrong-object blank (pipes[0] instead of matched pipe_ctx) — sink-triggerable panic with no active stream Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_link_dp.c:2605 · pass 2 · new	none	inconclusive
DF-4338	Medium	4.6	atom_index_iio indexes the 10-entry static atom_iio_len[] with an unvalidated VBIOS opcode byte (OOB read of kernel .data) and the garbage stride drives an unbounded walk past the BIOS image at attach Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/atom.c:1254 · pass 2 · new	none	inconclusive
DF-4346	Medium	4.6	amdgpu atom_index_iio indexes the 10-entry static atom_iio_len[] with an unvalidated VBIOS opcode byte (OOB read of kernel .data) and the garbage stride drives an unbounded walk past the BIOS image at attach (DF-4338's amdgpu twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/atom.c:1287 · pass 2 · new	none	inconclusive
DF-5248	Medium	4.6	run_drain_fifo() unbounded: loop exit depends on device-controlled VLD bit and run_read() failure value 0xffffffff has that bit set - permanent task wedge and device_detach hang Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_run.c:2513 · pass 2 · new	none	inconclusive
DF-5261	Medium	4.6	mtw_drain_fifo() is unbounded and exits only on a device-controlled VLD bit; mtw_read() failure stores 0xffffffff which HAS that bit set - permanent taskqueue wedge with the driver lock held Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_mtw.c:2173 · pass 2 · new	none	inconclusive
DF-3578	Low	4.6	Division by zero in iwn4965_set_txpower(): interpolate() divisor from unvalidated EEPROM channel samples Base system — drivers · sys/dev/netif/iwn/if_iwn.c:5707 · pass 2 · new	panic	inconclusive
DF-3777	Low	4.6	jme_rxeof() descriptor consistency check admits (nsegs=0, pktlen=0): jme_rxpkt neither reposts the descriptor nor advances jme_rx_cons — unbounded in-handler spin (RX halt + serializer-held CPU softlock) on faulty/malicious controller writeback; the DF-3604-family heap-OOB is otherwise CLOSED by the :2513 cross-check Base system — drivers · sys/dev/netif/jme/if_jme.c:2511 · pass 2 · new	none	inconclusive
DF-3815	Low	4.6	mpr_resize_queues() divide-by-zero when firmware reports IOCMaxChainSegmentSize == 1 Base system — drivers · sys/dev/raid/mpr/mpr.c:399 · pass 2 · new	none	inconclusive
DF-4047	Low	4.6	NULL command_table_helper callbacks called via BIOS-controlled command revisions on DCE10/11/11.2 (assign_control_parameter/transmitter_bp_to_atom/clock_source_id_to_ref_clk_src) + uninit crev steering in init_transmitter_control Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table.c:204 · pass 2 · new	panic	inconclusive
DF-4078	Low	4.6	Unbounded waits and ignored reinit errors: mps_wait_command(...,0) sleeps forever, mps_reinit ignores mps_reregister_events() failure leaving the simq frozen permanently Base system — drivers · sys/dev/raid/mps/mps.c:353 · pass 2 · new	none	inconclusive
DF-4160	Low	4.6	Unbounded PHY-reset poll in xe_mii_init(): card insertion / ifconfig up hangs the kernel in crit + serializer Base system — drivers · sys/dev/netif/xe/if_xe.c:1637 · pass 2 · new	dos	untested
DF-5265	Low	4.6	mtw_attach error path before MTW_LOCK jumps to 'detach:' which does MTW_UNLOCK of a never-acquired lock (plus usb_callout_drain of a never-initialized callout) - lockmgr assertion/panic on malformed USB device Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_mtw.c:541 · pass 2 · new	none	untested
DF-5299	Low	4.6	usbd_get_phys() type-confuses the USB controller's newbus ivars as struct pci_devinfo * without any bus-type or NULL check — NULL/wild deref panic or limited kernel-heap leak into the V4L2 bus_info string on non-PCI controllers Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_device.c:2249 · pass 2 · new	none	inconclusive
DF-3251	Medium	4.5	ext2 publish-before-validate (DF-3208 twin): all three post-ext2_ihashins error branches hand concurrent ext2_ihashget waiters half- or fully-initialized VBAD/VNON inodes, bypassing ext2_vinit's 'only unallocated inodes should be VNON' validation Base system — filesystems · sys/vfs/ext2fs/ext2_ihash.c:1358 · pass 2 · new	none	untested
DF-4278	Medium	4.5	R300_ZB_ZPASS_ADDR reloc patch records nothing and validates nothing: unvalidated u32 offset past the relocation BO becomes the GPU occlusion-counter write target (cross-BO GPU OOB increment-write) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r300.c:1073 · pass 2 · new	none	untested
DF-3615	Low	4.5	Unvalidated hardware-fed ts_antenna indexes ast_ant_tx[8]/sc_ant_tx[8] in ath_tx_update_stats — latent OOB write with function-pointer-table and past-allocation reach (RX twin clamps after field crashes) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath.c:4197 · pass 2 · new	none	inconclusive
DF-3925	Low	4.5	hptmv_event_notify uses closed-blob param2 as MV_U8 channel index into sataEvents[8]/VDevices[8] with no bounds check (hardening) Base system — drivers · sys/dev/raid/hptmv/entry.c:860 · pass 2 · new	none	not_reproduced
DF-4151	Low	4.5	adv_send_scsi_queue computes the per-queue sense DMA bus address from unvalidated firmware-LRAM free_q_head — device-DMA write outside sense_buffers (write-side twin of DF-2412) Base system — drivers · sys/dev/disk/advansys/advlib.c:1709 · pass 2 · new	none	inconclusive
DF-4422	Low	4.5	Pixel-mode cursor draw functions lack the cursor_base < font_height bound the text path enforces: negative font-buffer index and negative video-memory offset Kernel memory leaks / uninitialized disclosure · sys/dev/misc/syscons/scvgarndr.c:789 · pass 2 · new	none	untested
DF-4644	Low	4.5	Adapter/vidsw/vidcdevsw array lifecycle races in fb.c: vid_realloc_array frees outside vga_token, tokenless readers, and a vid_register free-slot index race — UAF read/write window and cross-driver type confusion Kernel memory corruption (UAF / OOB write) · sys/dev/video/fb/fb.c:76 · pass 2 · new	none	untested
DF-4651	Low	4.5	fm801_pci_attach failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc — mixer-UAF family, 14th instance (DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537/4550/4610) Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/fm801.c:620 · pass 2 · new	none	untested
DF-4738	Low	4.5	cbb_pci_attach() CardBus secondary-bus allocator is a driver-static counter seeded at 2: collision-blind against firmware-assigned bus numbers (config-space aliasing of unrelated devices) and unbounded into the u_int8_t secbus/subbus (256 -> 0 'unconfigured' sentinel wrap) Base system — drivers · sys/dev/pccard/pccbb/pccbb_pci.c:299 · pass 2 · new	none	not_reproduced
DF-5388	Low	4.5	No bus arbitration across transactions: serializer is dropped during RX waits, so concurrent smbus callers interleave inside one transfer Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:197 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-3428	Medium	4.4	generic_netmap_rxsync: 32-bit wrap in the ring->reserved sanitization drives the userspace-release loop index out of [0,lim] — unkillable kernel livelock holding the kring lock Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_generic.c:641 · pass 2 · new	none	build_failed
DF-3646	Medium	4.4	NULL-pointer dereference of rdev->pm.dpm.boot_ps when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:3593 · pass 2 · new	none	inconclusive
DF-3647	Medium	4.4	Integer divide-by-zero in spread-spectrum programming when the VBIOS SS rate is 0 (ci_calculate_mclk_params / ci_calculate_sclk_params) Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:2876 · pass 2 · new	none	inconclusive
DF-3648	Medium	4.4	Integer divide-by-zero on zero MPLL/SPLL reference clock in ci_calculate_mclk_params (usMemoryReferenceClock stored unchecked) Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:2872 · pass 2 · new	none	inconclusive
DF-3651	Medium	4.4	NULL-pointer dereference of rdev->pm.dpm.dyn_state.cac_tdp_table when the VBIOS has no PowerTune table: five unchecked sinks in ci_dpm.c Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:330 · pass 2 · new	none	inconclusive
DF-3741	Medium	4.4	Zero-stride VBIOS record walks never terminate: radeon_atom_init_mc_reg_table and atom_lookup_voltage_object_v3 infinite loops Base system — drivers · sys/dev/drm/radeon/radeon_atombios.c:4023 · pass 2 · new	none	inconclusive
DF-3742	Medium	4.4	radeon_atom_get_clock_info stores VBIOS reference clocks unchecked — zero reference_freq reaches mode-set and DPM divisions (#DE panic) Base system — drivers · sys/dev/drm/radeon/radeon_atombios.c:1146 · pass 2 · new	none	inconclusive
DF-3743	Medium	4.4	Spread-spectrum rate parses to zero (raw 0, v2/v3 /=100 truncation, or ppll never assigns rate) and reaches DPM SS divisions (#DE panic) Base system — drivers · sys/dev/drm/radeon/radeon_atombios.c:1546 · pass 2 · new	none	inconclusive
DF-3745	Medium	4.4	Connector/encoder object-table walks dereference unvalidated VBIOS offsets, accumulate attacker sizes, and over-index ucMuxState[2] — OOB heap reads at connector init Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_atombios.c:537 · pass 2 · new	none	inconclusive
DF-3746	Medium	4.4	VoltageObjectInfo walkers trust self-declared sizes — OOB heap reads, v1 stride bug, and ~130 KB unbounded leakage-array indices Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_atombios.c:3382 · pass 2 · new	none	inconclusive
DF-3837	Medium	4.4	evergreen_ib_parse()/evergreen_vm_packet3_check(): no packet-fits-in-IB validation + fixed-offset payload reads without pkt->count checks → OOB reads up to 5 dwords past the IB sub-allocation + kernel-log disclosure oracle (DF-3592/DF-3764 family, pre-SI VM path) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen_cs.c:3519 · pass 2 · new	none	inconclusive
DF-3853	Medium	4.4	Unchecked BIOS sysclk reference frequency (0) reaches calc_eng_mem_clock division — kernel divide-by-zero panic (local DoS) on PM transitions Base system — drivers · sys/dev/drm/radeon/radeon_combios.c:741 · pass 2 · new	none	inconclusive
DF-3921	Medium	4.4	hpt_async is an unconditional panic("Here") registered for AC_LOST_DEVICE - losing a disk (or any rescan of a lost target) panics the kernel Base system — drivers · sys/dev/raid/hptmv/entry.c:2147 · pass 2 · new	none	not_reproduced
DF-4224	Medium	4.4	Divide-by-zero (kernel panic) in drm_cvt_mode/drm_gtf_mode_complex via unvalidated cmdline @refresh — simple_strtol value wraps through unsigned int into int vfieldrate Base system — drivers · sys/dev/drm/drm_modes.c:1465 · pass 2 · new	dos	untested
DF-2833	Low	4.4	kern.syncdelay=SYNCER_MAXDELAY (32) accepted by sysctl → same-slot requeue livelock/deadlock of the syncer under sc_token (also kern.retrydelay<=0) Base system — kernel core (kern) · sys/kern/vfs_sync.c:133 · pass 2 · new	none	not_reproduced fixed
DF-3266	Low	4.4	pf_get_sport() infinite loop (netisr hang) when the NAT pool port range includes port 0 and all candidate ports are occupied Base system — network stack · sys/net/pf/pf.c:3033 · pass 2 · new	denial_of_service	not_reproduced
DF-3575	Low	4.4	NULL CDB pointer dereference in sym_action() INQUIRY peek (CAM_CDB_POINTER with cdb_ptr == NULL) Base system — drivers · sys/dev/disk/sym/sym_hipd.c:7526 · pass 2 · new	none	not_reproduced
DF-3599	Low	4.4	cz_init_cp_jump_table: NULL mec2_fw dereference on Carrizo when the MEC2 firmware request fails Base system — drivers · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1170 · pass 2 · new	none	inconclusive
DF-3825	Low	4.4	asr(4) unbounded polled waits: wait-forever ASR_resetIOP retry spin inside a critical section (asr_timeout-reachable), zero-timeout ASR_initOutBound reply poll reachable from the I2OUSRCMD ioctl, deadline-less ASR_queue_s poll, PCATCH-less ioctl wait Base system — drivers · sys/dev/raid/asr/asr.c:1254 · pass 2 · new	none	not_reproduced
DF-3841	Low	4.4	Firmware-image walks lack bounds: iwi_load_ucode odd-size size_t underflow (1-2 → SIZE_MAX) walks kernel memory past the image under IWI_LOCK until a page fault; iwi_load_firmware command-block walk reads up to 7 bytes past the DMA buffer and emits up to ~2^19 MMIO command blocks from unvalidated len (DF-3573/3591/3631 firmware-trust family) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwi/if_iwi.c:2446 · pass 2 · new	none	inconclusive
DF-3924	Low	4.4	fOsBuildSgl executes panic("physical address unsupported") on CAM_DATA_PHYS passthrough CCBs (reachable debug panic) Base system — drivers · sys/dev/raid/hptmv/entry.c:2518 · pass 2 · new	none	not_reproduced
DF-3932	Low	4.4	MLYIO_COMMAND size handling: DataTransferLength==INT_MIN negates/wraps into kmalloc(0xFFFFFFFF80000000, M_INTWAIT) — kernel panic (sink PROVEN on guest); plus unbounded wired allocation and ignored dmamap_load failure Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:2889 · pass 2 · new	panic	inconclusive
DF-3949	Low	4.4	MLX_NEXT_CHILD uses mlx_sysdrive[0] instead of the found [i] -> device_get_unit(NULL) panic after drive 0 is detached Base system — drivers · sys/dev/raid/mlx/mlx.c:753 · pass 2 · new	none	inconclusive
DF-4058	Low	4.4	hw.etX.tx_intr_nsegs sysctl accepts 0 (no handler) -> integer division by zero panic on the TX hot path (sc_tx / sc_tx_intr_nsegs); the two rx sysctls validate v>0 but the tx one is a raw SYSCTL_ADD_INT Base system — drivers · sys/dev/netif/et/if_et.c:314 · pass 2 · new	Privileged local user turns a tuning variable into an instant kernel panic of a production host.	untested
DF-4062	Low	4.4	ioctl transfer lengths are accepted unbounded and flow into kmalloc(M_WAITOK\|M_ZERO)/copyin/copyout: native au_length is a 64-bit unsigned long (up to 2^64-1), the linux generic path's imax(inlen,outlen) sign-extends a negative int through amr_ioctl_buffer_length, and the linux PASS path allocates the card-supplied ap_data_transfer_length — oversized-allocation panic, unbounded kernel-memory pinning, and a round_page() wrap hazard in the oversized-slab path Base system — drivers · sys/dev/raid/amr/amr.c:501 · pass 2 · new	Privileged local user trivially panics/wedges the kernel (oversized-allocation path / round_page wrap) or pins tens of GB of zeroed kernel memory per ioctl; kmalloc happens before any controller access.	untested
DF-4114	Low	4.4	TBI-mode nge(4) deletes itself: sc->nge_miibus = dev passed to device_delete_child(dev, dev) — unbounded nge_detach recursion on detach, live-device kobj_delete UAF on attach failure Kernel memory corruption (UAF / OOB write) · sys/dev/netif/nge/if_nge.c:864 · pass 2 · new	none	untested
DF-4228	Low	4.4	Root-writable debug.cyapa_*_freq sysctls feed an integer divide-by-zero in cyapa_poll_thread — deterministic kernel panic Base system — drivers · sys/dev/smbus/cyapa/cyapa.c:227 · pass 2 · new	none	untested
DF-4324	Low	4.4	ath_rate_get_static_rix() returns sc_rixmap[ucastrate] without validating the 0xff not-found sentinel — sn->static_rix=255 flows into rt->info[255] out-of-bounds reads (ni_txrate assignment and sample_stats sysctl print) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_rate/sample/sample.c:361 · pass 2 · new	The comment claims the static rate index is only set on successful lookup, but the function returns the raw sc_rixmap value (memset 0xff, only filled for table rates) - a fixed rate matching a node-negotiated rate yet absent from the table yields static_rix=255	untested
DF-4351	Low	4.4	Unconditional panic() on device-fed completion status bytes: q_status != QS_DONE (fires on legitimate QS_DONE\|QS_DISC1) and unhandled host_stat codes (including codes the driver itself enumerates) Base system — drivers · sys/dev/disk/advansys/advansys.c:1092 · pass 2 · new	none	untested
DF-4366	Low	4.4	[amdgpu_pm.c] Deterministic kernel NULL-deref panic in the pp_power_profile_mode store: strsep returns NULL on un-delimited writes and isspace(*tmp_str) dereferences address 0; buf_cpy[128] also never NUL-terminated Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_pm.c:916 · pass 2 · new	none	inconclusive
DF-4481	Low	4.4	complete_rqe() raw-plex error path never biodone's the user bio nor frees the request — permanent unkillable I/O hang plus locked-buf/pbuf leak per errored plex I/O Base system — drivers · sys/dev/raid/vinum/vinuminterrupt.c:219 · pass 2 · new	Permanent unkillable D-state I/O hang per errored raw-plex I/O plus locked-buf/pbuf leak; repeated errors exhaust the pbuf pool system-wide	untested
DF-4554	Low	4.4	amdgpu_debugfs: gpr_read VGPR path copies an UNINITIALIZED 4KB kmalloc to userspace when read_wave_vgprs is NULL (gfx_v7/v8) — independent of DF-1692; latent (dead code on DFly) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:710 · pass 2 · new	none	not_reproduced
DF-4756	Low	4.4	Mailbox handshake busy-waits up to 12 seconds with mdelay() inside the hard-IRQ .process handler — host/PF can stall the guest in interrupt context per message Base system — drivers · sys/dev/drm/amd/amdgpu/mxgpu_vi.c:318 · pass 2 · new	dos	untested
DF-4911	Low	4.4	dm_dp_aux_transfer discards dc_link_aux_transfer() return on both AUX write paths: failed DPCD/I2C writes reported as full success to the DRM DP core (MST sideband desync on failing/hostile DP hardware) Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:105 · pass 2 · new	none	untested
DF-5313	Low	4.4	daioctl(DAIOCTRIM) reads its 16-byte argument by direct user-pointer dereference with no copyin: kernel page fault (panic) on unmapped user pointer and user-memory race across the synchronous loop Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_da.c:423 · pass 2 · new	stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313)	untested
DF-5357	Low	4.4	pccard_driver_added NULL-deref panic (pf->dev) after a CIS-error card, via kldload of any pccard client driver Base system — bus / platform / cpu · sys/bus/pccard/pccard.c:1081 · pass 2 · new	panic	untested
DF-5086	Info	4.4	AcpiOsFree forwards NULL to _kfree which panics ("trying to free NULL pointer") — latent NULL-free panic unique to the DragonFly port (Linux/FreeBSD kfree(NULL) are no-ops) Base system — drivers · sys/dev/acpica/Osd/OsdMemory.c:73 · pass 2 · new	per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption)	untested
DF-5482	Info	4.4	efi_enter()/efi_leave() are not re-entrancy-safe despite LK_CANRECURSE: nested entry clobbers the global efi_savevm and the outer efi_leave() then installs a NULL vmspace → pmap panic (latent landmine) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/efirt.c:352 · pass 2 · new	none	untested
DF-5257	Medium	4.3	Remote net80211 taskqueue wedge: urtwn_tsf_task_adhoc sleeps hzni_intval5/1000 with attacker-controlled IBSS beacon interval Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_urtwn.c:2414 · pass 2 · new	deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257)	untested
DF-3211	Low	4.3	md_lookup_swap() reads only the low 32 bits of the 64-bit NFSv3 file size into a signed int — swap files in the 2-4 GiB window produce negative swap_nblks (negative swap vnode size, ~2^64-block swaponvp claim); >=4 GiB sizes silently wrap Base system — filesystems · sys/vfs/nfs/nfs_mountrpc.c:286 · pass 2 · new	dos	untested
DF-3751	Low	4.3	((struct rt2860_node *)ni)->wcid read from nodes allocated as plain ieee80211_node (missing ic_node_alloc override) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ral/rt2860.c:919 · pass 2 · new	none	not_reproduced
DF-3752	Low	4.3	Uninitialized retrycnt passed to ratectl on TX_FAILURE (amrr consumes it unconditionally) Base system — drivers · sys/dev/netif/ral/rt2860.c:1129 · pass 2 · new	none	not_reproduced
DF-4006	Low	4.3	fiji VCE/ACP/UVD level population NULL-derefs when the PowerPlay table omits usMMDependencyTableOffset Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1433 · pass 2 · new	none	inconclusive fixed
DF-4618	Low	4.3	Uninterruptible multi-second busy-wait handshakes (VP0_LOW_SPINTMO=5,000,000 iterations) run under vpo_intr's critical section — malicious parallel-port device can pin a CPU against preemption per I/O Base system — drivers · sys/dev/disk/vpo/immio.c:52 · pass 2 · new	Multi-second per-CPU preemption blackout per I/O (missed ticks, soft lockups, uniprocessor system-wide stall); repeatable per command	untested
DF-4881	Low	4.3	onoe ath_rate_getxtxrates() stores hardware rate codes into ath_rc_series.rix (rate-table INDEX) fields and clobbers the correct series-0 index — wrong-entry rt->info[] derefs on every multi-rate-retry frame, heap OOB read on 11n HALs (DF-4850 amrr twin) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_rate/onoe/onoe.c:143 · pass 2 · new	none	inconclusive
DF-5032	Low	4.3	ar5212InvalidGainReadback reads rfBuf[4..5] past the 3-word RF bank 7 of 2413/2316/2317/5413/2425/2417 radios (gain-readback OOB read, UB) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5212_rfgain.c:140 · pass 2 · new	none	untested
DF-5039	Low	4.3	os_map_pci_bar(): unchecked bus_alloc_resource() failure → rman_get_virtual(NULL) NULL-deref panic at device probe Base system — drivers · sys/dev/raid/hpt27xx/hpt27xx_os_bsd.c:113 · pass 2 · new	probe panic / shutdown-window UAF per finding	untested
DF-3982	Medium	4.2	Synchronous callout_stop() in the fwohci hard-interrupt path (mgm_ocb_timeout + CCB timeout sites) sleeps in 'costp' inside a critical section while the callback is INPROG — FireWire IRQ-thread stall plus softclock-wheel starvation cascade (DF-3715 family) Base system — drivers · sys/dev/disk/sbp/sbp.c:1600 · pass 2 · new	none	inconclusive
DF-3090	Low	4.2	NFSSVC_MNTD path type-confuses any filesystem's mount into struct nfsmount: VROOT check without vfstype check before VFSTONFS(vp->v_mount) Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_syscalls.c:175 · pass 2 · new	none	not_reproduced
DF-3299	Low	4.2	carp_group_demote_adj()/carp_send_ad_all() execute outside netisr0: unsynchronized demotion counter, wrong-CPU callout arming, unlocked carpif_list walk Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_carp.c:2765 · pass 2 · new	none	not_reproduced
DF-3721	Low	4.2	mxge_dma_test divides by the firmware-returned tick count with no zero check: kernel divide-by-zero panic at attach, at every open, and inside watchdog recovery Base system — drivers · sys/dev/netif/mxge/if_mxge.c:459 · pass 2 · new	none	inconclusive
DF-3883	Low	4.2	mst_primary NULL dereference race in drm_dp_mst_handle_up_req (send_up_ack_reply without lock or NULL check) Base system — drivers · sys/dev/drm/drm_dp_mst_topology.c:2401 · pass 2 · new	race-window NULL panic / teardown UAF	untested
DF-3890	Low	4.2	vid_mapping num_entries==0 count-1 underflow in kv_convert_vid2_to_vid7 — entries[0xFFFFFFFF] wild read (~+16 GiB) at boot via kv_construct_max_power_limits_table Base system — drivers · sys/dev/drm/amd/amdgpu/kv_dpm.c:90 · pass 2 · new	none	inconclusive
DF-4268	Low	4.2	wb_rxeof double-fetch of the device-written RX status word: check/use TOCTOU enabling a ~12KB OOB read copied into received packets (kernel heap info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/wb/if_wb.c:983 · pass 2 · new	none	not_reproduced
DF-4653	Low	4.2	puc_setup_intr publishes ihand before ihandarg: shared-IRQ event during child attach dispatches siointr with a NULL argument -> kernel NULL-deref panic (boot-time DoS) Base system — drivers · sys/dev/misc/puc/puc.c:691 · pass 2 · new	none	not_reproduced
DF-4742	Low	4.2	vce_v2_0: VCE bo sized exactly AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short — DATA window ends 256 bytes past vcpu_bo (DF-4524 v3 shape, v2 instance) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/vce_v2_0.c:424 · pass 2 · new	none	untested
DF-4832	Low	4.2	uvd_v1_0_resume programs VCPU cache windows +128B into vcpu_bo at full sizes — STACK/SESSION window overruns the pinned bo by 128 bytes into the adjacent VRAM object (radeon UVD v1 twin of DF-4524/DF-4742) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/uvd_v1_0.c:121 · pass 2 · new	none	untested
DF-4988	Low	4.2	Passthru SGL write destination steered by user-controlled gcmd->size byte: up to ~860 bytes of DMA descriptors written past the request's 1024-byte command packet into neighboring requests of the shared command pool Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_user.c:126 · pass 2 · new	none	not_reproduced
DF-5229	Low	4.2	uvd_v4_2_resume programs the VCPU cache-window chain +0x200 into vcpu_bo with a full-blob region0 size — chain ends 512 bytes past the pinned bo with the shipping CIK UVD firmware (radeon twin of DF-4832/DF-4524/DF-4742) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/uvd_v4_2.c:47 · pass 2 · new	none	untested
DF-5364	Low	4.2	Unchecked kmalloc(M_NOWAIT) in CISTPL_FUNCID/CISTPL_CONFIG handlers: NULL-page write on allocation failure Base system — bus / platform / cpu · sys/bus/pccard/pccard_cis.c:790 · pass 2 · new	panic	untested
DF-5767	Low	4.2	ohci_controller_init latches unvalidated device-reported NDP (0-255) into sc_noport: kernel-driven OOB MMIO reads AND writes past the 0x100-byte OHCI register file on every roothub event (DF-5268/5282/5296 register-geometry family, OHCI variant) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/ohci.c:286 · pass 2 · new	none	untested
DF-4985	Info	4.2	dce110 command-table helper leaves five vtable members NULL while six consumer call sites invoke them unguarded — latent NULL-function-pointer call under ASIC/VBIOS generation mismatch (generation-locked, unreachable on genuine hardware) Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:332 · pass 2 · new	none	untested
DF-5000	Info	4.2	dce80 command-table helper leaves 2 of 17 vtable members NULL (dc_clock_type_to_atom, transmitter_color_depth_to_atom); the SetPixelClock-V7 rev handlers call transmitter_color_depth_to_atom unguarded — latent NULL-function-pointer kernel panic under cross-generation VBIOS pairing on DCE8 silicon Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce80/command_table_helper_dce80.c:329 · pass 2 · new	none	untested
DF-3384	Medium	4.1	BIOCFLUSH racing an in-flight bpfread() breaks the buffer-slot invariants: unconditional bd_fbuf = bd_hbuf after uiomove() loses the hold-buffer pointer (leak) and later leaves bd_sbuf == NULL so catchpacket() writes the bpf header through NULL Base system — network stack · sys/net/bpf.c:439 · pass 2 · new	none	not_reproduced
DF-3470	Medium	4.1	Ratectl registry has no in-use accounting: nrefs unload-guard exists but amrr/rssadapt/none never increment it — kldunload of an in-use algorithm leaves every vap->iv_rate dangling into unmapped module text; next ir_* indirect call (world-readable rate_stats sysctl, any TX, vap detach) executes unmapped code Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_ratectl.c:58 · pass 2 · new	panic	inconclusive
DF-3715	Medium	4.1	em_stop() can deadlock the callout subsystem against em_timer/em_82547_move_tail (AB-BA): callout_stop() synchronously waits for a callback that is blocked on the serializer the stopper holds — mechanism PROVEN on the guest kernel via protocol-replica module (caller stuck D3/wchan 'costp') Kernel memory corruption (UAF / OOB write) · sys/dev/netif/em/if_em.c:2222 · pass 2 · new	none	inconclusive
DF-3717	Medium	4.1	mxge_detach() AB-BA deadlock: synchronous callout_stop() under ifnet_serialize_all vs mxge_tick blocked on main_serialize — mechanism PROVEN on guest via protocol replica (wchan 'costp' + softclock 'slize' wedge) Base system — drivers · sys/dev/netif/mxge/if_mxge.c:4463 · pass 2 · new	none	inconclusive
DF-3776	Medium	4.1	jme_stop()/jme_miibus_statchg() vs jme_tick() AB-BA deadlock: blocking lwkt_serialize_enter in the self-re-arming CPU0-pinned tick callback vs synchronous callout_stop() under ifnet_serialize_all — permanent kernel wedge + CPU0 softclock callout blackout (DF-3715/3738/3760 family, jme(4) instance) Base system — drivers · sys/dev/netif/jme/if_jme.c:2571 · pass 2 · new	none	inconclusive
DF-3806	Medium	4.1	msk_stop()/msk_tick() AB-BA callout deadlock: synchronous callout_stop() under ifnet serializer vs blocking lwkt_serialize_enter in the self-re-arming non-MPSAFE tick (DF-3715/3738/3760/3776 family, if_msk.c instance) Base system — drivers · sys/dev/netif/msk/if_msk.c:2936 · pass 2 · new	none	inconclusive
DF-3850	Medium	4.1	dc_stop()/dc_tick() AB-BA callout deadlock: synchronous callout_stop under the ifnet serializer vs dc_tick's blocking lwkt_serialize_enter — and dc_stat_timer is a NON-MPSAFE callout, so the parked softclock thread also holds the Giant MP lock (DF-3715 family, dc(4) instance, mechanism PROVEN on guest) Base system — drivers · sys/dev/netif/dc/if_dc.c:2725 · pass 2 · new	none	inconclusive
DF-3903	Medium	4.1	sk_stop()/sk_tick()/sk_yukon_tick() AB-BA callout deadlock: synchronous callout_stop() under the card-global serializer vs blocking lwkt_serialize_enter in the self-re-arming NON-MPSAFE 1 Hz tick (DF-3715 family, 7th instance) — mechanism PROVEN on guest Base system — drivers · sys/dev/netif/sk/if_sk.c:2782 · pass 2 · new	none	inconclusive
DF-3906	Medium	4.1	xl_stop()/xl_stats_update() AB-BA callout deadlock: synchronous callout_stop() under the ifnet serializer vs blocking lwkt_serialize_enter in the self-re-arming NON-MPSAFE 1 Hz stats tick (DF-3715 family, 10th instance) — mechanism PROVEN on guest Base system — drivers · sys/dev/netif/xl/if_xl.c:3169 · pass 2 · new	none	inconclusive
DF-3910	Medium	4.1	Divide-by-zero panic in tonga_thermal_setup_fan_table from VBIOS fan temperatures (usTMed==usTMin or usTHigh==usTMed) Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:2502 · pass 2 · new	none	inconclusive fixed
DF-3953	Medium	4.1	boot_ps NULL dereference panic in kv_dpm_enable/kv_dpm_disable (plus kv_dpm_get_sclk ps_priv-NULL window) when VBIOS power table has no BOOT-classified state Base system — drivers · sys/dev/drm/radeon/kv_dpm.c:1277 · pass 2 · new	none	inconclusive
DF-3954	Medium	4.1	num_levels==0 (VBIOS state with no valid clock entries) -> levels[0xFFFFFFFF] wild read ~48 GiB out in kv_set_valid_clock_range / kv_dpm_get_sclk Base system — drivers · sys/dev/drm/radeon/kv_dpm.c:1721 · pass 2 · new	none	inconclusive
DF-4022	Medium	4.1	NULL-deref panic in rv770_dpm_enable->rv770_init_smc_table when the VBIOS power table has no BOOT-classified state (or ucStateEntrySize<=1) or dpm.init failed — rv770-family twin of DF-3972/3953/3754/3646/3610 Base system — drivers · sys/dev/drm/radeon/rv770_dpm.c:1901 · pass 2 · new	none	inconclusive
DF-4025	Medium	4.1	re_stop(sc,TRUE) deadlocks against re_tick (callout_stop AB-BA under the driver serializer): permanent D3/'costp' wedge of two threads + CPU-wide callout starvation — re(4) instance of DF-3715(em); mechanism PROVEN on the guest via protocol replica Base system — drivers · sys/dev/netif/re/if_re.c:1354 · pass 2 · new	none	inconclusive
DF-4064	Medium	4.1	fxp_stop() callout_stop under the ifnet serializer can deadlock the callout subsystem against fxp_tick (AB-BA): non-MPSAFE fxp_stat_timer callback blocks in lwkt_serialize_enter and holds the MP lock while parked — DF-3715 (em) / DF-3738 (emx) family twin, mechanism PROVEN on the guest kernel via fxp-faithful replica Base system — drivers · sys/dev/netif/fxp/if_fxp.c:399 · pass 2 · new	none	inconclusive fixed
DF-4109	Medium	4.1	tl(4) callout AB-BA deadlock: tl_stats_update blocks on the driver serializer while tl_stop synchronously stops the timer under it (DF-3715 family) Base system — drivers · sys/dev/netif/tl/if_tl.c:1671 · pass 2 · new	none	inconclusive
DF-4112	Medium	4.1	nge(4) callout AB-BA deadlock: nge_tick blocks on the driver serializer while nge_stop synchronously stops the timer under it (DF-3715 family) Base system — drivers · sys/dev/netif/nge/if_nge.c:1372 · pass 2 · new	none	inconclusive
DF-4118	Medium	4.1	NULL boot_ps page-fault panic in cypress_dpm_enable when the VBIOS power table has no BOOT-classified state (or dpm.init failed) — cypress twin of DF-4022/DF-3972/DF-3754 Base system — drivers · sys/dev/drm/radeon/cypress_dpm.c:1839 · pass 2 · new	none	inconclusive
DF-4124	Medium	4.1	NULL boot_ps page-fault panic in rv6xx_dpm_enable (:1577) / rv6xx_dpm_disable (:1640) when the VBIOS power table lacks a BOOT-classified state, has ucStateEntrySize<=1, or dpm.init failure was swallowed (rv6xx twin of DF-4022/DF-4118) Base system — drivers · sys/dev/drm/radeon/rv6xx_dpm.c:1549 · pass 2 · new	none	inconclusive
DF-4125	Medium	4.1	Dangling rdev->pm.dpm.ps after kfree-without-NULL in rv6xx_parse_power_table (:1908-1912) + swallowed rv6xx_dpm_init error -> double free in rv6xx_dpm_fini (:2106); ps_priv[0..i-1] leaked (rv6xx twin of DF-4023/DF-3973/DF-4117) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rv6xx_dpm.c:1908 · pass 2 · new	none	inconclusive
DF-4290	Medium	4.1	SS getters return success with speed_spectrum_rate == 0 — integer divide-by-zero panic in every clock-spread consumer Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1248 · pass 2 · new	none	inconclusive
DF-4291	Medium	4.1	atomctrl_get_voltage_evv dereferences hwmgr->dyn_state.vddc_dependency_on_sclk without a NULL check (parser contract allows NULL) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1131 · pass 2 · new	none	inconclusive
DF-4626	Medium	4.1	intel_dsi_vbt: MIPI sequence execution walks the kmemdup'd VBT blob with no end bound — heap OOB read via i2c/spi/delay/gpio elements and the operation loop Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_dsi_vbt.c:444 · pass 2 · new	Kernel crash DoS in the panel-enable path (mode_config mutex held); OOB bytes only steer skip offsets - no direct info disclosure	untested
DF-5457	Medium	4.1	ichsmb_bread returns the raw slave-controlled block count (up to 255) while writing at most 32 bytes — /dev/smb SMB_BREAD then copies out up to 223 bytes of uninitialized kernel stack Kernel memory leaks / uninitialized disclosure · sys/bus/smbus/ichsmb/ichsmb.c:424 · pass 2 · new	none	not_reproduced fixed
DF-2659	Low	4.1	NULL column chain during sync: hammer2_inode_chain_and_parent() cannot return NULL (panics at chain->parent first) and synchro.c evaluates chain->bref.modify_tid BEFORE its own if (chain) guard Hammer2 · sys/vfs/hammer2/hammer2_synchro.c:417 · pass 2 · new	none	untested
DF-2871	Low	4.1	taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c) Base system — kernel core (kern) · sys/kern/subr_taskqueue.c:594 · pass 2 · new	none	not_reproduced
DF-2899	Low	4.1	fp_mmap maps VCHR vnodes without the revoked-device (v_rdev == NULL) guard its sibling kern_mmap has: NULL-deref panic in vm_mmap Base system — kernel core (kern) · sys/kern/kern_fp.c:473 · pass 2 · new	panic	not_reproduced
DF-2967	Low	4.1	wdog_disable() self-deadlocks/livelocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC) Base system — kernel core (kern) · sys/kern/kern_wdog.c:96 · pass 2 · new	denial_of_service	not_reproduced
DF-3069	Low	4.1	Unbounded rterm/rte allocation during stage2 extended-range TERM collection — attacker-controlled kernel-heap exhaustion at mount ('This must fit in memory!' is not enforced) Base system — filesystems · sys/vfs/hammer/hammer_recover.c:611 · pass 2 · new	none	not_reproduced
DF-3113	Low	4.1	hammer_ioc_add_snapshot / hammer_ioc_del_snapshot return with hmp->snapshot_lock held when hammer_init_cursor fails — permanent snapshot-subsystem lockup on production kernels Base system — filesystems · sys/vfs/hammer/hammer_ioctl.c:727 · pass 2 · new	denial_of_service	not_reproduced
DF-3181	Low	4.1	Failed non-forced umount of tmpfs has already truncated every regular file (destructive pre-vflush pass leaves a live mount with destroyed data) Base system — filesystems · sys/vfs/tmpfs/tmpfs_vfsops.c:284 · pass 2 · new	none	not_reproduced
DF-3351	Low	4.1	fs->backlogged never reset when pipe deletion purges child flowsets: p->sum accounting drift can reach exactly 0 → divide-by-zero panic in WF2Q drain Base system — network stack · sys/net/dummynet/ip_dummynet.c:555 · pass 2 · new	panic	untested
DF-3403	Low	4.1	slstart dereferences tp->t_slsc and the softc before acquiring any token (races slclose/SLIOCSUNIT) Base system — network stack · sys/net/sl/if_sl.c:531 · pass 2 · new	none	not_reproduced
DF-3409	Low	4.1	tuncreate() error path publishes a half-built softc via dev->si_drv1 (no rollback on if_alloc failure) — poisoned device node leads to later NULL-deref panic Base system — network stack · sys/net/tun/if_tun.c:213 · pass 2 · new	none	not_reproduced
DF-3411	Low	4.1	FIOSETOWN/TIOCSPGRP racing pgsigio: tun's async-SIGIO paths dereference a struct sigio that funsetown() frees outside sigio_token (generic UAF primitive, tun manifestation) Kernel memory corruption (UAF / OOB write) · sys/net/tun/if_tun.c:536 · pass 2 · new	none	not_reproduced
DF-3437	Low	4.1	Unlocked ss_ops dispatch TOCTOU: ieee80211_scan_timeout/iterate/flush check-then-call ss->ss_ops with no com lock while ieee80211_scan_vdetach's scan_detach kfrees ss->ss_priv (never cleared) - scan_age on freed table Base system — network stack · sys/netproto/802_11/wlan/ieee80211_scan.c:586 · pass 2 · new	none	untested
DF-3473	Low	4.1	wlan_xauth: nrefs is never incremented (NULL ia_attach) so kldunload succeeds while VAPs hold raw iv_auth pointers — use-after-free of module text/data on later auth dispatch Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:62 · pass 2 · new	none	inconclusive
DF-3488	Low	4.1	pppoe_ticker NULL deref: queued callout item races ng_pppoe_disconnect freeing the session Base system — network stack · sys/netgraph7/pppoe/ng_pppoe.c:1788 · pass 2 · new	none	not_reproduced
DF-3498	Low	4.1	ng_fec_addport has no cross-bundle exclusivity: a second fec node can re-enslave an already-bundled interface, saving fec_if_input=ng_fec_input and clobbering IFP2NG — after either node's teardown the member is left with if_input=ng_fec_input over a NULL/freed IFP2NG (permanent RX blackhole or freed-node deref on every frame) Base system — network stack · sys/netgraph7/ng_fec.c:384 · pass 2 · new	none	not_reproduced
DF-3509	Low	4.1	ng_fec_rmnode vs ng_fec_tick callout race: callout_stop does not wait for an in-flight tick, IFF_RUNNING is never cleared on the rmnode path, and tick re-arms itself -> callout can fire on &priv->fec_timeout after kfree(priv) Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:614 · pass 2 · new	none	not_reproduced
DF-3617	Low	4.1	ath_intr TDMA/SWBA branch: unchecked TAILQ_FIRST(&ic->ic_vaps) and NULL vap->iv_tdma dereference in hard interrupt context (sc_tdma outlives the TDMA vap) Base system — drivers · sys/dev/netif/ath/ath/if_ath.c:2186 · pass 2 · new	none	inconclusive
DF-3711	Low	4.1	arcmsr_detach() tears down DMA pool and cdev before deregistering the CAM SIM; MSIX IRQ resources leaked Kernel memory corruption (UAF / OOB write) · sys/dev/raid/arcmsr/arcmsr.c:4632 · pass 2 · new	detach-order UAF + IRQ resource leak	untested
DF-3854	Low	4.1	NULL-deref: 'rev = RBIOS8(offset)' executed before 'if (offset)' in radeon_combios_external_tmds_setup() IGP branch — panic when rdev->bios == NULL Base system — drivers · sys/dev/drm/radeon/radeon_combios.c:2889 · pass 2 · new	none	inconclusive
DF-3870	Low	4.1	bw_calcs_init: number_of_dram_channels = vram_width / dram_channel_width truncates to 0 -> #DE divisor family at boot/first modeset Base system — drivers · sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:2041 · pass 2 · new	dos	inconclusive
DF-3876	Low	4.1	mfi_aen_setup dereferences log_state before the error check whose EBUSY/ENOMEM paths leave it NULL; attach caller discards the error via a comma-operator bug Base system — drivers · sys/dev/raid/mfi/mfi.c:1020 · pass 2 · new	none	inconclusive
DF-3898	Low	4.1	mps_detach_sas frees sassc/sim after a 30-second bounded wait even if the scanner thread never exited: use-after-free reads and writes from mpssas_scanner_thread Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas.c:820 · pass 2 · new	none	not_reproduced
DF-3912	Low	4.1	Non-terminating reply walk in mpt_recv_handshake_reply when IOC reports MsgLength < 2 (negative loop counter, attach-time livelock holding MPT_LOCK) Base system — drivers · sys/dev/disk/mpt/mpt.c:1475 · pass 2 · new	none	not_reproduced fixed
DF-3942	Low	4.1	Five spread-spectrum table parsers dereference unchecked GET_IMAGE() results — NULL-page kernel panic at amdgpu/dc attach from a crafted/corrupt VBIOS Base system — drivers · sys/dev/drm/amd/display/dc/bios/bios_parser.c:1041 · pass 2 · new	panic	inconclusive
DF-3950	Low	4.1	mlx_wait_command(): timeout counter never incremented -> unkillable infinite 1s-sleep loop on a never-completing command Base system — drivers · sys/dev/raid/mlx/mlx.c:1655 · pass 2 · new	none	inconclusive
DF-3951	Low	4.1	mlx_start() controller-wedge path leaks mlx_busycmds (slot never decremented) -> permanent EBUSY lockout of all controller I/O; WEDGED command's DMA map left loaded Base system — drivers · sys/dev/raid/mlx/mlx.c:2107 · pass 2 · new	none	inconclusive
DF-3952	Low	4.1	mlx_setup_dmamap() panics when DMA segments exceed firmware me_max_sg, while the buffer tag is hard-coded to MLX_NSEG=64 and MLX_COMMAND passthrough is uncapped Base system — drivers · sys/dev/raid/mlx/mlx.c:2010 · pass 2 · new	none	inconclusive
DF-3956	Low	4.1	vid_mapping_table num_entries==0 -> entries[0xFFFFFFFF] wild read (~16 GiB) in kv_convert_vid2_to_vid7 / kv_convert_vid7_to_vid2 Base system — drivers · sys/dev/drm/radeon/kv_dpm.c:566 · pass 2 · new	none	inconclusive
DF-3957	Low	4.1	Unguarded enc_priv derefs (NULL-page read AND write) for LCD-supporting digital encoders when radeon_atombios_get_lvds_info returns NULL Base system — drivers · sys/dev/drm/radeon/atombios_encoders.c:742 · pass 2 · new	none	inconclusive
DF-3968	Low	4.1	rt2661_scan_end and rt2661_enable_tsf_sync dereference TAILQ_FIRST(&ic->ic_vaps) without a NULL check — panic racing last-vap destruction during the scanner's unlocked ic_scan_end call Base system — drivers · sys/dev/netif/ral/rt2661.c:2747 · pass 2 · new	none	not_reproduced
DF-3969	Low	4.1	rt2560_scan_end and rt2560_enable_tsf_sync dereference the vap without a NULL check — panic racing last-vap destruction during the scanner's unlocked ic_scan_end call (DF-3968 family) Base system — drivers · sys/dev/netif/ral/rt2560.c:2277 · pass 2 · new	none	not_reproduced
DF-3997	Low	4.1	NULL-pointer dereference in envy24_pci_attach error path when resource allocation fails before cfg initialization Base system — drivers · sys/dev/sound/pci/envy24.c:2569 · pass 2 · new	NULL deref (sc->cfg->codec) on the envy24 attach error path when resource allocation fails before envy24_init assigns sc->cfg — panic during device attach. Privileged/physical context only. Mirror of DF-1331 (envy24ht.c) on a distinct trigger path; distinct from DF-1322.	untested
DF-4084	Low	4.1	sis_stop uses callout_stop (which does not interlock against an in-progress callback) while sis_tick re-arms itself as its last serialized action: timer resurrects after stop; on detach the late tick dereferences freed softc/miibus/bus resources (use-after-free) — DF-3715 callout-discipline family Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sis/if_sis.c:1123 · pass 2 · new	none	untested
DF-4103	Low	4.1	Unguarded enc_priv (NULL) dereferences in all DIG setup paths when get_lcd_info()/get_dig_info() fail — NULL-page read at amdgpu attach and NULL-page WRITE on DPMS-ON (DF-3957 amdgpu twin) Base system — drivers · sys/dev/drm/amd/amdgpu/atombios_encoders.c:648 · pass 2 · new	none	untested
DF-4150	Low	4.1	NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0'd out) Base system — drivers · sys/dev/drm/amd/amdgpu/cik.c:1379 · pass 2 · new	NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0'd out in the DFly port). Boot/attach DoS on server platforms / VM GPU passthrough topologies.	untested
DF-4170	Low	4.1	smu8_upload_pptable_to_smu NULL-derefs the four optional dependency tables (vdd_gfx/acp/uvd/vce) at driver load Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:443 · pass 2 · new	none	untested
DF-4186	Low	4.1	radeon_device_init ignores radeon_doorbell_init() failure: NULL doorbell aperture WDOORBELL32 write (kernel panic) on CIK+ when BAR2 ioremap fails Base system — drivers · sys/dev/drm/radeon/radeon_device.c:1422 · pass 2 · new	none	not_reproduced
DF-4212	Low	4.1	mpt_raid_attach error paths: MPT_UNLOCK of a never-acquired lock (deterministic lockmgr panic) plus csa CCB leak Base system — drivers · sys/dev/disk/mpt/mpt_raid.c:283 · pass 2 · new	none	untested
DF-4222	Low	4.1	XPT_ABORT handler dereferences the ccb hcb back-pointer without a NULL check — aborting a completed/never-issued CCB panics Base system — drivers · sys/dev/virtual/vmware/pvscsi/pvscsi.c:1395 · pass 2 · new	none	inconclusive
DF-4258	Low	4.1	Unbounded PHY-reset busy-wait in my_autoneg_xmit — the driver's only hardware-wait loop without MY_TIMEOUT (spins forever in ioctl, boot, and ISR contexts holding ifp->if_serializer) Base system — drivers · sys/dev/netif/my/if_my.c:377 · pass 2 · new	none	inconclusive
DF-4271	Low	4.1	callout_stop() does not interlock with the self-serializing, self-re-arming wb_tick: repeating post-detach use-after-free of the softc Kernel memory corruption (UAF / OOB write) · sys/dev/netif/wb/if_wb.c:1590 · pass 2 · new	none	untested
DF-4277	Low	4.1	cbb_resume() error path NULLs irq_res/base_res and returns ENOMEM but leaves the driver attached with stale intrhand — subsequent cbb_detach/cbb_suspend dereference the NULL resources (kernel panic) Base system — drivers · sys/dev/pccard/pccbb/pccbb.c:1574 · pass 2 · new	cbb_resume() error path NULLs irq_res/base_res and returns ENOMEM but leaves the driver attached with stale intrhand and a live event thread - subsequent cbb_detach/cbb_suspend dereference the NULL resources (kernel panic in rman/bus paths).	untested
DF-4285	Low	4.1	midi_init() error paths: lockuninit() on held locks (KKASSERT panic) and m->synth leaked on every destruction path Base system — drivers · sys/dev/sound/midi/midi.c:371 · pass 2 · new	attach-time kernel panic (KKASSERT in lockuninit on held lock) when MPU_INIT fails; permanent small heap leak of m->synth on all init-error and destroy paths	inconclusive
DF-4292	Low	4.1	atomctrl_get_smc_sclk_range_table dereferences the SMU_Info table pointer without a NULL check (companion guard to DF-1496) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1374 · pass 2 · new	none	inconclusive
DF-4293	Low	4.1	mixer_reinit and mixer_hwvol_* dereference the mixer cdev pointer with no NULL guards — NULL-deref panic on resume/reinit of a mixer-less pcm device Base system — drivers · sys/dev/sound/pcm/mixer.c:828 · pass 2 · new	none	inconclusive
DF-4295	Low	4.1	musycc_intr0 SHT event path dereferences sc->chan[ch] without the NULL check all sibling paths perform Base system — drivers · sys/dev/misc/musycc/musycc.c:820 · pass 2 · new	Interrupt-context NULL-deref write panic on stray MUSYCC event for an unconfigured channel.	untested
DF-4296	Low	4.1	musycc_attach error-path asymmetry leaves half-initialized csoftc on the global list; sibling-function attach then NULL-derefs Base system — drivers · sys/dev/misc/musycc/musycc.c:1455 · pass 2 · new	Boot-time NULL-deref write panic on a dual-function card whose f0 BAR/IRQ allocation fails.	untested
DF-4301	Low	4.1	vkbd_term() ignores kbd_unregister() failure and frees a possibly still-registered/busy keyboard (latent UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/vkbd/vkbd.c:848 · pass 2 · new	none	untested
DF-4333	Low	4.1	hpt_add_disk_to_array divides by (bArnMember-1) unchecked - #DE panic on degenerate 1-member RAID1/5 arrays (sibling site of DF-1682) Base system — drivers · sys/dev/raid/hptmv/gui_lib.c:935 · pass 2 · new	none	inconclusive
DF-4368	Low	4.1	pp_get_current_clocks dereferences hwmgr->current_ps without the NULL guard its siblings have — NULL-deref panic after a failed pp_table reset, triggered via unprivileged DC modeset Base system — drivers · sys/dev/drm/amd/powerplay/amd_powerplay.c:1051 · pass 2 · new	pp_get_current_clocks NULL-deref panic after a failed (non-overflowing) pp_table reset leaves current_ps freed-and-NULL while dpm_enabled stays true; next unpriv modeset panics.	untested
DF-4391	Low	4.1	mfi_tbolt_alloc_cmd never checks request_desc_pool for NULL - failed kmalloc leads to near-NULL memset write on first command build Base system — drivers · sys/dev/raid/mfi/mfi_tbolt.c:455 · pass 2 · new	The alloc validates only the second kmalloc; if request_desc_pool fails while the pool-array succeeds, the setup loop stores cmd->request_desc = NULL + i and the first command issue memsets at address 16*index - a write into the unmapped low page, panicking the boot	untested
DF-4394	Low	4.1	hpt_shutdown_vbus frees LDM memory and adapter handles before terminating the vbus timer callout - pending timer callback runs on freed memory (shutdown-window UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptrr/hptrr_osm_bsd.c:363 · pass 2 · new	In the shutdown path the vbus lock is dropped, LDM command pools are freed and adapter handles kfree'd, but the periodic vbus timer (callout_init_lk'd to the vbus lock, armed for background RAID/rebuild tasks) is only terminated AFTERWARDS	untested
DF-4402	Low	4.1	tws_cam_attach error symmetry: missing return after cam_sim_alloc failure -> xpt_bus_register(NULL) NULL-deref panic at attach; sc->sim left dangling/registered on later failure paths Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_cam.c:173 · pass 2 · new	dos	inconclusive
DF-4408	Low	4.1	acpi_asus_probe dereferences the unchecked INIT evaluation result: NULL Obj or non-String object -> NULL/wild pointer panic at probe Base system — drivers · sys/dev/acpica/acpi_asus/acpi_asus.c:579 · pass 2 · new	dos	untested
DF-4409	Low	4.1	acpi_asus_detach removes the wrong ACPI notify handler: installed handler survives detach and fires into freed/unloaded driver state (use-after-free) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_asus/acpi_asus.c:810 · pass 2 · new	dos	untested
DF-4410	Low	4.1	acpi_asus LED state changes run in an undrained AcpiOsExecute task: detach/led_destroy free the softc under a pending acpi_asus_led_task (UAF window) Kernel memory corruption (UAF / OOB write) · sys/dev/acpi_asus/acpi_asus.c:922 · pass 2 · new	dos	untested
DF-4440	Low	4.1	atmel_mxtread/write/kqfilter dereference softc without the NULL guard used by open/close/ioctl — NULL-deref (later UAF) via fd held across driver detach/kldunload Kernel memory corruption (UAF / OOB write) · sys/dev/smbus/atmel_mxt/atmel_mxt.c:653 · pass 2 · new	Deterministic NULL-deref panic (later UAF) via fd held across driver detach/kldunload; root-triggered self-DoS	untested
DF-4453	Low	4.1	RVDA raw-VBT mapping: pmap_mapbios() of unvalidated firmware-supplied 64-bit address / 32-bit length, re-leaked every resume (amplifies DF-1629; panic-capable KVA exhaustion) Base system — drivers · sys/dev/drm/i915/intel_opregion.c:1029 · pass 2 · new	none	untested
DF-4528	Low	4.1	Admin submission queue lock-protocol violation: every admin-queue caller submits without queue->lk, racing subq_tail/unsubmitted/ksubq[] against the admin thread Base system — drivers · sys/dev/disk/nvme/nvme.c:446 · pass 2 · new	none	not_reproduced
DF-4538	Low	4.1	cs4281_pci_detach() releases the BA0/BA1 register mappings before bus_teardown_intr - live ISR reads released mappings (shared-IRQ use-after-release window) Base system — drivers · sys/dev/sound/pci/cs4281.c:893 · pass 2 · new	none	untested
DF-4539	Low	4.1	cs4281 attach ignores mixer_init()/pcm_addchan() failures; half-attached device NULL-derefs in cs4281_pci_resume (ch->parent NULL and mixer_dev NULL) Base system — drivers · sys/dev/sound/pci/cs4281.c:845 · pass 2 · new	none	untested
DF-4561	Low	4.1	mpssas_ir_shutdown scans [start_idx, end_idx) over an inclusive IR map range: the last volume slot is never checked, so its SYSTEM_SHUTDOWN_INITIATED action (cache flush) is skipped Base system — drivers · sys/dev/raid/mps/mps_sas_lsi.c:902 · pass 2 · new	none	untested
DF-4570	Low	4.1	cancel_fake_irq() drains fake_irq before hangcheck, so a concurrently-running hangcheck callback can re-arm fake_irq after its drain — intel_breadcrumbs_fake_irq fires on a torn-down engine (use-after-free at driver unload) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_breadcrumbs.c:840 · pass 2 · new	UAF read/write on freed engine->breadcrumbs at driver unload (panic-class; worse on heap reuse)	untested
DF-4583	Low	4.1	VBIOS-derived zero clocks reach dfixed_div as divisors in the rs690 watermark math: igp_sideport_mclk == 0 (no zero fallback) and ulDefaultEngineClock == 0 (pm.sclk == 0) → integer-divide-fault panic at boot/first bandwidth update Base system — drivers · sys/dev/drm/radeon/rs690.c:371 · pass 2 · new	panic	inconclusive
DF-4590	Low	4.1	tws_detach/attach-unwind never cancel driver callouts (reset_cb, reinit poll, per-req timeouts) before freeing the softc — use-after-free panic at driver unload during reset recovery Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws.c:346 · pass 2 · new	none	not_reproduced
DF-4627	Low	4.1	mipi_exec_delay: VBT-controlled u32 delay becomes a kernel BUSY-WAIT of up to ~71.6 minutes per element (arbitrarily many elements) Base system — drivers · sys/dev/drm/i915/intel_dsi_vbt.c:194 · pass 2 · new	Display subsystem hang + CPU burn up to ~71.6 min per delay element, indefinitely across elements, holding KMS locks so all DRM clients block	untested
DF-4656	Low	4.1	Bounce-buffer kmalloc failure path drops the ccb (xpt_done never called) — CAM devq wedge under memory pressure Base system — drivers · sys/dev/raid/twa/tw_osl_cam.c:336 · pass 2 · new	Each occurrence permanently strands one CAM_SIM_QUEUED ccb / devq slot; repeated occurrences wedge all I/O to the controller until reboot	untested
DF-4674	Low	4.1	bktr_attach fail-path releases the memory BAR with resource type SYS_RES_IRQ — resource_list_release() panics ('can't find resource') on any attach failure after the BAR was mapped Base system — drivers · sys/dev/video/bktr/bktr_os.c:331 · pass 2 · new	bktr_attach fail-path releases the memory BAR with SYS_RES_IRQ type - resource_list_release panics on any attach failure after BAR mapping (availability only)	untested
DF-4676	Low	4.1	cmx_kqfilter is the only entry point without the sc==NULL\|\|sc->dying guard — kevent() on a still-open fd after card detachment dereferences the NULL softc (kernel NULL-deref panic) Base system — drivers · sys/dev/misc/cmx/cmx.c:663 · pass 2 · new	cmx_kqfilter is the only entry without the sc/dying guard - kevent after card detach dereferences the NULL softc (panic). Root-only device + physical removal	untested
DF-4706	Low	4.1	amr_pci_attach registers amr_pci_intr before the state it consumes exists: a shared-IRQ-line interrupt in the attach window dispatches through the still-NULL sc->amr_get_work -> boot/kldload panic (setup-side mirror of DF-1820) Base system — drivers · sys/dev/raid/amr/amr_pci.c:257 · pass 2 · new	none	inconclusive
DF-4718	Low	4.1	aac_cam_fix_inquiry dereferences csio->data_ptr on successful INQUIRY completions without checking a data buffer exists (NULL-deref panic via no-data pass-through INQUIRY) Base system — drivers · sys/dev/raid/aac/aac_cam.c:551 · pass 2 · new	none	untested
DF-4729	Low	4.1	guc_ctl_log_params_flags() NULL-derefs guc->log.vma: the port compiled out intel_guc_log_create() but left its consumer live — instant kernel panic whenever GuC is enabled (enable_guc!=0) on Gen9+ Base system — drivers · sys/dev/drm/i915/intel_guc.c:294 · pass 2 · new	none	untested
DF-4734	Low	4.1	ar5210ResetTxQueue dereferences ah_curchan (IEEE80211_IS_CHAN_TURBO) without the NULL guard both sibling HALs carry ("NB: chan can be NULL during attach") Base system — drivers · sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:157 · pass 2 · new	none demonstrated (hardware-gated: no Atheros NIC on guest; latent NULL-deref kernel panic if a DATA queue is reset before the first channel set)	untested fixed
DF-4744	Low	4.1	ahci_pci_detach() has no interlock against an in-flight ahci_intr() on another CPU — hardirq-context UAF of sc_ports[]/ap and access to the already-unmapped ABAR during controller detach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ahci/ahci_attach.c:589 · pass 2 · new	none	untested
DF-4755	Low	4.1	VI mailbox RCV interrupt enabled before flr_work is initialized — host-timed mailbox interrupt executes schedule_work() on an uninitialized (zeroed) work_struct → NULL function-pointer call → kernel panic Base system — drivers · sys/dev/drm/amd/amdgpu/mxgpu_vi.c:600 · pass 2 · new	panic	untested
DF-4793	Low	4.1	ar9287SetPowerCalTable: non-2GHz channel leaves pCalBChans=NULL/numPiers=0, unguarded per-chain walk NULL-derefs pList[0] in ath_ee_getLowerUpperIndex (kernel panic) Base system — drivers · sys/dev/netif/ath/ath_hal/ar9002/ar9287_reset.c:68 · pass 2 · new	panic	untested
DF-4802	Low	4.1	initsd() verify loop retries a mismatched block forever (verified=0 with no bound): unbounded uninterruptible kernel loop in the ioctl thread Base system — drivers · sys/dev/raid/vinum/vinumrevive.c:526 · pass 2 · new	none	not_reproduced
DF-4805	Low	4.1	Disable path programs count=0 + reload while leaving AMDSB_WD_RUN armed — kern.watchdog.period=0 (and panic-path wdog_disable) never actually disarm the watchdog; a zero count under RUN may act as a 1-tick fuse per SB RRG countdown semantics Base system — drivers · sys/dev/misc/amdsbwd/amdsbwd.c:220 · pass 2 · new	dos	untested
DF-4818	Low	4.1	nvme(4): unchecked MSI-X vector IRQ resource allocation (and missing pci_teardown_msix on fallback) leads to boot-time kernel panics Base system — drivers · sys/dev/disk/nvme/nvme_attach.c:166 · pass 2 · new	panic	inconclusive
DF-4841	Low	4.1	Post-reset OBFL refill is a no-op: sense_bufs[].posted survives the controller soft reset, so tws_init_obfl_q() re-run by the recovery path posts nothing — firmware left with zero response frames, permanent I/O hang after any successful reset recovery Kernel memory corruption (UAF / OOB write) · sys/dev/raid/tws/tws_hdm.c:118 · pass 2 · new	none	not_reproduced
DF-4923	Low	4.1	tlphy_attach NULL-deref: strcmp(device_get_name(sibling), "tlphy") panics on not-yet-probed miibus sibling Base system — drivers · sys/dev/netif/mii_layer/tlphy.c:175 · pass 2 · new	none	not_reproduced
DF-4950	Low	4.1	ahci_os_stop_port(): unbounded thread-join with no escape converts any port-thread wedge into a permanent unkillable kernel hang at detach/shutdown, and tears down only 1 of the 3 per-port locks Base system — drivers · sys/dev/disk/ahci/ahci_dragonfly.c:248 · pass 2 · new	dos	untested
DF-4975	Low	4.1	AI (Vega20-class) mailbox RCV interrupt enabled before flr_work is initialized — host-timed IDH_FLR_NOTIFICATION executes schedule_work() on a zeroed work_struct → NULL function-pointer call → kernel panic (DF-4755 twin) Base system — drivers · sys/dev/drm/amd/amdgpu/mxgpu_ai.c:351 · pass 2 · new	none	untested
DF-4976	Low	4.1	flr_work never drained at mailbox teardown — xgpu_ai_mailbox_put_irq() lacks cancel_work_sync(), so a queued FLR work survives put_irq and uses amdgpu_device after hw_fini/free (UAF at driver detach) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/mxgpu_ai.c:365 · pass 2 · new	none	untested
DF-4986	Low	4.1	mfi_pci_attach failure unwind calls mfi_free() → callout_terminate() on a never-initialized watchdog callout → KKASSERT kernel panic (stock INVARIANTS GENERIC) Base system — drivers · sys/dev/raid/mfi/mfi_pci.c:230 · pass 2 · new	panic	not_reproduced
DF-4990	Low	4.1	SMB_TRANS copies out driver-updated rcount without re-clamping to SMB_MAXBLOCKSIZE — latent kernel stack OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/smb/smb.c:333 · pass 2 · new	infoleak	untested
DF-4994	Low	4.1	vega10_smu_init error path kfrees hwmgr->smu_backend without NULLing it, defeating vega10_smu_fini's NULL guard — latent double-free/UAF (the vega12 DF-4951 shape) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:288 · pass 2 · new	corruption	untested
DF-5006	Low	4.1	acpi_cpu has no detach teardown: ACPI notify handler (context=sc), both sysctl contexts and the sensordev outlive the softc → use-after-free on driver/module detach; attach error paths leak the same resources and orphan the first child Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_cpu.c:67 · pass 2 · new	none	untested
DF-5047	Low	4.1	idad_dump reports fake success for controller-failed/rejected dump writes — ida_command discards the controller error status (DF-5027 pattern) Base system — drivers · sys/dev/raid/ida/ida_disk.c:204 · pass 2 · new	none	untested
DF-5085	Low	4.1	AcpiOsMapMemory's NULL failure contract is dead code — pmap_mapdev panics on KVA exhaustion instead of returning NULL, converting ACPICA's graceful AE_NO_MEMORY degradation into an unrecoverable kernel panic with firmware/AML-controlled mapping volume Base system — drivers · sys/dev/acpica/Osd/OsdMemory.c:91 · pass 2 · new	per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption)	untested
DF-5093	Low	4.1	wbsio_detach never detaches its lm child (no bus_generic_detach): driver unload leaves a dangling attached child with a live 5s sensor task, leaked rman ports, and a NULL-ops parent — any later bus op on the child is a guaranteed NULL-deref panic Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/wbsio/wbsio.c:268 · pass 2 · new	guaranteed NULL-deref panic on later child bus op (root-gated)	untested
DF-5121	Low	4.1	MMalloc trace-table exhaustion (>=16384 outstanding allocations) makes Malloc() return NULL in VINUMDEBUG builds, breaking the never-fail M_WAITOK contract the vinum family relies on: unchecked callers NULL-deref (panic) and expand_table's CHECKALLOC longjmps out of crit_enter() without crit_exit() (leaked critical section) Base system — drivers · sys/dev/raid/vinum/vinummemory.c:103 · pass 2 · new	NULL-deref panic / leaked crit section in debug builds	untested
DF-5127	Low	4.1	rcu_expand() performs a blocking GFP_KERNEL (M_WAITOK) allocation inside crit_enter() — sleeping allocation in a critical section under memory pressure Base system — drivers · sys/dev/drm/linux_rcu.c:139 · pass 2 · new	latent crit-section rule violation under memory pressure	untested
DF-5129	Low	4.1	for_each_sg lacks Linux's `&& sg' termination guard — list shorter than sgmax turns into sg_next(NULL) NULL-deref panic Base system — drivers · sys/dev/drm/linux_scatterlist.c:342 · pass 2 · new	NULL-deref panic inside drm code on caller/list count mismatch	untested
DF-5130	Low	4.1	ecc_amd8000_attach() executes rdmsr(0x017B)/wrmsr(0x17B) with no CPU vendor/family validation — chipset-ID-gated #GP kernel panic (coretemp DF-4735 shape, hardware-gated) Base system — drivers · sys/dev/misc/ecc/ecc_amd8000.c:165 · pass 2 · new	attach-time #GP panic on platform-lying config	untested
DF-5168	Low	4.1	ips_ioctl_cmd ENOMEM error path feeds a failed bus_dmamem_alloc result into bus_dmamem_free — contigfree(NULL)/kfree(NULL) corrupts kernel_map or panics Base system — drivers · sys/dev/raid/ips/ips_ioctl.c:116 · pass 2 · new	kernel panic or kernel_map corruption on the ENOMEM path	untested
DF-5179	Low	4.1	atkbdattach() ignores IRQ resource allocation failure: NULL resource reaches nexus_setup_intr() which panics by design (boot-time kernel panic; BUS_SETUP_INTR result also unchecked, resource leaked) Base system — drivers · sys/dev/misc/atkbd/atkbd_isa.c:120 · pass 2 · new	panic	untested
DF-5180	Low	4.1	acpi_PkgStr() heap out-of-bounds read past non-NUL-terminated ACPI_TYPE_BUFFER: strlcpy()'s unbounded 'traverse rest of src' scan walks off the end of the ACPICA allocation for a zero-free firmware buffer Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_package.c:86 · pass 2 · new	dos	untested
DF-5217	Low	4.1	LKM screen-saver module unload TOCTOU: remove_scrn_saver samples scrn_blanked and clears current_saver with no syscons_lock, so kldunload can unmap the saver module (fade_saver et al.) while fade_saver is still executing — use-after-free of module text and statics Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/fade/fade_saver.c:46 · pass 2 · new	kernel UAF executing freed module text - panic ceiling	untested
DF-5339	Low	4.1	probe/enumerate BSP-validation asymmetry: disabled second BSP entry passes probe then trips KKASSERT(!found_bsp) — deterministic boot-time kernel panic Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:684 · pass 2 · new	none	untested
DF-5340	Low	4.1	mptable_search() base-memory scan: (base_memory-1)*1024 u_int underflow — KKASSERT(target!=0) boot panic (basemem==1) or mapdev scan of the top-of-4GB MMIO hole (basemem==0) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:284 · pass 2 · new	none	untested
DF-5342	Low	4.1	u_int truncation of the HT-fixup APIC-id mask for ids 32..63 silently corrupts the fixup decision — phantom logical CPUs enumerated, boot hangs on smp_startup_mask Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:641 · pass 2 · new	none	untested
DF-5343	Low	4.1	HT-fixup synthetic processor entries inherit the BSP flag: lapic_set_cpuid(0, fake_id) clobbers cpu_id_to_apic_id[0] and unconditionally burned CPU slots leave phantom SIPI targets — SMP boot hang / permanent cpu-0 IPI mis-addressing Base system — bus / platform / cpu · sys/platform/pc64/x86_64/mptable.c:702 · pass 2 · new	none	untested
DF-5345	Low	4.1	Unguarded rdmsr() in print_svm_info()/print_vmx_info(): CPUID-advertised VMX/SVM without MSR backing → ring-0 #GP → boot-time kernel panic Base system — bus / platform / cpu · sys/platform/pc64/x86_64/identcpu.c:1279 · pass 2 · new	none	not_reproduced
DF-5346	Low	4.1	SMAP missing from the hypervisor CPUID-feature blacklist in identify_cpu() despite the blacklist's own CR4-activation rule (buggy-hypervisor boot #GP) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/identcpu.c:668 · pass 2 · new	none	not_reproduced
DF-5366	Low	4.1	cpu_id_to_apic_id[] lacks the -1 sentinel its sibling gets: lapic_config() initializes only apic_id_to_cpu_id[], so any unassigned forward mapping silently aliases APIC ID 0 (the BSP) — INIT/SIPI redirected at the running BSP Base system — bus / platform / cpu · sys/platform/pc64/apic/lapic.c:1161 · pass 2 · new	INIT IPI redirected at the BSP: boot-time reset loop / SMP bringup hang	untested
DF-5622	Low	4.1	Reachable KKASSERT panic on firmware-supplied _PSS control values: endpoint P-states are never validated and vid>=rvo is never checked before amd0f_set_fidvid asserts Base system — bus / platform / cpu · sys/platform/pc64/x86_64/cpufreq_machdep.c:92 · pass 2 · new	none	not_reproduced
DF-5729	Low	4.1	lwkt_tokref published before initialization — DDB ps token walk (db_dump_td_tokens) can dereference a stale/NULL tr_tok (snapshot race) Base system — kernel core (kern) · sys/kern/lwkt_token.c:660 · pass 2 · new	none	untested
DF-5771	Low	4.1	mmc_rescan_cards()/mmc_delete_cards() free card ivars unconditionally after device_delete_child() — latent UAF if a child driver's detach ever fails Kernel memory corruption (UAF / OOB write) · sys/bus/mmc/mmc.c:1728 · pass 2 · new	slow kernel-memory leak (5770) / latent UAF (5771)	untested
DF-3438	Info	4.1	Cipher registry has no reference accounting: ieee80211_crypto_unregister clears ciphers[] while keys may still hold wk_cipher into the module; policy-module nrefs gate read unsynchronized at MOD_UNLOAD ('XXX disallow if references') - kldunload TOCTOU -> UAF Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_crypto.c:194 · pass 2 · new	none	untested
DF-4483	Info	4.1	build_rq_buffer malloc-failure path frees the whole request via abortrequest() and then every caller frees it again (latent double-free / UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrequest.c:833 · pass 2 · new	Latent heap double-free/UAF landmine (dead today: Malloc is M_WAITOK and never fails)	untested
DF-4825	Info	4.1	clockmod: raw wrmsr(MSR_THERM_CONTROL) without a fault-safe accessor — a VMM advertising CPUID ACPI+TM but faulting the MSR turns the root sysctl select / kldunload raise-to-100% into an unrecoverable #GP panic (DF-4735 family) Base system — drivers · sys/dev/powermng/clockmod/clockmod.c:472 · pass 2 · new	panic	untested
DF-4831	Info	4.1	hwmgr_hw_fini dereferences hwmgr->hwmgr_func->backend_fini and hwmgr->pptable_func->pptable_fini guarded only by pm_en — no PHM_FUNC_CHECK-style preflight (same latent class as DF-1913 at unguarded sites) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:278 · pass 2 · new	panic	untested
DF-5096	Info	4.1	parser2 command-table helper hub failure ignored leaves bp->cmd_helper NULL inside a 'successfully' constructed firmware BIOS parser — latent whole-vtable NULL function-pointer call (v2 twin of DF-5075) Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table_helper2.c:73 · pass 2 · new	latent NULL vtable call (panic)	untested
DF-5097	Info	4.1	helper2 hub wires v1 dce80/dce110 tables into the atomfirmware parser; both tables lack transmitter_color_depth_to_atom and dc_clock_type_to_atom which command_table2.c invokes unguarded — latent NULL function-pointer kernel panic under cross-generation VBIOS pairing (parser2 twin of DF-5000/DF-4985) Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table_helper2.c:43 · pass 2 · new	latent NULL vtable call (panic)	untested
DF-5623	Info	4.1	Unbounded FID/VID pending-bit spin and non-converging phase-2 ramp loop; success returned without completion verification Base system — bus / platform / cpu · sys/platform/pc64/x86_64/cpufreq_machdep.c:53 · pass 2 · new	none	not_reproduced
DF-3972	Medium	4.0	NULL-pointer dereference of rdev->pm.dpm.boot_ps in btc_dpm_enable/btc_dpm_disable when the VBIOS power table has no BOOT-classified state (or ucStateEntrySize<=1) — btc twin of DF-3610/3646/3754/3953 Base system — drivers · sys/dev/drm/radeon/btc_dpm.c:2377 · pass 2 · new	none	inconclusive
DF-5298	Medium	4.0	umass CBI command-phase error path leaks the in-flight CCB when the device detaches during teardown (sense-fetch fallback is a silent no-op) — unkillable hung process + leaked kernel CCB Base system — bus / platform / cpu · sys/bus/u4b/storage/umass.c:1871 · pass 2 · new	none (demonstrated); claimed impact: local DoS - permanent unkillable D-state process plus leaked kernel CCB, triggered by an evil CBI USB device that hangs an ADSC control transfer and then self-disconnects while a user I/O command is in flight	not_reproduced
DF-2847	Low	4.0	get_next_valid_apicid() -1 sentinel propagated unvalidated into get_cpuid_from_apicid(-1): OOB read of apic_id_to_cpu_id[-1] whose value is used, plus duplicate leaf member masks on exhaustion Kernel memory leaks / uninitialized disclosure · sys/kern/subr_cpu_topology.c:100 · pass 2 · new	none	not_reproduced
DF-3848	Low	4.0	bwn_phy_shm_tssi_read returns positive ENOENT but callers test < 0: the invalid-TSSI sentinel is treated as a valid TSSI of 2, so TX-power recalculation always 'adjusts' on fabricated data Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:3520 · pass 2 · new	TX-power correctness (bwn) / mbuf leak + ring wedge (dc)	untested
DF-3964	Low	4.0	Firmware-fed get_config values consumed unvalidated: PAGE_SIZE*(max_sg_count-1) maxsize underflow and cam_simq_alloc(max_requests-1) with openings=-1 Base system — drivers · sys/dev/raid/hptiop/hptiop.c:1928 · pass 2 · new	none	not_reproduced
DF-4299	Low	4.0	emu_pcm_attach late-failure path frees sc while the mixer remains registered: dangling mixer devinfo UAF on /dev/mixer ioctls and leaked AC97 submixer Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/emu10kx-pcm.c:1399 · pass 2 · new	none	untested
DF-4308	Low	4.0	adwprocesserror() panics on firmware-defined host_status codes the switch does not enumerate (0x35/0x36/0x46/0x47) — target/device-triggerable kernel panic Base system — drivers · sys/dev/disk/advansys/adwcam.c:1350 · pass 2 · new	none	untested
DF-4727	Low	4.0	aureal: au_intr calls chn_intr(au->pch.channel) while the channel is NULL — NULL-deref panic in the snd_setup_intr-to-pcm_addchan window that au_testirq deliberately enables IRQs inside Base system — drivers · sys/dev/sound/pci/aureal.c:411 · pass 2 · new	none	untested
DF-5040	Low	4.0	vbus_ext->timer never drained before vbus_ext is freed at shutdown: os_timer_for_ldm() fires on freed memory (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hpt27xx/hpt27xx_os_bsd.c:230 · pass 2 · new	probe panic / shutdown-window UAF per finding	untested
DF-5076	Low	4.0	ipmi2_pci_probe is the only IPMI frontend probe lacking the ipmi_attached singleton guard — double attach (second cdev + second kthread, interleaved KCS/SMIC state machines) on dual-description BMC hardware Base system — drivers · sys/dev/misc/ipmi/ipmi_pci.c:183 · pass 2 · new	none	untested
DF-5173	Low	4.0	ata_jmicron_setmode reads PCI config from the ATA disk device instead of the controller — 80-pin cable detect and multifunction PATA routing are permanently dead Base system — drivers · sys/dev/disk/nata/chipsets/ata-jmicron.c:161 · pass 2 · new	UDMA over 40-pin cable / misrouted PATA setmode	untested
DF-3974	Medium	3.9	Wild OOB kernel read in btc_find_voltage when a VBIOS voltage object has zero LUT entries: entries[0xFFFFFFFF] ≈ +32 GiB past eg_pi (btc twin of DF-3649/3956) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/btc_dpm.c:1293 · pass 2 · new	none	inconclusive
DF-2742	Low	3.9	diskstrategy consumes dp->d_slice with no serialization while disk_probe/disk_invalidate replace and free it — use-after-free window for every in-flight bio Kernel memory corruption (UAF / OOB write) · sys/kern/subr_disk.c:1246 · pass 2 · new	none	not_reproduced
DF-3421	Low	3.9	DDB 802.11 pretty-printers dump raw wlan key material (wk_key bytes) to the console — WEP/TKIP-temporal/CCM keys and RSC/TSC exposed in serial-console captures and crash-dump sessions Base system — network stack · sys/netproto/802_11/wlan/ieee80211_ddb.c:810 · pass 2 · new	none	untested
DF-3495	Low	3.9	v1 ng_l2tp session-hook / hook-private use-after-free: unreferenced cached hook+hpriv used across a microsecond-scale window while concurrent rmhook frees both Kernel memory corruption (UAF / OOB write) · sys/netgraph/l2tp/ng_l2tp.c:661 · pass 2 · new	none	not_reproduced
DF-4139	Low	3.9	throw_rude_remark strcpy of up-to-1024-byte message into ioctl_reply->msg[256]: up to 4 bytes past the VINUM_CREATE ioctl allocation, plus dangling static ioctl_reply (UAF write) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:114 · pass 2 · new	none	untested
DF-4195	Low	3.9	drm_connector_register() error path leaves dangling connector->kdev — latent double-free on re-register; unchecked kzalloc in the sysfs stub Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_connector.c:453 · pass 2 · new	none	untested
DF-4757	Low	3.9	LLQ stride accounting inverted: ena_com.c:657 assigns descs_per_entry backwards (SINGLE→entry/64, MULTIPLE→1) contradicting the vendor enum semantics and ena_eth_com.c:202 — free-space guard undercounts for SINGLE-stride LLQs and lets the tail lap outstanding descriptors Base system — drivers · sys/dev/virtual/amazon/ena/ena-com/ena_com.c:657 · pass 2 · new	corruption	untested
DF-5311	Low	3.9	dagetcapacity() parses READ CAPACITY results from a non-zeroed heap buffer; short transfer with good status publishes stale kernel heap as disk geometry and prints it to console/dmesg Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:2199 · pass 2 · new	stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313)	untested
DF-5552	Low	3.9	cam_devq reference count is a non-atomic int and cam_devq_release() frees the devq with active I/O after only a warning Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_queue.c:242 · pass 2 · new	none	untested
DF-5595	Low	3.9	sim refcount release protocol is non-atomic and unenforced — asymmetric with its atomic acquisition side and its cmpset-loop neighbors Base system — bus / platform / cpu · sys/bus/cam/cam_sim.c:246 · pass 2 · new	none	untested
DF-4675	Info	3.9	bktr_detach removes only the minor==unit device node — /dev/tunerN (unit+16) and /dev/vbiN (unit+32) persist after detach, stranding cdevs that reference the driver's dev_ops (use-after-free after module unload) Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_os.c:325 · pass 2 · new	bktr_detach removes only minor==unit - /dev/tunerN and /dev/vbiN persist, stranding cdevs referencing the driver's dev_ops (dev_ops UAF after module unload)	untested
DF-3634	Medium	3.8	Uninitialized kernel stack variable leaked to userspace by i915_gem_mmap_ioctl() when size==0 (DragonFly-only path) Privilege escalation (general use) · sys/dev/drm/i915/i915_gem.c:1923 · pass 2 · new	leak	inconclusive
DF-3975	Medium	3.8	btc_dpm_get_sclk/btc_dpm_get_mclk dereference eg_pi->requested_rps.ps_priv (NULL) before the first power-state change — NULL-page read panic from display bandwidth updates Base system — drivers · sys/dev/drm/radeon/btc_dpm.c:2802 · pass 2 · new	none	inconclusive
DF-5075	Low	3.8	v1 command-table helper hub leaves bp->cmd_helper NULL for DCE12/DCN generations on the legacy BIOS parser; construct ignores the init failure — whole-vtable NULL dereference at the first BIOS command Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table_helper.c:58 · pass 2 · new	none	untested
DF-5312	Low	3.8	DA_CCB_TRIM completion decrements outstanding_cmds_rd that the TRIM start path never increments: permanent queue-accounting underflow disables read throttling and tps balancing Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:1327 · pass 2 · new	stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313)	untested
DF-3088	Low	3.7	nfssvc_nfsd() socket-zap race after the pipelined dorec leaks the request's mbuf chain and client address (:576-579 frees only the descriptor) Base system — filesystems · sys/vfs/nfs/nfs_syscalls.c:575 · pass 2 · new	none	not_reproduced
DF-2717	Medium	3.6	nlookup_init()/retry path read the shared fd_ncdir/fd_nrdir nchandle pairs without fd_spin while sibling threads swap them — torn (ncp,mount) pairs and hold-after-drop race on the jail '..'-gate comparison inputs Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_nlookup.c:149 · pass 2 · new	none	not_reproduced
DF-5782	Medium	3.6	i915: unauthenticated ADDFB2 u32 overflow in framebuffer offset/size math (tile-aligned geometry) defeats bo-bounds check — OOB GPU scanout read from wrong/adjacent GGTT mappings Base system — drivers · sys/dev/drm/i915/intel_display.c:2398 · pass 2 · new	none	untested
DF-2760	Low	3.6	sys_getsid reads the p_pgrp->pg_session chain without pt->p_token; sys_setpgid reads curp->p_session unlocked — lifetime race vs. enterpgrp's pgrp free (stale/UAF read) Kernel memory corruption (UAF / OOB write) · sys/kern/kern_prot.c:153 · pass 2 · new	none	not_reproduced
DF-3038	Low	3.6	Crafted FAT32 root-alias directory entry (startCluster == pm_rootdirblk): rmdir() frees the live mount's root-directory cluster chain; rename() clobbers root entry 1 and creates a namespace cycle Base system — filesystems · sys/vfs/msdosfs/msdosfs_vnops.c:1230 · pass 2 · new	dos	untested
DF-3066	Low	3.6	ext2_nodealloccg honors unvalidated inode-bitmap content: reserved inode numbers (below first_ino) and tail bits (>= ipg) are allocatable — silent fs aliasing / OOB e2fs_gd[] reads via ino_to_cg Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new	none	not_reproduced
DF-3234	Low	3.6	ext2_balloc's four newb > UINT_MAX EFBIG returns leak the just-allocated block and leave ip->i_blocks inflated — permanent unprivileged-triggerable space/accounting corruption on 64BIT filesystems Base system — filesystems · sys/vfs/ext2fs/ext2_balloc.c:135 · pass 2 · new	corruption	not_reproduced
DF-3252	Low	3.6	ffs_vget publishes the inode into the ihash before validating it: bread-failure branch hands concurrent ufs_ihashget waiters a VBAD zeroed-inode vnode as a successful VFS_VGET result (DF-3208 ufs twin) Base system — filesystems · sys/vfs/ufs/ufs_ihash.c:1120 · pass 2 · new	none	untested
DF-3371	Low	3.6	ip_setmoptions IP_ADD_MEMBERSHIP: route reference dropped before rt_ifp is read — use-after-release race and permanent rtentry leak when the lookup held the last reference Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_output.c:1658 · pass 2 · new	none	not_reproduced
DF-3624	Low	3.6	Double free of adev->pm.dpm.ps on the kzalloc-failure path of ci_parse_power_table (plus leak of already-parsed ci_ps states) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/ci_dpm.c:5694 · pass 2 · new	OOM-gated double free	untested
DF-3642	Low	3.6	e1000_erase_flash_bank_ich8lan: erase address accumulates across retries, retry budget never reset, and erase failure reported as success Base system — drivers · sys/dev/netif/ig_hal/e1000_ich8lan.c:4779 · pass 2 · new	none	not_reproduced
DF-3734	Low	3.6	Unchecked requested_clock_mode_index++ in r600 DYNPM downclock (discrete branch) — one-past-end OOB heap read of per-state clock_info Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r600.c:486 · pass 2 · new	none	inconclusive
DF-3747	Low	3.6	sccngetch(): 8-byte size_t store through (size_t *)&fkeycp pun writes 4 bytes past a kernel static; unclamped bcopy into the 17-byte static fkey trusts the DF-1503-corruptible fkeytab length Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/syscons.c:2005 · pass 2 · new	none	inconclusive
DF-3809	Low	3.6	port_to_transcoder[PORT_F] out-of-bounds read in intel_enable_ddi_hdmi on GEN9_BC DDI-F hardware leads to wild CHICKEN_TRANS MMIO write Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_ddi.c:3180 · pass 2 · new	none	untested
DF-4073	Low	3.6	MVDD stash-table wrong-index reads: entries[count] instead of entries[level] (uninitialized voltage to SMU) and cross-table mvdd_voltage_table.entries[vdd_dep_on_mclk index] (true OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:459 · pass 2 · new	none	inconclusive
DF-4108	Low	3.6	vge TX short-frame pad path writes one fragment past vge_frag[7] when a <60-byte frame arrives with 7 DMA segments (vge_encap maxsegs off-by-one corrupts the next descriptor's vge_sts/vge_ctl) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/vge/if_vge.c:676 · pass 2 · new	none	untested
DF-4115	Low	3.6	hdac_stream_alloc() bidirectional-stream tag arithmetic: '+ num_oss' should be '- num_oss' (missing upstream FreeBSD fix) — wrong/colliding/negative HDA stream tags on BSS-capable controllers Base system — drivers · sys/dev/sound/pci/hda/hdac.c:1933 · pass 2 · new	none	not_reproduced
DF-4206	Low	3.6	vlv_dsi_init !fixed_mode error path kfrees a registered drm_connector without drm_connector_cleanup — dangling entry on mode_config.connector_list and in the mode-object IDR Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/vlv_dsi.c:1860 · pass 2 · new	none	untested
DF-4430	Low	3.6	PRIME import on radeon: populate() ignores the sg table (fresh pages bound into the GART instead of the exporter's) and unpopulate() leaks those pages + TTM accounting per import cycle Base system — drivers · sys/dev/drm/radeon/radeon_ttm.c:753 · pass 2 · new	PRIME-imported (ttm_bo_type_sg) BOs on radeon: populate() ignores ttm->sg (slave branch #ifdef DUMBBELL_WIP, radeon_ttm.c:753-764) and allocates fresh pool pages that get bound into the GART — the GPU view of an imported dma-buf diverges from the exporter's memory (silent data corruption); unpopulate()'s live slave early-return (radeon_ttm.c:808,818-819) then never frees those pages or their ttm_mem_global accounting, so repeated import/destroy cycles leak wired kernel memory until GPU allocations fail (DoS). Sibling amdgpu_ttm.c:1268-1330 implements the slave path live. Reachability: cross-driver dma-buf import with radeon as importer (multi-GPU); same-driver self-import unaffected.	untested
DF-4445	Low	3.6	radeon_router_select_ddc_port/cd_port write an uninitialized kernel-stack byte into the DDC/CD router i2c mux registers when the router read fails (and leak it via DRM_DEBUG) Base system — drivers · sys/dev/drm/radeon/radeon_i2c.c:1110 · pass 2 · new	none	untested
DF-4552	Low	3.6	snd_vibes: sv_attach failure paths after mixer_init leave a live 0666 /dev/mixerN over released bus resources and leak sc (DF-4156 family, 12th instance) Base system — drivers · sys/dev/sound/pci/vibes.c:789 · pass 2 · new	none	not_reproduced
DF-4588	Low	3.6	ttm_bo_vm_fault_dfly maps SG (prime-imported) foreign pages through the card node — the upstream TTM_PAGE_FLAG_SG refusal is dead code in #if 0 Base system — drivers · sys/dev/drm/ttm/ttm_bo_vm.c:161 · pass 2 · new	none	untested
DF-4603	Low	3.6	ttm_bo_util: stale/uninitialized old_copy.bus snapshot drives iounmap() decision in ttm_bo_move_memcpy out: cleanup — kernel mapping leak, and full VRAM-aperture unmap when old BO sits at aperture offset 0 Base system — drivers · sys/dev/drm/ttm/ttm_bo_util.c:344 · pass 2 · new	Permanent kernel mapping leak per failed move (VA pressure DoS), or full VRAM-aperture unmap when old BO sits at aperture offset 0 -> kernel panic on next premapped access	untested
DF-4799	Low	3.6	ar9285: 2GHz-only Kite never enforced — 11A/11NA caps advertised (GMODE divergence), 5GHz channel edges inherited, nf_5g limits left zeroed: 5GHz channels selectable → radio programmed out of calibrated design with 2GHz-only data Base system — drivers · sys/dev/netif/ath/ath_hal/ar9002/ar9285_attach.c:527 · pass 2 · new	none	untested
DF-4808	Low	3.6	dce110 i2c hw engine: SW engine-state accounting desync corrupts subsequent DDC/I2C transactions — write-path buffer_used_bytes undercounts (length consumed before the accounting add), counters never reset on aborted-busy/release paths, and I2C_HW_BUFFER_SIZE=538 exceeds the 8-bit DC_I2C_INDEX/COUNT0 fields Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:334 · pass 2 · new	none	untested
DF-4816	Low	3.6	iwm phy_db: unbounded firmware channel-group id → up-to-1 MiB M_WAITOK allocations from interrupt context + uint8_t truncation of the group-count upload loop (-1→255 hard-fails firmware load) Base system — drivers · sys/dev/netif/iwm/if_iwm_phy_db.c:279 · pass 2 · new	none	untested
DF-4830	Low	3.6	mdcreate unit allocation (mdunits++) is unlocked and non-atomic — concurrent mdopen auto-create of the top unit can mint two md devices with the same unit number/cdev name Base system — drivers · sys/dev/disk/md/md.c:135 · pass 2 · new	none	untested
DF-5066	Low	3.6	dm_target_autoload clobbers linker_file->userrefs with an unsynchronized '=1' store outside kld_lock, racing kldunload's locked read-modify-write — corrupts kld module pin accounting Base system — drivers · sys/dev/disk/dm/dm_target.c:88 · pass 2 · new	module pin-accounting corruption	untested
DF-5087	Low	3.6	Unsynchronized check-then-set of i2c_hw_buffer_in_use plus clear-before-release lets concurrent I2C acquisitions jointly drive the single shared DCE80 DC_I2C engine — interleaved single-instance MMIO and per-engine tracking divergence from the shared 144-byte HW data FIFO (dce80 twin of DF-5035/DF-4878; the DAL2 mutex was dropped in the port) Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c:139 · pass 2 · new	per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption)	untested
DF-5131	Low	3.6	DF-4871 family completion: seven more callers discard radeon_sync_resv()/radeon_sync_rings() returns — GPU work submitted without its cross-ring dependency on sync failure (silent bo data corruption, racing VM page-table updates) Base system — drivers · sys/dev/drm/radeon/radeon_sync.c:89 · pass 2 · new	none	untested
DF-5263	Low	3.6	mtw_key_set defers the raw ieee80211_key pointer; pairwise keys are node-embedded, so a node freed before mtw_key_set_cb runs makes the callback read and WRITE (k->wk_pad) freed node memory Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:1940 · pass 2 · new	none	inconclusive
DF-5385	Low	3.6	SMBus block write transmits the command byte where the byte-count belongs — every Block Write is malformed on the wire Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:381 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5387	Low	3.6	Read pipeline issues STOP despite SMB_TRANS_NOSTOP — chained I2C reads of >=2 bytes are terminated early Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:440 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5389	Low	3.6	RX-timeout error path leaks queued read allowances and stale FIFO state into the next same-slave transaction Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:448 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5590	Low	3.6	isavga_attach() discards both bus_alloc_resource() returns and never unwinds the legacy VGA window claims on attach failure — permanent orphaned rman claims (I/O 0x3c0-0x3df, MEM 0xa0000-0xbffff) on VGA-less BIOS boots, plus leaked cdev under FB_INSTALL_CDEV Base system — bus / platform / cpu · sys/bus/isa/vga_isa.c:144 · pass 2 · new	none	inconclusive
DF-3043	Low	3.5	nm_bioqlen async-bio accounting leaks on every nfs_startio early-exit and underflows on commit→write reissue — permanent mount-wide loss of NFS read-ahead from a malicious/oversized-server attribute claim (and loss of the async throttle) Base system — filesystems · sys/vfs/nfs/nfs_bio.c:922 · pass 2 · new	none	not_reproduced
DF-4450	Low	3.5	hsw_activate_psr2() overflows two 4-bit EDP_PSR2_CTL fields when sink reports max resync latency, corrupting IDLE_FRAME/FRAME_BEFORE_SU/TP2_TIME in one register write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_psr.c:415 · pass 2 · new	none	inconclusive
DF-4876	Low	3.5	afd_sense(): three uninitialized stack structs consumed as ATAPI response buffers — short (but successful) device responses publish stale kernel stack as disk geometry Base system — drivers · sys/dev/disk/nata/atapi-fd.c:345 · pass 2 · new	none	untested
DF-4949	Low	3.5	smic_read_byte() writes a status code (SC_SMS_RD_NEXT 0xC5) into the control register instead of the command code (CC_SMS_RD_NEXT 0x45) — out-of-spec SMIC control write on every reply byte Base system — drivers · sys/dev/misc/ipmi/ipmi_smic.c:202 · pass 2 · new	dos	untested
DF-5175	Low	3.5	CIS-controlled PCMCIA I/O window size drives out-of-allocation port I/O in ata_pccard_attach() Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-card.c:93 · pass 2 · new	none	untested
DF-5296	Low	3.5	uhci_pci_attach never validates the device-reported I/O BAR size against the fixed 0x14-byte UHCI register file — every UREAD/UWRITE can touch port-I/O outside the allocated resource window (DF-5268/DF-5282 register-geometry class, UHCI variant) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/controller/uhci.c:97 · pass 2 · new	silent cross-device port-I/O register corruption (max 12B excursion)	untested
DF-5495	Info	3.5	uether_rxmbuf() sets m_len/m_pkthdr.len from the caller-supplied len with no clamp — the core's unguarded RX entry point (live instance: DF-5396 urndis 2-byte heap overflow) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/usb_ethernet.c:563 · pass 2 · new	mbuf cluster leak per stall-unplug cycle (DF-5494) / future unguarded-len overflows (DF-5495)	untested
DF-3503	Low	3.4	ng7 ksocket rcvdata trusts foreign m_tag sockaddr with no m_tag_len validation: short tag (e.g. minted by ng_tag with user-configured cookie/type/len) makes stag->sa overlap OOB heap handed to sosend Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ksocket/ng_ksocket.c:904 · pass 2 · new	none	not_reproduced
DF-4134	Low	3.4	give_plex_to_volume() writes vol->plex[MAXPLEX] past the last member of struct volume when the 'too many plexes' throw is swallowed by disk-config mode Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:198 · pass 2 · new	none	untested
DF-4238	Low	3.4	sdma_v3_0 reads SDMA firmware sub-header fields (ucode_version @+16, ucode_feature_version @+32, ucode_size_bytes @+24) after only the datasize==size_bytes equality check — heap OOB read on a short root-installed firmware blob (DF-1451/1553/1598 family, v3 variant) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/sdma_v3_0.c:312 · pass 2 · new	none	not_reproduced
DF-4342	Low	3.4	ngmn_newhook channel aliasing: DOWN-state reuse admits two live hooks on one schan — silent second connect, blackholed peer hook, permanent nhooks drift blocking line reconfig, and a concurrent dual-teardown double-free enabler Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mn/if_mn.c:470 · pass 2 · new	none	inconclusive
DF-4600	Low	3.4	renameobject() bcopy's full-width newname with no NUL-termination guard → unterminated drive/sd/plex/volume name fields persisted to config and fed to strcmp/strlen/log %s Base system — drivers · sys/dev/raid/vinum/vinumioctl.c:740 · pass 2 · new	Unterminated names in find_* strcmp walks, detachobject strlen/bcmp, log %s, and persisted config text (garbage-tailed lines re-parsed at next init); reads bounded within the struct by NULs in following state enums	untested
DF-4880	Low	3.4	amdgpu_ucode_print_* helpers read version-dispatched sub-header fields (up to +156) with no blob-size check: unconditional heap OOB read on short crafted firmware, distinct sink from DF-1946 that survives its proposed minimum-size fix Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:54 · pass 2 · new	infoleak	untested
DF-5104	Low	3.4	led_attach() kstrdup()s the GPIOATTACH consumer arg without type validation: GPIO_TYPE_INT delivers an integer-as-pointer (arbitrary strlen/kstrdup deref) and the string variant is not termination-bounded (kernel-stack over-read) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/gpio/gpio_led.c:186 · pass 2 · new	none	inconclusive
DF-5166	Low	3.4	disable_irq/enable_irq resolve the victim entry by irq number only, ignoring dev_id — teardown/re-setup of the wrong device's handler whenever two registrations share or numerically collide on an irq Base system — drivers · sys/dev/drm/linux_irq.c:150 · pass 2 · new	interrupt-context UAF / orphaned armed handler / cross-device teardown	untested
DF-5290	Low	3.4	pmap_extract()/pmap_kextract() return (va & PAGE_MASK)-only garbage as a physical address when the PT exists but the PTE is empty — vkernel twin of pc64 DF-5245; live caller kvm_access_check() (/dev/kmem) then accepts unmapped KVA and mem I/O lands on guest-physical page 0 Base system — bus / platform / cpu · sys/platform/vkernel64/platform/pmap.c:662 · pass 2 · new	wrong-page /dev/kmem I/O (DF-5290) / latent PDP reclaim (DF-5291)	untested
DF-2874	Info	3.4	DIOCRECLUSTER has no privilege check and the kernel services dmsg peers with root credentials (raw RW with proc0.p_ucred, no open/keyid validation on I/O) — gated today only by diskopen's SYSCAP_RESTRICTEDROOT Privilege escalation (general use) · sys/kern/subr_diskiocom.c:108 · pass 2 · new	none	not_reproduced fixed
DF-3693	Medium	3.3	hptv2 metadata writeback: 2048-byte write from a 512-byte heap buffer persists ~1.5KB of kernel heap to disk (OOB read -> durable info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:1903 · pass 2 · new	leak	inconclusive
DF-3764	Medium	3.3	r100_packet3_check() reads payload dwords at fixed offsets without validating pkt->count -> OOB read 1 dword past the IB chunk end + kernel-log disclosure (same class as DF-1492/DF-3592) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r100.c:1961 · pass 2 · new	leak	inconclusive
DF-4181	Medium	3.3	radeon fb creation never validates framebuffer size against the backing GEM object — display engine scans out megabytes past a tiny BO, disclosing adjacent VRAM on the physical display Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_display.c:1294 · pass 2 · new	none	inconclusive
DF-2612	Low	3.3	ses_getputstat swallows all decode/encode/device errors and returns 0 (fail-open enclosure status) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ses.c:1268 · pass 2 · new	none	inconclusive
DF-2637	Low	3.3	Kernel heap-pointer (%p) kprintf disclosures on four hammer2 inode error paths Hammer2 · sys/vfs/hammer2/hammer2_inode.c:711 · pass 2 · new	none	untested
DF-2669	Low	3.3	kern_truncate()/kern_ftruncate() execute VFS_ACCOUNT() even when VOP_SETATTR failed — quota accounting corruption on failed truncates Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:4044 · pass 2 · new	none	untested
DF-2670	Low	3.3	sys_fchown() performs VFS_ACCOUNT() ownership-transfer accounting against the cwd's mount instead of the chowned file's mount Base system — kernel core (kern) · sys/kern/vfs_syscalls.c:3637 · pass 2 · new	none	untested
DF-2705	Low	3.3	vop_write quota accounting skips unlinked-open files (va_nlink==0) → complete quota enforcement bypass when vfs.quota_enabled=1; concurrent-writer delta TOCTOU Base system — kernel core (kern) · sys/kern/vfs_vopops.c:476 · pass 2 · new	none	untested
DF-2764	Low	3.3	journal_setextattr journals the post-VOP, fully consumed uio: the extended-attribute VALUE is never recorded in the REDO stream Base system — kernel core (kern) · sys/kern/vfs_jops.c:1027 · pass 2 · new	none	not_reproduced
DF-3059	Low	3.3	dirfs_setattr chtimes ignores the requested va_atime/va_mtime entirely — lutimes(path, NULL) always stamps 'now' (utimensat/UTIME_OMIT semantics unimplemented) Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:556 · pass 2 · new	none	not_reproduced
DF-3126	Low	3.3	cd9660_vptofh truncates ino_t into int ifid_ino; cd9660_vget_internal's int lbn truncation makes the volume-space bounds check bypassable — NFS file-handle inode aliasing and negative-offset bread on crafted/large images Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_vfsops.c:774 · pass 2 · new	denial_of_service	not_reproduced
DF-3135	Low	3.3	dirfs_open_helper tests the vnode type with a bitwise AND ('dnp->dn_type & VDIR') instead of equality — VBLK/VSOCK/VFIFO nodes are always opened with O_DIRECTORY and can never be opened at all; VLNK/VCHR take the plain-file path Base system — filesystems · sys/vfs/dirfs/dirfs_subr.c:583 · pass 2 · new	denial_of_service	not_reproduced
DF-3174	Low	3.3	Trigger retry dedup re-acquires already-done requests: concurrent waiters burn their retry budget on stale errors and never re-notify automountd Base system — filesystems · sys/vfs/autofs/autofs.c:324 · pass 2 · new	denial_of_service	not_reproduced
DF-3636	Low	3.3	Leftover debug kprintf("i915_gem_fault: CHUNKING PASS") on the unprivileged per-fault partial-view path enables console/log-flood DoS Privilege escalation (general use) · sys/dev/drm/i915/i915_gem.c:2323 · pass 2 · new	none	untested
DF-3677	Low	3.3	XPT_RESET_DEV on the RAID physical-disk bus resets the WRONG device: phydisk id passed unmapped as a bus-0 TMF TargetID (hits the RAID volume sharing the number) Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:3292 · pass 2 · new	none	inconclusive
DF-3694	Low	3.3	VIA/JMicron metadata writeback persists low 32 bits of kernel device_t pointers into on-disk metadata Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/ata-raid.c:2736 · pass 2 · new	leak	inconclusive
DF-3798	Low	3.3	ena_start_xmit leaks the dequeued mbuf when ena_xmit_mbuf returns ENA_COM_NO_MEM or ENA_COM_NO_SPACE Base system — drivers · sys/dev/virtual/amazon/ena/ena.c:2936 · pass 2 · new	mbuf leak / latent NULL-deref	untested
DF-3865	Low	3.3	DragonFly rbtree shim never maintains rb_root_cached.rb_leftmost — amdgpu_vm_fini's mapping-cleanup loop is dead code, leaking every mapping left in the interval tree at teardown Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3325 · pass 2 · new	none	not_reproduced
DF-4016	Low	3.3	mps_user_btdh off-by-one: target == max_devices passes the range check and reads mapping_table[max_devices] out of bounds Base system — drivers · sys/dev/raid/mps/mps_user.c:2021 · pass 2 · new	mps_user_btdh off-by-one: 'target > max_devices' lets TargetID==max_devices read mapping_table[max_devices] one 24-byte element past the heap allocation, disclosing a garbage u16 DevHandle to the operator-group caller. mpr twin at mpr_user.c:2240.	untested
DF-4021	Low	3.3	mpr_user_btdh off-by-one: target == max_devices passes the range check and reads mapping_table[max_devices] out of bounds (twin of DF-4016) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_user.c:2240 · pass 2 · new	mpr_user_btdh off-by-one: 'target > max_devices' (mpr_user.c:2240) lets TargetID==max_devices read mapping_table[max_devices] one 24-byte element past the heap allocation (mpr_mapping.c:2140-2141 allocates exactly max_devices entries), disclosing a garbage u16 dev_handle (byte offset 18 of the element) to the operator-group caller (mpr_user.c:2245-2247, node mpr_user.c:205). Twin of DF-4016 (mps).	untested
DF-4102	Low	3.3	dce4/avivo_crtc_do_set_base pin the scanout BO then return -EINVAL on unsupported-format/tiling errors without unpinning — repeatable VRAM pin-exhaustion DoS Base system — drivers · sys/dev/drm/radeon/atombios_crtc.c:1183 · pass 2 · new	Local DoS by any DRM-master-holding user on radeon hardware: one ioctl per leaked pin; VRAM exhaustion degrades/deadlocks the display subsystem.	untested
DF-4226	Low	3.3	Output-lock asymmetry: radeon_legacy_tmds_int_commit and radeon_legacy_tv_dac_commit re-LOCK the output instead of unlocking after modeset Base system — drivers · sys/dev/drm/radeon/radeon_legacy_encoders.c:768 · pass 2 · new	none	untested
DF-4239	Low	3.3	Stale ata_xfer resid propagated to CAM for zero-data commands: sili_unload_prb skips the resid update when datalen==0 and the completion copies the previous command's resid into csio->resid Base system — drivers · sys/dev/disk/sili/sili_cam.c:1667 · pass 2 · new	Stale ata_xfer resid propagated to CAM for zero-data commands: sili_unload_prb skips the resid update when datalen==0 and the completion copies the previous command's resid into csio->resid. Operator-group /dev/passN users receive bogus resid for zero-data commands; can mask real short-transfer conditions.	untested
DF-4264	Low	3.3	AMDGPU_FENCE_TO_HANDLE default case returns -EINVAL without dma_fence_put — one leaked fence reference per invalid call Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1427 · pass 2 · new	none	untested
DF-4357	Low	3.3	AMDGPU_INFO_READ_MMR_REG missing upstream count>128 cap: unprivileged unbounded kernel kmalloc (hardening / local DoS) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_kms.c:668 · pass 2 · new	none	inconclusive
DF-4428	Low	3.3	smu10_hwmgr_backend_fini never frees vdd_dep_on_mclk — deterministic kernel heap leak per powerplay fini cycle on Raven APUs Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:443 · pass 2 · new	none	untested
DF-4470	Low	3.3	Duplicate connector IDs in DRM_IOCTL_MODE_SETCRTC leak one drm_connector reference per duplicate slot per successful modeset — per-slot get vs per-connector binding, surplus dropped only on the fail path Base system — drivers · sys/dev/drm/drm_crtc_helper.c:626 · pass 2 · new	none	inconclusive
DF-4471	Low	3.3	__drm_helper_disable_unused_functions() NULLs crtc->primary->fb without dropping its framebuffer reference when invoked outside __drm_mode_set_config_internal — fb + GEM object reference leak per disabled unused CRTC Base system — drivers · sys/dev/drm/drm_crtc_helper.c:189 · pass 2 · new	none	untested
DF-4517	Low	3.3	DRM_CLOEXEC silently dropped when creating prime fds: dma_buf_fd() #if 0's the close-on-exec handling, so the validated flags lie to userspace and dma-buf fds leak across execve Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_prime.c:669 · pass 2 · new	Exported PRIME fds stay open across execve, contradicting the API contract Mesa/libdrm rely on; combined with DF-4429 (missing radeon verify_access) widens cross-user GPU buffer access	untested
DF-4532	Low	3.3	drm_open() calls device_busy() on every successful open but no live path ever calls device_unbusy(): drm device and its PCI parent wedged in DS_BUSY forever, permanently blocking device_detach()/kldunload Base system — drivers · sys/dev/drm/drm_file.c:351 · pass 2 · new	none	inconclusive
DF-4533	Low	3.3	drm_open() leaks one drm_device kref per successful open: the success-path drm_minor_acquire() is never balanced on any live path, so drm_dev_release()/drm_dev_fini() can never run and the whole drm_device leaks at unload Base system — drivers · sys/dev/drm/drm_file.c:325 · pass 2 · new	none	inconclusive
DF-4571	Low	3.3	missed_breadcrumb() forces intel_engine_dump() unconditionally ('\|\| 1' debug leftover): full engine state dump, including the DF-4246 over-reading ring hexdump path, runs from callout context every hangcheck period on production kernels Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_breadcrumbs.c:85 · pass 2 · new	Unthrottled multi-KB engine dumps every ~1.5s per engine on production kernels (console/dmesg flood DoS + repeated DF-4246 over-read path in callout context)	untested
DF-4794	Low	3.3	ig_hal VF: E1000_VF_SET_MULTICAST_OVERFLOW flag overwritten before send — PF never told to enable multicast promiscuous, >30 joined groups silently dropped (IPv6 ND breakage) Base system — drivers · sys/dev/netif/ig_hal/e1000_vf.c:421 · pass 2 · new	none demonstrated at runtime (guest is virtio-only, no SR-IOV 82576/I350 VF device); logic-level proven from source ordering + upstream divergence: with >30 multicast groups joined on an igb VF interface, PF-visible msgbuf[0]=0x001E0003 loses E1000_VF_SET_MULTICAST_OVERFLOW (0x00800000), PF never enables multicast promiscuous, groups beyond the 30 forwarded hashes silently stop receiving (typ. IPv6 solicited-node/ND breakage) — availability only, no corruption/leak/privilege crossing	untested
DF-4877	Low	3.3	afd_strategy(): no mediasize bounds check and 32-bit LBA truncation — out-of-range raw I/O wraps onto low LBAs instead of failing Base system — drivers · sys/dev/disk/nata/atapi-fd.c:241 · pass 2 · new	none	untested
DF-4924	Low	3.3	gfx_v9_0 gfx-ring emit_frame_size never reserves the 2-dword TMZ FRAME_CONTROL emission that amdgpu_ib_schedule() makes unconditionally — ring-reservation overrun of 2 dwords for every CS job with num_ibs == 24 (mod 64) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_ib.c:159 · pass 2 · new	dos	not_reproduced
DF-5027	Low	3.3	ipsd_dump() reports fake success when ips_poll_cmd never completes — copperhead crash dumps can be silently empty/corrupt (zeroed status defeats COMMAND_ERROR) Base system — drivers · sys/dev/raid/ips/ips_disk.c:249 · pass 2 · new	none	not_reproduced
DF-5050	Low	3.3	mfi_syspd_dump acknowledges every crash-dump chunk the firmware rejected — polled transport returns 0 for any firmware cmd_status, so a dead/removed system PD 'successfully' dumps an empty core (DF-5027 shape) Base system — drivers · sys/dev/raid/mfi/mfi_syspd.c:287 · pass 2 · new	none	not_reproduced
DF-5215	Low	3.3	LinuxKPI interval 'tree' is an O(N) circular list — sole live consumer (radeon_vm.c GEM_VA path) turns it into unprivileged per-ioctl O(N) kernel scans (O(N^2) mapping churn), a kernel-CPU amplification DoS on radeon-equipped systems Base system — drivers · sys/dev/drm/linux_interval_tree.c:34 · pass 2 · new	latent interior kfree / kernel-CPU amplification / unkillable spin	untested
DF-5264	Low	3.3	mtw_stop never frees the endpoint queues; the next mtw_init_locked memsets them via mtw_setup_tx_list, orphaning every queued mbuf and its ieee80211_node reference - repeatable kernel leak per down/up cycle Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_mtw.c:4647 · pass 2 · new	none	untested
DF-5279	Low	3.3	pci_get_vpd_readonly_method(): missing break discards every successful keyword match — lookup always returns ENXIO Base system — bus / platform / cpu · sys/bus/pci/pci.c:1354 · pass 2 · new	VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281)	untested
DF-5417	Low	3.3	Bind/xfer lifecycle leaks and open race: fw_bindadd failure leaks fwb+xfer, CBIND/close free binds without their xferlist xfers, fw_open si_drv1 check-then-set race double-allocates fw_drv1 Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:165 · pass 2 · new	slow kernel memory exhaustion / open-race panic	untested
DF-5743	Low	3.3	netbt uses IFF_LINK0 (0x1000) as an mbuf direction tag, colliding with the core mbuf flag M_LASTFRAG — spurious flag propagation and spoofable SCM_HCI_DIRECTION metadata Base system — network stack · sys/netbt/hci_socket.c:991 · pass 2 · new	none	untested
DF-5751	Low	3.3	l2cap_connect() failure paths after l2cap_cid_alloc() leak the CID and leave the half-open channel on l2cap_active_list: socket bricked with EISCONN until close, CID space consumed Base system — network stack · sys/netbt/l2cap_upper.c:166 · pass 2 · new	CID-space exhaustion + bricked sockets on connect-failure	untested
DF-2689	Info	3.3	Leftover DEBUG kprintf in vm_pageout_scan_hold leaks kernel pointer and spams the console on the normal race-recovery path Kernel memory leaks / uninitialized disclosure · sys/vm/vm_pageout.c:1932 · pass 2 · new	none	untested
DF-3397	Info	3.3	rx-ring init writes 4-byte int into const uint16_t nr_buf_size, clobbering the adjacent flags field (latent — module does not build on DFly) Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_mem2.c:974 · pass 2 · new	none	build_failed
DF-3868	Info	3.3	Copy-paste bug: 'debug' hint clamps sc->mch_rec instead of sc->dbg_level (and clamping is skipped exactly when the hint exists) Base system — drivers · sys/dev/sound/pci/emu10kx.c:3081 · pass 2 · new	log-spam DoS (debug sysctl unbounded)	untested
DF-4358	Info	3.3	DF-added kprintf leaks drm_device/amdgpu_device kernel pointers to dmesg at amdgpu attach Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_kms.c:185 · pass 2 · new	none	untested
DF-4441	Info	3.3	init_device kprintf leaks kernel heap pointer (COREBUF %p) to console — readable by unprivileged users via dmesg (security.unprivileged_read_msgbuf=1 default) Privilege escalation (general use) · sys/dev/smbus/atmel_mxt/atmel_mxt.c:393 · pass 2 · new	Kernel heap pointer disclosed to dmesg, readable unprivileged (security.unprivileged_read_msgbuf=1 default on guest)	untested
DF-4514	Info	3.3	ath_lna_div: dead ath_lna_div_ioctl() unconditionally copyouts uninitialized kernel heap (kmalloc without M_ZERO, executed even after EINVAL) - latent uninitialized-memory disclosure if ever wired up Privilege escalation (general use) · sys/dev/netif/ath/ath/if_ath_lna_div.c:176 · pass 2 · new	None in-tree (dead code); latent chosen-length uninitialized kernel-heap disclosure if ever wired to an ioctl (and the diag ioctls themselves lacked priv checks per DF-4320)	untested
DF-4527	Info	3.3	HAL_DIAG_ANI_CURRENT copies out the internal ar5212AniState including the kernel 'params' pointer: kernel heap address disclosure Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:1081 · pass 2 · new	none	untested
DF-5318	Info	3.3	USB_SETDEBUG sets the global usb_debug level with no privilege check (only FWRITE on the fd) — unprivileged kernel-log flooding / console spam Privilege escalation (general use) · sys/bus/u4b/usb_generic.c:2084 · pass 2 · new	latent unchecked index (DF-5317) / unpriv log flooding (DF-5318)	untested
DF-3400	Low	3.2	nat_del_dispatch never frees nat_state2 entries (free loops commented out): unbounded kernel heap leak on NAT delete/flush Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_nat/ip_fw3_nat.c:806 · pass 2 · new	none	not_reproduced
DF-3670	Low	3.2	ixgbe_calc_eeprom_checksum_generic walks NVM sections on NVM-resident pointer/length with u16 index and no word_size bounds — upstream FreeBSD fix missing in DragonFly Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ix/ixgbe_common.c:2214 · pass 2 · new	none	inconclusive
DF-3031	Low	3.1	ext2_readdir never corrects the caller's cookie count — missing '*' deref leaves stale uninitialized kernel heap in the over-reported tail (VOP contract violation, latent NFS-facing heap disclosure) Base system — filesystems · sys/vfs/ext2fs/ext2_vnops.c:262 · pass 2 · new	none	untested
DF-3097	Low	3.1	HAMMER1 NFS file handles carry zero entropy and fhtovp honors an attacker-chosen as-of TID: forged handles yield historical-version reads and cross-PFS reach on exported mounts Base system — filesystems · sys/vfs/hammer/hammer_vfsops.c:1083 · pass 2 · new	none	untested
DF-3209	Low	3.1	xdr_string_encode() transmits 1-3 uninitialized kernel-heap bytes (XDR string padding) in every boot mountd MOUNT / NFS LOOKUP request Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_mountrpc.c:143 · pass 2 · new	leak	untested
DF-3289	Low	3.1	Uninitialized stack args[1] transmitted in mesh peer-timeout CLOSE action frames Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:3107 · pass 2 · new	none	not_reproduced fixed
DF-3313	Low	3.1	ieee80211_recv_bar parses BAR control/sequence fields with no frame-length validation — OOB read of up to 10 bytes on short ctl frames Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_ht.c:994 · pass 2 · new	none	untested
DF-3637	Low	3.1	ath_tx_start() discards ath_tx_normal_setup() failure ('done: return 0') — leaked ath_buf + 10-descriptor slab + dmamap per failure, phantom TIM set, caller told success Base system — drivers · sys/dev/netif/ath/ath/if_ath_tx.c:2021 · pass 2 · new	none	not_reproduced
DF-3638	Low	3.1	ath_tx_retry_clone() dmasetup-failure path: node reference leaked forever and nbf recycled to the free list with bf_m dangling at a freed mbuf Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_tx.c:4568 · pass 2 · new	none	not_reproduced
DF-4210	Low	3.1	Unknown-INOT-status path overwrites the parsed notify entry with a log string and then acknowledges the string instead of the queue entry (f/w gets garbage ack; original Immediate Notify never properly acknowledged) Base system — drivers · sys/dev/disk/isp/isp_target.c:346 · pass 2 · new	In the RQSTYPE_NOTIFY default case, ISP_SNPRINTF overwrites the just-parsed Immediate Notify entry in the 64-byte stack buffer with an ASCII log message; isp_print_bytes correctly prints the ORIGINAL entry (vptr) but isp_notify_ack(isp, local) is handed the STRING, which it re-parses as in_entry_t - na_iid/na_seqid/na_status/na_task_flags become ASCII bytes and that garbage Notify-Ack goes to the firmware queue	untested
DF-4520	Low	3.1	ar5212_xmit: halTotalQueues taken unclamped from EEPROM AR_EEP_MAXQCU (raw 5-bit, 1..31) bounds ah_txq[HAL_NUM_TX_QUEUES=10] in every queue op -> SetupTxQueue OOB scan read + OS_MEMZERO OOB heap write at attach on crafted EEPROM Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:137 · pass 2 · new	none demonstrated (latent OOB kernel heap read + OS_MEMZERO OOB write at driver attach if the NIC EEPROM encodes MAXQCU>10; crafted/corrupted EEPROM = physical-card trust boundary)	untested fixed
DF-4548	Low	3.1	ar5212_attach: halKeyCacheSize taken unclamped from 4-bit EEPROM AR_EEP_KCENTRIES field (up to 32768) vs 128-entry hardware key table; every HAL keycache bounds check validates against the attacker-controlled value Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:867 · pass 2 · new	Latent MMIO OOB-write primitive (key-cache writes past the 128-entry table into PHY register space); defused in-tree by if_ath's ATH_KEYMAX=128 clamp	untested
DF-2704	Low	3.0	vop_cache_operate_ap dispatches through mnt_vn_journal_ops unsynchronized against journal_detach kfree (UAF window, root-gated) Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_vopops.c:1781 · pass 2 · new	none	untested
DF-2969	Low	3.0	suspend_kproc holds no reference on the target thread: concurrent kthread_exit yields use-after-free read/write on a recycled struct thread and an unkillable sleeper Kernel memory corruption (UAF / OOB write) · sys/kern/kern_kthread.c:188 · pass 2 · new	denial_of_service	not_reproduced
DF-3237	Low	3.0	iod-shutdown race: after nfssvc_iod_stop1() the reader re-queues EINPROGRESS requests onto nm_reqtxq whose only consumer (the writer thread) is already exiting — stranded nfsreq + nfsm_info + bio (biodone never called, buffer stuck B_BUSY), queue head embedded in the nfsmount that nfs_unmount then frees Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_iod.c:134 · pass 2 · new	leak	not_reproduced
DF-3281	Low	3.0	if_addgroup() increments ifg_refcnt outside ifgroup_lock and makes the find-or-create decision non-atomically: lost-update refcount -> premature group destruction with live references (latent UAF/double-free) Kernel memory corruption (UAF / OOB write) · sys/net/if.c:1174 · pass 2 · new	none	not_reproduced
DF-3399	Low	3.0	Unreplied cross-CPU netmsg in NAT state-add path leaks the kmalloc'd message when dispatch CPU diverges from hash CPU Base system — network stack · sys/net/ipfw3_nat/ip_fw3_nat.c:385 · pass 2 · new	none	not_reproduced
DF-3401	Low	3.0	ip_fw3_ctl_nat_get_record walks all CPUs' lockless per-CPU NAT state with no synchronization; break-vs-continue truncation Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_nat/ip_fw3_nat.c:585 · pass 2 · new	none	not_reproduced
DF-3496	Low	3.0	ng_fec_rcvmsg treats msg->data as a NUL-terminated interface name with no arglen validation: ifunit()/kprintf %s walk past the ng_mesg allocation (unbounded heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_fec.c:1287 · pass 2 · new	none	not_reproduced
DF-3512	Low	3.0	ng_bt3c_rcvmsg: NGM_BT3C_NODE_GET_QLEN reads msg->data without arglen validation — heap OOB read Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:444 · pass 2 · new	none	inconclusive
DF-3542	Low	3.0	Unsynchronized ng_eiface_next_unit++ races under concurrent node creation — duplicate interface unit numbers and duplicate if_xname ifnets Privilege escalation (general use) · sys/netgraph/eiface/ng_eiface.c:127 · pass 2 · new	state-confusion (duplicate if_xname)	untested
DF-3659	Low	3.0	ISP_TSK_MGMT ioctl (24xx) double-releases the FC scratch buffer on the error path, breaking fcbsy mutual exclusion Base system — drivers · sys/dev/disk/isp/isp_freebsd.c:665 · pass 2 · new	none	not_reproduced
DF-3808	Low	3.0	msk_txeof() consumes the device-supplied TX done index (0..4095) with no MSK_TX_RING_CNT (256) range check: bogus index force-completes the entire in-flight TX window (premature dmamap_unload/m_freem on HW_OWNER descriptors) Base system — drivers · sys/dev/netif/msk/if_msk.c:2884 · pass 2 · new	none	untested
DF-3846	Low	3.0	sc->map_update_cmd is never cleared: shutdown aborts a recycled pooled mfi command (stale handle → wrong-command abort) Base system — drivers · sys/dev/raid/mrsas/mrsas.c:2953 · pass 2 · new	none	inconclusive
DF-3856	Low	3.0	Unchecked BIOS shift counts >= 32 (C99 6.5.7p3 UB) used to build PLL/GPIO write masks at four parser sites Base system — drivers · sys/dev/drm/radeon/radeon_combios.c:654 · pass 2 · new	none	inconclusive
DF-3994	Low	3.0	Per-device runtime mutation of shared static radeon_asic dispatch tables (r420 'macs' hack, agp_disable gart swap, IGP clock-op NULL-out) — cross-device dispatch corruption in multi-GPU systems Base system — drivers · sys/dev/drm/radeon/radeon_asic.c:167 · pass 2 · new	none	inconclusive
DF-4137	Low	3.0	remove_plex_entry compacts vol->plex[] with a byte count instead of element count and decrements vol->plexes even when the plex was not found Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:1849 · pass 2 · new	none	untested
DF-4138	Low	3.0	ppc_pc873xx_detect() static probe index never reset: OOB reads past pc873xx_basetab[] used as x86 I/O port numbers (wild inb/outb) Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ppc/ppc.c:435 · pass 2 · new	none	untested
DF-4243	Low	3.0	dptexecuteccb send-failure path frees CCB without callout_stop — armed timeout later runs dpttimeout on stale/recycled state (premature abort of unrelated command / UAF read) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/dpt/dpt_scsi.c:778 · pass 2 · new	none demonstrated on guest (no DPT hardware); source-level impact: stale armed callout after send failure → premature abort of unrelated command / UAF-read on recycled ccb	untested
DF-4294	Low	3.0	Kernel heap OOB read via non-NUL-terminated NGM_TEXT_CONFIG data fed to strcmp/strtol Kernel memory corruption (UAF / OOB write) · sys/dev/misc/musycc/musycc.c:1013 · pass 2 · new	Kernel heap over-read (match/no-match oracle; page-fault panic at arena boundary). Root-only ngctl + LMC1504 hardware.	untested
DF-4343	Low	3.0	mn_attach error-path asymmetry: discarded BAR resource handles (unreleasable), leaking ENXIO returns, failures reported as attach success, dangling sc->node after node destruction, and no device_detach Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mn/if_mn.c:1302 · pass 2 · new	none	inconclusive
DF-4407	Low	3.0	/dev/tpm open/read/write are not serialized across CPUs: TOCTOU on TPM_OPEN plus interleaved TIS transactions Base system — drivers · sys/dev/crypto/tpm/tpm.c:1155 · pass 2 · new	dos	untested
DF-4443	Low	3.0	vtpci_intr_alloc does not clamp the caller's interrupt count to the fixed vtpci_intr_res[1 + VIRTIO_MAX_VIRTQUEUES] array — latent out-of-bounds softc state write for any child driver requesting more than 9 vectors Base system — drivers · sys/dev/virtual/virtio/pci/virtio_pci.c:460 · pass 2 · new	Latent OOB write of softc state (rid ints + kernel pointers) past vtpci_intr_res[1+VIRTIO_MAX_VIRTQUEUES] for any child kmod requesting >9 vectors against a host advertising >=10 MSI-X vectors	untested
DF-4519	Low	3.0	ar5212_xmit: TX-queue index q validated only by inert HALASSERT in 5 exported xmit ops; signed q<0 bypasses the >=-only checks in Set/GetTxQueueProps down to &ah_txq[q] Base system — drivers · sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:91 · pass 2 · new	none demonstrated (no unprivileged trigger; latent OOB kernel read/write below ah_txq[0] via negative q, and UB 1<<q / unchecked MMIO addressing, if a future/buggy caller passes an unvalidated queue index)	untested fixed
DF-4534	Low	3.0	lptclose() frees the I/O buffers while the lptout callout and the registered interrupt handler can still execute (use-after-free read window) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/lpt/lpt.c:596 · pass 2 · new	none	not_reproduced
DF-4541	Low	3.0	hptmv AS_INITIALIZE_START queues the rebuild DPC with flag VERIFY - initialization never starts; ioctl spins 80s and returns success Base system — drivers · sys/dev/raid/hptmv/ioctl.c:572 · pass 2 · new	none	untested
DF-4595	Low	3.0	read_drive_label() ignores the read_drive() error and classifies stale/uninitialized heap as a vinum label (wrong-drive acceptance) Base system — drivers · sys/dev/raid/vinum/vinumio.c:332 · pass 2 · new	none	untested
DF-4616	Low	3.0	ips_morpheus_poll deadline mixes units: seconds + watchdog ticks (10 s each) — crash-dump poll window 10× too short, dump proceeds on unacknowledged writes Base system — drivers · sys/dev/raid/ips/ips.c:601 · pass 2 · new	none	not_reproduced
DF-4640	Low	3.0	ips: attach-time info-command timeout unwind frees the DMA buffer and recycles the static command slot while the adapter still owns the command - device UAF write / zeroed-callback call on late completion Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips_commands.c:313 · pass 2 · new	none	not_reproduced
DF-4678	Low	3.0	DragonFly devm_request_mem_region shim is conflict-blind: i915_adjust_stolen's stolen-region safety check is dead code (+ static-rman double-init/leak/off-by-one) Base system — drivers · sys/dev/drm/i915/i915_gem_stolen.c:83 · pass 2 · new	none	untested
DF-4703	Low	3.0	All fixed-struct VBIOS table reads discard the table size and dereference full structs after checking only frev/crev — OOB read past truncated ATOM data tables Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:61 · pass 2 · new	Kernel reads past the declared table (potentially past the mapped ROM image): garbage power tables / fault-on-read near the ROM end	untested
DF-4712	Low	3.0	ar5211_xmit: signed q<0 bypasses the >=-only checks in ar5211Set/GetTxQueueProps down to &ah_txq[q], and five exported xmit ops gate q only via inert HALASSERT (ar5211 analogue of DF-4519) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:84 · pass 2 · new	none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[10] via negative q through ar5211SetTxQueueProps/ar5211GetTxQueueProps and unchecked AR_Q* MMIO in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index)	untested fixed
DF-4717	Low	3.0	XPT_RESET_DEV sends its FIB under a stale Header.Command (assigned only in the XPT_SCSI_IO case; aac_release_command() never clears it) Base system — drivers · sys/dev/raid/aac/aac_cam.c:452 · pass 2 · new	none	untested
DF-4733	Low	3.0	ar5210_xmit: signed q<0 bypasses the >=-only checks in ar5210Set/GetTxQueueProps down to ah_txq[3], and five exported xmit ops gate q only via inert HALASSERT (ar5210 twin of DF-4519/DF-4712) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:40 · pass 2 · new	none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[3] via negative q through ar5210Set/GetTxQueueProps, plus unvalidated ah_txq[q] struct reads in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index)	untested fixed
DF-4798	Low	3.0	ad_get_geometry: signed-int overflow in cylindersheadssectors (with u16→u8 truncation of IDENTIFY heads/sectors) corrupts total_secs into an ~16-EiB media-size lie Base system — drivers · sys/dev/disk/nata/ata-disk.c:471 · pass 2 · new	corruption	untested
DF-4807	Low	3.0	ppiwrite() ignores the uiomove() return value: stale ppi_buffer bytes are handed to byte_peripheral_write() and a fully-faulting write never terminates (DF-4535 lpt twin, IEEE1284-peripheral side) Base system — drivers · sys/dev/misc/ppi/ppi.c:459 · pass 2 · new	none	not_reproduced
DF-4824	Low	3.0	acpi_dock: _EJ0 executed even when device_detach() of an _EJD-dependent child fails — hardware ejected out from under still-attached drivers Base system — drivers · sys/dev/acpica/acpi_dock/acpi_dock.c:300 · pass 2 · new	none	untested
DF-4855	Low	3.0	agp_amd64_attach error exits leak the GATT and aperture resource and leave a live /dev/agpgart on an unattached device Base system — drivers · sys/dev/agp/agp_amd64.c:183 · pass 2 · new	none	not_reproduced
DF-4972	Low	3.0	Magic-map desync across master swap leaves dangling drm_file* in the old master's idr → use-after-free bit-write via DRM_IOCTL_AUTH_MAGIC Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_auth.c:65 · pass 2 · new	corruption	untested
DF-5068	Low	3.0	psm_init_power_state_table() ignores get_pp_table_entry() failures: partially-initialized or all-zero power states enter the state table, become boot/current/request states, and are programmed to the SMC Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:76 · pass 2 · new	none	untested
DF-5153	Low	3.0	dpt_pci_attach() bus_setup_intr failure leaves XPT-registered SIMs, CAM wildcard paths, shutdown_post_sync handler and softc (on global dpt_softcs) live against released io/irq — phantom CAM bus issues bus_space I/O through a released rman record and never completes a command Base system — drivers · sys/dev/raid/dpt/dpt_pci.c:159 · pass 2 · new	none	untested
DF-5167	Low	3.0	bt_pci_attach() error unwind after bus_setup_intr() failure leaves an XPT-registered SIM and wildcard CAM path live over released port/IRQ rman records, freed DMA memory and a lockuninit'd softc lock (UAF-class teardown) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt_pci.c:152 · pass 2 · new	none	untested
DF-5210	Low	3.0	iounmap() passes a raw physical address to pmap_change_attr(), which requires a kernel virtual address — RAM-backed ioremap cleanup writes PTEs via vtopte() on a user-range address (page-fault panic or silent cache-attr corruption) Base system — drivers · sys/dev/drm/linux_iomapping.c:90 · pass 2 · new	attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure	untested
DF-5461	Low	3.0	ichsmb_wait timeout path never aborts the in-flight transaction — late completions are mis-attributed to the next command, which then returns success with stale/zero data Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb.c:637 · pass 2 · new	none	untested
DF-5503	Low	3.0	ioapic.c parameter-validation gap cluster: containment-defeating overlap test, npin<=0 acceptance, negative-pin acceptance in ioapic_gsi(), and completely unvalidated pin/select in ioapic_pin_prog() (the sink of the ABI entry points DF-5351/5352 proved callable on production kernels) Base system — bus / platform / cpu · sys/platform/pc64/apic/ioapic.c:236 · pass 2 · new	nested-GSI-space misrouting + undefined IOAPIC register programming	untested
DF-5614	Low	3.0	fwdma_map_cb and both fwdma load call sites discard the bus_dmamap_load error — stale/garbage bus_addr would be programmed into OHCI DMA registers (latent protocol violation) Base system — bus / platform / cpu · sys/bus/firewire/fwdma.c:53 · pass 2 · new	none demonstrated (latent): garbage/stale fwdma bus_addr programmed into OHCI registers on any bus_dmamap_load failure -> hardware DMA against a wild physical address; unreachable on the current x86_64 busdma because loads of bus_dmamem_alloc'd memory cannot fail there	untested
DF-4776	Info	3.0	am7990_start_locked feeds unbounded mbuf chains into lance_put, memcpy'ing into the fixed LEBLEN(1522)-byte TX slot with no clamp (dead-code twin of DF-4746) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/lnc/am7990.c:523 · pass 2 · new	none	untested
DF-5030	Info	3.0	ar5312GetMacAddr dereferences unvalidated BSP board-config pointer; 6-byte wild read becomes the unprivileged-readable Wi-Fi MAC on a SoC build with corrupt flash board-data Base system — drivers · sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:289 · pass 2 · new	none	untested
DF-5193	Info	3.0	drm_legacy_sg_free clears dev->sg before validating the handle: a failed match permanently orphans the sg allocation and a re-alloc stacks a second one on top (latent: root-only ioctl, no DRIVER_SG/LEGACY driver in tree) Base system — drivers · sys/dev/drm/drm_scatter.c:131 · pass 2 · new	none	not_reproduced
DF-5194	Info	3.0	Snake movement engine confines itself purely by wall-bounce arithmetic writing through the completely unchecked sc_vtb_putc: any geometry inconsistency escapes and runs away with unbounded 2-byte OOB writes marching through the video window into adjacent DMAP'd memory (latent — no in-tree path produces the trigger) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/snake/snake_saver.c:100 · pass 2 · new	none	not_reproduced
DF-5197	Info	3.0	set_video_mode() return value ignored in warp_saver(): on failure vid aliases the stale 32KB text window and the 64000-byte bzero (plus every star write) overruns it by 32KB into 0xC0000+ (DF-5114 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/warp/warp_saver.c:87 · pass 2 · new	none	untested
DF-5202	Info	3.0	rain_saver(): set_video_mode() return value ignored — on blank-time failure vid aliases the stale 32KB text window and the 64000-byte bzero + drop-fill overrun it into 0xC0000+, while blanked/vid state commits as if the saver were active (DF-5114/DF-5197/DF-5198 family twin, last saver) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/rain/rain_saver.c:77 · pass 2 · new	latent out-of-window MMIO writes + text-mode corruption	untested
DF-3965	Low	2.9	Per-I/O dmamap unloaded only on IOP_RESULT_SUCCESS: every BAD_TARGET/BUSY/FAIL/CHECK_CONDITION completion leaks a loaded map — deterministic per absent-target bus probe; bounce-pool exhaustion on bounce-capable configs Base system — drivers · sys/dev/raid/hptiop/hptiop.c:2304 · pass 2 · new	none	not_reproduced
DF-4094	Low	2.9	emu_pci_attach bad: path never unwinds emu_init — leaks ptb_pages/silent_page DMA and mpu401/midi state on every late attach failure Base system — drivers · sys/dev/sound/pci/emu10k1.c:2114 · pass 2 · new	none	inconclusive
DF-4372	Low	2.9	Unvalidated VBIOS container offsets in r600_parse_extended_power_table: usFanTableOffset and usExtendendedHeaderOffset dereferenced with no zero/bounds check — offset 0 aliases the PowerPlayInfo header as the extended header; out-of-range offsets read past the kmalloc'd BIOS image (sibling of DF-1566: offset provenance, not counts) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r600_dpm.c:893 · pass 2 · new	none	untested
DF-4573	Low	2.9	DragonFly i915 PCI-ID matcher drops subvendor/subdevice criteria: Quanta entry hijacks all 0x016a IvyBridge devices into the headless num_pipes=0 info Base system — drivers · sys/dev/drm/i915/i915_pci.c:810 · pass 2 · new	Display loss (headless num_pipes=0 binding) on all non-Quanta 0x016a IvyBridge GT2-server iGPUs; no memory corruption	untested
DF-4890	Low	2.9	AcpiOsAcquireLock implements one ACPICA lock as two disjoint primitives (idle thread → spinlock, everyone else → lockmgr+crit): no mutual exclusion between the two holder classes across CPUs Base system — drivers · sys/dev/acpica/Osd/OsdSynch.c:383 · pass 2 · new	none	not_reproduced
DF-5002	Low	2.9	miibus leaks every kmalloc'd newbus ivars (mii_attach_args per PHY child, mii_probe_args per bus) — nothing in the kernel ever frees them Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mii_layer/mii.c:157 · pass 2 · new	none	untested
DF-5241	Low	2.9	PROBE_INQUIRY_BASIC_DV1/DV2: bcmp() reads SHORT_INQUIRY_LENGTH (36) bytes from a kmalloc(additional_length+5) buffer as small as 6 bytes (device-controlled heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/cam_xpt.c:5867 · pass 2 · new	heap OOB comparison oracle / race-gated UAF / accounting drift	untested
DF-3664	Info	2.9	bge_nvram_getbyte leaks the NVRAM software-arbitration lock and leaves NVRAM access enabled on its two timeout paths (BCM5906) Base system — drivers · sys/dev/netif/bge/if_bge.c:557 · pass 2 · new	none	inconclusive
DF-5095	Info	2.9	MFI_DEBUG timeout helpers print kernel heap pointer (cm) and the pmap_kextract() physical address of command data buffers to the world-readable kernel message buffer Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi_debug.c:197 · pass 2 · new	KVA + physical address disclosure to dmesg in debug builds	untested
DF-4081	Low	2.8	oce_tso_setup reads ether/IP/TCP headers (incl. th->th_off at offset up to ~74) before its m_pullup — out-of-contract mbuf reads on split-header TSO frames (DF-1373 class, different function) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_if.c:1046 · pass 2 · new	none	untested
DF-4795	Low	2.8	ig_hal VF: uninitialized kernel-stack tail (up to 50 of 60 payload bytes) of the E1000_VF_SET_MULTICAST mailbox message transmitted verbatim to the PF (hypervisor) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ig_hal/e1000_vf.c:403 · pass 2 · new	none demonstrated at runtime (no SR-IOV VF hardware on guest); source-proven disclosure class: up to 50 of 60 payload bytes of the E1000_VF_SET_MULTICAST mailbox message are uninitialized guest kernel stack, copied verbatim by e1000_write_mbx_vf (e1000_mbx.c:476-477) into E1000_VMBMEM registers read by the host PF driver — guest-kernel-stack residue crosses the guest->host boundary on every multicast update with <30 groups (the common case)	untested
DF-4974	Low	2.8	radeon_crtc_cursor_set2 never validates cursor BO size — display engine scans up to 16 KiB from an arbitrarily small pinned BO (VRAM OOB read to screen) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_cursor.c:295 · pass 2 · new	none	not_reproduced
DF-5184	Low	2.8	wake_up_bit() ignores the bit number and wakes exactly ONE waiter on the word: wrong-waiter wakeups and N-1 stranded waiters for N concurrent waiters on one word (no per-(addr,bit) wait identity, fanout of one) Base system — drivers · sys/dev/drm/linux_wait.c:97 · pass 2 · new	stolen wakeups / stranded waiters (bounded by timeouts + accidental 1Hz repoll)	untested
DF-5537	Low	2.8	vconswinch_intr() manipulates tty token-protected state (t_winsize write, t_pgrp read + pgsignal) without tp->t_token — INTR_MPSAFE lock-protocol violation with theoretical pgrp use-after-free (self-pinned in practice) and vconsole double-load vs vconsterm Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/platform/console.c:276 · pass 2 · new	none	not_reproduced
DF-5589	Info	2.8	pmap_inval.c discards every madvise()/vmspace_mcontrol() return value — the vkernel's sole memory-revocation primitive fails silently, leaving stale (possibly writable) host PTEs with no diagnostic Base system — bus / platform / cpu · sys/platform/vkernel64/platform/pmap_inval.c:85 · pass 2 · new	silent loss of the sole memory-revocation primitive on any future failure	untested
DF-4418	Low	2.7	e1000_phy_init_script_82541 ignores read_reg() failures and writes uninitialized kernel stack into PHY registers 0x2F5B / ANALOG_FUSE_CONTROL Base system — drivers · sys/dev/netif/ig_hal/e1000_82541.c:1108 · pass 2 · new	none	untested
DF-3775	Low	2.6	DHRS-error path bypasses the blockable filter: blocking error recovery (tsleep-based pwaits, 1-2s each) executes in hard-interrupt context Base system — drivers · sys/dev/disk/ahci/ahci.c:2843 · pass 2 · new	none	not_reproduced
DF-4315	Low	2.6	Device-fed rs_rate through rateCodeToIndex[] 0xFF sentinel indexes sc_hwmap[32] out of bounds in ath_rx_tap/dump/led paths (OOB read exported into radiotap) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_rx.c:577 · pass 2 · new	none	not_reproduced
DF-3753	Info	2.6	Unvalidated legacy-rate lookups: rt2860_rates[255] OOB read (tx) and 1<<255 UB (set_basicrates, peer-fed rateset) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ral/rt2860.c:1576 · pass 2 · new	none	not_reproduced
DF-3107	Medium	2.5	ufs_checkpath uses vp->v_mount after vput() drops intermediate ancestors to refcount 0 — read of unreferenced/reclaimable vnode on every deep rename (FreeBSD caches mp; ext2_checkpath shares the bug) Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ufs_lookup.c:1158 · pass 2 · new	none	not_reproduced
DF-4903	Medium	2.5	Uninitialised heap read in k8_powernow_setperf tail leaks a heap word into world-readable sysctl machdep.powernow.frequency.current Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/powernow/powernow.c:223 · pass 2 · new	leak	untested
DF-2628	Low	2.5	hammer2_vop_nlink increments meta.nlinks even when hammer2_dirent_create fails — permanent link-count inflation and unfreeable inodes Hammer2 · sys/vfs/hammer2/hammer2_vnops.c:1599 · pass 2 · new	none	inconclusive
DF-2736	Low	2.5	vop_compat_* '[diagnostic] EAGAIN on ncp %p %s' prints leak kernel namecache heap pointer and full pathname into the world-readable msgbuf Base system — kernel core (kern) · sys/kern/vfs_default.c:200 · pass 2 · new	none	not_reproduced
DF-2758	Low	2.5	FOFFSETLOCK acquisition sleeps uninterruptibly ('fpoff', no PCATCH): a thread wedged forever inside VOP_READ while holding the offset lock makes every other thread sharing the file descriptor permanently unkillable Base system — kernel core (kern) · sys/kern/vfs_vnops.c:569 · pass 2 · new	none	not_reproduced
DF-2821	Low	2.5	rand_thread_loop feeds generator output back into the entropy pools, so the MIN_POOL_SIZE reseed gate can be satisfied with zero external entropy Base system — kernel core (kern) · sys/kern/kern_nrandom.c:886 · pass 2 · new	none	not_reproduced
DF-2858	Low	2.5	shmfork() bcopy's transient shmmap_s reservation state: fork landing in shmat's blocked window permanently burns a SHMSEG slot in the child (and gives it an un-accounted, un-shmdt-able mapping) Base system — kernel core (kern) · sys/kern/sysv_shm.c:646 · pass 2 · new	none	not_reproduced
DF-2868	Low	2.5	ktrcanset dereferences targetp->p_ucred with no token and no crhold — freed-cred read / stale-cred TOCTOU racing cratom_proc (distinct from DF-0103's p_tracenode scope) Base system — kernel core (kern) · sys/kern/kern_ktrace.c:668 · pass 2 · new	none	inconclusive
DF-2885	Low	2.5	kern_ptrace permission checks dereference tracer (and pre-token target) ucred pointers with no crhold and no token — freed-cred read racing cratom_proc (DF-2868 analog in sys_process.c) Kernel memory corruption (UAF / OOB write) · sys/kern/sys_process.c:153 · pass 2 · new	panic	not_reproduced
DF-2958	Low	2.5	vkernel64: sys_umtx_sleep() calls blocking uservtophys() inside a critical section — LWKT lock-protocol violation Base system — kernel core (kern) · sys/kern/kern_umtx.c:199 · pass 2 · new	denial_of_service	not_reproduced
DF-2991	Low	2.5	handle_workitem_freeblocks: indir_trunc errors silently swallowed — '== 0' dead store makes allerror unreachable, I/O errors during indirect-block deallocation unreported Base system — filesystems · sys/vfs/ufs/ffs_softdep.c:2168 · pass 2 · new	corruption	not_reproduced
DF-3032	Low	2.5	ext2_rename strands IN_RENAME on the source directory inode when the step-3 relookup race resolves the from-name to a different inode — directory permanently unrenameable (EINVAL) until reclaim Base system — filesystems · sys/vfs/ext2fs/ext2_vnops.c:1025 · pass 2 · new	none	untested
DF-3058	Low	2.5	dirfs_fsync returns 0 unconditionally — host fsync() failures are swallowed (and the double-fsync retry stores -1, not errno) Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:588 · pass 2 · new	none	not_reproduced
DF-3105	Low	2.5	64-bit file-offset truncation family beyond DF-0833: udf_read's int offset, and udf_strategy/udf_bmap passing off_t bio_offset/loffset into udf_bmap_internal's uint32_t parameter Base system — filesystems · sys/vfs/udf/udf_vnops.c:399 · pass 2 · new	none	not_reproduced
DF-3110	Low	2.5	hammer_cursor_moved_element() again2 parent-cursor leaf fixup indexes the PARENT's element array with the CHILD's index (oindex instead of pindex) — cursor->leaf left stale inside a node the cursor no longer references during rebalance Base system — filesystems · sys/vfs/hammer/hammer_cursor.c:1054 · pass 2 · new	corruption	not_reproduced
DF-3129	Low	2.5	msdosfs_sync() never initializes scaninfo.waitfor — uninitialized kernel-stack read gates metadata flushing: sync(2)/umount can silently skip fsync of dirty denodes depending on stack garbage's MNT_LAZY bit (DF-specific regression; NetBSD sets ctx.waitfor, FreeBSD passes waitfor directly) Base system — filesystems · sys/vfs/msdosfs/msdosfs_vfsops.c:787 · pass 2 · new	corruption	not_reproduced
DF-3160	Low	2.5	Lost-wakeup window in fifo_open() FIFO rendezvous (uninterlocked check-then-sleep, no re-check loop) Base system — filesystems · sys/vfs/fifofs/fifo_vnops.c:295 · pass 2 · new	none	not_reproduced
DF-3186	Low	2.5	hammer_upgrade_undo_4 never terminates on UNDO_ALIGN-incongruent alloc_offset in a crafted volume header — unkillable kernel thread under finalize_lock+sync_lock, mount hang and buffer-cache deadlock Base system — filesystems · sys/vfs/hammer/hammer_undo.c:381 · pass 2 · new	denial_of_service	not_reproduced
DF-3206	Low	2.5	cd9660_lookup evaluates shared dp->i_ino after vn_unlock in the DOTDOT path: concurrent lookup race can bind '..' to an arbitrary concurrently-scanned inode (wrong parent vnode) or spuriously fail Privilege escalation (general use) · sys/vfs/isofs/cd9660/cd9660_lookup.c:343 · pass 2 · new	denial_of_service	not_reproduced
DF-3219	Low	2.5	dirfs_root lazy-init of dmp->dm_root is completely unlocked — concurrent VFS_ROOT creates two root nodes, leaks a dnp + host fd forever, and can produce a mount root vnode without VROOT Privilege escalation (general use) · sys/vfs/dirfs/dirfs_vfsops.c:234 · pass 2 · new	denial_of_service	not_reproduced
DF-3334	Low	2.5	netmap_mem_get_info() failure paths unbalance the adapter refcount: premature free/UAF (NIOCREGIF) and pinned adapters (NIOCGINFO) Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap.c:1331 · pass 2 · new	none	untested
DF-3372	Low	2.5	sockaddr address fields read before sa_len validation in tcp_usr_bind/connect/preconnect and tcp6_usr_bind/connect (DF-3357 family): heap read of recycled/uninitialized bytes past the user-copied length (v6: up to 16 bytes past the allocation) Kernel memory leaks / uninitialized disclosure · sys/netinet/tcp_usrreq.c:316 · pass 2 · new	none	not_reproduced
DF-3484	Low	2.5	Global netgraph queue (ngqbase/ngqlast/ngqfree) manipulated under crit_enter only: cross-CPU producer races silently orphan queue entries, permanently leaking their mbufs/messages and pinning node/hook references Kernel memory corruption (UAF / OOB write) · sys/netgraph/netgraph/ng_base.c:1871 · pass 2 · new	none	not_reproduced
DF-3572	Low	2.5	u32 wrap in SKL DDB data-rate sum over-subscribes the per-pipe DDB (un-carried Linux v5.2 u64 rework) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_pm.c:4216 · pass 2 · new	none	not_reproduced
DF-3675	Low	2.5	Unsigned resid underflow: ccb->csio.resid = dxfer_len - IOC-supplied TransferCount with no clamp Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:3132 · pass 2 · new	none	inconclusive
DF-3723	Low	2.5	ixgbe_checksum_ptr_x550/ixgbe_calc_checksum_X550 caller-buffer path: bounds checks ignore the ptr base offset (plus two off-by-ones) — OOB read past the caller's u16 buffer[] Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ix/ixgbe_x550.c:3358 · pass 2 · new	none	inconclusive
DF-3791	Low	2.5	drm_atomic_helper: missing backport of upstream 022debad063e (drm_atomic_state->duplicated) — drm_atomic_helper_resume() fails after connector unregistered during suspend, leaving all outputs off Kernel memory leaks / uninitialized disclosure · sys/dev/drm/drm_atomic_helper.c:325 · pass 2 · new	none	inconclusive
DF-3803	Low	2.5	mprsas_prepare_for_tm leaks one union ccb + cam_path per TM reuse/escalation during error recovery Base system — drivers · sys/dev/raid/mpr/mpr_sas.c:3801 · pass 2 · new	none	not_reproduced
DF-3804	Low	2.5	mprsas_check_eedp error path calls xpt_free_path(NULL) instead of freeing local_path: deterministic NULL-deref panic under memory pressure during EEDP probe Base system — drivers · sys/dev/raid/mpr/mpr_sas.c:3689 · pass 2 · new	none	not_reproduced
DF-3826	Low	2.5	e1000_read_i2c_byte_generic double-releases the SW_FW_SYNC PHY0 semaphore on retry exhaustion Base system — drivers · sys/dev/netif/ig_hal/e1000_82575.c:3333 · pass 2 · new	none	not_reproduced
DF-3827	Low	2.5	Unchecked PHY register read in e1000_set_d0_lplu_state_82575 writes stale data into IGP01E1000_PHY_PORT_CONFIG Base system — drivers · sys/dev/netif/ig_hal/e1000_82575.c:833 · pass 2 · new	none	not_reproduced
DF-3829	Low	2.5	NVMM VMX: host NMIs are silently swallowed while a vCPU is resident on the CPU Privilege escalation (general use) · sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c:1252 · pass 2 · new	none	inconclusive
DF-3836	Low	2.5	static channel-pointer in bwn_phy_lp_b2063_switch_channel defeats the not-found NULL check after the first call — unsupported channels silently re-program the previous channel's RF values and return success Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:794 · pass 2 · new	none	inconclusive
DF-3840	Low	2.5	1-byte use-after-free read in iwi_frame_intr(): frame->rate read at :1353 from the old rx mbuf after ieee80211_input() consumed/freed it (softled enabled by default) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/iwi/if_iwi.c:1353 · pass 2 · new	none	inconclusive
DF-3851	Low	2.5	dc_setfilt_21143/dc_setfilt_xircom enqueue the setup frame with no TX-ring-space check: descriptor clobber of an in-flight frame, leaked mbuf, and tx_cnt overrun when invoked on a saturated ring Kernel memory corruption (UAF / OOB write) · sys/dev/netif/dc/if_dc.c:1055 · pass 2 · new	TX-power correctness (bwn) / mbuf leak + ring wedge (dc)	untested
DF-3896	Low	2.5	Unsigned resid underflow on the DATA_UNDERRUN path: csio->resid = cm_length − IOC-supplied TransferCount with no clamp (DF-3675 twin) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mps/mps_sas.c:1943 · pass 2 · new	none	not_reproduced
DF-3901	Low	2.5	Uninitialized stack consumed as SKL DRAM channel info when one MAD_DIMM channel register is blank: ch0/ch1 rank/is_16gb_dimm/symmetric_memory steer watermark config Base system — drivers · sys/dev/drm/i915/i915_drv.c:1219 · pass 2 · new	none	inconclusive
DF-3916	Low	2.5	_mapping_get_dpm_idx_from_id reads PhysicalIdentifier once from entry 0 and compares every DPM entry against it - DPM lookups only ever match entry 0 Base system — drivers · sys/dev/raid/mpr/mpr_mapping.c:547 · pass 2 · new	logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919)	untested
DF-3917	Low	2.5	_mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry) and its overlap test is off by one, clearing a map slot beyond the enclosure Base system — drivers · sys/dev/raid/mpr/mpr_mapping.c:1076 · pass 2 · new	logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919)	untested
DF-3919	Low	2.5	Event element-count walks (SAS topo PHY, PCIe topo Port, IR config Element) never validated against the event frame length Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_mapping.c:2917 · pass 2 · new	logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919)	untested
DF-3936	Low	2.5	ena_com_set_hash_function() inverts the device-support check — RSS hash function is never programmed on compliant devices Base system — drivers · sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2238 · pass 2 · new	none	inconclusive
DF-4010	Low	2.5	mpr_user_pass_thru leaks the user-sized cm->cm_data buffer and its dmamap mapping across the timeout/reinit path Base system — drivers · sys/dev/raid/mpr/mpr_user.c:1050 · pass 2 · new	none	untested
DF-4039	Low	2.5	polaris10_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:396 · pass 2 · new	none	inconclusive fixed
DF-4041	Low	2.5	polaris10 MVDD stash walks: SmioTable2.Pattern reads entries[count] instead of entries[level]; populate_mvdd_value walks the raw MCLK-dependency count past mvdd_voltage_table.entries[32] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:657 · pass 2 · new	none	inconclusive fixed
DF-4065	Low	2.5	Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms — upstream direction is 'never do this on LLC' (GPU hangs/wedges); DFly carries the pre-fix v4.19 state Base system — drivers · sys/dev/drm/i915/intel_ringbuffer.c:1096 · pass 2 · new	Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms (SNB+) - upstream direction 'never do this on LLC' (GPU hangs/wedges, display wedge/GPU DoS).	untested
DF-4072	Low	2.5	vegam_get_dependency_volt_by_clk reads dep_table->entries[count] one record past the heap allocation in the clock-above-max path Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:614 · pass 2 · new	none	inconclusive
DF-4087	Low	2.5	_mapping_get_dpm_idx_from_id reads PhysicalIdentifier once from entry 0 and compares every DPM entry against it (mps twin of DF-3916) Base system — drivers · sys/dev/raid/mps/mps_mapping.c:512 · pass 2 · new	mapping-table/persistence corruption (logic class); no direct OOB	untested
DF-4088	Low	2.5	_mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry), off-by-one overlap test, stale num_found (mps twin of DF-3917) Base system — drivers · sys/dev/raid/mps/mps_mapping.c:802 · pass 2 · new	mapping-table/persistence corruption (logic class); no direct OOB	untested
DF-4089	Low	2.5	Event element-count walks (SAS topo NumEntries, IR NumElements) never validated against the event frame length (mps twin of DF-3919) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_mapping.c:2043 · pass 2 · new	OOB read (up to ~2KB) of kmalloc'd event frame; garbage feeds mapping engine (kernleak-class, no direct copyout traced)	untested
DF-4090	Low	2.5	dpm_pg0_sz truncated to u16 in mps_mapping_initialize: DPM page silently under-read (benign direction proven) Base system — drivers · sys/dev/raid/mps/mps_mapping.c:1721 · pass 2 · new	none (functional: DPM entries silently under-read; overflow direction provably impossible)	untested
DF-4091	Low	2.5	dce110_timing_generator_validate_timing: h_blank/h_back_porch u32 underflow bypasses the minimum checks; no vertical checks -> program_blanking programs wrapped (masked) blanking registers Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:1109 · pass 2 · new	none at kernel-memory level (masked MMIO only); worst case inconsistent CRTC timing -> display corruption/possible pipe hang on real ASIC	untested
DF-4142	Low	2.5	wi_rx_intr ignores wi_read_bap() failure: uninitialized kernel heap delivered to the 802.11 stack and BPF (device-fed info disclosure) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/wi/if_wi.c:1356 · pass 2 · new	none	inconclusive
DF-4166	Low	2.5	get_gpio_i2c_info off-by-one (count < table_index) reads gpio_pin[count] one entry past the GPIO pin LUT Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:369 · pass 2 · new	none	untested
DF-4182	Low	2.5	Page flip programmed on a CRTC disabled while the flip was pending wedges that CRTC's flip path forever (flip_status never leaves RADEON_FLIP_SUBMITTED) and leaks the vblank reference Base system — drivers · sys/dev/drm/radeon/radeon_display.c:449 · pass 2 · new	none	inconclusive
DF-4197	Low	2.5	DragonFly's Linux-compat seqlock shim returns the seqcount to its pre-write value — drm_vblank_count_and_time() accepts torn {count,time} vblank snapshots (protocol violation) Base system — drivers · sys/dev/drm/drm_vblank.c:784 · pass 2 · new	none	inconclusive
DF-4213	Low	2.5	16-byte memcpy out of the 4-byte MSG_RAID_ACTION_REPLY.ActionData publishes stale reply-frame bytes as RAID resync progress Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_raid.c:578 · pass 2 · new	none	untested
DF-4265	Low	2.5	amdgpu_cs_wait_all_fences reads fence->error after the final dma_fence_put (use-after-free read, value returned as ioctl errno) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1501 · pass 2 · new	none	untested
DF-4305	Low	2.5	bfe_intr error reinit performs M_WAITOK cluster allocations in interrupt context: BFE_ISTAT_ERRORS -> bfe_init -> bfe_newbuf(init=1) sleeps in the ithread holding the serializer Base system — drivers · sys/dev/netif/bfe/if_bfe.c:1186 · pass 2 · new	none	not_reproduced
DF-4306	Low	2.5	e1000_release_swfw_sync_80003es2lan acquires the SWSM hardware semaphore in an unbounded empty-body loop on every PHY/KMRN/NVM release path: a stuck SMBI bit pins a CPU forever under the driver serializer Base system — drivers · sys/dev/netif/ig_hal/e1000_80003es2lan.c:455 · pass 2 · new	none	not_reproduced
DF-4318	Low	2.5	dce80/dce81/dce83_create_resource_pool leak struct dce110_resource_pool on construct() failure (missing kfree at 3 sites) Base system — drivers · sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1052 · pass 2 · new	none	untested
DF-4360	Low	2.5	cik_sdma_soft_reset(): stale status variable — SDMA1-busy test reads mmSDMA0_F32_CNTL instead of mmSRBM_STATUS2, so a hung SDMA1 is never soft-reset Base system — drivers · sys/dev/drm/amd/amdgpu/cik_sdma.c:1089 · pass 2 · new	none	untested
DF-4377	Low	2.5	probeCard() consumes uninitialized stack eeprom[256] when readEEProm() fails — uninitialized stack bytes reach console/dmesg and drive card identification (CWE-457) Base system — drivers · sys/dev/video/bktr/bktr_card.c:605 · pass 2 · new	none	not_reproduced
DF-4386	Low	2.5	hw.oceN.firmware_version served via unbounded strlen over a possibly non-NUL-terminated device string — adjacent softc bytes (incl. kernel pointers) leak to unprivileged readers Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_sysctl.c:84 · pass 2 · new	none	untested
DF-4387	Low	2.5	Device-controlled sc->port_id indexes rxf.port[2]/port[4] unchecked in copy_stats_to_sc_be2/_be3 — OOB read past the stats DMA buffer into world-readable sysctls Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_sysctl.c:1151 · pass 2 · new	none	untested
DF-4389	Low	2.5	hwmgr->num_vce_state_tables stored unclamped (up to 255) over vce_states[6] — fill loop silently skipped, count left as a loaded gun for any consumer Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1328 · pass 2 · new	none	untested
DF-4437	Low	2.5	drm_mode_page_flip_ioctl: -EDEADLK retry bypasses the only drm_crtc_vblank_put - one vblank reference leaked per page flip that succeeds after a deadlock retry Base system — drivers · sys/dev/drm/drm_plane.c:1053 · pass 2 · new	none	untested
DF-4455	Low	2.5	Unbounded MMIO spin in PLL atomic-update wait can wedge the DRM master permanently Base system — drivers · sys/dev/drm/radeon/radeon_legacy_crtc.c:219 · pass 2 · new	Permanent DRM-stack DoS: modeset ioctl never returns, holding mode_config.mutex and modeset locks forever	untested
DF-4477	Low	2.5	ata_reinit drops a running request already flagged ATA_R_TIMEOUT after callout_cancel: request/buffer leak and permanently hung issuer Base system — drivers · sys/dev/disk/nata/ata-all.c:205 · pass 2 · new	none	not_reproduced
DF-4490	Low	2.5	acpi_ec: ec_sci_pend publication race between EcGpeHandler and EcGpeQueryHandler permanently disables the EC GPE (lost AcpiFinishGpe) Base system — drivers · sys/dev/acpica/acpi_ec.c:693 · pass 2 · new	Permanent loss of EC-mediated event delivery (lid suspend, brightness/hotkeys, battery/AC/thermal notifies) plus transient EC I/O degradation to polled mode; availability only	untested
DF-4518	Low	2.5	vke_stop() teardown can hang the vkernel forever: the tx cothread's done-fifo full-wait never checks the exit flag, and once the exit flag is set vke_tx_intr() refuses to drain the done fifo, so cothread_delete()'s pthread_join blocks while holding if_serializer Base system — drivers · sys/dev/virtual/vkernel/net/if_vke.c:170 · pass 2 · new	Unprivileged guest user permanently wedges the entire vkernel (ifconfig never returns; serializer held forever); vkernel-internal only, no host-kernel impact	untested
DF-4522	Low	2.5	amdgpu_vm_fini's DragonFly cleanup loop iterates on vm->va.rb_leftmost, which the DFly rb_root_cached shim never maintains: zero iterations, all leftover VM mappings leak Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3325 · pass 2 · new	none	inconclusive
DF-4523	Low	2.5	cik_sdma_ib_test leaks the IB (SA-bo) and its fence on fence-wait error/timeout — reachable after every GPU reset while a DMA engine stays wedged Base system — drivers · sys/dev/drm/radeon/cik_sdma.c:738 · pass 2 · new	One IB SA-bo + fence leaked from the fixed-size shared pool per unrecovered reset cycle - progressive pool exhaustion = persistent GPU-accel DoS	untested
DF-4524	Low	2.5	vce_v3_0: VCE bo is sized exactly AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short — instance-1 DATA window extends past the end of vcpu_bo Base system — drivers · sys/dev/drm/amd/amdgpu/vce_v3_0.c:427 · pass 2 · new	Firmware writes to the last 256 bytes of the instance-1 DATA window land past vcpu_bo into the adjacent VRAM object (speculative - fw-defined; arithmetic overrun certain)	untested
DF-4530	Low	2.5	vchan_trigger commits trigger state and parent busy-list membership before chn_notify() and never rolls back on failure, enabling a masked-retry fake-running channel (per-fd wedge) Base system — drivers · sys/dev/sound/pcm/vchan.c:144 · pass 2 · new	Per-fd dsp wedge: fake-running channel blocks writes/poll until close; no memory-safety impact (busy-list membership stays paired)	untested
DF-4572	Low	2.5	exca_activate_resource leaks the ExCA window when parent BUS_ACTIVATE_RESOURCE fails (and exca_mem_map on its memreg error return) — permanent per-socket window-exhaustion DoS Base system — drivers · sys/dev/pccard/exca/exca.c:250 · pass 2 · new	none	inconclusive
DF-4577	Low	2.5	intel_hdcp_validate_v_prime KSV fill shift missing -sha_leftovers offset: repeater SHA-1 input stream corrupted for >=2 downstream devices, HDCP1.4 repeater authentication always fails (fail-closed) Base system — drivers · sys/dev/drm/i915/intel_hdcp.c:221 · pass 2 · new	none	untested
DF-4581	Low	2.5	radeon_cs_parser_relocs: unchecked radeon_vm_get_bos() NULL return silently drops the VM page directory and page tables from the CS reservation/validation set — submission then updates the PD/PTs without holding their reservations (stale-address GPU writes, unsynchronized eviction); latent on DF as compiled, live upstream and after any DF-4580-style allocator fix Base system — drivers · sys/dev/drm/radeon/radeon_cs.c:190 · pass 2 · new	none	not_reproduced
DF-4632	Low	2.5	radeon MST connector leaks one EDID blob per probe and per destroy (radeon_connector->edid overwritten without kfree) Base system — drivers · sys/dev/drm/radeon/radeon_dp_mst.c:193 · pass 2 · new	none	untested
DF-4695	Low	2.5	sili_pm_softreset: error = EBUSY on unexpected device-signature change is dead-stored by the unconditional error = 0 — signature-change detection never propagates, probe proceeds with stale at_type Base system — drivers · sys/dev/disk/sili/sili_pm.c:489 · pass 2 · new	none	inconclusive
DF-4700	Low	2.5	snd_hdspe PCM: hdspechan_setspeed() read-modify-writes the shared ctrl_register and writes CONTROL/FREQ registers without sc->lock — cross-channel lost-update race (interrupt storm / stuck-enable / rate scramble) Base system — drivers · sys/dev/sound/pci/hdspe-pcm.c:486 · pass 2 · new	none	untested
DF-4745	Low	2.5	am79900_start_locked lacks the upstream 'break' after detecting a LANCE-owned TMD: the driver dequeues an mbuf and overwrites the chip-owned descriptor and TX buffer on a ring desync Base system — drivers · sys/dev/netif/lnc/am79900.c:540 · pass 2 · new	none	not_reproduced
DF-4775	Low	2.5	am7990_start_locked lacks the 'break' after detecting a LANCE-owned TMD (dead-code twin of DF-4745): on a ring desync the driver dequeues an mbuf and overwrites the chip-owned descriptor and TX buffer Base system — drivers · sys/dev/netif/lnc/am7990.c:503 · pass 2 · new	dos	untested
DF-4778	Low	2.5	aux_engine: read-continuation chunks copied to buffer BASE instead of buffer+offset — corruption of partial-ACK DPCD/EDID read data (twin in dce_aux.c) Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/aux_engine.c:204 · pass 2 · new	none	untested
DF-4870	Low	2.5	r600_dma_ib_test leaks the IB (suballocator chunk + fence ref) on both fence-wait error paths Base system — drivers · sys/dev/drm/radeon/r600_dma.c:371 · pass 2 · new	none	untested
DF-4871	Low	2.5	r600_copy_dma discards radeon_sync_resv()/radeon_sync_rings() failures — copy committed without cross-ring ordering, silent bo data corruption Base system — drivers · sys/dev/drm/radeon/r600_dma.c:466 · pass 2 · new	none	untested
DF-4879	Low	2.5	drm_mode_config_init() ignores drm_mode_create_standard_properties() failure: NULL standard properties are attached to every universal plane and atomic CRTC, turning any later unprivileged MODE_OBJ_GETPROPERTIES/GETCONNECTOR ioctl into a kernel NULL-deref panic (upstream-inherited, ENOMEM-gated) Base system — drivers · sys/dev/drm/drm_mode_config.c:217 · pass 2 · new	none	untested
DF-4904	Low	2.5	Unsigned underflow in Phase-1 voltage ramp writes malformed MSR 0xc0010041 (reserved bits 13-31 garbage, wrong VID) Base system — drivers · sys/dev/powermng/powernow/powernow.c:231 · pass 2 · new	dos	untested
DF-4906	Low	2.5	READ_PENDING_WAIT spins forever on a stuck FID/VID change-pending bit (unkillable kernel-context CPU spin) Base system — drivers · sys/dev/powermng/powernow/powernow.c:84 · pass 2 · new	dos	untested
DF-4920	Low	2.5	Recursive drm_modeset_lock (same ctx, same lock) double-tracks and corrupts ww accounting: ctx->acquired off-by-one leak, ww->ctx/ww->stamp cleared while lock still held, latent lockmgr LK_RELEASE panic Base system — drivers · sys/dev/drm/drm_modeset_lock.c:269 · pass 2 · new	none	untested
DF-4969	Low	2.5	adw_pci_attach error unwinds leak the PCI register/IRQ resources (and the softc on the setup() path): adw_free() never calls bus_release_resource Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/adw_pci.c:211 · pass 2 · new	none	untested
DF-4983	Low	2.5	cxm_iic_detach()'s CXM_IVAR_IICBUS invalidation is a permanent no-op (write_ivar guard rejects clears) — cxm_softc.iicbus dangles to a destroyed device_t after iic teardown Base system — drivers · sys/dev/video/cxm/cxm_i2c.c:229 · pass 2 · new	none	untested
DF-5035	Low	2.5	Unsynchronized check-then-set of i2c_hw_buffer_in_use lets concurrent acquires on different DDC lines both hold the single shared DCE11 DC_I2C HW engine — acquire-side twin of DF-4878's release-side race (DAL2 mutex dropped) Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:105 · pass 2 · new	none	untested
DF-5089	Low	2.5	si_copy_dma discards radeon_sync_resv()/radeon_sync_rings() returns — SI twin of DF-4871: DMA copy committed without cross-ring ordering on sync failure, silent bo data corruption Base system — drivers · sys/dev/drm/radeon/si_dma.c:255 · pass 2 · new	none	untested
DF-5111	Low	2.5	amdgpu_job_dependency busy-loops forever on amdgpu_vmid_grab allocation failure, wedging the ring scheduler kthread (unbounded spin + DRM_ERROR flood, ring-wide GPU DoS) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_job.c:193 · pass 2 · new	sched kthread wedge / ring-wide GPU DoS	untested
DF-5181	Low	2.5	smu9_send_msg_to_smc/_with_parameter return 0 on SMC failure — vacuous caller error guards and stale smu9_get_argument() data flow into Vega10/12 powerplay decisions Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:113 · pass 2 · new	none	untested
DF-5209	Low	2.5	pci_iomap() treats pci_resource_start()'s -1 failure sentinel as a valid base and drives __ioremap_common() into BUG_ON panic for any absent/unallocatable BAR Base system — drivers · sys/dev/drm/linux_iomapping.c:47 · pass 2 · new	attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure	untested
DF-5219	Low	2.5	i915_timeline kref leak: intel_engine_create_ring error path frees the ring without dropping its timeline reference Base system — drivers · sys/dev/drm/i915/i915_timeline.c:1190 · pass 2 · new	bounded refcount/heap leak (DF-5219) / latent API trap (DF-5221)	untested
DF-5256	Low	2.5	DragonFly-only unlocked traversal of ifp->if_multiaddrs in urtwn_set_multi (upstream takes if_maddr_rlock) Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_urtwn.c:4898 · pass 2 · new	deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257)	untested
DF-5267	Low	2.5	Five linear rate lookups store MTW_RIDX_MAX (36) on a miss; the stale ridx then indexes rt2860_rates[36] one element out of bounds (mtw_tx/mtw_set_tx_desc/tx_mgt/radiotap wt_rate) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_mtw.c:1720 · pass 2 · new	none	untested
DF-5307	Low	2.5	Unvalidated descriptor-field reads in the UVC entity/CS parsers: OOB reads up to 253 bytes past malformed descriptors Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/uvc/uvc_drv.c:1843 · pass 2 · new	none	untested
DF-5350	Low	2.5	Unsynchronized dmat->segments allocation and map_count bookkeeping race under concurrent map create/destroy (double allocation leak; tag UAF window) Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/busdma_machdep.c:337 · pass 2 · new	device-side out-of-window DMA (DF-5349) / segments leak + tag UAF window (DF-5350)	untested
DF-5373	Low	2.5	bus_dmamap_create() leaks the freshly kmalloc'd map when the initial bounce-page allocation partially fails (vkernel never got pc64's kfree(*mapp) error-path fix) Base system — bus / platform / cpu · sys/platform/vkernel64/platform/busdma_machdep.c:333 · pass 2 · new	device-visible corrupted S/G lists (DF-5371) / 72B-per-failure leak (DF-5373)	untested
DF-5386	Low	2.5	TX-abort condition is read and discarded — writes to a non-ACKing slave return SMB_ENOERR success (silent write failure) Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:482 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5446	Low	2.5	Unchecked 4-byte logical-ID read on short PNP_TAG_LOGICAL_DEVICE descriptor (≤3-byte overread; worst case past the allocation into uninitialized heap) Kernel memory leaks / uninitialized disclosure · sys/bus/isa/pnp.c:444 · pass 2 · new	none	untested
DF-5609	Low	2.5	cothread_create/cothread_delete ignore pthread_create()/pthread_join() failure — EAGAIN leaves a registered virtual interrupt, a NULL pthread handle, and undefined pthread_kill/pthread_join on it Base system — bus / platform / cpu · sys/platform/vkernel64/platform/cothread.c:110 · pass 2 · new	vkernel host crash / dead device channel (5609); <=1s systimer latency spikes (5610)	untested
DF-5610	Low	2.5	cothread_wakeup()'s vktimer_ts zeroing races vktimer_thread's reload store — wakeup can be silently consumed, delaying all systimers by up to the stale sleep Base system — bus / platform / cpu · sys/platform/vkernel64/platform/cothread.c:188 · pass 2 · new	vkernel host crash / dead device channel (5609); <=1s systimer latency spikes (5610)	untested
DF-5685	Low	2.5	Unchecked copyin() return in sys_vquotactl feeds an uninitialized stack plistref to _prop_object_copyin Base system — kernel core (kern) · sys/kern/vfs_quota.c:345 · pass 2 · new	see summary	untested
DF-5705	Low	2.5	_prop_stack_push growth allocation is kmalloc(M_WAITOK) executed while callers hold the global proplib dictionary lockmgr (release walk) or deep per-object mtx chains (equals walk); and push-failure handling is kernel-dead code since M_WAITOK never returns NULL on DragonFly Base system — libkern / libprop / ddb · sys/libprop/prop_stack.c:50 · pass 2 · new	none	untested
DF-5783	Low	2.5	i915: intel_legacy_cursor_update() fast path mutates the LIVE crtc state's active_planes before a fallible section — failure leaves state desynchronized from hardware (missing upstream c249c5f64336), breaking subsequent plane disable / IPS / watermark decisions Base system — drivers · sys/dev/drm/i915/intel_display.c:13686 · pass 2 · new	none	untested
DF-2671	Info	2.5	extattr syscalls copyin() the 255-byte attribute name without a NUL-termination guarantee (latent stack OOB read) Kernel memory leaks / uninitialized disclosure · sys/kern/vfs_syscalls.c:5224 · pass 2 · new	none	untested
DF-2701	Info	2.5	swap_pager_getpage() 20-second timeout diagnostic dereferences the completed-and-released pbuf (use-after-free read in console path) Kernel memory corruption (UAF / OOB write) · sys/vm/swap_pager.c:1527 · pass 2 · new	none	untested
DF-3725	Info	2.5	Dropped hardware-write statuses across X550 link/flow-control setup: failed MMIO/MDIO writes reported as success Base system — drivers · sys/dev/netif/ix/ixgbe_x550.c:1812 · pass 2 · new	none	inconclusive
DF-3762	Info	2.5	Unchecked PHY-read returns across the shared e1000 PHY layer: link-stall workaround branches on uninitialized kernel stack; power up/down write back a zeroed PHY_CONTROL after failed reads (DF-3643/DF-3671 family, e1000_phy.c instance) Base system — drivers · sys/dev/netif/ig_hal/e1000_phy.c:3848 · pass 2 · new	none	inconclusive
DF-3770	Info	2.5	DFly port deleted the upstream pre-B3 ValleyView PPGTT disable from intel_sanitize_enable_ppgtt: PPGTT enabled on silicon where upstream considers it broken (GPU fault/hang wedge on that hardware) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/i915_gem_gtt.c:136 · pass 2 · new	none	untested
DF-3927	Info	2.5	siba_pcicore_intr computes 1 << tmp with MMIO-derived tmp up to 63 (SIBA_TPS_BPFLAG=0x3f) - UB shift silently enables the wrong INTR_MASK bit on pre-rev6 PCI cores Base system — drivers · sys/dev/netif/bwn/siba/siba_core.c:2131 · pass 2 · new	none	not_reproduced
DF-3944	Info	2.5	patch_gamut_packet_checksum reads up to 227 bytes past dc_info_packet.sb[32] (length byte unbounded; dead path — no producer ever sets gamut.valid) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/core/dc_resource.c:2152 · pass 2 · new	none	not_reproduced
DF-4176	Info	2.5	iir_timeout is an empty handler: SCSI timeouts never abort, retry, or complete — timed-out CCBs hang forever; also references an undeclared identifier under GDT_DEBUG Base system — drivers · sys/dev/raid/iir/iir.c:1472 · pass 2 · new	gdtexecuteccb arms a callout to iir_timeout, but the body is only a GDT_DPRINTF - no abort, no retry, no xpt_done, no gdt_next	untested
DF-4427	Info	2.5	acpi_hp_notify / acpi_hp_evaluate_auto_on_off run without the hp serial lock, racing sysctl handlers on softc state Base system — drivers · sys/dev/acpica/acpi_hp/acpi_hp.c:809 · pass 2 · new	Lost/duplicated WLAN/BT/WWAN on-air notifications; benign int races, no memory-safety consequence	untested
DF-4601	Info	2.5	dce112_compressor_construct() init-order defects: dead 64-bit-bus LPT guard + lpt_channels_num wipe make program_lpt_control's only valid case unreachable (LPT armed with unprogrammed config) Base system — drivers · sys/dev/drm/amd/display/dc/dce112/dce112_compressor.c:793 · pass 2 · new	none	not_reproduced
DF-4642	Info	2.5	dce_virtual_pageflip dereferences crtcs[crtc_id] before the crtc_id bounds check (latent OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/dce_virtual.c:659 · pass 2 · new	none	untested
DF-4663	Info	2.5	dc_link_ddc: unchecked dal_ddc_aux/i2c_payloads_create() NULL in dal_ddc_service_query_ddc_data — OOM-gated (and zero-size-deterministic) NULL deref Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:578 · pass 2 · new	none	not_reproduced fixed
DF-4664	Info	2.5	dc_link_ddc: uninitialized type2_dongle_buf[0x20] hexdumped to the kernel log on dongle-detect i2c failure (drm.debug) Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:436 · pass 2 · new	none	not_reproduced fixed
DF-4728	Info	2.5	aureal: AC97 codec access busy-spins up to ~0.35s per register and ignores timeouts (au_wrcd writes anyway and always returns success) Base system — drivers · sys/dev/sound/pci/aureal.c:126 · pass 2 · new	none	untested
DF-4839	Info	2.5	BUG_ON panic in drm_primary_helper_update() when SetPlane targets an enabled CRTC left with zero encoder-bound connectors Base system — drivers · sys/dev/drm/drm_plane_helper.c:264 · pass 2 · new	none	not_reproduced
DF-5067	Info	2.5	power_state_management() NULL-checks pcurrent then dereferences it anyway — latent kernel NULL-deref (NULL check at :249 routes control INTO the :254 deref; :248 passes the pointer to the smu8 backend unchecked) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:246 · pass 2 · new	none	untested
DF-5113	Info	2.5	Spectral scan start/configure permanently disables radar-detect hardware with no restore path — latent DFS-detection bypass (ar5416DisableRadar clobbers AR_PHY_RADAR_0_ENA/EXT and AR_RX_FILTER; ar5416StopSpectralScan restores none of it) Base system — drivers · sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:47 · pass 2 · new	none	untested
DF-5137	Info	2.5	kv_notify_message_to_smu() fail-open SMC response validation (radeon twin of DF-5132): timeout (0x0000) and all undefined response codes except 0x00FF/0x00FE reported as success to the entire kv_dpm power-management state machine Base system — drivers · sys/dev/drm/radeon/kv_smc.c:44 · pass 2 · new	none	untested
DF-5148	Info	2.5	AUX completion poll off-by-one: a DisplayPort AUX transaction that completes on the 1001st poll is misreported as -EIO (counter-keyed timeout gate) Base system — drivers · sys/dev/drm/radeon/radeon_dp_auxch.c:152 · pass 2 · new	none	untested
DF-5163	Info	2.5	amdgpu atom-i2c consumes the shared ATOM fb scratch after amdgpu_atom_execute_table released ctx->mutex — radeon's scratch_mutex fix was never ported; concurrent hw-DDC/atom-fb users deliver cross-contaminated DDC data Base system — drivers · sys/dev/drm/amd/amdgpu/atombios_i2c.c:52 · pass 2 · new	none	not_reproduced
DF-5205	Info	2.5	trinity_notify_message_to_smu() fail-open SMC response validation: timeout (0x0) and all undefined codes outside exactly 0xFF/0xFE reported as success to the entire trinity_dpm power-management state machine — and unlike the kv twin (DF-5137), the response register is read UNMASKED Base system — drivers · sys/dev/drm/radeon/trinity_smc.c:43 · pass 2 · new	none	untested
DF-5206	Info	2.5	trinity_acquire_mutex() is void and cannot fail: on SMC mutex-grant timeout it silently returns without the mutex, and all six live callers then program SMC registers assuming exclusivity against the SMC firmware Base system — drivers · sys/dev/drm/radeon/trinity_smc.c:112 · pass 2 · new	none	untested
DF-5213	Info	2.5	amdgpu df_v3_6_funcs is an incomplete vtable: .enable_ecc_force_par_wr_rmw left NULL (latent NULL function-pointer dereference for any Vega20 caller) Base system — drivers · sys/dev/drm/amd/amdgpu/df_v3_6.c:108 · pass 2 · new	none	not_reproduced
DF-5216	Info	2.5	interval_tree misuse degrades to unkillable kernel spin or panic instead of a bounded failure — remove() on an empty root NULL-derefs/panics, remove() of a non-member spins forever holding the caller's mutex, iter_next() on a detached sole node loops or returns the removed node Base system — drivers · sys/dev/drm/linux_interval_tree.c:56 · pass 2 · new	latent interior kfree / kernel-CPU amplification / unkillable spin	untested
DF-5526	Info	2.5	npxprobemask() lacks the mxcsr_mask==0 fallback guard: a non-conforming FXSAVE probe zeroes npx_mxcsr_mask, forcing MXCSR=0 (all SIMD FP exceptions unmasked) and a SIGFPE on every FPU restore Base system — bus / platform / cpu · sys/platform/pc64/x86_64/npx.c:134 · pass 2 · new	MXCSR=0 + SIGFPE on every restore on mxcsr_mask==0 hardware	untested
DF-5557	Info	2.5	npxprobemask() lacks the mxcsr_mask==0 fallback guard — non-conforming FXSAVE probe zeroes npx_mxcsr_mask and SIGFPEs every FPU restore (DF-5526 twin) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/npx.c:112 · pass 2 · new	none	untested
DF-5591	Info	2.5	vga_probe_unit() returns success without initializing the caller's video_adapter_t — uninit kernel-stack read programmed into world-readable devinfo resource ranges (structurally unreachable today: both sources gated on one 'optional vga') Kernel memory leaks / uninitialized disclosure · sys/bus/isa/vga_isa.c:108 · pass 2 · new	none	not_reproduced
DF-5687	Info	2.5	_prop_object_copyout() leaks the vm_mmap()ed user region when copyout() fails (no vm_map_remove on the error path) Base system — libkern / libprop / ddb · sys/libprop/prop_kern.c:526 · pass 2 · new	see summary	untested
DF-3627	Low	2.4	Uninitialized stack array consumed as eDP link rates when DP_SUPPORTED_LINK_RATES DPCD read fails Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_dp.c:3949 · pass 2 · new	none	inconclusive
DF-3971	Low	2.4	rt2560 beacon-ring slot overwrite leaks the old beacon mbuf and its ieee80211_node reference on every re-entry to RUN — remotely pump-able in IBSS mode (ibss merge) Base system — drivers · sys/dev/netif/ral/rt2560.c:820 · pass 2 · new	none	not_reproduced
DF-3985	Low	2.4	sbp_free_target early-returns on luns==NULL without clearing target->fwdev or stopping scan_callout — target slots permanently leaked holding dangling fw_device pointers (8-round hostile device-churn attach DoS), plus freed-fw_device derefs via armed mgm/ccb timeouts Base system — drivers · sys/dev/disk/sbp/sbp.c:1993 · pass 2 · new	none	inconclusive
DF-4077	Low	2.4	Reply-frame range check off-by-one in mps_intr_locked accepts a ReplyFrameAddress exactly one frame past the end Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps.c:1541 · pass 2 · new	none	inconclusive
DF-4340	Low	2.4	Undefined shift counts throughout the ATOM interpreter: VBIOS-controlled shift operands (up to 32-bit) used unmasked in shl/shr/shift ops, WS OR/AND masks and IIO masks Base system — drivers · sys/dev/drm/radeon/atom.c:904 · pass 2 · new	none	inconclusive
DF-4348	Low	2.4	Undefined shift counts throughout the amdgpu ATOM interpreter: VBIOS-controlled shift operands (up to full 32-bit) used unmasked in shl/shr/shift ops, WS OR/AND masks and IIO width masks (DF-4340's amdgpu twin) Base system — drivers · sys/dev/drm/amd/amdgpu/atom.c:121 · pass 2 · new	none	inconclusive
DF-4556	Low	2.4	dce_aux: partial AUX reads reassembled at buffer base instead of running offset — kernel-assembled DPCD/EDID corruption reported as SUCCEEDED Base system — drivers · sys/dev/drm/amd/display/dc/dce/dce_aux.c:426 · pass 2 · new	none	not_reproduced
DF-4589	Low	2.4	radeon_dp_link_train_cr has no overall iteration bound: malicious DP sink oscillating adjust-request voltage wedges the modeset path forever (unkillable task + display-subsystem lock) Base system — drivers · sys/dev/drm/radeon/atombios_dp.c:684 · pass 2 · new	none	not_reproduced
DF-4637	Low	2.4	vpoio: uninterruptible 500K/5M-iteration handshake spins (VP0_FAST_SPINTMO/VP0_LOW_SPINTMO) execute under vpo_intr's hard critical section — a malicious parallel-port ZIP emulator pins a CPU with interrupts masked for seconds per I/O (DF-4618 family, vpoio.c instance) Base system — drivers · sys/dev/disk/vpo/vpoio.c:59 · pass 2 · new	Multi-second uninterruptible CPU pin (preemption disabled, interrupts deferred) per I/O against a malicious/faulty parallel-port ZIP emulator; repeatable per command — local/physical DoS (DF-4618 family, vpio instance)	untested
DF-4652	Low	2.4	amdgpu_atombios_dp_link_train_cr has no overall iteration bound: malicious DP sink oscillating adjust-request voltage wedges the modeset path forever (unkillable task + mode_config.mutex) — line-for-line twin of DF-4589 (radeon) Base system — drivers · sys/dev/drm/amd/amdgpu/atombios_dp.c:605 · pass 2 · new	none	not_reproduced
DF-4866	Low	2.4	siba_bwn_attach leaks the MMIO BAR, bus mastering and scanned child devices when siba_core_attach fails (bad-SPROM CRC or unsupported-PHY child) Base system — drivers · sys/dev/netif/bwn/siba/siba_bwn.c:151 · pass 2 · new	leak	untested
DF-5251	Low	2.4	run_stop early-return on failed USB read skips run_unsetup_tx_list; the next run_init_locked->run_setup_tx_list memsets the queues, orphaning all queued mbufs and node references (repeatable leak with a wedged/hostile device) Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_run.c:6201 · pass 2 · new	UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252)	untested
DF-5270	Low	2.4	Last-TRB TD Size clear masks only 4 of the 5 TDSZ field bits (15 instead of 31) — controller mispredicts remaining packets on large transfers Base system — bus / platform / cpu · sys/bus/u4b/controller/xhci.c:2016 · pass 2 · new	streams-endpoint transfer hangs (DF-5269) / large-transfer miscompletion (DF-5270)	untested
DF-5359	Low	2.4	uipaq_attach() stalls the per-bus USB explore thread up to ~12.8s on an unresponsive crafted device: 64 unconditional retries of the magic SET_CONTROL_LINE_STATE request (100ms timeout + ~100ms pause each) with no early-out on stall or device-removal, while holding the device enum lock Base system — bus / platform / cpu · sys/bus/u4b/serial/uipaq.c:1129 · pass 2 · new	none	untested
DF-5400	Info	2.4	mos_bulk_read_callback() passes actlen instead of pktlen to uether_rxbuf(): every received frame is delivered one byte too long (trailing device status byte included), and transfers of 2045..2056 bytes are silently dropped without ierrors Base system — bus / platform / cpu · sys/bus/u4b/net/if_mos.c:817 · pass 2 · new	non-canonical frames up the stack (DF-5400) / skewed interface stats (DF-5401)	untested
DF-3440	Medium	2.3	div_output() reads sin_port and sin_addr from an under-sized sendto() destination sockaddr (offsets 4..8 and 8..12 past a >=4-byte allocation); OOB bytes steer re-inject direction and the ipfw resume rule Kernel memory leaks / uninitialized disclosure · sys/netinet/ip_divert.c:344 · pass 2 · new	none	not_reproduced
DF-2639	Low	2.3	hammer2_inode_create_pfs never sets *errorp on its done2 error paths — snapshot ioctl silently succeeds without creating anything Hammer2 · sys/vfs/hammer2/hammer2_inode.c:1042 · pass 2 · new	none	untested
DF-2699	Low	2.3	vfs_setpublicfs() leaks nfs_pub.np_index when MNT_EXPUBLIC is re-exported on the same mount without MNT_DELEXPORT Base system — kernel core (kern) · sys/kern/vfs_subr.c:2246 · pass 2 · new	none	not_reproduced
DF-2897	Low	2.3	Mute-interaction bookkeeping leak: cnclose()'s muted early-return never clears cn_is_open/cn_phys_is_open, so un-muting re-opens the physical console device with a stale flags snapshot for a /dev/console that is no longer open Base system — kernel core (kern) · sys/kern/tty_cons.c:403 · pass 2 · new	none	untested
DF-3130	Low	2.3	update_mp() re-executed on every remount with fspec re-opens all four iconv handles without closing the previous ones — unbounded kernel-heap handle leak via mount -u loop (partial-failure remounts leak the replaced handles too) Base system — filesystems · sys/vfs/msdosfs/msdosfs_vfsops.c:115 · pass 2 · new	leak	not_reproduced
DF-3166	Low	2.3	Memory leaks on udf_mountfs/udf_vget error paths: s_table freed only in udf_unmount, unode->fentry leaked when udf_allocv fails Base system — filesystems · sys/vfs/udf/udf_vfsops.c:393 · pass 2 · new	leak	not_reproduced
DF-3189	Low	2.3	hammer_ioc_set_pseudofs clobbers hammer_load_pseudofs's error with copyin's result — every load failure (not just the intended ENOENT) is silently ignored and the PFS is created/saved anyway Base system — filesystems · sys/vfs/hammer/hammer_pfs.c:117 · pass 2 · new	corruption	not_reproduced
DF-3214	Low	2.3	netaddr_match union type confusion for RC_NAM cache entries: rc_nam pointer compared as an IPv4 address in the dup-reply-cache hash walk — spoofed-source false cache hits and a silently inert duplicate cache for non-AF_INET transports Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_srvcache.c:194 · pass 2 · new	leak	not_reproduced
DF-3262	Low	2.3	O_VIA/O_RECV/O_XMIT name[IFNAMSIZ] not required NUL-terminated: kfnmatch() pattern scan runs past the 16-byte field toward/past the rule allocation Kernel memory leaks / uninitialized disclosure · sys/net/ipfw/ip_fw2.c:1355 · pass 2 · new	leak	not_reproduced
DF-3497	Low	2.3	ng_fec_delport (NGM_FEC_DEL_IFACE) frees the portlist entry without releasing the port's multicast list: M_DEVBUF ng_fec_mc structs and ifmultiaddr memberships leak on every add/del cycle Base system — network stack · sys/netgraph7/ng_fec.c:514 · pass 2 · new	none	not_reproduced
DF-3532	Low	2.3	ng7 ng_tty: ngt_open() error path leaks sc when ng_name_node() fails Base system — network stack · sys/netgraph7/tty/ng_tty.c:212 · pass 2 · new	none	inconclusive
DF-3768	Low	2.3	DFly i915 registers the GGTT aperture fictitious range on every attach but never unregisters it: unbounded fake-vm_page leak and permanent 8-slot exhaustion (graphics attach DoS) via kldload/kldunload cycles Base system — drivers · sys/dev/drm/i915/i915_gem_gtt.c:2966 · pass 2 · new	none	not_reproduced
DF-3861	Low	2.3	amdgpu_device_fini never unregisters the fictitious VRAM range — permanent vm_page-array leak and exhaustion of the 8-slot DRM shim (EBUSY driver-load DoS) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_device.c:2648 · pass 2 · new	none	not_reproduced
DF-3900	Low	2.3	i915 MMIO register mapping (pmap_mapdev KVA + global iomap node + shim bus resource) leaked on every driver detach: the only pci_iounmap in the i915 tree is #if 0'd Base system — drivers · sys/dev/drm/i915/i915_drv.c:1027 · pass 2 · new	none	inconclusive
DF-3970	Low	2.3	rt2560_set_chan walks the unterminated RT2560_RF5222 channel table with no bound — OOB read across kernel .rodata and garbage RF programming when an admin-installed channel misses the table Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ral/rt2560.c:2210 · pass 2 · new	none	not_reproduced
DF-4061	Low	2.3	Linux-compat ioctl 0xc0046d00 re-reads a 110-byte struct amr_linux_ioctl from the 4-byte IOC buffer: 106 bytes of uninitialized kernel stack become ali.inlen/outlen, opcode, mailbox and passthrough pointers that steer the whole management ioctl Kernel memory leaks / uninitialized disclosure · sys/dev/raid/amr/amr.c:765 · pass 2 · new	Control-flow nondeterminism on a root-only surface: stack-garbage-chosen opcode/mailbox/pointers; no exfiltration (4-byte copy-back returns the user's own inlen).	untested
DF-4135	Low	2.3	config_volume readpol case falls through into setupstate: VF_CONFIG_SETUPSTATE silently set for every volume configured with readpol Base system — drivers · sys/dev/raid/vinum/vinumconfig.c:1527 · pass 2 · new	none	untested
DF-4229	Low	2.3	cyapawrite returns uninitialized stack `error` on zero-length writes — 32 bits of stale kernel stack leak to userland as the write() result/errno Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/cyapa/cyapa.c:791 · pass 2 · new	none	untested
DF-4257	Low	2.3	my_softc my_ldata_ptr (2056-byte DMA descriptor block) is never freed: leaked on every detach and every failed attach Base system — drivers · sys/dev/netif/my/if_my.c:870 · pass 2 · new	none	inconclusive
DF-4269	Low	2.3	wb_attach() allocates sc->wb_ldata but wb_detach() frees never-assigned sc->wb_ldata_ptr: ~296KB contigmalloc leak per attach/detach cycle Base system — drivers · sys/dev/netif/wb/if_wb.c:779 · pass 2 · new	none	untested
DF-4378	Low	2.3	DRM minor teardown leaks the make_dev'd /dev/dri/cardN cdev and the kzalloc'd struct device; stale devfs node keeps si_drv1 dangling at the freed drm_device Base system — drivers · sys/dev/drm/drm_drv.c:158 · pass 2 · new	none	not_reproduced
DF-4397	Low	2.3	vega10_pp_tables_uninitialize leaks 8 subtable allocations (socclk/dcefclk/pixclk/phyclk/dispclk dep tables, pcie_table, valid_socclk_values, valid_dcefclk_values) on every pp_table reload / rebind cycle Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1183 · pass 2 · new	none	untested
DF-4553	Low	2.3	snd_vibes: sv_suspend() aborts the playback channel with the record trigger (copy-paste) — playback DMA engine left enabled across suspend Base system — drivers · sys/dev/sound/pci/vibes.c:644 · pass 2 · new	none	not_reproduced
DF-4579	Low	2.3	radeon: every failed PCI attach leaks one drm_device — DragonFly's drm_get_pci_dev has its entire error unwind #if 0'd out (upstream err_free: drm_dev_unref deleted); radeon_pci_probe is the only live caller Base system — drivers · sys/dev/drm/radeon/radeon_drv.c:318 · pass 2 · new	dos	not_reproduced
DF-4596	Low	2.3	set_drive_parms() re-Mallocs drive->freelist without freeing the previous allocation (leak on drive re-init) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumio.c:143 · pass 2 · new	none	untested
DF-4597	Low	2.3	daemon_save_config() 'break' aborts the whole drive loop on the first malformed drive — later drives' config replicas never updated Base system — drivers · sys/dev/raid/vinum/vinumio.c:601 · pass 2 · new	none	untested
DF-4655	Low	2.3	twa_bus_scan_cb frees the scan ccb with the wrong malloc type and leaks its timeout_ch callout on every bus scan Base system — drivers · sys/dev/raid/twa/tw_osl_cam.c:578 · pass 2 · new	Kernel heap leak (sizeof(struct callout) per bus scan, unbounded across controller resets) + wrong-type free corrupting malloc accounting	untested
DF-4752	Low	2.3	gpio_unregister leaks the master device's clone unit and the shared struct gpio_driver (unlinked while sibling controllers still reference it) Base system — drivers · sys/dev/misc/gpio/gpio.c:587 · pass 2 · new	leak	inconclusive
DF-4860	Low	2.3	Uninterruptible multi-second waits and 750ms DELAY busy-spin held under dev_lock in the TIS transmit path (DF-1991's TIS twin plus a new busy-wait): 40s unkillable sleep for user-chosen Create* command codes, ~750ms+ CPU spin per burst on a stalled TPM Base system — drivers · sys/dev/crypto/tpm/tpm_tis.c:258 · pass 2 · new	dos	untested
DF-4989	Low	2.3	TWS_IOCTL_GET_LOCK result dead-stored: time_remaining_msec/grant state computed but never copied back to the caller (advisory ioctl lock unobservable) Base system — drivers · sys/dev/raid/tws/tws_user.c:280 · pass 2 · new	none	not_reproduced
DF-4991	Low	2.3	SMB_BREAD passes uninitialized stack byte as the driver's requested count; user's clamped rcount never communicated Kernel memory leaks / uninitialized disclosure · sys/dev/smbus/smb/smb.c:217 · pass 2 · new	corruption	untested
DF-5072	Low	2.3	Silent 64→32-bit mb_lba truncation with a print-only beyond-EOF check in amr_bio_command — unchecked raw-disk I/O past 2TiB wraps to an attacker-chosen in-range LBA (firmware is the only backstop) Base system — drivers · sys/dev/raid/amr/amr_disk.c:181 · pass 2 · new	silent wrap-around write via raw device (root:operator)	untested
DF-5255	Low	2.3	640KB kernel heap leak per interface down/up cycle: urtwn_stop never frees rx/tx lists while urtwn_init unconditionally re-allocates (plus detach-side leak of queued TX mbufs) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_urtwn.c:5268 · pass 2 · new	deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257)	untested
DF-5295	Low	2.3	rum_tx_mgt() pops a tx_free slot before validating the frame; the ENOENT/ENOBUFS error paths orphan it permanently - seven privileged raw injections wedge the TX path until down/up Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_rum.c:1478 · pass 2 · new	none	inconclusive
DF-3609	Info	2.3	ncr(4): CCB-supplied target_id/target_lun index per-adapter arrays without bounds checks in ncr_action/ncr_get_nccb (and CDB/sense length fields are trusted for DMA sizing) — hardening against privileged CAM injection Privilege escalation (general use) · sys/dev/disk/ncr/ncr.c:3874 · pass 2 · new	privileged-only OOB read/hardening	untested
DF-3625	Info	2.3	ci_dpm_force_performance_level passes the AMD_DPM_FORCED_LEVEL_HIGH enum value (8) instead of the computed top index to ci_dpm_force_state_pcie Base system — drivers · sys/dev/drm/amd/amdgpu/ci_dpm.c:4369 · pass 2 · new	firmware-side misbehavior	untested
DF-4254	Info	2.3	IR_PHYSICAL_DISK OFFLINE branch uses '\|= ~MPR_TARGET_FLAGS_RAID_COMPONENT' — sets every flag bit instead of clearing one (disk stays hidden; HDD not stopped at power-off) Base system — drivers · sys/dev/raid/mpr/mpr_sas_lsi.c:598 · pass 2 · new	none	untested
DF-4261	Info	2.3	acpi_pst_attach() leaks allocated _PCT bus resources (and burns cpu_next_rid) on every error path after acpi_pst_alloc_resource() Base system — drivers · sys/dev/acpica/acpi_cpu_pstate.c:500 · pass 2 · new	none	untested
DF-4309	Info	2.3	adw_free() never destroys the per-ACB buffer DMA maps — attach/detach asymmetry leaks up to 253 bus_dmamaps and destroys their tag while live Base system — drivers · sys/dev/disk/advansys/adwcam.c:205 · pass 2 · new	none	untested
DF-4892	Info	2.3	32-bit arithmetic overflow in SMU7 fan-RPM math: 60 * crystal_clock_freq * 10000 wraps for 25/27 MHz VI reference clocks, skewing reported fan speed (hwmon fan1_input/fan1_target) and the programmed TACH target by a constant ~7.09x (DF-4761 vega10 twin) Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu7_thermal.c:100 · pass 2 · new	none	untested
DF-4992	Info	2.3	Failed SMB_READB/SMB_READW/SMB_PCALL transfers reported as success: copyout result clobbers the bus error Base system — drivers · sys/dev/smbus/smb/smb.c:272 · pass 2 · new	none	untested
DF-4993	Info	2.3	SMB_BWRITE silently truncates wcount to u_char: 256..1024-byte block writes are short/zero-length yet return success Base system — drivers · sys/dev/smbus/smb/smb.c:305 · pass 2 · new	none	untested
DF-5081	Info	2.3	mpu401_init/mpu401_uninit free the kobj without kobj_delete: parent mpu class reference never dropped, compiled kobj_ops pinned forever (unbounded refs++ on reattach) Base system — drivers · sys/dev/sound/midi/mpu401.c:177 · pass 2 · new	bounded leak + refcount imbalance	untested
DF-5481	Info	2.3	EFIIOC_GET_TABLE hands a kernel DMAP virtual address straight back to userspace: kernel-VA disclosure (root-only) and an ioctl ABI that can never work Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/efirt.c:481 · pass 2 · new	none	inconclusive
DF-3490	Low	2.1	sc_isoc_in_buffer mbuf leaked on device detach: unfreed SCO reassembly buffer enables repeatable mbuf exhaustion Base system — network stack · sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:683 · pass 2 · new	none	inconclusive
DF-4005	Low	2.1	fiji_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:406 · pass 2 · new	none	inconclusive fixed
DF-4873	Low	2.1	ath_hal_9287EepromAttach error paths leak the malloc'd HAL_EEPROM_9287 (~1KB permanently per failed attach): three post-malloc returns never free or install it, and ar9287Attach's bad: unwind is a no-op for it Base system — drivers · sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:239 · pass 2 · new	none	untested
DF-4970	Low	2.1	xe_pccard_probe flag loop exits at the DINGO bit before testing it: case XE_CARD_TYPE_FLAGS_DINGO is dead code, CEM56/REM56 Dingo cards are never detected as Dingos Base system — drivers · sys/dev/netif/xe/if_xe_pccard.c:311 · pass 2 · new	none	inconclusive
DF-3671	Info	2.1	Unchecked PHY/EEPROM read return values across ixgbe_common.c: config decisions from uninitialized kernel stack, and a failed PHY read written back clobbering the AN advertisement (DF-3643 parity) Base system — drivers · sys/dev/netif/ix/ixgbe_common.c:278 · pass 2 · new	none	inconclusive
DF-5489	Info	2.1	uvisor VISOR GET_CONNECTION_INFORMATION: actlen never validated after a SHORT_XFER_OK control-IN into an 18-byte stack struct; the USB_DEBUG connection loop consumes uninitialized kernel stack when an evil Visor short-transfers (Info: no production consumer) Base system — bus / platform / cpu · sys/bus/u4b/serial/uvisor.c:387 · pass 2 · new	none	untested
DF-3452	Low	2.0	Uninitialized kernel stack transmitted in ipfw3 sync datagrams: ip_fw3_sync_send_state fills 3 of 9 fields of a stack struct and ships all of it over UDP (LATENT — subsystem dead by omission) Kernel memory leaks / uninitialized disclosure · sys/net/ipfw3_basic/ip_fw3_sync.c:443 · pass 2 · new	none	not_reproduced
DF-3992	Low	2.0	Ignored DPCD-read failures feed uninitialized stack into PSR/training-interval/dongle-quirk decisions; read_hpd_rx_irq_data uses a shared 'static' retval across links Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_link_dp.c:50 · pass 2 · new	Ignored DPCD-read failures feed uninitialized stack into PSR/training-interval/dongle-quirk decisions (comparison-only, no disclosure); shared 'static retval' across links in read_hpd_rx_irq_data. Low/hardening — PoC skipped per contract.	untested
DF-4339	Low	2.0	atom_parse name[512] stays unterminated when the VBIOS message is 511 printable bytes — %s leaks uninitialized kernel stack past the buffer to console/log; msg string also walked unbounded past the image Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/atom.c:1276 · pass 2 · new	none	inconclusive
DF-4347	Low	2.0	amdgpu VBIOS part-number string walked and printed past the BIOS image: unvalidated idx deref + %s/strlcpy on an unterminated source (DF-4339's amdgpu twin, worse shape — no bounded copy at all) Base system — drivers · sys/dev/drm/amd/amdgpu/atom.c:1340 · pass 2 · new	none	inconclusive
DF-5269	Low	2.0	xhci_check_transfer decodes a stream ID from the completion TRB, which per xHCI spec carries none — completions on streams endpoints are silently dropped (transfer hang/DoS) Base system — bus / platform / cpu · sys/bus/u4b/controller/xhci.c:908 · pass 2 · new	streams-endpoint transfer hangs (DF-5269) / large-transfer miscompletion (DF-5270)	untested
DF-5360	Low	2.0	Poisoned num_iospace=16/num_memspace=8 persist on the queued cfe after the CFTABLE error-break and propagate via the default-copy Kernel memory leaks / uninitialized disclosure · sys/bus/pccard/pccard_cis.c:916 · pass 2 · new	none	untested
DF-5494	Low	2.0	uether_ifdetach() never drains ue->ue_rxq — mbufs enqueued by a final RX callback that exits without flushing leak with the freed softc (live path: cdce bulk-read tr_stall skips uether_rxflush) Base system — bus / platform / cpu · sys/bus/u4b/net/usb_ethernet.c:576 · pass 2 · new	mbuf cluster leak per stall-unplug cycle (DF-5494) / future unguarded-len overflows (DF-5495)	untested
DF-5770	Low	2.0	mmc_ivars leaked on every discovery error-break of a newly-allocated card (hostile card leaks ~0.7 kB per scan) Base system — bus / platform / cpu · sys/bus/mmc/mmc.c:1440 · pass 2 · new	slow kernel-memory leak (5770) / latent UAF (5771)	untested
DF-3722	Info	2.0	Uninitialized kernel stack shipped to the NIC: mxge_close's ETHERNET_DOWN cmd (12B), mxge_dummy_rdma (40 of 64 PIO bytes), mxge_load_firmware boot handoff (36 of 64 PIO bytes) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/mxge/if_mxge.c:3517 · pass 2 · new	none	inconclusive
DF-4049	Info	2.0	dac1/2_output_control_v1 pass 3 uninitialized stack padding bytes as the VBIOS parameter space Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table.c:1669 · pass 2 · new	none	untested
DF-4209	Info	2.0	Memory leak of ee_modePowerArray5112[].pChannels allocations when legacyEepromReadContents fails after eepromAllocExpnPower5112 succeeded Base system — drivers · sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:383 · pass 2 · new	readEepromRawPowerCalInfo5112 allocates pChannels/pDataPerChannel per mode BEFORE eepromExpandPower5112 can fail	untested
DF-2666	Low	1.9	HAMMER2IOC_RECLUSTER leaks the holdfp() file reference on both error returns in hammer2_ioctl_recluster() — permanent struct-file pin per failing call Hammer2 · sys/vfs/hammer2/hammer2_ioctl.c:212 · pass 2 · new	none	not_reproduced
DF-2696	Low	1.9	sorecvtcp(): MSG_OOB + sio path is missing 'm = m_free(m)' — repeated sbappend of the same mbuf corrupts the caller's sockbuf (latent, currently unreachable) Base system — kernel core (kern) · sys/kern/uipc_socket.c:1648 · pass 2 · new	none	not_reproduced
DF-2703	Low	1.9	vop_mountctl/vop_markatime/vop_allocate dispatch with partially-uninitialized stack argument structs (a_vp pointer never set) Base system — kernel core (kern) · sys/kern/vfs_vopops.c:1300 · pass 2 · new	none	untested
DF-2850	Low	1.9	_gtaskqueue_start_threads() reports total thread-creation failure as success; queue teardown lifecycle is stubbed, so a half-born queue silently hangs all future drainers Base system — kernel core (kern) · sys/kern/subr_gtaskqueue.c:455 · pass 2 · new	none	not_reproduced
DF-2945	Low	1.9	acctwatch() ignores VFS_STATFS failure (decides suspend/resume on uninitialized stack statfs) and races vgone(): NULL v_mount dereference panic Base system — kernel core (kern) · sys/kern/kern_acct.c:332 · pass 2 · new	panic	not_reproduced
DF-3019	Low	1.9	devfs_spec_open clone path: EPERM/EBUSY early returns after securelevel/mounted-RW checks leak the cloned vp exclusively locked and referenced forever Base system — filesystems · sys/vfs/devfs/devfs_vnops.c:1006 · pass 2 · new	none	not_reproduced
DF-3041	Low	1.9	hammer_install_volume dereferences the volume header after brelse(bp) — buffer-cache use-after-release read of vol0_stat_bigblocks into f_blocks Kernel memory corruption (UAF / OOB write) · sys/vfs/hammer/hammer_ondisk.c:250 · pass 2 · new	none	not_reproduced
DF-3125	Low	1.9	cs_local/cs_disk charset names copied from mount args without NUL-termination — bounded kernel-stack OOB read in iconv_lookupcs strcmp Kernel memory leaks / uninitialized disclosure · sys/vfs/isofs/cd9660/cd9660_vfsops.c:492 · pass 2 · new	leak	not_reproduced
DF-3200	Low	1.9	u_char length truncation in struct devfs_rule: name[-1] heap over-read and cross-mount rule-clear confusion Kernel memory leaks / uninitialized disclosure · sys/vfs/devfs/devfs_rules.c:200 · pass 2 · new	none	inconclusive fixed
DF-3420	Low	1.9	pfi_update_status() snapshots the pf-group member-list head outside the ifgroup lock, then walks the snapshot — use-after-free of ifg_member under concurrent group churn Kernel memory corruption (UAF / OOB write) · sys/net/pf/pf_if.c:722 · pass 2 · new	none	not_reproduced
DF-3430	Low	1.9	ieee80211_create_wds leaks the find_node_locked reference in the 'station in use' branch: permanent node refcount inflation, un-reclaimable station table entries Base system — network stack · sys/netproto/802_11/wlan/ieee80211_wds.c:163 · pass 2 · new	none	untested
DF-3528	Low	1.9	ng_car SHAPE timer leaks ng_item + node ref + hook ref on every armed-cancel (DF-3523 twin) - latent: module does not build on DragonFly Base system — network stack · sys/netgraph7/ng_car.c:539 · pass 2 · new	none	build_failed
DF-3548	Low	1.9	Lost-wakeup race in ngdread: NGDF_RWAIT armed after the empty-queue check Base system — network stack · sys/netgraph7/ng_device.c:419 · pass 2 · new	none	untested
DF-3573	Low	1.9	Legacy firmware size-check bypass (err clobbered by later request_firmware success) → heap OOB reads in constant-bounded legacy ucode loaders Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/cik.c:2080 · pass 2 · new	none	not_reproduced
DF-3583	Low	1.9	RIO1 fast-post loop trusts card-controlled 8-bit rqs_seqno against a 15-element handle array — kernel stack OOB read up to 960 bytes Kernel memory leaks / uninitialized disclosure · sys/dev/disk/isp/isp.c:5093 · pass 2 · new	none	inconclusive
DF-3605	Low	1.9	bce_nvram_read returns on first-dword read failure while still holding the NVRAM arbitration lock and access-enable, permanently bricking NVRAM access (driver re-attach fails) Base system — drivers · sys/dev/netif/bce/if_bce.c:1726 · pass 2 · new	NVRAM lock permanently held on error path	untested
DF-3635	Low	1.9	i915_gem_object_get_pages_phys() error path returns holding the GEM backing vm_object (leaked hold_count + LWKT token) Base system — drivers · sys/dev/drm/i915/i915_gem.c:305 · pass 2 · new	none	untested
DF-3640	Low	1.9	bnx_reset acquires the NVRAM software-arbitration lock (SET1/GNT1) and never releases it — flash arbiter held for the driver's lifetime, locking out APE/management firmware Base system — drivers · sys/dev/netif/bnx/if_bnx.c:2585 · pass 2 · new	none	inconclusive
DF-3666	Low	1.9	sumo_rlc_init() save/restore buffer object undersized for the ON/LN/TN packed format: deterministic 172-byte write past the 324-byte BO Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen.c:4155 · pass 2 · new	none	inconclusive
DF-3795	Low	1.9	acpi_parse_prw() copies _PRW elements 0..N-3 instead of 2..N as wake power resources (off-by-two) Base system — drivers · sys/dev/acpica/acpi.c:2963 · pass 2 · new	none	not_reproduced
DF-3847	Low	1.9	int8_t overflow in bwn G-PHY tssi2dbm table generation: clamp to 128 wraps to -128 (DFly divergence; FreeBSD clamps to 127), corrupting TX-power control Base system — drivers · sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:230 · pass 2 · new	TX-power correctness (bwn) / mbuf leak + ring wedge (dc)	untested
DF-3905	Low	1.9	sk_marv_miibus_writereg(): inverted YU_SMICR_BUSY check aborts the SMI write-completion wait the moment the write starts (vs correct msk_phy_writereg sibling) Base system — drivers · sys/dev/netif/sk/if_sk.c:519 · pass 2 · new	none	inconclusive
DF-3913	Low	1.9	intel_sdvo_connector_state leaked when intel_sdvo_connector_init() fails (all four SDVO connector init paths) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_sdvo.c:2481 · pass 2 · new	none	inconclusive
DF-4052	Low	1.9	nfe_alloc_{rx,tx}_ring error paths destroy data[i].map in a loop over j — dmamap leak + tag map_count underflow on attach failure Kernel memory corruption (UAF / OOB write) · sys/dev/netif/nfe/if_nfe.c:1725 · pass 2 · new	none	untested
DF-4105	Low	1.9	Fake-EDID record: kmalloc(128) with memcpy of only ucFakeEDIDLength bytes leaves an uninitialized heap tail that (a) drives an OOB multi-block walk in drm_edid_is_valid via uninit extensions byte and (b) on a ~1/256 checksum pass is exposed to unprivileged users via the EDID ioctl (kernel heap info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/atombios_encoders.c:2171 · pass 2 · new	none	untested
DF-4126	Low	1.9	Inverted error checks at rv6xx_dpm_init:1957-1969 — ATOM-computed SPLL/MPLL reference divider used only when radeon_atom_get_clock_dividers FAILS; default used on success (rv6xx twin of DF-3976/DF-4119) Base system — drivers · sys/dev/drm/radeon/rv6xx_dpm.c:184 · pass 2 · new	none	inconclusive
DF-4128	Low	1.9	Ignored rv6xx_convert_clock_to_stepping failures (:249-250, :302) leave uninitialized stepping structs programmed into the SPLL; VBIOS-driven step count overruns the SPLL step register block into VID_RT@0x6f8+ Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/rv6xx_dpm.c:225 · pass 2 · new	none	inconclusive
DF-4141	Low	1.9	ar5211GetLowerUpperValues with empty pier list: 2-byte OOB stack read below tempChannelList plus uninitialized stack read -> garbage regulatory edge-power selection (DF-3977 ar5211 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c:1818 · pass 2 · new	none	inconclusive fixed
DF-4177	Low	1.9	isp_pci_mbxdma allocations are never torn down: error paths leak the master DMA tag, and a successful attach->detach leaks pcmd_pool, xflist, tgtlist, control queues, per-channel FC scratch, per-cmd maps and all DMA tags Base system — drivers · sys/dev/disk/isp/isp_pci.c:1536 · pass 2 · new	isp_pci_mbxdma creates the master tag and allocates pcmd_pool, xflist/tgtlist, control-space tag+memory, per-channel FC scratch, and per-cmd dma maps	untested
DF-4204	Low	1.9	ahci_cam_attach() error paths leak the cam_sim and leave the bus registered: ahci_cam_detach() no-ops because AP_F_CAM_ATTACHED is not yet set Base system — drivers · sys/dev/disk/ahci/ahci_cam.c:137 · pass 2 · new	ahci_cam_attach error paths leak the cam_sim and leave the bus registered: ahci_cam_detach no-ops because AP_F_CAM_ATTACHED is not yet set. Memory leak + stale registered CAM bus on any port whose device fails IDENTIFY at attach (hostile/misbehaving SATA device). Resource-exhaustion ceiling.	untested
DF-4205	Low	1.9	vlv_dsi_init dereferences vbt.dsi.config without a NULL/dangling guard — boot-time NULL-page panic or UAF read of freed config Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/vlv_dsi.c:1797 · pass 2 · new	none	untested
DF-4244	Low	1.9	dpt_detect_cache log-page walk bounded by device-fed 16-bit page length (up to 65539) instead of the 512 bytes actually DMA'd — OOB kernel read up to ~64KB past the transfer buffer Kernel memory leaks / uninitialized disclosure · sys/dev/raid/dpt/dpt_scsi.c:618 · pass 2 · new	none demonstrated on guest (no DPT hardware); source-level impact: device-fed bound → OOB kernel read up to ~65KB past the 512-byte DMA buffer at attach (DoS ceiling, no disclosure)	untested
DF-4246	Low	1.9	linux_hexdump() memcmp over-reads up to rowsize-1 bytes past the kmalloc'd ring snapshot on the final partial row (print_request_ring path) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_engine_cs.c:1261 · pass 2 · new	linux_hexdump() memcmp over-reads up to rowsize-1 (31) bytes past the kmalloc'd ring snapshot on the final partial row (print_request_ring path). Bytes never printed; only observable is a 1-bit equality oracle vs the previous row, on debugfs/error-capture paths.	untested
DF-4248	Low	1.9	V1-branch state-array off-by-one: entry_index == ucNumStates passes 'entry_index > ucNumStates' guard Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:937 · pass 2 · new	none	untested
DF-4249	Low	1.9	Extended-header fields read before/without usSize gating (usPPMTableOffset at +16 read before V5 check; overdrive limits read with no size gate) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1029 · pass 2 · new	none	untested
DF-4256	Low	1.9	Unsigned underflow in agp_i915_get_stolen_size: sc->stolen wraps to ~0x3FFFFFFF entries when BIOS stolen size < GTT size, permanently breaking all GTT binds Base system — drivers · sys/dev/agp/intel-gtt.c:696 · pass 2 · new	none	inconclusive
DF-4281	Low	1.9	drm_addmap_core leaks vmalloc'd SHM maps, WC MTRR registrations and CONSISTENT DMA memory on error paths Base system — drivers · sys/dev/drm/drm_bufs.c:338 · pass 2 · new	Kernel memory / MTRR-slot exhaustion (DoS ceiling) by root on DRM machines.	untested
DF-4353	Low	1.9	dce110_create_resource_pool leaks the kzalloc'd pool on construct() failure (DF-4318 twin) and dc->fbc_compressor is never destroyed anywhere (dce110_compressor_destroy has zero callers) Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:1373 · pass 2 · new	none	untested
DF-4359	Low	1.9	cik_sdma_init_microcode() ignores amdgpu_ucode_validate() failure for all but the last SDMA instance — invalid firmware accepted (door to the DF-1553 sink that a DF-1553 fix does not close) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/cik_sdma.c:141 · pass 2 · new	none	untested
DF-4376	Low	1.9	dce112_create_resource_pool leaks the kzalloc'd pool shell on construct() failure (DF-4318/4353 twin) Base system — drivers · sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1353 · pass 2 · new	none	inconclusive
DF-4406	Low	1.9	acpi_tz_attach: NULL-pointer panic when tz unit 0 fails acpi_tz_establish and a second thermal zone attaches (global sysctl tree dereferenced before creation) Base system — drivers · sys/dev/acpica/acpi_thermal.c:237 · pass 2 · new	NULL-pointer panic when thermal zone unit 0 fails acpi_tz_establish (malformed _ALx non-package) and a second zone attaches: the driver-global sysctl tree was never created (unit-0-only) but per-zone SYSCTL_ADD_NODE dereferences SYSCTL_CHILDREN(NULL) = raw (oid_ptr)->oid_arg1 -> NULL-page read panic at attach/boot. Firmware-gated boot-time DoS.	untested
DF-4416	Low	1.9	wa_init_mcr uses 1-based fls() to index the 0-based subslice_mask[] and (via intel_calculate_mcr_s_ss_select) programs invalid MCR slice steering on gen10/11 Base system — drivers · sys/dev/drm/i915/intel_workarounds.c:787 · pass 2 · new	none	untested
DF-4465	Low	1.9	uguru_attach ENXIO paths leak the active IOPORT resource and permanently wedge the driver until reboot Base system — drivers · sys/dev/powermng/uguru/uguru.c:757 · pass 2 · new	Monitoring driver permanently dead until reboot after a failed attach (leaked active IOPORT range)	untested
DF-4549	Low	1.9	viapm_wait() off-by-one: while(count--)/if(!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts — silent success with stale register data — and spuriously fails last-poll successes Base system — drivers · sys/dev/powermng/viapm/viapm.c:574 · pass 2 · new	none	not_reproduced
DF-4585	Low	1.9	mpt_dump_sgl called with offset=0 on interior/stack pointers: bounded SGL walk overshoots the request area and hex-dumps up to ~504 bytes of kernel stack past an 8-byte stack union Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_debug.c:604 · pass 2 · new	Kernel stack contents (up to ~500 bytes) and adjacent request-area DMA data hex-dumped to console/dmesg - kernel info leak into logs; no write primitive	untested
DF-4591	Low	1.9	tws_attach error unwinds leak the MSI allocation and every post-probe resource (~200 KB heap + DMA maps/tags + scan_ccb per failed attach) Base system — drivers · sys/dev/raid/tws/tws.c:309 · pass 2 · new	none	not_reproduced
DF-4609	Low	1.9	Uninitialized stack value used as relocation buffer bound before session validation Base system — drivers · sys/dev/drm/radeon/radeon_vce.c:561 · pass 2 · new	Negligible standalone: a kernel-stack garbage value gates a bounds decision on an IB that is then rejected before any execution; hardening correctness issue	untested
DF-4641	Low	1.9	radeon: radeon_read_platform_bios maps a fixed 256KB window from the PCI ROM BAR base regardless of the BAR's actual decode size - kernel reads physical memory beyond the device's ROM aperture into rdev->bios (and maps device MMIO write-back cached) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_bios.c:130 · pass 2 · new	Kernel-side over-read of adjacent physical space (other devices' MMIO / unclaimed holes) into rdev->bios, parsed by atom/combios; possible read side effects on neighboring devices; no userspace exposure path found	untested
DF-4698	Low	1.9	nvme(4): queue-creation retry (tryagain) re-allocates still-allocated subqueues — lockinit on a live lock and permanent leak of the previous queue's DMA maps + request array Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:453 · pass 2 · new	none	untested
DF-4699	Low	1.9	nvme(4): admin commands have no completion timeout — a stalled controller permanently wedges the admin thread and hangs detach/shutdown in nvwend Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:104 · pass 2 · new	none	untested
DF-4701	Low	1.9	twa(4): tw_cl_shutdown_ctlr tears the Common Layer down (active=FALSE, interrupts/watchdog gone, CL locks destroyed) before the firmware shutdown handshake result is known and returns that error — twa_detach then aborts, leaving a still-attached half-dead device whose I/O entry points have no ctlr->active gate, so subsequent unprivileged disk I/O is submitted to a dead controller until reboot Base system — drivers · sys/dev/raid/twa/tw_cl_init.c:569 · pass 2 · new	dos	untested
DF-4731	Low	1.9	DAL_VALID_IRQ_SRC_NUM off-by-one ('<=') accepts irq_source == DAL_IRQ_SOURCES_NUMBER — one-past-end index into amdgpu_dm_irq.c's handler-list tables Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:176 · pass 2 · new	none	untested
DF-4737	Low	1.9	amdpm_wait() off-by-one: while(count--)/if (!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts (silent success with stale HSTDATA/FIFO data) and spuriously fails completions on the final poll Base system — drivers · sys/dev/powermng/amdpm/amdpm.c:302 · pass 2 · new	none	not_reproduced
DF-4739	Low	1.9	alpm_wait() off-by-one: while(count--)/if(!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts (silent success with stale SMBHDATA/SMBHBLOCK data) and spuriously fails last-poll completions — DF-4737/DF-4549 family Base system — drivers · sys/dev/powermng/alpm/alpm.c:297 · pass 2 · new	none	not_reproduced
DF-4767	Low	1.9	PSP buffer objects (tmr_bo 3MB VRAM, asd_shared_bo 16KB, firmware.rbuf 4KB) leaked permanently when psp_hw_start fails during psp_load_fw Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_psp.c:379 · pass 2 · new	none	inconclusive
DF-4771	Low	1.9	intel_dp_add_mst_connector error path leaks the allocated intel_connector (drm_connector_cleanup without kfree) Base system — drivers · sys/dev/drm/i915/intel_dp_mst.c:473 · pass 2 · new	leak	untested
DF-4785	Low	1.9	psp_v11_0_init_microcode never loads ASD firmware for Vega20 — generic psp_asd_load memcpy's from NULL and submits a zero-length LOAD_ASD whose PSP rejection is silently swallowed Base system — drivers · sys/dev/drm/amd/amdgpu/psp_v11_0.c:95 · pass 2 · new	none	untested
DF-4815	Low	1.9	mmhub_v1_0_init_cache_regs never programs mmVM_L2_CNTL3: BANK_SELECT/L2_CACHE_BIGK_FRAGMENT_SIZE computed into a stale CNTL2-derived local and silently dropped (the v5.2-era WREG32 line is missing from the DF vendor sync) Base system — drivers · sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:171 · pass 2 · new	none at runtime on this guest (no AMD GPU present); code-level: GPU MMU L2 TLB geometry (BANK_SELECT/L2_CACHE_BIGK_FRAGMENT_SIZE) never programmed — functional misconfiguration on Vega10-class ASICs, VM-fault/hang class on translate_further (Raven2) parts; no attacker control, no demonstrated memory-isolation breach	untested
DF-4859	Low	1.9	Locality 0 never relinquished on any of the 9 error exits in tpmtis_transmit (TIS twin of DF-1990), leaving TPM arbitration claimed and imposing a fixed 750ms uninterruptible sleep on every later request Base system — drivers · sys/dev/crypto/tpm/tpm_tis.c:407 · pass 2 · new	dos	untested
DF-4888	Low	1.9	iir_pci_attach error paths: BAR0 resource never released (release commented out, rid clobbered) and bus_setup_intr failure skips iir_free()/XPT teardown — leaked DMA state + /dev/iirN + live registered CAM SIMs with no interrupt (CCBs hang forever) Base system — drivers · sys/dev/raid/iir/iir_pci.c:195 · pass 2 · new	Permanent BAR/rman resource leak on every failed attach; late attach failure (bus_setup_intr) leaks all DMA state and /dev/iirN and leaves XPT-registered CAM SIMs with no interrupt handler - CAM scan CCBs hang forever (iir_timeout empty), wedging the rescan thread; hardware-gated local DoS/resource exhaustion (CWE-404)	untested
DF-4896	Low	1.9	complete_rqe() volume error path abandons the request: recover_io() re-strategizes the bio but nobody frees the old request — full request leak (rq + rqg chain + malloc'd buffers + locked bufs) per errored volume I/O, unbounded with VF_RETRYERRORS; VOL[].active never decremented on error Base system — drivers · sys/dev/raid/vinum/vinuminterrupt.c:223 · pass 2 · new	kernel memory leak: full struct request + rqg chain + XFR_MALLOCED buffers + XFR_BUFLOCKED buf locks per errored volume I/O; unbounded with VF_RETRYERRORS (daemon retry loop leaks at I/O speed); VOL[].active counter also never decremented on the error path	untested
DF-4917	Low	1.9	vf2pf checksum computed over pf2vf_size bytes instead of sizeof(amdgim_vf2pf_info): out-of-bounds read of up to ~3 KB past the 1 KB vf2pf struct and a wrong protocol checksum published to the host Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_virt.c:383 · pass 2 · new	none	not_reproduced
DF-4941	Low	1.9	if_ic: SIOCSIFMTU frees the working buffers before checking the replacement allocations — on kmalloc failure installs NULL ic_obuf/ic_ifbuf while still updating if_mtu Base system — drivers · sys/dev/netif/ic/if_ic.c:211 · pass 2 · new	none	untested
DF-4953	Low	1.9	aibs_attach ENXIO path leaks every kmalloc'd sc_asens_* sensor array — newbus never calls detach after a failed attach Base system — drivers · sys/dev/acpica/aibs/atk0110.c:126 · pass 2 · new	leak	untested
DF-4954	Low	1.9	mpr_pci_setup_interrupts: bus_setup_intr failure truncates msi_msgs before the failing queue, permanently leaking its allocated IRQ resource and (via ignored EBUSY) the MSI message Base system — drivers · sys/dev/raid/mpr/mpr_pci.c:294 · pass 2 · new	leak	untested
DF-4955	Low	1.9	mpr_pci_free destroys the parent DMA tag while mpr_free can early-return without freeing the 7 child tags — DragonFly's bus_dma_tag_destroy kfree()s unconditionally, permanently leaking all IOC-facts DMA memory and tags on a wedged-controller failed attach Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_pci.c:232 · pass 2 · new	leak	untested
DF-4982	Low	1.9	iir(4) GDT_IOCTL_EVENT double-fetch: raced event_data.size drives memcmp/strcmp length against the 16-byte eu union in static ebuffer[] — OOB kernel read with byte-wise equality-oracle disclosure Base system — drivers · sys/dev/raid/iir/iir_ctrl.c:324 · pass 2 · new	none	untested
DF-5014	Low	1.9	Broken attach-unwind contract: mps_attach leaks sc->facts on early failures, and mps_pci_free destroys the parent DMA tag over live child tags when mps_free early-returns Base system — drivers · sys/dev/raid/mps/mps_pci.c:234 · pass 2 · new	none	not_reproduced
DF-5074	Low	1.9	acpi_acad has no device_detach: ACPI notify handler (context=dev), global ACPIIO_ACAD_GET_STATUS ioctl hook and hw.acpi.acline sysctl OID are never removed (DF-5006-family; resource pinning + blocked kldunload, structurally non-UAF today) Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_acad.c:76 · pass 2 · new	none	untested
DF-5091	Low	1.9	acpi_button has no device_detach: ACPI notify handler and fixed-event handler (context = softc) plus PRW wake GPE are never removed — DF-5006/DF-5074 family teardown gap, guaranteed UAF if a detach path is ever added Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_button.c:74 · pass 2 · new	none	not_reproduced
DF-5094	Low	1.9	Unbounded vinum daemon instantiation with pid-blind lazy abdication: N concurrent daemons, unkillable P_SYSTEM processes, non-unloadable module; the plausible multi-consumer daemonq double-free is refuted on current DragonFly only by incidental MP-token serialization Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumdaemon.c:83 · pass 2 · new	none	not_reproduced
DF-5103	Low	1.9	apple_fw detach leaves softc-backed world-readable sysctls live while newbus frees the softc: use-after-free read window during driver unload Kernel memory corruption (UAF / OOB write) · sys/dev/apple/fw/apple_fw.c:144 · pass 2 · new	none	untested
DF-5124	Low	1.9	hyperv_md_uninit() frees the reference-TSC DMA page without quiescing in-flight hyperv_tc64 readers — shutdown-time use-after-free read window Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:96 · pass 2 · new	none	untested
DF-5149	Low	1.9	pps driver has no device_detach and never destroy_dev()s its make_dev() cdev (DF-5006/5074/5091 teardown-gap family): /dev/ppsN and the ppbus child are permanent, module unload is structurally blocked, and a future naive detach is an interrupt-context UAF Kernel memory corruption (UAF / OOB write) · sys/dev/misc/pps/pps.c:103 · pass 2 · new	none	not_reproduced
DF-5150	Low	1.9	acpi_lid has no device_detach: ACPI_DEVICE_NOTIFY handler installed with context = softc, AcpiOsExecute deferrals of that softc, and the enabled PRW wake GPE are never removed — DF-5091 (acpi_button) mirror; guaranteed UAF if a detach path is ever added Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_lid.c:66 · pass 2 · new	none	not_reproduced
DF-5158	Low	1.9	ata_ati_chipinit AHCI fallback attaches with dangling ctlr->r_res2: double bus_release_resource (rman UAF/panic) at detach Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/chipsets/ata-ati.c:108 · pass 2 · new	none	untested
DF-5161	Low	1.9	check_and_purge_safe_mem livelocks forever when the head allocation fails _free_safe_mem's integrity checks — unbounded kernel loop + tbridge_printf spam turns any detected corruption into a hard hang Base system — drivers · sys/dev/misc/tbridge/safe_mem.c:171 · pass 2 · new	kernel livelock + console spam (corruption-detector amplifier)	untested
DF-5203	Low	1.9	ipmi_smbus_probe is a second unguarded probe in the ipmi_attached singleton family (DF-5076 twin) — cross-bus/dual-smbus double attach yields second ssif kthread, second /dev/ipmiN cdev, and interleaved SSIF state machines on one BMC Base system — drivers · sys/dev/misc/ipmi/ipmi_smbus.c:65 · pass 2 · new	none	untested
DF-5208	Low	1.9	ata-isa registers no device_detach and never unwinds probe-allocated resources: kldunload of the ISA nata attachment permanently fails (ENXIO) and attach-failure leaks both IOPORT ranges with dangling softc pointers Base system — drivers · sys/dev/disk/nata/ata-isa.c:102 · pass 2 · new	permanent unload failure + per-boot resource leak	untested
DF-5349	Low	1.9	bus_dmamap_load() with map==NULL silently disables the tag's bounce constraints (segments returned with out-of-window addresses) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/busdma_machdep.c:601 · pass 2 · new	device-side out-of-window DMA (DF-5349) / segments leak + tag UAF window (DF-5350)	untested
DF-5404	Low	1.9	sgread(): unlocked re-check of rdwr->state races another reader's remove+free — 4-byte use-after-free read and tsleep on a freed object (PINTERLOCKED pattern) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sg.c:795 · pass 2 · new	UAF-read driven control flow (DF-5404) / uninit stack tag match (DF-5405)	untested
DF-5440	Low	1.9	targbhctor leaks the softc when targbhenlun() fails: cam_periph_alloc() never calls the dtor on ctor failure Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_targ_bh.c:384 · pass 2 · new	per-attach softc leak + speculative abort-refusing-SIM UAF (DF-5440) / stale CTIO timeout (DF-5441)	untested
DF-5566	Low	1.9	iicbus ownership protocol is not MP-safe and mis-ordered: crit_enter gives no cross-CPU exclusion (double-acquire), and iicbus_release_bus frees the bridge resource BEFORE validating ownership (non-owner teardown of bridge exclusion) Base system — bus / platform / cpu · sys/bus/iicbus/iiconf.c:100 · pass 2 · new	double bus acquisition + non-owner bridge release -> external-device wire corruption	untested
DF-5631	Low	1.9	kqueue_del() latent API hazards: close-before-delete EV_DELETE-ENOENT panics the whole vkernel; delete-vs-dispatch kfree races kqueue_intr()'s in-flight udata dispatch on another vCPU host thread (zero in-tree callers today) Kernel memory corruption (UAF / OOB write) · sys/platform/vkernel64/platform/kqueue.c:164 · pass 2 · new	none	untested
DF-3336	Info	1.9	netmap kqfilter stub: f_event always returns 0 and no knlist bookkeeping — kevent() on netmap fds sleeps forever Base system — network stack · sys/net/netmap/netmap.c:1516 · pass 2 · new	none	untested
DF-3475	Info	1.9	ng_callout() discards the previously-armed callout item (oitem) - re-arming a pending ng_callout leaks the item and permanently pins the node reference (unfreeable node, unloadable type) Base system — network stack · sys/netgraph7/netgraph/ng_base.c:3266 · pass 2 · new	none	untested
DF-3560	Info	1.9	Camellia derived key material (subL/subR schedule words, setup192's kk[32] 256-bit folded key, Encrypt/DecryptBlock tmp[4] block data) left unzeroed on the kernel stack; keyBitLength validated only by KASSERT, so production kernels would run on an uninitialized subkey schedule if a non-{128,192,256} length ever reached these entry points (latent: no in-tree callers) Base system — crypto · sys/crypto/camellia/camellia.c:445 · pass 2 · new	latent key-material stack residue + KASSERT-only key-size validation	untested
DF-3574	Info	1.9	sym_action2 XPT_GET/SET_TRAN_SETTINGS index np->target[]/lunmp[] without the bounds check used by every other sym entry point Kernel memory leaks / uninitialized disclosure · sys/dev/disk/sym/sym_hipd.c:8048 · pass 2 · new	none	not_reproduced
DF-3580	Info	1.9	Inverted privilege-check result in iwn_cdev_ioctl(): returns success when caps_priv_check fails Privilege escalation (general use) · sys/dev/netif/iwn/if_iwn.c:5157 · pass 2 · new	none	untested
DF-3724	Info	1.9	ixgbe_led_{on,off}_t_X550em: PHY read return ignored — uninitialized stack word masked and written back to the X557 LED provisioning register Base system — drivers · sys/dev/netif/ix/ixgbe_x550.c:4551 · pass 2 · new	none	inconclusive
DF-3726	Info	1.9	Unvalidated vf index in exported MDD/anti-spoof ops: register-index OOB MMIO read-modify-write if wired with vf beyond the register window Base system — drivers · sys/dev/netif/ix/ixgbe_x550.c:1078 · pass 2 · new	none	inconclusive
DF-3792	Info	1.9	drm_atomic_helper: unguarded CRTC helper-callback dereferences — funcs->dpms/funcs->commit fallbacks and crtc->helper_private derefs lack the NULL guards of upstream fe6169288666/26564be56d73 Base system — drivers · sys/dev/drm/drm_atomic_helper.c:461 · pass 2 · new	none	inconclusive
DF-3947	Info	1.9	dce110_apply_ctx_to_hw error return leaves VBIOS scratch critical-state latched Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2028 · pass 2 · new	none	untested
DF-3979	Info	1.9	dcn10_enable_per_frame_crtc_position_reset dereferences triggered_crtc_reset.event_source without NULL check (dead path; DF-3948 twin) Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406 · pass 2 · new	none	inconclusive
DF-3980	Info	1.9	hwss1_plane_atomic_disconnect: `opp` NULL check placed after its own dereferences (dead guard, latent NULL-deref) Base system — drivers · sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889 · pass 2 · new	none	inconclusive
DF-4175	Info	1.9	iir_init: bus_dmamap_create failure returns with sc_init_level one step low — iir_free skips kfree(sc_gccbs) and every created gc_dmamap (permanent leak on failed attach) Base system — drivers · sys/dev/raid/iir/iir.c:261 · pass 2 · new	The gccb init loop returns 1 immediately when bus_dmamap_create fails, but sc_init_level is only bumped to 5 after the whole loop	untested
DF-4420	Info	1.9	oce_mq_create leaks the CQ (struct + 4KiB DMA ring) on two of its three error paths Base system — drivers · sys/dev/netif/oce/oce_queue.c:675 · pass 2 · new	none	untested
DF-4434	Info	1.9	sln_attach() error path after bus_setup_intr failure leaks the 64KB contigmalloc RX ring and skips ifmedia cleanup Base system — drivers · sys/dev/netif/sln/if_sln.c:221 · pass 2 · new	64KB contiguous kernel memory + media list leaked per failed attach (bus_setup_intr failure)	untested
DF-4435	Info	1.9	dce120 TG: CRTC_REG_UPDATE_4/_5 pass pair-count 3 - 4th/5th CRTC register-field updates silently dropped (CRTC_TEST_PATTERN_COLOR_FORMAT / VRES / RAMP0_OFFSET never programmed) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:57 · pass 2 · new	none	untested
DF-4462	Info	1.9	Duplicate sensordev xname "dieN" installs two ksensordevs on one shared hw.sensors.dieN node; the CCD device's first sensor sysctl is silently dropped Base system — drivers · sys/dev/powermng/amdtemp/amdtemp.c:706 · pass 2 · new	Broken sensors(4) presentation on Zen: missing/shadowed temperature readings; no security impact	untested
DF-4487	Info	1.9	acpi_video_vo_init kmalloc without M_ZERO leaves vo_sysctl_tree uninitialized when the global video sysctl node is absent Base system — drivers · sys/dev/acpica/acpi_video/acpi_video.c:513 · pass 2 · new	none	untested
DF-4598	Info	1.9	vinum_scandisk() strncpy leaves partname[64] unterminated → stack OOB read in find_drive_by_dev()'s %s copy Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumio.c:723 · pass 2 · new	none	untested
DF-4708	Info	1.9	amr_sglist_map's 'goto retry' leaks the rejected s/g table (and its dmamap) unboundedly and all three PCI-setup bus_dmamap_load results are ignored — load failure yields a 0/garbage bus address handed to the controller Base system — drivers · sys/dev/raid/amr/amr_pci.c:592 · pass 2 · new	none	inconclusive
DF-4761	Info	1.9	32-bit arithmetic overflow in fan-RPM math: 60 * crystal_clock_freq * 10000 wraps for any realistic xclk, skewing reported fan speed and the programmed TACH target Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:115 · pass 2 · new	none	untested
DF-4817	Info	1.9	iwm phy_db: latent heap OOB read in channel_id_to_txp() — entry size never checked before reading txp_chg->max_channel_idx (path currently dead in-tree) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwm/if_iwm_phy_db.c:382 · pass 2 · new	none	untested
DF-4822	Info	1.9	DCE110v output regamma mode is never engaged: configure_regamma_mode() discards its computed value and writes literal 0, and dce110_opp_set_regamma_mode_v() is an empty stub — user-programmed gamma LUT silently bypassed Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_opp_regamma_v.c:111 · pass 2 · new	none	untested
DF-4833	Info	1.9	iwm_send_cmd: TFD TB0 length field (12 bits of hi_n_len) truncates to zero at the wide-header max-payload boundary (hdrlen+paylen==4096) Base system — drivers · sys/dev/netif/iwm/if_iwm_util.c:220 · pass 2 · new	none	untested
DF-4845	Info	1.9	lnc PCI detach/unwind never frees the ifmedia list — small kernel memory leak per attach/detach cycle Base system — drivers · sys/dev/netif/lnc/if_lnc_pci.c:449 · pass 2 · new	leak	untested
DF-4851	Info	1.9	aac(4) MSI tunable registered under mfi(4)'s name (hw.mfi.msi.enable) and NOMSI attach path permanently mutates the shared boot global Base system — drivers · sys/dev/raid/aac/aac_pci.c:61 · pass 2 · new	none	untested
DF-4856	Info	1.9	agp_amd64_via_init reads AGP3_VIA_ATTBASE as the RMW source for the AGP3_VIA_GARTCTRL write (register confusion, upstream-inherited) Base system — drivers · sys/dev/agp/agp_amd64.c:460 · pass 2 · new	none	not_reproduced
DF-4865	Info	1.9	cpuctl microcode update paths ignore rdmsr_safe() failures: uninitialized stack rev0/rev1/res printed to dmesg and used in the success decision Privilege escalation (general use) · sys/dev/misc/cpuctl/cpuctl.c:289 · pass 2 · new	none	not_reproduced
DF-4867	Info	1.9	ata_intel_chipinit treats any non-ENXIO return of ata_ahci_chipinit as AHCI success, leaving ctlr->setmode NULL — latent boot-time NULL function-pointer call (fragile error contract) Base system — drivers · sys/dev/disk/nata/chipsets/ata-intel.c:177 · pass 2 · new	none	not_reproduced
DF-4869	Info	1.9	mps table layer latent defects: live-but-gated unvalidated NumEntries walk in mps_print_evt_sas, three dead config-page printers, sentinel+1 fallback in mps_describe_table Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_table.c:63 · pass 2 · new	none	untested
DF-4894	Info	1.9	aac_disk_dump() consumes firmware-derived geometry with no host-side clamping: max_sectors==0 → infinite dump loop, sg_tablesize/SectorCount/BlockNumber overflow the FIB fields, single static dump map shared across controllers Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac_disk.c:256 · pass 2 · new	dos	untested
DF-4898	Info	1.9	vpo_cam_rescan leaks struct cam_path on every attach and the entire CCB (incl. its callout) when xpt_create_path fails Base system — drivers · sys/dev/disk/vpo/vpo.c:176 · pass 2 · new	leak	untested
DF-4899	Info	1.9	vpo_attach error paths never unwind the low-level attach (leaked microseq buffer, ppbus left claimed) and the driver has no detach method at all Base system — drivers · sys/dev/disk/vpo/vpo.c:139 · pass 2 · new	leak	untested
DF-4935	Info	1.9	dc_clock_type_to_atom default path leaves *atom_clock_type uninitialized yet returns true — latent uninitialized-stack feed into ATOM setdceclock params (v2) Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper2_dce112.c:333 · pass 2 · new	none	untested
DF-4937	Info	1.9	dc_clock_type_to_atom default leaves *atom_clock_type uninitialized while returning true (v1 twin; consumer command_table.c:2432/2440) Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper_dce112.c:333 · pass 2 · new	none	untested
DF-4938	Info	1.9	gfx sw_init partial-failure strands KIQ/MQD kernel BOs and mqd_backup allocations — teardown unreachable behind the IP-block status.sw gate Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:282 · pass 2 · new	leak	untested
DF-4968	Info	1.9	radeon GART table_size / num_gpu_pages 32-bit wrap (DF-2012's radeon twin): missing table-size invariant check in radeon_gart_table_{vram,ram}_alloc — power-of-two validator currently forces the wrapped size to 0 (fail-closed) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_gart.c:68 · pass 2 · new	none	untested
DF-4973	Info	1.9	dm_target_dmirror.c is non-compiling, unregistered dead scratch code whose latent memory-safety bugs must never be revived — delete it Base system — drivers · sys/dev/disk/dm/dmirror/dm_target_dmirror.c:135 · pass 2 · new	none	not_reproduced
DF-4980	Info	1.9	amdgpu_atomfirmware_allocate_fb_scratch: VBIOS-controlled unclamped kernel allocation (up to 64MB) whose -ENOMEM return the caller ignores — NULL-scratch write chain on Linux-semantics allocators, dead error branch on DragonFly Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:99 · pass 2 · new	none	untested
DF-5023	Info	1.9	Unsupported 5GHz radio revision check fails open: the HAL_ENOTSUPP/goto bad rejection is compiled out unless AH_DEBUG (FreeBSD-inherited) Base system — drivers · sys/dev/netif/ath/ath_hal/ar9001/ar9160_attach.c:228 · pass 2 · new	fail-open hardware validation, no memory-safety impact	untested
DF-5038	Info	1.9	Unsupported 5GHz radio-revision check fails open: the HAL_ENOTSUPP/goto bad rejection is compiled out unless AH_DEBUG — ar9160/DF-5023 family twin, shipped fail-open empirically confirmed Base system — drivers · sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:197 · pass 2 · new	none	untested
DF-5092	Info	1.9	ar5416GpioCfgInput drives the GPIO pin (DRV_ALL) instead of tristating it, contradicting its own contract — BT-coexistence sense pins get actively driven by the MAC Base system — drivers · sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:146 · pass 2 · new	none	untested
DF-5098	Info	1.9	oce_page_list() hardcodes the segment bound (8) regardless of the destination pages[] array size — latent out-of-bounds write into RQ/CQ mailbox commands Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_util.c:258 · pass 2 · new	latent intra-object OOB write into fw command struct	untested
DF-5100	Info	1.9	joyread() busy-loops inside crit_enter() against WALL-CLOCK nanotime() — backward clock steps extend an interrupt-masked critical section beyond the configured timeout Base system — drivers · sys/dev/misc/joy/joy.c:190 · pass 2 · new	none	inconclusive
DF-5114	Info	1.9	dragon_saver(): set_video_mode() return value ignored — on failure vid would alias the wrong (32KB text) video window and 64000-byte writes would overrun it Kernel memory corruption (UAF / OOB write) · sys/dev/misc/syscons/dragon/dragon_saver.c:192 · pass 2 · new	latent out-of-window video MMIO writes (not kernel RAM)	untested
DF-5117	Info	1.9	dmamap_cb continues after bus_dmamap_load error: uninitialized-stack segments[0].ds_addr is stored into dcons_paddr and published to FireWire peers via the ConfigROM, the stack bytes are printed to console, and dcons_conf is wired for a map whose load failed — while dcons_crom_attach ignores all three bus_dma return values and reports success Base system — drivers · sys/dev/misc/dcons/dcons_crom.c:130 · pass 2 · new	none	untested
DF-5132	Info	1.9	amdgpu_kv_notify_message_to_smu() fail-open response validation: SMC timeout (0x00) and undefined response codes 0x02–0xFD all reported as success to the whole kv_dpm power-management state machine Base system — drivers · sys/dev/drm/amd/amdgpu/kv_smc.c:40 · pass 2 · new	none	untested
DF-5139	Info	1.9	iwm_abort_notification_waits() is dead code: the device stop path never aborts pending notification waits, leaving control threads stalled for their full bounded timeout during firmware stop/restart Base system — drivers · sys/dev/netif/iwm/if_iwm_notif_wait.c:155 · pass 2 · new	stalled control threads / detach-race UAF write	untested
DF-5187	Info	1.9	Default drm_gem_dumb_map_offset returns offsets from the wrong address space: vma-manager address without DRM_GEM_MAPPING_KEY bits, unresolvable by (and unrelated to) the hash-key mmap path — latent (no in-tree caller) Base system — drivers · sys/dev/drm/drm_dumb_buffers.c:123 · pass 2 · new	none	untested
DF-5204	Info	1.9	Terminal-emulator registry sc_term_list is completely unsynchronized and the SCTERM_MODULE MOD_UNLOAD refcount gate is TOCTOU — kldload/kldunload of any third-party scterm module races console ioctls into list corruption or a call into freed module text Base system — drivers · sys/dev/misc/syscons/scterm.c:74 · pass 2 · new	list corruption / freed-text call on third-party module races	untested
DF-5211	Info	1.9	arch_io_reserve_memtype_wc() persists 4 uninitialized stack bytes into the global memrange descriptor array (mr_owner[4..7] leak into MEMRANGE_GET) Base system — drivers · sys/dev/drm/linux_iomapping.c:111 · pass 2 · new	attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure	untested
DF-5214	Info	1.9	Dead dal_hw_factory_destroy() kfrees a struct hw_factory that only ever exists embedded in gpio_service — latent interior-pointer kfree (heap corruption) one future caller away Base system — drivers · sys/dev/drm/amd/display/dc/gpio/hw_factory.c:101 · pass 2 · new	latent interior kfree / kernel-CPU amplification / unkillable spin	untested
DF-5231	Info	1.9	Dead FPGA-diagnostics GPIO factory installs an all-NULL function table (create_* and both omitted define_*_registers): activating the unreachable MAXIMUS env would turn every GPIO operation into an immediate NULL function-pointer call Base system — drivers · sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_factory_diag.c:45 · pass 2 · new	latent NULL-call panic / latent invalid-state commit	untested
DF-5232	Info	1.9	dml_init_instance's default branch is ASSERT-only (WARN_ON) and still commits lib->project with no bounding box loaded — latent invalid-state commit that would feed the dml_log2(0)/÷0 family (DF-4198) if a future project value lacks a case Base system — drivers · sys/dev/drm/amd/display/dc/dml/display_mode_lib.c:38 · pass 2 · new	latent NULL-call panic / latent invalid-state commit	untested
DF-5234	Info	1.9	u32-domain shift truncation: PF_LFB_SIZE<<24 wraps before assignment to u64 node_segment_size, silently mis-placing XGMI VRAM/GART apertures Base system — drivers · sys/dev/drm/amd/amdgpu/gfxhub_v1_1.c:47 · pass 2 · new	GPU VM faults / device hang from mis-placed apertures (config DoS)	untested
DF-5281	Info	1.9	Vendor-database parsing: ksscanf("%80[^\n]") writes up to 81 bytes into kmalloc(80); pci_load_vendor_data() writes one byte past the preloaded blob Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci.c:3243 · pass 2 · new	VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281)	untested
DF-5310	Info	1.9	usb_open() error path after successful fifo opens leaks the opened fifos with curr_cpd pointing at the freed cpd (latent — devfs_set_cdevpriv cannot currently fail for a fresh open) Base system — bus / platform / cpu · sys/bus/u4b/usb_dev.c:929 · pass 2 · new	single-owner invariant break -> concurrent-setup entry / latent dangling curr_cpd	untested
DF-5325	Info	1.9	ukbd_detach mutates keyboard state and runs ukbd_interrupt() without kb_lock, racing the kb_lock-holding ukbd_timeout callout (in-bounds input-ring corruption on unplug) Base system — bus / platform / cpu · sys/bus/u4b/input/ukbd.c:1380 · pass 2 · new	garbled trailing key events / ring count drift at unplug	untested
DF-5331	Info	1.9	DELAY()/DRIVERSLEEP() do not clamp negative arguments — sign-extended usec count converts to a multi-hour (i8254: multi-month) kernel spin Base system — bus / platform / cpu · sys/platform/pc64/isa/clock.c:386 · pass 2 · new	none	untested
DF-5391	Info	1.9	No suspend/resume/shutdown lifecycle: controller loses programming across D3 while softc caches stay 'valid' — bus dead until reload Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:493 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5435	Info	1.9	uvc_buf_queue_req_bufs signed count handling is undefined behavior: count >= 0x80000000 makes int num negative, skipping the clamp and the allocation loop and reading an uninitialized mem (currently compiled to ENOMEM by the shipping gcc - fragile across toolchains) Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/uvc/uvc_buf.c:540 · pass 2 · new	toolchain-fragile UB, no exploit on the shipping build	untested
DF-5460	Info	1.9	ichsmb_attach error path: lockuninit() runs while the interrupt handler is still registered and the smbus child is leaked Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb.c:132 · pass 2 · new	none	untested
DF-5508	Info	1.9	amdsmb_detach performs no quiesce/drain: kldunload during an in-flight locked transaction runs lockuninit() on a held lock and releases the I/O resource under live bus_read_1/bus_write_1 (post-release port I/O) Base system — bus / platform / cpu · sys/bus/smbus/amdsmb/amdsmb.c:175 · pass 2 · new	none	untested
DF-5529	Info	1.9	urio_open: WRITE-stall flag updated without sc_lock, asymmetric with the locked READ path Base system — bus / platform / cpu · sys/bus/u4b/storage/urio.c:404 · pass 2 · new	lost stall-flag update -> one spurious/missed ENDPOINT_HALT clear	untested
DF-5567	Info	1.9	cb_dumpdata() has no PAGE_SIZE floor on di->maxiosize: a dump device reporting sub-page si_iosize_max makes chunk==0 and spins the panic-dump loop forever (no dump, silent hang) Base system — bus / platform / cpu · sys/platform/pc64/x86_64/dump_machdep.c:168 · pass 2 · new	silent panic-dump hang (no dump produced)	untested
DF-5569	Info	1.9	DRIVERSLEEP() divides by its usec argument with no zero guard (latent SIGFPE/vkernel panic; vkernel64-only divergence from pc64 twin) Base system — bus / platform / cpu · sys/platform/vkernel64/platform/systimer.c:358 · pass 2 · new	none	untested
DF-5598	Info	1.9	ichsmb_pci.c:175 wires device_detach to ichsmb_detach, whose device_delete_child() return is ignored (ichsmb.c:689) before unconditional IRQ/IO teardown, lockuninit and a lying success return — DF-5544/5545/5562 family residue, with every deterministic veto path caught one level up (live-proven) Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb_pci.c:175 · pass 2 · new	none	not_reproduced
DF-5599	Info	1.9	ichsmb_pci_attach requests 16 I/O-port bytes first while ICH5+ SMBus BARs decode 32 (64 under QEMU's ICH9) — on BIOS-unprogrammed BARs pci_alloc_map under-claims the decode window, leaving the tail bytes hardware-decoded but rman-unowned Base system — bus / platform / cpu · sys/bus/smbus/ichsmb/ichsmb_pci.c:233 · pass 2 · new	none	not_reproduced
DF-5606	Info	1.9	sys/bus/u4b/net/ruephy.c is an unbuildable FreeBSD-API orphan — dead weight carrying latent ifm_cur derefs (:145/:231) and the DF-5001 empty-media branch Base system — bus / platform / cpu · sys/bus/u4b/net/ruephy.c:47 · pass 2 · new	none	not_reproduced
DF-5644	Info	1.9	smbus_attach mints NAMELESS wildcard children that any driver on the smbus bus with probe priority above GENERIC can hijack: ipmi_smbus_probe's unconditional BUS_PROBE_DEFAULT claims the generic child and all 96 address children — /dev/smbN disappears on non-SSIF platforms and duplicates the SSIF instance on SSIF ones Base system — bus / platform / cpu · sys/bus/smbus/smbus.c:94 · pass 2 · new	none	untested
DF-5645	Info	1.9	smbus_attach's probe loop issues 96 real bus transactions without smbus_request_bus — the only transaction issuer in the tree that bypasses the sc->owner arbitration, interleaving with owned transfers on re-attach and stalling attach by ~96 controller timeouts Base system — bus / platform / cpu · sys/bus/smbus/smbus.c:95 · pass 2 · new	none	untested
DF-5651	Info	1.9	Proximity-domain association compares only ProximityDomainLo (ignores ProximityDomainHi and x2APIC entries): NUMA domains >= 256 silently dropped or organized under the wrong socket Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_srat.c:112 · pass 2 · new	none	untested
DF-5665	Info	1.9	FRAMEUP stack-walk heuristic accepts non-monotonic, non-aligned, non-contained frame pointers — a stale kernel %rbp can fault the chain walk (panic-only ceiling; hardening) Kernel memory corruption (UAF / OOB write) · sys/cpu/x86_64/misc/ktr.c:67 · pass 2 · new	none	untested
DF-4442	Info	1.8	Partially uninitialized mxt_message on the poller stack when the (device-controlled) T5 object size < 7 — stale stack bytes flow into the user-visible ELO pressure field Base system — drivers · sys/dev/smbus/atmel_mxt/atmel_mxt.c:917 · pass 2 · new	1-2 stale kernel stack bytes per ELO packet to the (already-root) device reader; physical-attacker/lying-device model	untested
DF-5319	Info	1.8	usbd_req_get_ss_hub_descriptor() length formula overflows struct usb_hub_ss_descriptor by one byte for nports >= 249 — latent kernel stack OOB write with device-controlled byte Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_request.c:1503 · pass 2 · new	1-byte device-controlled write past 42-byte stack struct if a caller forwards unclamped bNbrPorts	untested
DF-5491	Info	1.8	pcfintr slave-transmitter paths transmit an uninitialized kernel stack byte onto the I2C wire (callbacks never fill *buf) Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/pcf/pcf.c:396 · pass 2 · new	leak	untested
DF-3817	Low	1.6	mpr_log_evt_handler(): hexdump() of firmware event data with unvalidated device-controlled length — OOB heap read to console Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr.c:2065 · pass 2 · new	none	inconclusive
DF-3977	Low	1.6	ar5212GetLowerUpperValues with an empty pier list: uninitialized stack read (lp[0]) and 2-byte OOB stack read (ep[-1]) below tempChannelList, garbage pier selection can program MAX_RATE_POWER Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2639 · pass 2 · new	none	inconclusive
DF-4119	Low	1.6	Inverted error check at cypress_dpm_init:2059-2064 — ATOM engine-PLL reference divider used only on FAILURE (consuming uninitialized stack dividers), default used on success (cypress twin of DF-3976) Base system — drivers · sys/dev/drm/radeon/cypress_dpm.c:2059 · pass 2 · new	none	inconclusive
DF-5448	Info	1.6	uvscom_cfg_read_status() returns uninitialized kernel stack on a successful SHORT vendor control-IN (core actlen=NULL zeroization gap) — return value currently has no consumer, latent DF-1062/2342-class hazard Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/serial/uvscom.c:719 · pass 2 · new	none	untested
DF-3008	Low	1.1	devfs_find_device_by_devid/name return an unreferenced cdev: kern.devname sysctl (CTLFLAG_ANYBODY) reads si_name after devfs_lock is released — microscopic UAF-read race Kernel memory corruption (UAF / OOB write) · sys/vfs/devfs/devfs_core.c:910 · pass 2 · new	none	not_reproduced
DF-3070	Low	1.1	tmpfs_reg_resize shrink path: 'aobj->size = osize;' self-assignment dead store — swap-object size never reduced after truncate (intended aobj->size = nsize), live upstream Base system — filesystems · sys/vfs/tmpfs/tmpfs_subr.c:1055 · pass 2 · new	none	not_reproduced
DF-4234	Low	1.1	txp(4) attach error path leaks the 256 rb_sd swdesc kmallocs (and ifmedia) when txp_alloc_rings() fails after allocating them Base system — drivers · sys/dev/netif/txp/if_txp.c:948 · pass 2 · new	none	untested
DF-5080	Low	1.1	nsgphy_status() decodes 1000baseT from link-partner advertisement with no master/slave resolution (MSR) or fault (MSF) check, and never reports the master role (IFM_ETH_MASTER) Base system — drivers · sys/dev/netif/mii_layer/nsgphy.c:252 · pass 2 · new	none	untested
DF-5286	Low	1.1	samount parses uninitialized 8192-byte heap as block-limits geometry on short READ BLOCK LIMITS Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_sa.c:1961 · pass 2 · new	none	untested
DF-3155	Info	1.1	ext2 extent-block checksum verification is dead code — metadata_csum extent blocks are never verified, and the dormant implementation carries a latent eh_max-driven ~768KB OOB read Kernel memory leaks / uninitialized disclosure · sys/vfs/ext2fs/ext2_csum.c:375 · pass 2 · new	none	untested
DF-3451	Info	1.1	mld6_stop_listening mutates the shared MLD link-local templates without mld6_token — torn if_index embedding mis-addresses MLD DONE and mis-classifies the all-nodes comparison Base system — network stack · sys/netinet6/mld6.c:163 · pass 2 · new	none	untested
DF-3602	Info	1.1	Off-by-one OOB write in hdaa_pcmchannel_setup: ch->io[ret] = -1 with ret==16 writes one nid_t past nid_t io[16] Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pci/hda/hdaa.c:5317 · pass 2 · new	intra-object clobber only	untested
DF-3643	Info	1.1	Unchecked PHY-read return values: EEE decisions and PHY write-backs derived from uninitialized kernel stack Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ig_hal/e1000_ich8lan.c:959 · pass 2 · new	none	not_reproduced
DF-3767	Info	1.1	r100_cs_parse_packet0() off-by-one: '> n' boundary check permits auth[n] read one u32 past the const reg_safe_bm arrays Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r100.c:1392 · pass 2 · new	4-byte rodata OOB read, decision-only	untested
DF-3769	Info	1.1	gen8 3-level PPGTT insert walk advances pdpe with a 4-level wrap constant and no runtime bound: latent OOB walk of the 4-entry pdp->page_directory array (GEM_BUG_ON-only guard is a production no-op) Base system — drivers · sys/dev/drm/i915/i915_gem_gtt.c:1075 · pass 2 · new	none	untested
DF-4158	Info	1.1	vga_save_font()/vga_load_font() accept unvalidated glyph index and count — latent OOB-write API one caller away from a real overflow (user-influenced mouse_char already flows in) Base system — drivers · sys/dev/video/fb/vga.c:1189 · pass 2 · new	none	not_reproduced
DF-4446	Info	1.1	DF i2c bit-bang shim is a stub: every radeon bit-banged DDC/EDID transfer is a silent no-op and the whole bit-bang block of radeon_i2c.c is dead code on DragonFly (display detection dead on default config) Base system — drivers · sys/dev/drm/radeon/radeon_i2c.c:955 · pass 2 · new	none	untested
DF-4460	Info	1.1	drm_gem_create_mmap_offset_size commits the offset-hash + unr publication before drm_vma_offset_add() is known to succeed — failure leaves on_map=true, a leaked idx/hash slot, and a retry that reports success with no vma offset Base system — drivers · sys/dev/drm/drm_gem.c:566 · pass 2 · new	none	inconclusive
DF-4480	Info	1.1	ac97mix_setrecsrc() reads codec->mix[AC97_MIXER_SIZE] out of bounds when src==0 (latent OOB read; guard present upstream) Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pcm/ac97.c:1069 · pass 2 · new	Latent intra-object OOB read (mix[25] lands on name[]) + bogus RECSEL write + nonexistent 1<<25 return bit; no userspace disclosure	untested
DF-4540	Info	1.1	cxm_tuner: terminator-less band_codes[3]/assignments[17] walks rely on unenforced min_freq/min_channel data invariants - latent rodata OOB-read hazard (Info hardening) Kernel memory leaks / uninitialized disclosure · sys/dev/video/cxm/cxm_tuner.c:725 · pass 2 · new	none	untested
DF-4586	Info	1.1	mmgrab() reference on the DF shim mm_struct is a no-op (mm_count is never read) and dev_priv->mm_structs is keyed by the recyclable current->mm pointer: i915_mm_struct.mm dangles after process exit and can silently alias a later process Base system — drivers · sys/dev/drm/i915/i915_gem_userptr.c:322 · pass 2 · new	None in shipped config (all stale-pointer derefs compiled out; unpriv creates fail, root objects inert); becomes a genuine UAF/wrong-mm registration when the notifier path is ever enabled	untested
DF-4645	Info	1.1	ix(4): ixgbe_read_posted_mbx/ixgbe_write_posted_mbx dispatch to ops.read/ops.write with unvalidated size, bypassing the clamp/reject enforced only by the non-posted wrappers - latent OOB-to-MMIO and cross-VF-mailbox-spill footgun (twin of DF-4638 e1000_mbx); no in-tree caller (DF ix has no SR-IOV) Base system — drivers · sys/dev/netif/ix/ixgbe_mbx.c:224 · pass 2 · new	none	untested
DF-4810	Info	1.1	AHCI command-table stride ATA_AHCI_CT_SIZE=256 != sizeof(struct ata_ahci_cmd_tab)=1152: latent work-area OOB the moment per-tag (NCQ) dispatch is enabled Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/chipsets/ata-ahci.c:254 · pass 2 · new	none	untested
DF-4838	Info	1.1	amdgpu userptr MMU-notifier invalidation is entirely absent on DragonFly — inert shim, compiled-out amdgpu_mn.c, stubbed userptr ioctl; latent missed-invalidation GPU DMA + stripped-kref p->mn UAF if ever enabled Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_mn.c:72 · pass 2 · new	none	untested
DF-4885	Info	1.1	check_atom_bios() off-by-one/out-of-bounds heap reads: size==0x49 accepted then bios[0x49] read; memcmp reads up to 4 bytes past the buffer when bios_header_start+4==size Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_bios.c:52 · pass 2 · new	none	untested
DF-5060	Info	1.1	feed_format_init does not bound the channel count: AFMT's 5-bit channel field (up to 31) flows unvalidated into ialign/oalign sizing against a reservoir and FXDIV table dimensioned for SND_CHN_MAX — latent reservoir heap overflow and snd_fxdiv_table OOB index if a >SND_CHN_MAX-channel format ever becomes constructible Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/feeder_format.c:48 · pass 2 · new	none (latent invariant gap)	untested
DF-5088	Info	1.1	Generic I2C HW-engine chunker boundary defects (max_payload_size==1 degenerate unaddressed 1-byte chunking; zero-length payload rejected FAILED_INCOMPLETE; timeout omits in-batch stretch accounting) — latent only: unit proven dead code in this port Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96 · pass 2 · new	none	untested
DF-5112	Info	1.1	amdgpu_job_submit_direct latches *fence before checking the error and leaks ownership on failure — any future caller passing an uninitialized fence gets a wild kref_get (latent error-contract defect) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_job.c:164 · pass 2 · new	latent (no affected caller)	untested
DF-5122	Info	1.1	Legacy drm_mmap: page/byte hash-key mismatch, user-token double-count in phys math, and PFN/byte return-convention inconsistency — three latent memory-safety-relevant defects in a d_mmap handler unreachable on every shipped driver Base system — drivers · sys/dev/drm/drm_vm.c:91 · pass 2 · new	none	untested
DF-5123	Info	1.1	hypercall_md() inline asm violates the GCC extended-asm contract: %r8 lifetime unprotected between two separate asm statements; indirect-call asm missing caller-saved-register and memory clobbers Base system — drivers · sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:80 · pass 2 · new	none	not_reproduced
DF-5144	Info	1.1	Latent unchecked res_pool deref + lockless dc->current_state walk in dead public API dc_plane_get_status() Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_surface.c:115 · pass 2 · new	none	untested
DF-5159	Info	1.1	WARN-only range guards: silent 64-bit wrap in bw_int_to_fixed_nonconst / bw_frc_to_fixed / bw_mul in release builds Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:49 · pass 2 · new	none	untested
DF-5178	Info	1.1	hw_hpd set_config consumes the gpio_config_data tagged union's hpd member without validating config_data->type Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/gpio/hw_hpd.c:107 · pass 2 · new	latent tagged-union confusion -> masked MMIO mis-programming	untested
DF-5190	Info	1.1	vmalloc()/vzalloc()/vmalloc_user() implemented over plain kmalloc violate the Linux vmalloc contract (page alignment, whole-page ownership) that the legacy DRM _DRM_SHM userspace-mapping path is written against Base system — drivers · sys/dev/drm/linux_vmalloc.c:107 · pass 2 · new	none	untested
DF-5192	Info	1.1	Latent negative LRU bucket index in i915_gem_batch_pool_get walks cache_list[-1] and would write through the live engine pointer Base system — drivers · sys/dev/drm/i915/i915_gem_batch_pool.c:95 · pass 2 · new	none	untested
DF-5225	Info	1.1	amdgpu_vf_error: signed int ring counters used as modulo array indices — 2^31 wrap is signed-overflow UB and produces negative array-index writes (contained inside amdgpu_vf_error_buffer) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_vf_error.c:42 · pass 2 · new	latent signed-overflow UB, in-struct self-corruption ceiling	untested
DF-5233	Info	1.1	Underlay OPP constructed with NULL regs/shift/mask while every entry in its vtable dereferences regs (latent NULL-deref held off only by four cross-file invariants) Base system — drivers · sys/dev/drm/amd/display/dc/dce110/dce110_opp_v.c:39 · pass 2 · new	latent NULL-deref panic (display DoS)	untested
DF-5300	Info	1.1	usbd_get_iface() computes udev->ifaces + iface_index before bounds-checking iface_index — out-of-bounds/NULL-base pointer arithmetic on every call with an unvalidated index Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/usb_device.c:2237 · pass 2 · new	latent OOB pointer arithmetic	untested
DF-5671	Info	1.1	Stale MP-safety comment asserts a locked OR where code emits a nonlocked OR — safety of gd_spending pend path rests on an unstated, unenforced per-CPU invariant Base system — bus / platform / cpu · sys/platform/vkernel64/platform/ipl_funcs.c:45 · pass 2 · new	latent silently-lost soft interrupts if a future cross-CPU caller follows the comment	untested
DF-5401	Info	1.0	mos_intr_callback() counts every interrupt as an output error and copies 4 bytes regardless of actlen into a never-used local; mos_bulk_write_callback() double-counts opackets Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/net/if_mos.c:862 · pass 2 · new	non-canonical frames up the stack (DF-5400) / skewed interface stats (DF-5401)	untested
DF-3119	Low	0.8	flush_group refcount asymmetry: critical-error unmount decrements flg->refs for inodes that never incremented it Base system — filesystems · sys/vfs/hammer/hammer_flusher.c:423 · pass 2 · new	corruption	not_reproduced
DF-5245	Low	0.8	pmap_extract() KVA path duplicates the PDE validity check instead of testing the PTE — bogus non-zero physical address returned for unmapped kernel VA Base system — bus / platform / cpu · sys/platform/pc64/x86_64/pmap.c:1739 · pass 2 · new	none	untested
DF-2737	Info	0.8	Dead code: oid_running is never incremented, so the dynamic-oid teardown drain and CTLFLAG_DYING machinery in sysctl_remove_oid_locked are inoperative Kernel memory corruption (UAF / OOB write) · sys/kern/kern_sysctl.c:384 · pass 2 · new	none	untested
DF-2743	Info	0.8	DIOCGKERNELDUMP handled with no privilege check or FWRITE gate (diskioctl → disk_dumpconf → set_dumper) Privilege escalation (general use) · sys/kern/subr_disk.c:1186 · pass 2 · new	none	not_reproduced
DF-3007	Info	0.8	devfs_uninit passes NULL to devfs_msg_send — two stores through address 0 (latent; SYSUNINIT path dead on stock configs) Base system — filesystems · sys/vfs/devfs/devfs_core.c:1112 · pass 2 · new	none	not_reproduced
DF-3417	Info	0.8	in6_ifdetach purges UDP moptions from udbinfo[0] only while the IPv4 twin loops all CPUs — latent purge gap that is complete today only by accident of udp6_attach() Kernel memory corruption (UAF / OOB write) · sys/netinet6/in6_ifattach.c:818 · pass 2 · new	none	not_reproduced
DF-3522	Info	0.8	ng_bridge constructor leaks priv->tab on ng_make_node_common failure Base system — network stack · sys/netgraph/bridge/ng_bridge.c:310 · pass 2 · new	none	untested
DF-3549	Info	0.8	sys/netgraph7/ng_device.c is non-compilable, unwired FreeBSD-port rot (all defects latent) Base system — network stack · sys/netgraph7/ng_device.c:107 · pass 2 · new	none	untested
DF-3641	Info	0.8	bnx_sysctl_std_refill iterates bnx_tx_ringcnt while indexing bnx_rx_ret_ring[] (copy-paste): only min(tx,rx) rings updated; validation admits negative cntmax that wraps uint16_t Base system — drivers · sys/dev/netif/bnx/if_bnx.c:5684 · pass 2 · new	none	inconclusive
DF-3652	Info	0.8	ci_populate_mvdd_value returns -EINVAL unconditionally, so MemoryACPILevel.MinMvdd is always programmed as 0 (inverted success return) Base system — drivers · sys/dev/drm/radeon/ci_dpm.c:2355 · pass 2 · new	none	inconclusive
DF-3678	Info	0.8	mpt_cam detach/error-path memory leaks: els_cmd_ptrs and tgt_cmd_ptrs never freed; sas_portinfo freed without its phy_info array Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_cam.c:1198 · pass 2 · new	none	inconclusive
DF-3799	Info	0.8	validate_tx_req_id inverts its NULL check — latent NULL-pointer dereference on out-of-range TX req_id (currently dead code) Base system — drivers · sys/dev/virtual/amazon/ena/ena.c:1181 · pass 2 · new	mbuf leak / latent NULL-deref	untested
DF-4011	Info	0.8	COMPAT_FREEBSD32 shim is un-compilable dead code (undefined com/td, 5-arg mpr_ioctl call); native RAID_ACTION ioctl referenced but unimplemented Base system — drivers · sys/dev/raid/mpr/mpr_user.c:2425 · pass 2 · new	none	untested
DF-4017	Info	0.8	COMPAT_FREEBSD32 shim is un-compilable dead code (5-arg mps_ioctl call, undefined td); RAID_ACTION32 dispatches to an unimplemented ioctl (DF-4011 mpr twin) Base system — drivers · sys/dev/raid/mps/mps_user.c:2303 · pass 2 · new	COMPAT_FREEBSD32 shim is un-compilable dead code (5-arg mps_ioctl call, undefined td; RAID_ACTION32 dispatches to an unimplemented ioctl). DF-4011 mpr twin.	untested
DF-4230	Info	0.8	cyapa_poll_thread reads uninitialized regs.stat when the device stops responding — garbage byte drives the bootloader re-init state machine Base system — drivers · sys/dev/smbus/cyapa/cyapa.c:1164 · pass 2 · new	none	untested
DF-4436	Info	0.8	drm_universal_plane_init: format_count>64 error path returns without kfree(format_types) or drm_mode_object_unregister - leaks the format array and the mode-object id Base system — drivers · sys/dev/drm/drm_plane.c:193 · pass 2 · new	none	untested
DF-4464	Info	0.8	uguru_attach sensor-table loop writes sc_sensors[i] with no bound against UGURU_MAX_SENSORS — one table entry away from a kernel softc overflow Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/uguru/uguru.c:867 · pass 2 · new	Latent softc overflow if a future board table exceeds 27 entries (max today 26)	untested
DF-4489	Info	0.8	apply_below_the_range: BTR min-frame-duration clamp uses wrong constant (dead clamp) and computed min_frame_duration_in_ns is never used Base system — drivers · sys/dev/drm/amd/display/modules/freesync/freesync.c:250 · pass 2 · new	none	untested
DF-4716	Info	0.8	b_cmd=READ guard tests m.flags for XFR_BAD_SUBDISK (never set there) - condition always true, intended bad-subdisk exclusion dead Base system — drivers · sys/dev/raid/vinum/vinumraid5.c:536 · pass 2 · new	none	untested
DF-4959	Info	0.8	's' blink-spec filter typo `*s <= 'u'` accepts arbitrary characters as no-op blink ticks Base system — drivers · sys/dev/misc/led/led.c:169 · pass 2 · new	none	untested
DF-4960	Info	0.8	led_set() always returns 0, swallowing ENOMEM/ENOENT from its own logic (DragonFly divergence) Base system — drivers · sys/dev/misc/led/led.c:273 · pass 2 · new	none	untested
DF-4998	Info	0.8	hw.ral.msi_disable tunable is a no-op: pci_alloc_1intr receives ~ral_msi_disable, which is truthy for BOTH tunable values (0 → ~0 == 0xFFFFFFFF, 1 → ~1 == 0xFFFFFFFE) Base system — drivers · sys/dev/netif/ral/if_ral_pci.c:254 · pass 2 · new	none	untested
DF-4999	Info	0.8	generic_reg_wait prototype in dm_services.h transposes (mask, shift) vs the definition in dc_helper.c (shift, mask) — latent API-contract trap in the DC register hub; harmless today only because REG_WAIT's FN() expansion happens to match the definition Base system — drivers · sys/dev/drm/amd/display/dc/dc_helper.c:254 · pass 2 · new	none	untested
DF-5018	Info	0.8	radeon_mn.c is dead code: excluded from the kernel and module builds, gated on CONFIG_MMU_NOTIFIER which is never defined, and not even compilable if re-enabled (missing mmu_notifier compat API) Base system — drivers · sys/dev/drm/radeon/radeon_mn.c:90 · pass 2 · new	none	untested
DF-5031	Info	0.8	it_generic_stemp missing (int8_t) sign conversion for IT87xx temperature registers — sub-zero temps published as +128..+255 C under hw.sensors Base system — drivers · sys/dev/powermng/it/it.c:259 · pass 2 · new	none	untested
DF-5063	Info	0.8	Plexno()/Sdno() decode composite plex/sd minors with no bounds checks and propagate the -1 empty-slot sentinel into PLEX[-1].sdnos[] (latent heap OOB read; unreachable on current DragonFly) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumutil.c:261 · pass 2 · new	none	not_reproduced fixed
DF-5221	Info	0.8	framebuffer_alloc() ignores its size argument and never sets info->par — silent API-contract divergence, latent NULL-deref for any caller passing size > 0 Base system — drivers · sys/dev/drm/linux_compat.c:58 · pass 2 · new	bounded refcount/heap leak (DF-5219) / latent API trap (DF-5221)	untested
DF-5222	Info	0.8	drm_legacy_ioremapfree() bypasses linuxkpi iounmap() bookkeeping, permanently orphaning iomap_list entries for any kmod user of the exported wrapper pair Base system — drivers · sys/dev/drm/drm_memory.c:76 · pass 2 · new	none	untested
DF-5243	Info	0.8	PROBE_SERIAL_NUM_0 frees the VPD page list with the wrong malloc type (M_DEVBUF vs allocation's M_CAMXPT) — per-type accounting corruption, upstream-corrected divergence Base system — bus / platform / cpu · sys/bus/cam/cam_xpt.c:5922 · pass 2 · new	heap OOB comparison oracle / race-gated UAF / accounting drift	untested
DF-5379	Info	0.8	sub_info->uvc_info stores a dangling pointer to the initializer's dead stack frame (persisted in the heap control graph) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_ctrls.c:776 · pass 2 · new	latent stale-stack back-pointer in the heap control graph	untested
DF-5405	Info	0.8	sgread() parses the 12-byte old-sg header with uiomove short-copy semantics: pack_len/reply_len/pack_id left uninitialized when read() supplies fewer than 12 bytes Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_sg.c:764 · pass 2 · new	UAF-read driven control flow (DF-5404) / uninit stack tag match (DF-5405)	untested
DF-5549	Info	0.8	fwmem_close() frees the fwmem_softc with the wrong malloc type (M_FW instead of M_FWMEM) — per-type accounting corruption and wrong-type-free panic on debug builds Base system — bus / platform / cpu · sys/bus/firewire/fwmem.c:272 · pass 2 · new	corrupted per-type malloc accounting + wrong-type-free panic on debug builds	untested
DF-5621	Info	0.8	MWAIT hint word validated only in its low 8 bits: firmware-supplied GAS.Address bits 31:8 forwarded verbatim to MWAIT EAX (and GAS BitWidth vendor field never checked) Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_cstate_machdep.c:50 · pass 2 · new	forward-compat: reserved hint bits to MWAIT EAX	untested
DF-5670	Info	0.8	hw.acpi.reset_video is a dead control surface: sysctl+tunable registered by acpi_machdep_init() with zero consumers anywhere in sys/ Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_machdep.c:49 · pass 2 · new	none	untested
DF-5010	Info	0.7	vkd_doio performs COW-mode bcopy and backing-file pread/pwrite with no driver-level bounds check on bio_offset/b_bcount (latent arbitrary-offset OOB R/W in the vkernel host process; shielded today only by dscheck) Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vkernel/disk/vdisk.c:311 · pass 2 · new	none	not_reproduced fixed
DF-5252	Info	0.7	RT5592 TXWI extension: usbd_copy_in reads sizeof(data->desc)+4 bytes from data->desc, a 4-byte out-of-bounds read of desc/ridx/padding into the USB transfer buffer Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_run.c:3089 · pass 2 · new	UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252)	untested
DF-4050	Info	0.6	adjust_display_pll_v2 never executes the AdjustDisplayPll BIOS command (missing EXEC block; always returns BP_RESULT_FAILURE) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/bios/command_table.c:1457 · pass 2 · new	none	untested
DF-5398	Info	0.6	urndis(4) control channel: RNDIS response length never validated against the actually-transferred size — short device responses are parsed from stale sc_response_buf bytes Base system — bus / platform / cpu · sys/bus/u4b/net/if_urndis.c:418 · pass 2 · new	none	untested
DF-5412	Info	0.6	udav_csr_read1() ignores control-request failure and returns an uninitialized stack byte (error-masking; device-register influence only) Base system — bus / platform / cpu · sys/bus/u4b/net/if_udav.c:395 · pass 2 · new	none	untested
DF-4612	Low	0.5	init_transmitter_control steers handler selection with uninitialized stack byte crev when the VBIOS master command table lacks dig1transmittercontrol (v2 twin of DF-4047's sub-issue) Base system — drivers · sys/dev/drm/amd/display/dc/bios/command_table2.c:178 · pass 2 · new	none	not_reproduced
DF-4905	Low	0.5	k8pnow_states() PST walk advances past BIOS_START+BIOS_LEN with no bounds check (kernel OOB read of physical 0x100000+ region) Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/powernow/powernow.c:187 · pass 2 · new	none	untested
DF-5615	Low	0.5	fwdma_malloc leaks the dma_tag when bus_dmamem_alloc fails (the '/* XXX destory tag */' path) Base system — bus / platform / cpu · sys/bus/firewire/fwdma.c:94 · pass 2 · new	none (resource leak): one leaked bus_dma_tag (M_DEVBUF) per failed attach-time allocation; attach-error path only	untested
DF-2613	Info	0.5	Off-by-one bounds checks in SES config-page walkers allow a 1-byte heap over-read past the 8192-byte sdata allocation Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ses.c:1311 · pass 2 · new	none	inconclusive
DF-2934	Info	0.5	m_tag_alloc silently truncates int len/type into uint16_t m_tag_len/m_tag_id (allocation sized from untruncated len) Base system — kernel core (kern) · sys/kern/uipc_mbuf2.c:260 · pass 2 · new	none	untested
DF-3123	Info	0.5	Latent memory-safety landmines in the #if 0-disabled htree write path: heap memcpy overflow in the index-node split, four double-brelse-after-bwrite error paths, u16 reclen truncation at 64K blocks Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_htree.c:457 · pass 2 · new	none	untested
DF-3151	Info	0.5	HAMMER1 mirror ioctls: mirror->size unchecked in mirror_read and mirror->count unchecked in both paths — wrap-around bypasses the ubuf bounds guards (hardening) Base system — filesystems · sys/vfs/hammer/hammer_mirror.c:156 · pass 2 · new	none	untested
DF-3210	Info	0.5	krpc_call() early-error exits (socreate/sosetopt/sobind) leak the caller's request mbuf chain — md_mount/md_lookup_swap's 'message already freed' ownership contract is false Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_mountrpc.c:146 · pass 2 · new	none	untested
DF-3306	Info	0.5	expire_upcalls() frees bw meters without unschedule_bw_meter() — latent UAF (FreeBSD divergence; unreachable today) Kernel memory corruption (UAF / OOB write) · sys/net/ip_mroute/ip_mroute.c:1423 · pass 2 · new	none	untested fixed
DF-3335	Info	0.5	netmap_sw_to_nic() double-increments k1: skipped TX rings and latent kring array OOB (currently dead code — no d_poll wired) Base system — network stack · sys/net/netmap/netmap.c:798 · pass 2 · new	none	untested
DF-3461	Info	0.5	in6_cksum() sanity check bypassable via u32 wrap of off+len — intended panic becomes uncontrolled NULL-mbuf deref (defense-in-depth) Base system — network stack · sys/netinet6/in6_cksum.c:116 · pass 2 · new	none	untested
DF-3616	Info	0.5	ath_txq_addholdingbuf bounds check is off-by-one and comes after the OOB pointer arithmetic; ath_freebuf has no check at all (hardening, currently unreachable) Base system — drivers · sys/dev/netif/ath/ath/if_ath.c:4805 · pass 2 · new	latent one-past-end hardening	untested
DF-3676	Info	0.5	mpt_abort_target_ccb indexes trt[target_lun] without the MPT_MAX_LUNS guard every sibling target-mode XPT case has Base system — drivers · sys/dev/disk/mpt/mpt_cam.c:4631 · pass 2 · new	none	inconclusive
DF-3899	Info	0.5	Off-by-one bounds guard in intel_get_shared_dpll_id(): one-past-end pointer passes the WARN_ON and yields id == num_shared_dpll (== 7 == I915_NUM_PLLS on ICL) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_dpll_mgr.c:103 · pass 2 · new	none	untested
DF-4096	Info	0.5	emupchan_init feeds unchecked emu_valloc() NULL into emu_vinit() — latent NULL-pointer write (unreachable today, hardening) Base system — drivers · sys/dev/sound/pci/emu10k1.c:824 · pass 2 · new	none	inconclusive
DF-4131	Info	0.5	Latent stack OOB in oce_mbox_eqd_modify_periodic: protocol array delay[8] filled from set_eqd[OCE_MAX_EQ=32] with num<=neqs Kernel memory corruption (UAF / OOB write) · sys/dev/netif/oce/oce_mbox.c:1795 · pass 2 · new	none	not_reproduced
DF-4282	Info	0.5	drm addmap/rmmap validation gaps: unbounded _DRM_SCATTER_GATHER offset, x86_64 offset-wrap check compiled out, RM_MAP lacks ownership check (tokens enumerable via unauthenticated GET_MAP) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_bufs.c:311 · pass 2 · new	Currently theoretical (root-gated creation + the mmap units mismatch).	untested
DF-4361	Info	0.5	select_tuner() bounds the tuners[] dispatch index on the upper side only — a negative tuner type would install an out-of-bounds TUNER pointer that consumers dereference (hardening) Base system — drivers · sys/dev/video/bktr/bktr_tuner.c:710 · pass 2 · new	none	untested
DF-4380	Info	0.5	Latent divide-by-zero family in calculate_ss: unvalidated ATOMBIOS spread-spectrum percentage_divider and modulation rate (runtime-dead today: ENABLE_SS hardcoded 0) Base system — drivers · sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:673 · pass 2 · new	Latent divide-by-zero family in calculate_ss (percentage_divider / modulation rate / modulation_time); runtime-dead today because ENABLE_SS is hardcoded 0 at both producers. Becomes a crafted-VBIOS #DE panic the moment any change wires it.	untested
DF-4384	Info	0.5	set_dp_phy_pattern_80bit_custom() ignores param->custom_pattern_size and unconditionally reads pattern[0..9] (latent OOB read for future callers) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dcn10/dcn10_link_encoder.c:292 · pass 2 · new	none	untested
DF-4411	Info	0.5	acpi_asus probe/attach mutate the driver-wide static model tables (non-idempotent probe, cross-device state contamination) Base system — drivers · sys/dev/acpi/acpi_asus/acpi_asus.c:682 · pass 2 · new	none	untested
DF-4417	Info	0.5	wal_add() leaks the previous W/A list kmalloc on every growth step; i915_wa_lists are never freed at teardown Base system — drivers · sys/dev/drm/i915/intel_workarounds.c:604 · pass 2 · new	none	untested
DF-4449	Info	0.5	audio_regs[] defines 6 entries while res_cap.num_audio=7 — the audio_regs[6] global-out-of-bounds fixed upstream in 44035ec2fde1 (KASAN, Cc:stable) is latent in this tree behind resource_construct's pipe_count cap Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:322 · pass 2 · new	none	untested
DF-4456	Info	0.5	radeon_crtc_do_set_base returns 'false' (0 = success) for unsupported framebuffer formats Base system — drivers · sys/dev/drm/radeon/radeon_legacy_crtc.c:417 · pass 2 · new	Swallowed error masquerading as success: unsupported fb formats leave stale scanout while modeset reports success (DRM-master-only)	untested
DF-4463	Info	0.5	amdtemp_detach frees dev.cpu.N.temperature oids but leaves dangling entries in the cpu devices' sysctl contexts — latent UAF if a cpu device is ever destroyed Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/amdtemp/amdtemp.c:674 · pass 2 · new	Latent UAF/double-free if a cpu device is ever hot-destroyed (none today - pc64 cpu driver has no detach)	untested
DF-4491	Info	0.5	intel_lvds_init failed-path leaks the DDC EDID buffer when the EDID yields no preferred mode Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_lvds.c:1001 · pass 2 · new	One-shot boot/probe-time heap leak (up to EDID size) per driver load; no unpriv trigger, no disclosure, no UAF	untested
DF-4499	Info	0.5	amdgpu_amdkfd_gfx_v9: entire KFD backend is dead code on DragonFly; latent unvalidated vmid/engine_id index arithmetic should be guarded before KFD is ever enabled Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:291 · pass 2 · new	none	inconclusive
DF-4536	Info	0.5	lptopen() sc_state check-then-set TOCTOU: double open double-allocates and the paired closes double-free the same M_LPT chunks (latent — currently blocked by the mplock) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/lpt/lpt.c:458 · pass 2 · new	none	not_reproduced
DF-4547	Info	0.5	lm_setup_sensors copies sensor tables into sc->sensors[WB_MAX_SENSORS] with no bound — w83792d_sensors already fills all 19 slots, zero headroom Base system — drivers · sys/dev/powermng/lm/lm78.c:635 · pass 2 · new	None today; defense-in-depth against a future one-row change turning into a softc overflow at probe	untested
DF-4565	Info	0.5	Unbounded flicker-filter table index: a non-matching flicker_removal exits the SLOPE_limit walk at i==5 and reads SLOPE_value[5]/YCOEF_value[5]/YCOEF_EN_value[5] one element past the [5]-element arrays (latent; unreachable with current constants) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_legacy_tv.c:647 · pass 2 · new	none	untested
DF-4574	Info	0.5	adw_init_chip restores the saved BIOS image to the wrong LRAM base (addr + ADW_MC_BIOSLEN instead of addr + ADW_MC_BIOSMEM): 16-byte-shifted restore smears BIOS bytes over microcode variables 0x9C/0x9E and leaves 0x40-0x4F clobbered Base system — drivers · sys/dev/disk/advansys/adwlib.c:353 · pass 2 · new	Chip-internal correctness only: WDTR_ABLE/SDTR_ABLE LRAM words hold arbitrary BIOS bytes (negotiation misbehavior on the EEPROM-checksum-failed corner); no host memory impact	untested
DF-4578	Info	0.5	amdgpu_amdkfd_gfx_v8: entire gfx8 KFD backend is dead code on DragonFly; latent unvalidated vmid/engine index arithmetic and a structurally broken fw-NULL guard must be fixed before KFD is ever enabled (gfx8 sibling of DF-4499) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:245 · pass 2 · new	none	untested
DF-4638	Info	0.5	ig_hal: e1000_read_posted_mbx/e1000_write_posted_mbx dispatch to ops.read/ops.write with unvalidated size, bypassing the read-clamp/write-reject discipline enforced only by the non-posted wrappers — latent kernel-buffer overflow footgun on the live igb VF path Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ig_hal/e1000_mbx.c:246 · pass 2 · new	none demonstrated (latent API hazard): any future caller of e1000_read_posted_mbx/e1000_write_posted_mbx with size > mbx->size(16) gets an unconditional ops.read/ops.write word loop (e1000_mbx.c:476-477/:512-513/:697-698/:736-737) past its buffer — kernel overflow with PF-controlled mailbox content plus OOB E1000_VMBMEM register-array writes; all in-tree callers (e1000_vf.c) pass sizes 1/2/3/16 with correctly sized buffers	untested
DF-4667	Info	0.5	phm_wait_on_indirect_register passes (mask, value) to a (index, value, mask) callee — swapped arguments, currently latent Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:145 · pass 2 · new	None today (sole caller passes value==mask); future callers could silently skip an SMC firmware-ready handshake and race the microcontroller during clock/voltage programming	untested
DF-4736	Info	0.5	Unguarded indirect call dev_priv->display.hpd_irq_setup() in intel_hpd_irq_handler() — guard asymmetry vs sibling call sites (latent NULL function-pointer call) Base system — drivers · sys/dev/drm/i915/intel_hotplug.c:483 · pass 2 · new	none	inconclusive
DF-4768	Info	0.5	psp_cmd_submit_buf ignores resp.status when ucode==NULL: TMR/ASD firmware-command failures silently reported as success Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_psp.c:137 · pass 2 · new	none	inconclusive
DF-4788	Info	0.5	Pin-busy bitmap indexed by unbounded caller-supplied en (no number_of_pins bound) and NULL create_generic/sync/gsl creator pointers invoked unchecked Base system — drivers · sys/dev/drm/amd/display/dc/gpio/gpio_service.c:197 · pass 2 · new	none	untested
DF-4790	Info	0.5	Dead debug printers carry latent unvalidated firmware-count walks (mpr_print_evt_sas NumEntries) and mpr_describe_table relies on a sentinel-plus-one convention Base system — drivers · sys/dev/raid/mpr/mpr_table.c:72 · pass 2 · new	none	untested
DF-4811	Info	0.5	aps(4): every EC transaction reads and writes I/O port 0x161F, one byte past the driver's allocated 0x1f-byte I/O resource window Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/aps/aps.c:102 · pass 2 · new	none	untested
DF-4861	Info	0.5	aux_engine_funcs.configure left NULL in the dce110 (and all i2caux) AUX engine func tables while dal_i2caux_configure_aux() invokes it unconditionally — latent NULL function-pointer call/panic on any future caller Base system — drivers · sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:451 · pass 2 · new	panic	untested
DF-4912	Info	0.5	Dead stats module carries a latent length==0 off-by-one OOB write in mod_stats_update_event (unsigned wrap → event_string[-1]); module not compiled by any Makefile — delete it or guard Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/modules/stats/stats.c:316 · pass 2 · new	none	untested
DF-4921	Info	0.5	Parent-NIC softc type confusion gated only by 4-char driver-name prefix (strncmp "stge") Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mii_layer/ip1000phy.c:435 · pass 2 · new	none	untested
DF-4934	Info	0.5	dig_encoder_sel_to_atom computes a 7-case DIGx_SEL mapping then discards it with literal 'return 0' (v2; DF-2030 dce110 sibling; upstream-intended dead code) Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper2_dce112.c:151 · pass 2 · new	none	untested
DF-4936	Info	0.5	dig_encoder_sel_to_atom dead 7-case mapping discarded by literal 'return 0' (v1 twin of DF-2030; file additionally dead code on genuine hardware) Base system — drivers · sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper_dce112.c:151 · pass 2 · new	none	untested
DF-4984	Info	0.5	dm_target_snapshot.c is unbuildable, unregistered dead scratch code (dmirror DF-4973 class) whose latent memory-safety bugs — cross-allocator free, double-unbusy refcount underflow, NULL-deref panics — must never be revived; delete it Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/snapshot/dm_target_snapshot.c:113 · pass 2 · new	none	untested
DF-5034	Info	0.5	acquire_i2c_hw_engine bounds the signed gpio_ddc_line index only above (line < GPIO_DDC_LINE_COUNT): GPIO_DDC_LINE_UNKNOWN(-1) passes and reads i2c_hw_engines[-1] — dce110 twin of DF-2089 (dce80) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:98 · pass 2 · new	none	untested
DF-5036	Info	0.5	Shared family constructor dal_i2caux_dce110_construct indexes callee-static 6-entry hw_ddc_lines[]/hw_aux_lines[] with the caller-supplied num_i2caux_inst — latent OOB read feeding an unbounded engine-array store (DF-4827 pattern-class) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:127 · pass 2 · new	none	untested
DF-5056	Info	0.5	smu10_smu_init error paths leave hwmgr->smu_backend dangling after kfree(priv) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/smu10_smumgr.c:232 · pass 2 · new	latent UAF hardening, not reachable in this tree	untested
DF-5069	Info	0.5	psm_fini_power_state_table() leaves hwmgr->boot_ps and hwmgr->uvd_ps dangling into the freed hwmgr->ps allocation (incomplete cleanup; no in-tree reader today) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:102 · pass 2 · new	none	untested
DF-5090	Info	0.5	ruephy(4) is dead code — unreachable carrier of the DF-4930/DF-5001 empty-media attach-panic leaf and the DF-1973/DF-5009 service KASSERT: no NIC driver named "rue" exists anywhere in DragonFly Base system — drivers · sys/dev/netif/mii_layer/ruephy.c:96 · pass 2 · new	none	untested
DF-5099	Info	0.5	joyopen/joyclose exclusive-access protocol is an unsynchronized check-then-set (TOCTOU) — EBUSY exclusivity bypass Base system — drivers · sys/dev/misc/joy/joy.c:159 · pass 2 · new	none	inconclusive
DF-5101	Info	0.5	Non-atomic, lock-inconsistent dev->irq_enabled test-and-clear in drm_irq_uninstall() admits double driver->irq_uninstall()+free_irq(), amplified into a double-free/UAF by the unlocked free_irq() lookup in linux_irq.c Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_irq.c:182 · pass 2 · new	none	inconclusive
DF-5107	Info	0.5	SCDC channel-lock status bit macros use '<' comparison instead of '<<' shift: SCDC_CH0_LOCK==0 (channel-0 lock undetectable) and SCDC_CH_LOCK_MASK aliases SCDC_CLOCK_DETECT Base system — drivers · sys/dev/drm/drm_scdc_helper.c:53 · pass 2 · new	latent logic defect (no runtime path)	untested
DF-5118	Info	0.5	dcons_crom_detach half-clears the global dcons state: dcons_conf->dma_map is left dangling over the map freed two lines below and the module-static dcons_paddr is never reset — a re-attached dcons_crom takes dmamap_cb's 'already set' early-return and can never re-wire dcons_conf, silently disabling DMA sync; memory safety rests solely on the incidental dma_tag!=NULL guards in dcons_os.c Kernel memory corruption (UAF / OOB write) · sys/dev/misc/dcons/dcons_crom.c:199 · pass 2 · new	none	untested
DF-5142	Info	0.5	rdrand_rng() asm loop body executes unconditionally: called with limit < 8 it writes a full 8-byte RDRAND word past a sub-word buffer Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/rdrand/rdrand.c:85 · pass 2 · new	latent 8B OOB write on sub-word call / GPU DMA to aliased physical pages	untested
DF-5147	Info	0.5	dcons_load_buffer() trusts wire-supplied buffer geometry (sizes, ooffset/ioffset, 24-bit pos) with an overflowable sum-only sanity check — latent arbitrary-displacement OOB read/write primitive in dead-but-exported module code Kernel memory leaks / uninitialized disclosure · sys/dev/misc/dcons/dcons.c:158 · pass 2 · new	none	untested
DF-5152	Info	0.5	if_ath_alq.c is permanently dead, unportable code on DragonFly: ATH_DEBUG_ALQ cannot be defined (commented out of sys/conf/options) and the FreeBSD ALQ API it calls does not exist anywhere in the DF tree Base system — drivers · sys/dev/netif/ath/ath/if_ath_alq.c:58 · pass 2 · new	none as shipped (dead TU); latent strncpy/race on revival	untested
DF-5154	Info	0.5	dpt_pci_attach() leaks parent_dmat on the dpt_init() failure path — dpt_free()'s init_level ladder never destroys the DMA tag the PCI glue created Base system — drivers · sys/dev/raid/dpt/dpt_pci.c:143 · pass 2 · new	none	untested
DF-5156	Info	0.5	orm_identify() scan loop lacks a MAX_ROMS bound — latent OOB write past the 196-byte orm_softc (rid[]/res[]), currently unreachable because the ISA bus caps SYS_RES_MEMORY rids at ISA_NMEM=8 Kernel memory corruption (UAF / OOB write) · sys/dev/misc/orm/orm.c:104 · pass 2 · new	none	not_reproduced
DF-5164	Info	0.5	amdgpu_atombios_i2c_channel_trans() omits the memset of its stack atom parameter block that its sibling performs — defense-in-depth only, every struct byte is coincidentally initialized today Base system — drivers · sys/dev/drm/amd/amdgpu/atombios_i2c.c:169 · pass 2 · new	none	untested
DF-5172	Info	0.5	vcdstrategy() drains sc->bio_queue with no serialization — latent SMP TAILQ-corruption race, shielded today only by the missing D_MPSAFE flag (mplock) Base system — drivers · sys/dev/virtual/vkernel/cdrom/vcd.c:148 · pass 2 · new	none	not_reproduced
DF-5174	Info	0.5	Operator-precedence bug in ata_jmicron_ident: '& 0x02 >> 1' tests bit 0 of config 0x40 instead of bit 1, misidentifying the AHCI/PATA function in the device description Base system — drivers · sys/dev/disk/nata/chipsets/ata-jmicron.c:58 · pass 2 · new	cosmetic description string	untested
DF-5185	Info	0.5	intel_guc_ads_create() indexes GUC_MAX_ENGINES_NUM-sized ADS arrays with sparse engine->guc_id (hw_id) values — out-of-bounds array writes on ICL (VCS3_HW=6) that stay contained inside the packed blob but corrupt GuC-visible ADS fields Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_guc_ads.c:109 · pass 2 · new	corrupted GuC-visible ADS data (in-blob contained)	untested
DF-5188	Info	0.5	ttm_agp_backend.c is dead, un-compilable, half-ported code: excluded from every build (CONFIG_AGP undefined, asm/agp.h absent), and if ever revived carries a pages-vs-bytes 8x under-allocation (heap OOB write in the bind loop) plus an agp_memory leak on every AGP rebind Base system — drivers · sys/dev/drm/ttm/ttm_agp_backend.c:60 · pass 2 · new	latent: 8x heap OOB write of page pointers + unbounded kernel agp_memory leak, only if the dead backend is ever compiled in; impact today: none	untested
DF-5196	Info	0.5	warp_update() wrap off-by-one: star coordinate resting at exactly SCRW*SCRH is drawn and erased at vid[64000], one byte past the 64000-byte M_VGA_CG320 framebuffer (`>` must be `>=`) Base system — drivers · sys/dev/misc/syscons/warp/warp_saver.c:72 · pass 2 · new	none	untested
DF-5236	Info	0.5	Dead FPGA-diagnostics hw_translate installs an all-NULL function table: activating the MAXIMUS env would turn every GPIO id/offset translation into an immediate NULL function-pointer call (kernel panic) Base system — drivers · sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_translate_diag.c:34 · pass 2 · new	none	untested
DF-5237	Info	0.5	cxm_dec_fw: decoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in Kernel memory leaks / uninitialized disclosure · sys/dev/video/cxm/cxm_dec_fw.c:3 · pass 2 · new	latent rodata OOB read DMA'd to card, no userspace read-back	untested
DF-5238	Info	0.5	cxm_enc_fw: encoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in (twin of the dec_fw finding) Kernel memory leaks / uninitialized disclosure · sys/dev/video/cxm/cxm_enc_fw.c:3 · pass 2 · new	latent rodata OOB read DMA'd to card, no userspace read-back	untested
DF-5275	Info	0.5	cdregister(): cdchanger leaked on camq_init failure and callout_init'd twice Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_cd.c:889 · pass 2 · new	CCB double-release UAF family (DF-5274) / attach-time leak (DF-5275)	untested
DF-5291	Info	0.5	pmap_growkernel() PDP-page branch allocates the new PDP page without vm_page_wire() (the PT branch wires at :1623) — latent reclaim/reuse of an installed kernel page-directory-pointer page Base system — bus / platform / cpu · sys/platform/vkernel64/platform/pmap.c:1584 · pass 2 · new	wrong-page /dev/kmem I/O (DF-5290) / latent PDP reclaim (DF-5291)	untested
DF-5317	Info	0.5	USB_FS_STOP bounds-checks u.pstop->ep_index but indexes the array with u.pstart->ep_index — latent union type-confusion, benign only because the two ioctl structs are layout-identical Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_generic.c:1435 · pass 2 · new	latent unchecked index (DF-5317) / unpriv log flooding (DF-5318)	untested
DF-5354	Info	0.5	usb_temp_setup() correctness silently depends on scratch-union aliasing between temp_setup and hw_ep_scratch Base system — bus / platform / cpu · sys/bus/u4b/template/usb_template.c:1247 · pass 2 · new	refactor trap toward bad free / leak on gadget bring-up	untested
DF-5390	Info	0.5	write_started/read_started are never set anywhere — the compensating-STOP cleanup in set_slave_addr() is dead code Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_iic.c:266 · pass 2 · new	SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps	untested
DF-5429	Info	0.5	Error-path hygiene in the v4l2 layer: uninitialized return + leak in uvc_v4l2_reg(), ignored devfs_set_cdevpriv() in open(), NULL check after deref in query_cap() Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_v4l2.c:125 · pass 2 · new	defensive correctness only	untested
DF-5441	Info	0.5	EVPD/page-code INQUIRY branch leaves descr->timeout stale (zero on first use), feeding an unconfigured timeout into the CTIO engine Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_targ_bh.c:565 · pass 2 · new	per-attach softc leak + speculative abort-refusing-SIM UAF (DF-5440) / stale CTIO timeout (DF-5441)	untested
DF-5469	Info	0.5	lookup_res() rid aliasing: truncating PCI_RID2BAR division maps unaligned rids (0x11-0x13, 0x15-0x17, ...) onto the lower BAR's cache slot while bus_alloc_resource programs config space at the unaligned offset Base system — bus / platform / cpu · sys/bus/pci/vga_pci.c:425 · pass 2 · new	rid-alias cache confusion for buggy children	untested
DF-5492	Info	0.5	Lifecycle gaps: no device_detach/shutdown methods, probe-time resource allocation, and an attach-error path that permanently leaks the ISA ioport and IRQ Base system — bus / platform / cpu · sys/bus/iicbus/pcf/pcf.c:104 · pass 2 · new	none	untested
DF-5499	Info	0.5	passioctl() runs CAMIOCOMMAND/CAMGETPASSTHRU with no periph reference across unkillable blocking sleeps (DF-5273/5327 hold/release class) — latent premature-free/UAF, currently blocked by devfs close semantics Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_pass.c:451 · pass 2 · new	none	not_reproduced
DF-5570	Info	0.5	ECAM config path (pciereg_cfgread/cfgwrite) skips the bytes and alignment validation that the type-1 path enforces Base system — bus / platform / cpu · sys/bus/pci/x86_64/pci_cfgreg.c:322 · pass 2 · new	device-semantics confusion from a future buggy kernel caller; confined to ECAM mapping	untested
DF-5572	Info	0.5	Latent NULL-deref and wrong-CPU binding in #ifdef notyet cpu attachment block (cpu_add_child) Base system — bus / platform / cpu · sys/bus/pci/x86_64/legacy.c:316 · pass 2 · new	wrong per-CPU device binding + NULL-write panic path when the block is ever enabled	untested
DF-5585	Info	0.5	Quirk-apply fast path trusts stale pf / absent pf_last state: latent write-after-free and NULL-page write (unreachable with the shipped quirk table) Kernel memory corruption (UAF / OOB write) · sys/bus/pccard/pccard_cis_quirks.c:248 · pass 2 · new	none	untested
DF-5602	Info	0.5	ig4_pci.c:236's device_detach wiring runs child deletion with unchecked device_delete_child() returns (ig4_iic.c:690/694) before unconditional IRQ/MSI/MMIO teardown and a success return — DF-5544/5545/5562/5598 detach-veto family residue; every deterministic veto is caught one level up in this driver Base system — bus / platform / cpu · sys/bus/smbus/ichiic/ig4_pci.c:207 · pass 2 · new	none	untested
DF-5612	Info	0.5	cpu_enable_intr()/cpu_unmask_all_signals() implement 'restore' as an absolute sigsetmask(0) — not nesting-aware, silently discards any unrelated blocked-signal state Base system — bus / platform / cpu · sys/platform/vkernel64/platform/machintr.c:198 · pass 2 · new	none	untested
DF-5666	Info	0.5	bios_sigsearch(9) performs no parameter sanity checks: paralen==0 infinite-loops the kernel, negative paralen/sigofs walk outside the BIOS scan window (kernel-API robustness; all in-tree callers pass constants) Kernel memory leaks / uninitialized disclosure · sys/platform/pc64/x86_64/bios.c:67 · pass 2 · new	none	untested
DF-5731	Info	0.5	db_get_value/db_put_value clamp only the upper bound of size; size<=0 would wrap to a huge size_t in db_read_bytes/db_write_bytes' unbounded byte loops Base system — libkern / libprop / ddb · sys/ddb/db_access.c:79 · pass 2 · new	none	not_reproduced
DF-5778	Info	0.5	Unguarded irq_service->funcs->to_dal_irq_source double-deref in dal_irq_service_to_irq_source plus swallowed dal_irq_service_construct failure — latent NULL-deref hardening gap (asymmetric with every sibling entry point) Base system — drivers · sys/dev/drm/amd/display/dc/irq/irq_service.c:53 · pass 2 · new	none	untested
DF-5224	Info	0.4	bios_get_image()'s sole bounds check uses wrap-prone 32-bit offset+size arithmetic — the security boundary for ~60 DC atombios parser dereferences, latent only (all current callers are uint16-bounded) Base system — drivers · sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:40 · pass 2 · new	none	untested
DF-5438	Info	0.4	ulpt_status_callback consumes uninitialized stack byte on short/zero-length status replies Base system — bus / platform / cpu · sys/bus/u4b/serial/ulpt.c:295 · pass 2 · new	none	untested
DF-5439	Info	0.4	ulpt_attach alt-setting scan counter is uint8_t and wraps with >=256 crafted alt settings Base system — bus / platform / cpu · sys/bus/u4b/serial/ulpt.c:523 · pass 2 · new	none	untested
DF-4496	Low	0.3	dce100_create_resource_pool leaks the kzalloc'd dce110_resource_pool shell on construct() failure (DF-4318/4353/4376 family twin) Base system — drivers · sys/dev/drm/amd/display/dc/dce100/dce100_resource.c:1060 · pass 2 · new	none	untested
DF-3986	Info	0.3	cayman_init dropped the CP1/CP2 compute-ring r600_ring_init (upstream and in-tree si.c/cik.c have them) — cayman_cp_resume evaluates order_base_2(0) = 1UL<<64 (C-standard UB) and programs CP_RB1/CP_RB2_CNTL/BASE with zero-size garbage on every Cayman/Aruba boot Base system — drivers · sys/dev/drm/radeon/ni.c:2434 · pass 2 · new	none	inconclusive
DF-3976	Info	0.2	Inverted error check at btc_dpm_init:2602-2607 — ATOM-computed PLL reference divider used only when radeon_atom_get_clock_dividers FAILS (default used on success) Base system — drivers · sys/dev/drm/radeon/btc_dpm.c:2602 · pass 2 · new	none	inconclusive
DF-3943	Medium	—	resource_build_scaling_params INTERLACE error path leaves shared dc_stream_state.dst.height permanently doubled (compounding signed-int overflow) Base system — drivers · sys/dev/drm/amd/display/dc/core/dc_resource.c:1119 · pass 2 · new	none	not_reproduced
DF-3984	Medium	—	ORB completion matching is address-only across ORB recycling (OCB_MATCH compares just orb_lo): a replayed management-ORB status completes the recycled command ORB — premature bus_dmamap_unload while device DMA is live and spurious CAM_REQ_CMP with device-chosen status Base system — drivers · sys/dev/disk/sbp/sbp.c:156 · pass 2 · new	none	inconclusive
DF-5328	Medium	—	cam_periph_alloc() TOCTOU on the borrowed cam_periph_find() pointer: camperiphfree() can free the periph between find() and the unlocked NEW_DEV_FOUND/deferred_callback stores (UAF write), and camperiphfree() can see the flag set before deferred_callback is published (NULL/garbage indirect call) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_periph.c:176 · pass 2 · new	none observed; code-level race: camperiphfree() can free the periph inside cam_periph_alloc()'s find()->flag-store window (UAF write into freed 144B M_CAMPERIPH chunk) and camperiphfree() can observe CAM_PERIPH_NEW_DEV_FOUND with an unpublished NULL deferred_callback -> indirect call through NULL/garbage	not_reproduced
DF-3060	Low	—	dm_fdlist is walked and mutated without any common lock — nresolve's TAILQ scan races dirfs_node_setpassive's INSERT/REMOVE on SMP vkernels (UAF / list corruption) Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vnops.c:171 · pass 2 · new	none	not_reproduced
DF-4957	Low	—	ciphy_attach 'no media present' branch skips all media setup → miibus_mediainit calls ifmedia_set on an EMPTY list → panic("ifmedia_set") at attach on zero-capability PHYs Base system — drivers · sys/dev/netif/mii_layer/ciphy.c:142 · pass 2 · new	none	not_reproduced
DF-5410	Low	—	vkernel sys_sigreturn calls npxpop without the critical section pc64 has — FPU ownership-state race (npxdna panic class) Base system — bus / platform / cpu · sys/platform/vkernel64/x86_64/cpu_regs.c:447 · pass 2 · new	none	not_reproduced
DF-5084	Info	—	radeon_agp.c treats ai_aperture_size (BYTES tree-wide) as MB — dead <32MB guard and 2^20x-inflated gtt_size mis-programming GPU DMA-window registers; latent only (IS_ENABLED(CONFIG_AGP)==0, code not compiled on DragonFly) Base system — drivers · sys/dev/drm/radeon/radeon_agp.c:152 · pass 2 · new	none	not_reproduced
DF-5199	Info	—	virtual_str_enc_funcs omits 7 ops (NULL) — latent NULL function-pointer call if virtual encoders are ever instantiated and cross-assigned to a real DP stream by the allocator fallback Base system — drivers · sys/dev/drm/amd/display/dc/virtual/virtual_stream_encoder.c:77 · pass 2 · new	latent NULL function-pointer call (DoS)	untested
DF-5207	Info	—	virtual_lnk_enc_funcs omits 6 of 18 link_encoder_funcs ops (NULL) with 4 unguarded call sites in DC core — latent NULL function-pointer call if virtual link encoders are ever instantiated Base system — drivers · sys/dev/drm/amd/display/dc/virtual/virtual_link_encoder.c:86 · pass 2 · new	latent NULL function-pointer call (DoS)	untested
DF-2597	High	9.8	TCP-MD5 signature option writes past 40-byte opt[] stack buffer with no bounds check Kernel memory corruption (UAF / OOB write) · sys/netinet/tcp_output.c:186	none	not_reproduced
DF-0285	High	9.6	Remote heap overflow via unchecked MESHID IE length in ieee80211_parse_meshid Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_mesh.c:3456	Real CWE-787 heap OOB write in ieee80211_parse_meshid (up to 223 bytes) reaching ni_mltimer.toc / ni_mlhtimer.toc pointers => indirect function-pointer-control RCE surface on wifi-equipped MBSS hosts; NOT runtime-triggerable on this KVM guest (no wifi hardware).	inconclusive
DF-0326	High	9.6	Remote heap overflow: unbounded SSID IE length copied into fixed 32-byte ni_essid Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_node.c:815	remote-unauth heap overflow corrupting ni_chan kernel pointer (panic/DoS minimum, code-exec plausible) on any host with a wlan radio	inconclusive
DF-0428	High	9.6	pfsync_input has no source/peer authentication: any on-link host can inject/modify/destroy pf state Base system — network stack · sys/net/pf/if_pfsync.c:462	none	not_reproduced
DF-0430	High	9.3	Unauthenticated PFSYNC_ACT_CLR/DEL/DEL_C let attacker mass-destroy arbitrary pf state across all CPUs Base system — network stack · sys/net/pf/if_pfsync.c:542	none	not_reproduced
DF-1125	High	9.3	Unvalidated FCP response/sense lengths cause OOB read from kernel stack (24XX FC) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/isp/isp.c:5225	leak	inconclusive
DF-0704	Medium	9.1	No length validation on received sync datagram — type field and struct casts read without bounds check Base system — network stack · sys/net/ipfw3_basic/ip_fw3_sync.c:208	none	not_reproduced
DF-1215	Critical	8.8	METEORSVIDEO ioctl allows unprivileged user to set arbitrary physical DMA target address Kernel memory corruption (UAF / OOB write) · sys/dev/video/bktr/bktr_core.c:1396	none	inconclusive fixed
DF-1020	High	8.8	OOB heap write in fw_bus_explore_callback via wire-controlled ongoaddr jump -> arbitrary 4-byte kernel heap write Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/firewire.c:1500	none	inconclusive
DF-0269	Medium	8.8	Stack buffer overflow in sppp_print_bytes: VLA sized len but hexncpy writes 3*len bytes Kernel memory corruption (UAF / OOB write) · sys/net/sppp/if_spppsubr.c:5290	panic	not_reproduced
DF-0289	Medium	8.8	UAF/TOCTOU: mesh route pointers returned unreferenced, forward_to_gates drops lock mid-traversal Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_mesh.c:230	dos	inconclusive
DF-1264	High	8.4	drm_dp_sideband_msg_build OOB write past chunk[48] via unchecked msg_len from malicious MST hub Kernel memory corruption (UAF / OOB write) · sys/dev/drm/drm_dp_mst_topology.c:349	none	inconclusive
DF-1314	High	8.4	Off-by-one in btc_copy_vbios_mc_reg_table + post-write bound check in btc_set_mc_special_registers allows VBIOS OOB write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/btc_dpm.c:1992	none	inconclusive
DF-1319	High	8.4	Unvalidated DisplayPort lane_count from malicious sink causes stack buffer overflow in link-training helpers Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1784	none	inconclusive
DF-2348	High	8.4	Dead unsigned comparison in mmap bounds check enables vtophys on wrapped ZERO_LENGTH_PTR - kernel panic / kernel memory exposure Base system — bus / platform / cpu · sys/bus/u4b/uvc/uvc_buf.c:107	none	not_reproduced
DF-2349	High	8.4	uint8_t loop index in uvc_ctrl_init_dev wraps causing infinite loop and heap OOB write on malicious UVC descriptor Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_ctrls.c:925	none	not_reproduced
DF-2354	High	8.4	txd_fw buffer overflow on firmware load: 6 KB heap overflow + kernel-memory leak to USB device on every attach Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_mtw.c:128	none	not_reproduced
DF-2511	High	8.4	Unvalidated controller-supplied subq_id and cmd_id in nvme_poll_completions enable kernel memory corruption Privilege escalation (general use) · sys/dev/disk/nvme/nvme.c:713	none	not_reproduced
DF-1526	Medium	8.3	Missing RX length bounds check + RX buffer-length misprogramming allows heap OOB read (info leak) and DMA heap overflow write Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sf/if_sf.c:883	none	inconclusive
DF-0291	High	8.2	Heap buffer overflow in setmlme_assoc_adhoc: unbounded im_ssid_len into 32-byte buffers Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_ioctl.c:1568	none observed; real shipped heap+stack overflow (CWE-787) unreachable on this guest (no wlan vap possible without a wifi radio)	inconclusive
DF-0401	High	8.2	Heap buffer overflow via unchecked slot->len in VALE bridge forwarding: pkt_copy up to 65536 bytes into 2048-byte buffer Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_vale.c:988	none	not_reproduced
DF-0429	High	8.2	Unauthenticated PFSYNC_ACT_UREQ forces victim to multicast entire pf state table: info disclosure + amplification DoS Base system — network stack · sys/net/pf/if_pfsync.c:900	none	not_reproduced
DF-0775	High	8.2	RPC reply verifier-length integer overflow corrupts XDR cursor — wild pointer deref client kernel panic or OOB read Kernel memory leaks / uninitialized disclosure · sys/vfs/nfs/nfs_socket.c:1498	none	not_reproduced
DF-0640	High	8.1	ieee80211_crypto_decap minimum-length check ignores hdrlen, causing OOB-read panic or mbuf double-free on crafted encrypted frames Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_crypto.c:587	none	inconclusive
DF-1123	High	8.1	iwn_rx_done: missing upper bound on firmware-reported frame length allows OOB read of RX mbuf / kernel heap Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwn/if_iwn.c:3069	none	not_reproduced
DF-1131	High	8.1	Heap OOB read in bwn_dma_rxeof via dr_rx_bufsize / descriptor bytecnt mismatch Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bwn/bwn/if_bwn.c:5486	leak	inconclusive
DF-1849	Medium	8.1	Missing upper-bound on attacker-controlled stream.len in fwe_as_input causes kernel heap over-read Kernel memory leaks / uninitialized disclosure · sys/dev/netif/fwe/if_fwe.c:560	none	inconclusive
DF-1213	High	8.0	Unchecked device-supplied rxcd->rxd_idx yields OOB array access, OOB write, arbitrary-pointer write, and infinite loop in RX completion path Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2056	none	not_reproduced
DF-0320	Medium	8.0	Reorder buffer rxa_m[] mutated without dedicated lock: RX races timer flush and ADDBA re-init (double-free/UAF) Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_ht.c:780	none	inconclusive
DF-0509	High	7.8	Stack buffer overflow in ng_ksocket_sockaddr_unparse via negative pathlen (PF_LOCAL sun_len underflow) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ksocket/ng_ksocket.c:323	none	not_reproduced
DF-0641	High	7.8	Heap buffer overflow in smb_smb_ssnsetup: ntencpass sized from charset-converted password but filled from original Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_smb.c:255	none	not_reproduced
DF-1057	High	7.8	FW_ASYREQ bcopy writes payload into &xfer->send.payload (field address) instead of xfer->send.payload (buffer) — kernel heap overflow + arbitrary kfree Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:558	none	inconclusive
DF-1058	High	7.8	fw_write trusts user-supplied stream packet header len field for the second uiomove, overflowing the per-packet DMA buffer slot Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:388	none	inconclusive
DF-1065	High	7.8	Use-after-free: bq->mem kfree()d while userspace mmap mappings keep wired fictitious pages pointing at freed memory Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_buf.c:517	none	not_reproduced
DF-1081	High	7.8	Stack buffer overflow in cue_setmulti: 8-byte hashtbl for 64-byte (512-bit) multicast hash table Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/if_cue.c:273	none	inconclusive
DF-1141	High	7.8	Heap OOB write in ci_setup_default_dpm_tables: VBIOS counts index fixed-size dpm_levels[8] unchecked Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/ci_dpm.c:3593	none	inconclusive
DF-1142	High	7.8	Heap OOB write in ci_populate_smc_uvd/vce/acp/samu_level: VBIOS counts index fixed-size SMU7 level arrays unchecked Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/ci_dpm.c:2791	none	inconclusive
DF-1146	High	7.8	i915_gem_fault missing offset bounds check and partial-view GMADR misaddressing allow cross-object GPU memory read/write Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_gem.c:2229	none	inconclusive
DF-1149	High	7.8	Heap OOB write in SMC UVD/VCE/ACP/SAMU level population from unbounded VBIOS count Kernel memory corruption (UAF / OOB write) · DF-1142 · sys/dev/drm/radeon/ci_dpm.c:2689	none	inconclusive
DF-1150	High	7.8	Heap OOB write in ci_setup_default_dpm_tables from unbounded VBIOS dependency-table counts Kernel memory corruption (UAF / OOB write) · DF-1141 · sys/dev/drm/radeon/ci_dpm.c:3514	none	inconclusive
DF-1166	High	7.8	Heap overflow: unvalidated VBIOS dependency-table count overflows fixed dpm_levels[8] array Kernel memory corruption (UAF / OOB write) · DF-1141 · sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:784	none	inconclusive
DF-1258	High	7.8	Heap buffer overflow / OOB read in MFI_CMD and MFI_LINUX_CMD_2 ioctl SGL copyin/copyout Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mfi/mfi.c:2991	none	inconclusive
DF-1271	High	7.8	VBIOS-controlled mm_dep_table->count drives heap overflow in UVD/VCE/ACP SMC level population Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1320	none	inconclusive
DF-1272	High	7.8	VBIOS-controlled vdd_dep_on_sclk->count drives Sclk_voltageOffset[8] heap overflow in clock stretcher Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1584	none	inconclusive
DF-1311	High	7.8	Stack buffer overflow in hptiop_post_req_itl via unbounded SG list (HIGH_MEM_ACESS path) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptiop/hptiop.c:2417	none	inconclusive
DF-1337	High	7.8	Use-after-free write in chn_write (and UAF read in chn_read) via concurrent chn_resizebuf during uiomove unlock window Kernel memory corruption (UAF / OOB write) · sys/dev/sound/pcm/channel.c:502	none	inconclusive
DF-1340	High	7.8	u32 integer overflow in CB/DB size validation bypasses BO bounds check (cross-process GPU memory corruption) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_cs.c:430	none	inconclusive
DF-1342	High	7.8	r600_dma_cs_parse reads/writes IB past length_dw (heap OOB via DMA packet at IB end) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_cs.c:2388	none	inconclusive
DF-1574	High	7.8	Heap OOB write in get_vddc_lookup_table: buffer sized for 16 records, loop walks up to 255 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:168	none	not_reproduced
DF-1586	High	7.8	Heap buffer overflow in get_vddc_lookup_table: VBIOS ucNumEntries > caller max_levels writes ~2.5KB past slab object Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1026	none	not_reproduced
DF-2002	High	7.8	Forged EEPROM pwr_table_offset drives OOB write/read in ar9280AdjustPDADCValues (up to 64KB overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c:188	none	inconclusive
DF-2028	High	7.8	Use-after-free in GDT_IOCTL_GENERAL: framework-owned ioctl buffer queued into persistent controller command list Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir_ctrl.c:245	none	inconclusive
DF-2079	High	7.8	Heap buffer overflow and NULL-deref panic in SPECTRAL_CONTROL_GET_PARAMS due to missing output-buffer validation Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath/if_ath_spectral.c:218	none	not_reproduced
DF-2145	High	7.8	tasklet_kill() UAF: premature return on TASKLET_STATE_RUN leaves dangling tasklet_entry; runner later calls t->func from freed memory Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_tasklet.c:170	none	not_reproduced
DF-2174	High	7.8	__hrtimer_task epilogue unconditionally clears timer->active, defeating callback re-arm via hrtimer_start + NORESTART — un-cancellable timer leading to UAF Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_hrtimer.c:59	none	not_reproduced
DF-2268	High	7.8	Heap overflow in cdcheckmedia via uncapped num_entries from device-supplied TOC header Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_cd.c:2947	none	not_reproduced
DF-2282	High	7.8	sgopen: missing cam_periph_acquire plus cam_periph_unlock-without-lock in securelevel path (lock/refcount protocol violation; refcount underflow->UAF) Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sg.c:385	none	not_reproduced
DF-2332	High	7.8	Stack buffer overflow in ACPI SMBus handler: buf[32] vs attacker-controlled GSBUS lengths Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/smbacpi/smbacpi.c:137	none	not_reproduced
DF-2339	High	7.8	Stack buffer overflow in cue_setmulti: 8-byte hashtbl indexed by 9-bit multicast hash Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/net/if_cue.c:273	none	not_reproduced
DF-2346	High	7.8	SIGIO recipient stored as raw unreferenced struct proc pointer -> use-after-free after fork+exit Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_dev.c:1044	none	not_reproduced
DF-2389	High	7.8	Heap out-of-bounds write in link_add_prs when _PRS has more IRQ resources than _CRS Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_pci_link.c:311	none	not_reproduced
DF-2424	High	7.8	Scatter/gather list heap overflow via unchecked sglist_cnt in amdexecutesrb Kernel memory corruption (UAF / OOB write) · sys/dev/disk/amd/amd.c:455	none	not_reproduced
DF-2428	High	7.8	Unbounded scatter/gather copy in btexecuteccb via CAM_SCATTER_VALID CCB (kernel heap overflow) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/buslogic/bt.c:1055	none	not_reproduced
DF-2488	High	7.8	Stack buffer overflow/underflow in ad_describe via unterminated model string Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-disk.c:508	none	not_reproduced
DF-2493	High	7.8	Heap OOB write via untrusted disk index in ATA RAID metadata parsers Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-raid.c:1806	none	not_reproduced
DF-2506	High	7.8	TOCTOU kernel heap overflow in acd_send_cue via double-fetch of cuesheet->len Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-cd.c:1318	none	not_reproduced
DF-2510	High	7.8	Unbounded ctlr->channels (up to 32) overflows the fixed interrupt[8] dispatch array causing heap OOB write of function pointers and OOB indirect call on every IRQ Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/chipsets/ata-ahci.c:101	none	not_reproduced
DF-2517	High	7.8	Heap OOB write in sili_load_prb_callback via unchecked DMA segment count Kernel memory corruption (UAF / OOB write) · sys/dev/disk/sili/sili.c:1245	none	not_reproduced
DF-2520	High	7.8	trm_ExecuteSRB writes user-controlled nseg SG entries into 32-slot pSRBSGL with no bounds check (heap overflow via pass(4) SCATTER_VALID) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:433	none	not_reproduced
DF-2521	High	7.8	trm_action bcopy of user-controlled cdb_len into 12-byte CmdBlock overflows the SRB struct (pass(4)-reachable heap corruption) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:591	none	not_reproduced
DF-0547	Medium	7.8	Ring cleanup trusts userspace-writable buf_idx: cross-adapter double-free / buffer aliasing Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_mem2.c:995	corruption	not_reproduced
DF-1235	Medium	7.8	Unbounded CDB copy into fixed 12-byte SRB CmdBlock overwrites SRB pointer fields Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:591	none	not_reproduced
DF-1454	Medium	7.8	Heap buffer overflow in autosense data copy - missing sizeof(sense_data) bound Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/vmware/pvscsi/pvscsi.c:945	none	inconclusive
DF-1848	Medium	7.8	ENA LLQ bounce buffer heap overflow via descs_left_in_line u16 underflow when device reports descs_num_before_header=0 Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:150	none	inconclusive
DF-2469	Medium	7.8	Heap OOB write via double channel offset in RQCS_SYNCXFER_FAILED status handler Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp.c:6282	none	not_reproduced
DF-2492	Medium	7.8	OOB heap write/read on interrupt[8] via AHCI controllers with >8 ports Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-pci.c:383	none	not_reproduced
DF-1122	High	7.6	iwn_rx_compressed_ba: unbounded firmware-supplied qid indexes sc->txq[] and sc->qid2tap[] (OOB array access / NULL deref) Base system — drivers · sys/dev/netif/iwn/if_iwn.c:3251	none	not_reproduced
DF-2490	High	7.6	ATAPI PIO heap OOB write/read via unvalidated device byte_count_limit Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-lowlevel.c:329	none	not_reproduced
DF-0349	Medium	7.6	Heap OOB read in PREQ processing when target count is 0: (ndest-1) wraps to SIZE_MAX Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_hwmp.c:311	none	inconclusive
DF-0220	High	7.5	Predictable RNG: /dev/urandom+getrandom+kern.random return deterministic ChaCha20 keystream (zero key) before first reseed Base system — kernel core (kern) · sys/kern/subr_csprng.c:84	none	not_reproduced
DF-0580	High	7.5	ieee80211_defrag UAF/dangling-pointer: DragonFly m_cat frees fragment but code reads wh + m_pkthdr.len after Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_input.c:248	none	inconclusive
DF-0703	High	7.5	Unauthenticated remote mbuf leak in edge socket handler — kernel memory exhaustion DoS Base system — network stack · sys/net/ipfw3_basic/ip_fw3_sync.c:203	none	not_reproduced
DF-2358	High	7.5	Heap buffer overflow in USB RX frame aggregation: m_getcl (2048B) too small for m_copydata of up to 4080B Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_run.c:3013	none	not_reproduced
DF-0533	Medium	7.5	Unsynchronized sc->inq/outq between hard ISR and netgraph forward: ifqueue corruption / UAF Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:939	none	not_reproduced
DF-0581	Medium	7.5	ieee80211_setup_rates trusts attacker-controlled IE length byte: latent heap overflow of rs_rates[15] Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_input.c:420	none	not_reproduced
DF-1060	Medium	7.5	FW_GTPMAP bcopy uses (topology_map->crc_len + 1) * 4 as the count — attacker-inflatable crc_len drives unbounded kernel OOB read up to 256 KB Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:657	none	not_reproduced
DF-1249	Medium	7.5	dc_pnic_rx_bug_war unbounded copy loop - heap overflow if PNIC produces >5 descriptors Kernel memory corruption (UAF / OOB write) · sys/dev/netif/dc/if_dc.c:2414	none	inconclusive
DF-1828	Medium	7.5	isc_soc: NULL deref in so_input pdu_alloc retry uses M_NOWAIT (comment says WAITOK) derefs unchecked Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:540	none	inconclusive
DF-1236	High	7.4	Extended SCSI message accumulation overflows MsgInBuf[6] into adjacent SRB pointer fields Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:1832	none	not_reproduced
DF-1292	Medium	7.4	Multi-segment RX reads overwritten descriptor length inflating m_len past cluster for heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/netif/age/if_age.c:2025	none	not_reproduced
DF-1385	Medium	7.4	Unbounded VBIOS num_entries overflows MC register table arrays (heap OOB write+read) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/cypress_dpm.c:1052	none	inconclusive
DF-1950	Medium	7.4	Unvalidated ACPI ATRM return object: heap buffer overflow and type confusion in amdgpu_atrm_call Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_bios.c:264	none	inconclusive
DF-2418	Medium	7.4	Missing bounds check on device-controlled NCQ error tag causes OOB heap read/write in ahci_port_read_ncq_error Privilege escalation (general use) · sys/dev/disk/ahci/ahci.c:3488	none	not_reproduced
DF-2484	Medium	7.4	Untrusted IOC-supplied indices index raid_disks/raid_volumes arrays without bounds checks (OOB read/write of kernel heap) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_raid.c:414	none	not_reproduced
DF-1211	High	7.3	OOB read+write in NCQ error recovery: device-controlled log-page tag indexes ap_ccbs without bounds check Kernel memory leaks / uninitialized disclosure · sys/dev/disk/ahci/ahci.c:3488	none	not_reproduced
DF-2322	High	7.3	MSI-X table/PBA out-of-bounds MMIO read/write - no BAR-size validation against attacker-controlled table offset and vector count Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci.c:1431	none	not_reproduced
DF-2356	High	7.3	Unvalidated hardware frame length in RX path allows heap OOB read / uninitialized-memory info leak Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_rum.c:1146	none	not_reproduced
DF-2401	High	7.3	intel_gtt_insert_page swaps index/physical arguments causing out-of-bounds MMIO write into Intel IGD BAR Kernel memory corruption (UAF / OOB write) · sys/dev/agp/intel-gtt.c:1407	none	not_reproduced
DF-0275	Medium	7.2	Heap buffer overflow in WPA/RSN IE construction: variable-length IE written into fixed sizeof(ieee80211_ie_wpa)=100 slot Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_output.c:1976	none	inconclusive
DF-0243	High	7.1	size_t underflow in exec_shell_imgact when argv[0] longer than interpreter+fname -> kernel panic Base system — kernel core (kern) · sys/kern/imgact_shell.c:117	none	not_reproduced
DF-0700	High	7.1	User-controlled edge count not bounded by MAX_EDGES — BSS OOB array write/read on centre_socks[] Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_sync.c:143	none	not_reproduced
DF-0701	High	7.1	Heap OOB read in centre_conf bcopy and integer overflow in size math Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_sync.c:143	none	not_reproduced
DF-0702	High	7.1	Mbuf UAF and double-free in centre_test and send_state (sosend consumes m, loop reuses it) Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_sync.c:339	none	not_reproduced
DF-0766	High	7.1	Heap OOB write in NFS READDIR/READDIRPLUS reply XDR null-padding — missing nfsm_clget before pad bytes Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_serv.c:3186	none	not_reproduced fixed
DF-1227	High	7.1	mpr_build_nvme_prp heap overflow via unbounded user-supplied data length Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr.c:2716	none	not_reproduced
DF-1257	High	7.1	Integer overflow in offset+size bounds check in amdgpu_vm_bo_map enables OOB read in amdgpu_vm_bo_split_mapping Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_vm.c:2509	none	not_reproduced
DF-1259	High	7.1	mfi_stp_cmd unbounded SGE loop corrupts mfi_softc via size-[2] DMA arrays and STP frame SGL Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mfi/mfi.c:2724	none	inconclusive
DF-1333	High	7.1	OOB kernel-heap read in rv7xx_parse_power_table via unchecked VBIOS offsets and indices Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/rv770_dpm.c:2284	none	inconclusive
DF-2133	High	7.1	dma_buf_export never initializes dmabuf->resv; GPU drivers dereference uninitialized slab pointer Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_dma-buf.c:127	none	not_reproduced
DF-2175	High	7.1	hrtimer_start_range_ns corrupts per-CPU systimer queue by calling systimer_init_oneshot without prior systimer_del on an armed timer Base system — drivers · sys/dev/drm/linux_hrtimer.c:115	none	not_reproduced
DF-2221	High	7.1	ar5312EepromRead unbounded OOB read of radio-config buffer reachable from unprivileged SIOCGATHDIAG/HAL_DIAG_EEREAD Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:37	none	not_reproduced
DF-2419	High	7.1	Heap OOB write in INQUIRY handler when data buffer length is 36..95 bytes Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ahci/ahci_cam.c:1109	none	not_reproduced
DF-0286	Medium	7.1	Missing length validation in mesh action frame handler: OOB read of stale data Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_mesh.c:2548	none	inconclusive
DF-0352	Medium	7.1	RANN frame overwrites shared global ieee80211_hwmp_rannint without lock: remote timer DoS Base system — network stack · sys/netproto/802_11/wlan/ieee80211_hwmp.c:1971	none	not_reproduced
DF-0706	Medium	7.1	Lifecycle bugs in edge handler cleanup: UAF on replaced edge_sock, missing thread join, soclose+sofree imbalance Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_sync.c:195	none	not_reproduced
DF-0998	Medium	7.1	TX DMA buffer overflow: mbuf length clamp uses wrong bound -> 16-byte heap overwrite past USB DMA buffer Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_rum.c:438	none	not_reproduced
DF-1181	Medium	7.1	Heap OOB read via unbounded vddInd/vddciInd/mvddInd into 4-8 entry voltage lookup tables Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:635	none	not_reproduced
DF-1197	Medium	7.1	2-byte DMA heap overflow in RX buffer when ETHER_ALIGN applied with jumbo MTU Kernel memory corruption (UAF / OOB write) · sys/dev/netif/emx/if_emx.c:2918	none	not_reproduced
DF-1237	Medium	7.1	Scatter/gather list copy has no bounds vs the 32-entry hardware SG buffer Kernel memory corruption (UAF / OOB write) · sys/dev/disk/trm/trm.c:434	none	not_reproduced
DF-1476	Medium	7.1	intel_gtt_insert_page swaps (index, physical) arguments to install_gtt_pte causing OOB MMIO write past BAR Kernel memory corruption (UAF / OOB write) · sys/dev/agp/intel-gtt.c:1406	none	inconclusive
DF-1545	Medium	7.1	amdgpu atom WS operand index unbounded + NULL deref when ws=0 Base system — drivers · sys/dev/drm/amd/amdgpu/atom.c:222	none	inconclusive
DF-1551	Medium	7.1	snread subtracts 6 from u_short packet_length with no bound: underflow -> ~63KB kernel heap overflow write via insw into 2KB mbuf cluster Kernel memory corruption (UAF / OOB write) · sys/dev/netif/sn/if_sn.c:983	none	inconclusive
DF-1755	Medium	7.1	radeon_vce: integer overflow in create-message size calculation bypasses reloc buffer checks Base system — drivers · sys/dev/drm/radeon/radeon_vce.c:602	none	inconclusive
DF-0315	High	7.0	UAF: wg_peer_destroy frees peer struct while data-plane paths access it without peer refcount Kernel memory corruption (UAF / OOB write) · sys/net/wg/if_wg.c:589	none observed dynamically (code-level UAF real + reachable; race window too narrow to panic on GENERIC)	not_reproduced
DF-0590	High	7.0	No serialization of bridge state in legacy netgraph/ng_bridge -- UAF in rehash, OOB heap write in GET_TABLE, deterministic KASSERT panics under concurrent traffic Kernel memory corruption (UAF / OOB write) · sys/netgraph/bridge/ng_bridge.c:297	none	not_reproduced
DF-0636	High	7.0	ngt_rcvdata accesses sc->outq without tp->t_token, racing with ngt_start (UAF write / queue corruption) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/tty/ng_tty.c:591	none	not_reproduced
DF-0691	High	7.0	UAF / NULL-deref in mld6_input MLD_LISTENER_QUERY path: in6m freed concurrently with iteration Kernel memory corruption (UAF / OOB write) · sys/netinet6/mld6.c:280	none	not_reproduced
DF-0692	High	7.0	UAF and unsynchronized list walk in mld6_fasttimeo over global in6_multihead Kernel memory corruption (UAF / OOB write) · sys/netinet6/mld6.c:382	panic	not_reproduced
DF-1136	High	7.0	Heap buffer overflow in si_get_svi2_voltage_table: unbounded VBIOS count writes past entries[32] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/si_dpm.c:3939	panic	inconclusive
DF-1246	High	7.0	OOB read/write past IB end in evergreen_dma_cs_parse (no per-packet bounds check) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/evergreen_cs.c:2806	none	not_reproduced
DF-1298	High	7.0	Heap overflow in update_slot_layout_info via unchecked ucConnNum Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/bios/bios_parser.c:2634	none	inconclusive
DF-1305	High	7.0	Heap OOB write/read in kv_init_graphics_levels via unbounded VBIOS table->count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/kv_dpm.c:2355	none	inconclusive
DF-2146	High	7.0	Unbounded AUX reply byte count causes heap/stack OOB write on DP read path Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_dp_auxch.c:177	none	not_reproduced
DF-2292	High	7.0	FW_ASYREQ response copy overflows ioctl heap buffer with oversized FireWire RRESB payload Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwdev.c:576	none	not_reproduced
DF-0420	Medium	7.0	Use-after-free in SCO reassembly buffer: sc_isoc_in_buffer retains dangling pointer after mbuf forwarded and realloc fails Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1103	none	inconclusive
DF-0497	Medium	7.0	TOCTOU use-after-free on rtentry in ng_btsocket_l2cap_raw_bind: releases rt_lock before storing pointer Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:690	none	inconclusive
DF-0513	Medium	7.0	Rule-chain mutation raced with concurrent ip6_fw_chk: lock-free linked list + kfree after crit_exit -> UAF on SMP Kernel memory corruption (UAF / OOB write) · sys/net/ip6fw/ip6_fw.c:856	none	not_reproduced
DF-0521	Medium	7.0	PF_LOCAL sockaddr unparse: sun_len<pathoff underflow -> giant bcopy -> stack OOB write (DF-0509 v1 twin) Kernel memory corruption (UAF / OOB write) · sys/netgraph/ksocket/ng_ksocket.c:321	none	not_reproduced
DF-0586	Medium	7.0	Lockless global hci_pcb list allows use-after-free during concurrent socket teardown and packet tap Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_socket.c:87	none	not_reproduced
DF-0589	Medium	7.0	sc->outq mbuf-queue race in ng_h4: IF_DEQUEUE in ng_h4_start (tty ctx) vs IF_DRAIN in disconnect/shutdown (netgraph ctx); NG_H4_LOCK is only per-CPU crit_enter Kernel memory corruption (UAF / OOB write) · sys/netgraph7/bluetooth/drivers/h4/ng_h4.c:88	dos	inconclusive
DF-0793	Medium	7.0	Use-after-free in async TRIM block-free path — ffs_blkfree stores unrefcounted mount/device pointers in deferred task Kernel memory corruption (UAF / OOB write) · sys/vfs/ufs/ffs_alloc.c:1633	none	not_reproduced fixed
DF-1061	Medium	7.0	LOOPRECOVER watchdog silently abandons unacknowledged TLB invalidations, enabling stale-TLB use-after-free / info leak Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/pmap_inval.c:342	none	not_reproduced
DF-1153	Medium	7.0	Use-after-free in reset functions when kzalloc fails (connector/crtc/plane state) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:3190	none	not_reproduced
DF-1289	Medium	7.0	Heap overflow of CAM CCB sense buffer from untrusted controller sense_length Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:2356	none	not_reproduced
DF-1290	Medium	7.0	OOB write on softc via untrusted controller event channel/target/lun in mly_process_event Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mly/mly.c:1323	none	not_reproduced
DF-1295	Medium	7.0	METEORSSIGNAL stores curproc without reference causing UAF via fork+child-exit+DMA interrupt Kernel memory corruption (UAF / OOB write) · sys/dev/video/cxm/cxm.c:2760	none	not_reproduced
DF-1366	Medium	7.0	Heap OOB write in vegam_populate_smc_vce_level via unbounded VBIOS mm_dep_table->count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1217	none	inconclusive
DF-1367	Medium	7.0	Heap OOB write in vegam_populate_smc_uvd_level via unbounded VBIOS mm_dep_table->count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1330	none	inconclusive
DF-1368	Medium	7.0	Heap+stack OOB writes in clock-stretcher/AVFS/CAC table population via unbounded VBIOS counts Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:515	none	inconclusive
DF-1411	Medium	7.0	DragonFly sysctl backlight handler captures drm_connector_state before modeset lock enabling UAF Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_panel.c:1815	none	inconclusive
DF-1417	Medium	7.0	Stack/heap OOB write in smu8_get_clock_by_type from unbounded SMU-derived count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1613	none	inconclusive
DF-1449	Medium	7.0	Unvalidated firmware-reported disk/volume indices cause OOB read/write in RAID arrays and IOC page buffers Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_raid.c:414	none	inconclusive
DF-1546	Medium	7.0	Unclamped csio->sense_len handed to firmware allows DMA overflow of the per-queue sense slot Base system — drivers · sys/dev/disk/advansys/advansys.c:559	none	inconclusive
DF-1758	Medium	7.0	ips: card-controlled command_id indexes commandarray[] with no bounds check in both interrupt handlers -> OOB r/w + indirect call Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ips/ips.c:567	none	inconclusive
DF-1911	Medium	7.0	r600_audio_update_hdmi walks encoder_list without mode_config.mutex: UAF race vs modeset/unload (variant of DF-1878) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r600_hdmi.c:114	none	inconclusive
DF-1959	Medium	7.0	dm_dev_remove use-after-free via concurrent stale-pointer removal: operator-group to root heap corruption Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_dev.c:305	none	inconclusive
DF-1979	Medium	7.0	queue_work broken lock protocol on multi-CPU bound workqueues enables cross-CPU STAILQ corruption and arbitrary code execution Base system — drivers · sys/dev/drm/linux_workqueue.c:119	none	inconclusive
DF-2331	Medium	7.0	Slave-controlled block-read byte count overflows sc->block_data[32] in interrupt handler Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/ichsmb/ichsmb.c:575	none	not_reproduced
DF-2382	Medium	7.0	Heap OOB write in cmi_order[] when BIOS exposes >128 CMI instances Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_hp/acpi_hp.c:1165	none	not_reproduced
DF-2414	Medium	7.0	Unvalidated 32-bit ccb_index read from firmware LRAM used to index ccb_infos[] in all four halt/error paths - OOB read NULL-deref and UAF Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/advlib.c:1005	none	not_reproduced
DF-2453	Medium	7.0	Use-after-free of target config in async read iodone callback Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/flakey/dm_target_flakey.c:303	none	not_reproduced
DF-2474	Medium	7.0	Stale base pointer in isp_pci_mbxdma error cleanup causes kernel-heap multi-free Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_pci.c:1600	none	not_reproduced
DF-2585	Medium	7.0	Cluster array chain pointer read without cluster_spin UAF in volume dedup check Hammer2 · sys/vfs/hammer2/hammer2_flush.c:1377	none	not_reproduced
DF-1157	High	6.8	wpi_rx_done reads tail and sets m_len from unbounded firmware head->len (OOB read / heap info-leak) Kernel memory leaks / uninitialized disclosure · DF-1123 · sys/dev/netif/wpi/if_wpi.c:1959	none	not_reproduced
DF-2288	High	6.8	OOB heap write/read in fw_bus_explore_callback via unchecked ongoaddr (Config ROM parser) Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/firewire.c:1500	none	not_reproduced
DF-2289	High	6.8	Off-by-one stack buffer overflow in crom_next depth guard allows kernel stack corruption Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwcrom.c:115	none	not_reproduced
DF-2359	High	6.8	urtwn_efuse_read_data writes past sc->rom union on malicious USB device (RTL8188EU extended efuse header) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/wlan/if_urtwn.c:1756	none	not_reproduced
DF-1097	Medium	6.8	Use-after-free and double-free in fwohci_pci_add_child error path Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci_pci.c:442	none	not_reproduced
DF-1268	Medium	6.8	Unbounded VBIOS dependency-table counts overflow fixed SMU7 level arrays (heap OOB write) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/kv_dpm.c:2422	none	inconclusive
DF-1280	Medium	6.8	Unchecked reply-frame offset in mpt_intr allows OOB read/write via malicious IOC address reply Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt.c:734	none	inconclusive
DF-1369	Medium	6.8	Unvalidated SMID in reply descriptors allows NULL-deref panic and heap OOB write Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps.c:1515	none	inconclusive
DF-1439	Medium	6.8	Wild OOB read in sumo_get_valid_engine_clock when num_max_dpm_entries==0 Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/sumo_dpm.c:1037	none	inconclusive
DF-1478	Medium	6.8	my_rxeof trusts 12-bit NIC-reported FLNG as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/my/if_my.c:1105	none	inconclusive
DF-1490	Medium	6.8	epic_rx_done trusts 16-bit NIC-reported rxlength as m_len with no MCLBYTES bound: large OOB heap read past RX mbuf cluster (16-bit field) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/tx/if_tx.c:557	none	inconclusive
DF-1517	Medium	6.8	Missing MCLBYTES upper-bound check on rs->rs_datalen allows kernel heap OOB read via crafted wifi frames Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath/if_ath_rx.c:730	none	inconclusive
DF-1519	Medium	6.8	lge_rxeof trusts 16-bit NIC-reported LGE_RXBYTES as m_len / m_devget copy length without jumbo-buffer bound: up to 56519-byte OOB heap read Kernel memory leaks / uninitialized disclosure · sys/dev/netif/lge/if_lge.c:870	none	inconclusive
DF-1554	Medium	6.8	Malformed _CST leaving cst_cx_count==0 causes heap OOB read in set_lowest_oncpu and NULL-deref panic in idle Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_cpu_cstate.c:530	none	inconclusive
DF-1562	Medium	6.8	pcn_rxeof trusts 16-bit NIC-reported pcn_rxlen as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/pcn/if_pcn.c:798	none	inconclusive
DF-1566	Medium	6.8	VBIOS-controlled VCE/UVD clock-info index and table entry counts are not bounds-checked against the BIOS allocation Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/r600_dpm.c:1104	none	inconclusive
DF-1590	Medium	6.8	Firmware-supplied req_id used as heap index without bounds check in tws_intr_resp and tws_err_complete Base system — drivers · sys/dev/raid/tws/tws_cam.c:1163	none	inconclusive
DF-1767	Medium	6.8	virtqueue: host-controlled descriptor indices used without runtime bounds validation cause OOB read/write Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/virtio/virtio/virtqueue.c:559	none	inconclusive
DF-1868	Medium	6.8	Write-reply stack buffer overflow in aux_engine: missing bound of returned_byte against reply_data[16] Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/i2caux/aux_engine.c:415	none	inconclusive
DF-1882	Medium	6.8	Stack buffer overflow/underflow in ad_describe via non-NUL-terminated IDENTIFY model string Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/ata-disk.c:508	none	inconclusive
DF-1938	Medium	6.8	Write-reply stack overflow via self-comparing bound check in read_channel_reply (cross-file with DF-1868) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:316	none	inconclusive
DF-2005	Medium	6.8	Missing VBIOS PowerPlay table size validation allows heap out-of-bounds read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c:64	none	inconclusive fixed
DF-2518	Medium	6.8	OOB array access in sili_port_read_ncq_error via unchecked device-supplied NCQ tag Base system — drivers · sys/dev/disk/sili/sili.c:2138	none	not_reproduced
DF-0720	High	6.7	Heap overflow: if_alloc(IFT_PPP) returns sizeof(struct ifnet) but sppp_attach writes ~1KB of struct sppp fields past allocation (LATENT — file does not compile) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_sppp.c:249	none	not_reproduced
DF-1066	High	6.7	Integer underflow in uvc_buf_queue_mmap_locked bounds check allows out-of-bounds vtophys() when buf_size==0 Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_buf.c:107	none	not_reproduced
DF-1133	High	6.7	RLC v2.0 firmware register-list parsing: integer-overflow kmalloc + unvalidated offset to heap OOB write/read Kernel memory corruption (UAF / OOB write) · DF-1119 · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1106	panic	inconclusive
DF-1134	High	6.7	cz_init_cp_jump_table: unvalidated jt_offset/jt_size from CE/PFP/ME/MEC fw headers -> OOB read/write Kernel memory corruption (UAF / OOB write) · DF-1119 · sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1301	panic	inconclusive
DF-1163	High	6.7	gfx_v7_0_init_cp_pg_table heap OOB write+read via untrusted firmware jt_offset/jt_size Kernel memory corruption (UAF / OOB write) · DF-1134 · sys/dev/drm/amd/amdgpu/gfx_v7_0.c:3788	none	inconclusive
DF-1203	High	6.7	Heap buffer overflow via unbounded ucStateEntrySize in power table parsing Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/ni_dpm.c:3927	none	not_reproduced
DF-1578	High	6.7	Heap OOB write in INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN via missing dxfer_len check Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptrr/hptrr_osm_bsd.c:582	none	not_reproduced
DF-0402	Medium	6.7	Direct kernel dereference of user-controlled pointer in netmap_bdg_learning before copyin: panic or kernel info-leak Kernel memory corruption (UAF / OOB write) · sys/net/netmap/netmap_vale.c:994	none	not_reproduced
DF-1112	Medium	6.7	Stack buffer overflow: 32-byte buf[] used for GSBUS BLOCK/BYTES transfers carrying up to 255 bytes Kernel memory corruption (UAF / OOB write) · sys/bus/smbus/smbacpi/smbacpi.c:137	none	not_reproduced
DF-1178	Medium	6.7	gfx_v9_1_parse_ind_reg_list: stack buffer overflow on indirect_start_offsets[10] and unbounded OOB read Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/gfx_v9_0.c:2084	none	not_reproduced
DF-1185	Medium	6.7	arcmsr_iop_message_xfer writes up to 1031 bytes past CAM buffer sized by dxfer_len Kernel memory corruption (UAF / OOB write) · sys/dev/raid/arcmsr/arcmsr.c:2604	none	not_reproduced fixed
DF-1221	Medium	6.7	RX completion req_id used as array index without bounds check (OOB read/write/panic) Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena.c:1450	none	inconclusive
DF-1703	Medium	6.7	iscsi initiator: heap overflow in i_send via 32-bit truncation in i_prepPDU + signedness bypass of maxBurstLength check Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/iscsi.c:454	none	inconclusive
DF-1820	Medium	6.7	amr_pci: UAF - amr_pci_intr runs concurrently with DMA/command teardown in amr_pci_free; interrupt torn down LAST Kernel memory corruption (UAF / OOB write) · sys/dev/raid/amr/amr_pci.c:477	none	inconclusive
DF-1854	Medium	6.7	Heap overflow in psp_asd_load via unvalidated asd_ucode_size from PSP ASD firmware header Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_psp.c:254	none	inconclusive
DF-1933	Medium	6.7	Heap OOB write in dm_target_stripe_table via unchecked ksnprintf return value Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/striped/dm_target_striped.c:208	none	inconclusive
DF-1955	Medium	6.7	Unvalidated firmware header fields enable heap overflow in ASD firmware copy (variant of DF-1838/1854/1875) Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/psp_v10_0.c:142	none	inconclusive
DF-1320	High	6.6	Unbounded MST stream_count overflows stack work_table[MAX_CONTROLLER_NUM=6] in update_mst_stream_alloc_table Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/display/dc/core/dc_link.c:2322	none	inconclusive
DF-1242	Medium	6.6	mrsas_complete_cmd uses firmware-controlled SMID to index mpt_cmd_list with no bounds check Base system — drivers · sys/dev/raid/mrsas/mrsas.c:1269	none	not_reproduced
DF-1243	Medium	6.6	mrsas_get_pd_list indexes local_pd_list with unchecked firmware deviceId (OOB write) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas.c:3307	none	not_reproduced
DF-1244	Medium	6.6	mrsas_get_ld_list indexes ld_ids with unchecked firmware targetId (OOB byte write) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mrsas/mrsas.c:3380	none	inconclusive
DF-1528	Medium	6.6	Missing bounds validation of firmware-provided RAID map fields enables out-of-bounds kernel reads on every IO Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mrsas/mrsas_fp.c:1428	none	inconclusive
DF-1561	Medium	6.6	Stack OOB write in pp_dpm_get_pp_num_states when hwmgr->num_ps > 16 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/amd_powerplay.c:619	none	inconclusive
DF-2507	Medium	6.6	afd_reinit frees softc without destroying disk orphaning device with freed memory (UAF / NULL-deref panic) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-fd.c:176	none	not_reproduced
DF-2464	Low	6.6	Unbounded attacker-controlled buffer offset (bo) in so_recv douio path - latent OOB write + latent stack overflow same defect class as scsi_decap DF-2458 Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:450	none	not_reproduced
DF-0489	High	6.5	Neighbor Advertisement handler leaks route refcount on every received NA: remote kernel memory exhaustion DoS Kernel memory corruption (UAF / OOB write) · sys/netinet6/nd6_nbr.c:734	none	not_reproduced
DF-0542	High	6.5	inquiry_result: unbounded variable-length loop reads past mbuf end -> remote kernel panic Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:380	none	not_reproduced
DF-0543	High	6.5	num_compl_pkts: unbounded variable-length loop reads past mbuf end -> remote kernel panic Base system — network stack · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:884	none	not_reproduced
DF-0558	High	6.5	hci_event_num_compl_pkts: unbounded variable-length loop NO per-iteration bounds check -> remote kernel panic Base system — network stack · sys/netbt/hci_event.c:376	panic	inconclusive
DF-0559	High	6.5	hci_event_inquiry_result/rssi_result: unbounded loops guarded only by KKASSERT -> remote kernel panic on short data Base system — network stack · sys/netbt/hci_event.c:447	panic	inconclusive
DF-0627	High	6.5	mbuf chain leak on duplicate SMB responses enables remote kernel memory-exhaustion DoS Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_iod.c:363	none	not_reproduced
DF-0654	High	6.5	ccmp_setkey omits AES key load for software-decrypt-only keys, causing kernel panic on first received frame Base system — network stack · sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:140	none	inconclusive
DF-1315	High	6.5	Guest debug registers (DR7/DR0-3) persist in host after #VMEXIT enabling host kernel panic via injected HW breakpoint Base system — drivers · sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1492	none	inconclusive
DF-2274	High	6.5	Divide-by-zero panic from device-supplied block size of zero in READ CAPACITY Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:2280	none	not_reproduced
DF-2475	High	6.5	Wrong bitmask includes task-attribute bits in IU length causing ATIO queue consumer to skip 128-960 entries on any non-SIMPLE FCP_CMND (remote DoS) Base system — drivers · sys/dev/disk/isp/isp_target.c:174	none	not_reproduced
DF-0287	Medium	6.5	Divide-by-zero kernel panic in mesh_airtime_calc via ni_txrate==0 Base system — network stack · sys/netproto/802_11/wlan/ieee80211_mesh.c:3366	none	inconclusive
DF-0560	Medium	6.5	hci_event_command_compl: reads status byte beyond asserted length -> short-event remote kernel panic Kernel memory leaks / uninitialized disclosure · sys/netbt/hci_event.c:299	panic	not_reproduced
DF-0562	Medium	6.5	STEPBY unsigned underflow via missing minimum length check (LMI_MIN_LENGTH defined never used) — ng7 twin of DF-0554 Kernel memory leaks / uninitialized disclosure · sys/netgraph7/lmi/ng_lmi.c:88	leak:3	not_reproduced
DF-0611	Medium	6.5	Missing IP-length / ip_hl validation in ng_nat_rcvdata allows OOB access of mbuf trailing area Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_nat.c:690	none	not_reproduced
DF-0625	Medium	6.5	Missing arglen check in L2CA_Ping path causes kernel heap OOB read leaked to remote Bluetooth peer Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/l2cap/ng_l2cap_main.c:438	none	not_reproduced
DF-0673	Medium	6.5	nbssn_recv() leaks mbufs on receive error and on inner-loop sbinit() reset Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/netproto/smb/smb_trantcp.c:345	none	not_reproduced
DF-0946	Medium	6.5	swp_pager_meta_build while-loop can free a swap block assigned by a concurrent meta_build for the same pindex Base system — virtual memory · sys/vm/swap_pager.c:2385	none	not_reproduced
DF-0999	Medium	6.5	Divide-by-zero in rum_set_sleep_time when associated AP advertises zero beacon interval Base system — bus / platform / cpu · sys/bus/u4b/wlan/if_rum.c:2184	none	not_reproduced
DF-1515	Medium	6.5	Kernel divide-by-zero via zero dst_height/dst_width in overlay PUT_IMAGE ioctl Base system — drivers · sys/dev/drm/i915/intel_overlay.c:916	none	inconclusive
DF-2538	Medium	6.5	Unbounded loop in inquiry_result causes kernel panic from malformed HCI Inquiry Result event Kernel memory leaks / uninitialized disclosure · sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:387	none	not_reproduced
DF-0525	High	6.4	ng_fec_tick iterates port list with no list lock: UAF race vs addport/delport Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:579	none	not_reproduced
DF-0662	High	6.4	Use-after-free of readq: ng_device_disconnect frees readq BEFORE destroy_dev drains in-flight operations Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_device.c:407	none	not_reproduced
DF-1018	High	6.4	TRIM req->data heap buffer overflow and OOB DMA read via device-controlled small secsize Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_da.c:1341	none	inconclusive
DF-1109	High	6.4	TOCTOU double-fetch of d->nmsgs in I2CRDWR ioctl causes kernel heap buffer overflow Kernel memory corruption (UAF / OOB write) · sys/bus/iicbus/iic.c:291	none	not_reproduced
DF-1346	High	6.4	Heap buffer overflow populating VCE/UVD SMC levels from unclamped VBIOS MM-dependency count Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1298	none	inconclusive
DF-0246	Medium	6.4	UAF: eventhandler dispatch traverses entry list without token while deregister frees entries Kernel memory corruption (UAF / OOB write) · sys/kern/subr_eventhandler.c:114	panic	not_reproduced
DF-0296	Medium	6.4	UAF/cross-node races: peer hooks/nodes dereferenced without reference or peer-token Kernel memory corruption (UAF / OOB write) · sys/netgraph7/netgraph/ng_base.c:1092	dos	inconclusive
DF-0306	Medium	6.4	UAF in add_bw_upcall: mfc pointer used after mroute_token released across blocking kmalloc Kernel memory corruption (UAF / OOB write) · sys/net/ip_mroute/ip_mroute.c:2285	none	inconclusive
DF-0355	Medium	6.4	nd6_sysctl_drlist/prlist iterate defrouter/prefix lists without nd6_mtx: UAF race with RA processing Kernel memory corruption (UAF / OOB write) · sys/netinet6/nd6.c:2168	none	inconclusive
DF-0503	Medium	6.4	ifnet locking-contract violation and stored-pointer UAF on member ifnets Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_fec.c:370	none	not_reproduced
DF-0664	Medium	6.4	Missing locking enables TOCTOU/UAF races across all device entry points Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_device.c:309	none	not_reproduced
DF-1045	Medium	6.4	UAF in targclose: softc kfree'd before periph's targdtor runs Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_target.c:207	none	not_reproduced
DF-1071	Medium	6.4	pnp_create_devices mis-tracks scanning, causing heap OOB reads (and possible bogus device creation) from crafted PnP resource data Kernel memory leaks / uninitialized disclosure · sys/bus/isa/pnp.c:378	none	not_reproduced
DF-1228	Medium	6.4	Untrusted SMID used directly as sc->commands[] index in mpr_intr_locked (OOB array access) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr.c:2336	none	not_reproduced
DF-1294	Medium	6.4	Unvalidated hypervisor sq_idx causes stack buffer overflow in ena_com_ind_tbl_convert_from_device Kernel memory corruption (UAF / OOB write) · sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1156	none	not_reproduced
DF-1404	Medium	6.4	cuse_server_open re-initializes global cuse_global_mtx on every /dev/cuse open corrupting lock state Kernel memory corruption (UAF / OOB write) · sys/dev/misc/cuse/cuse.c:791	none	inconclusive
DF-1502	Medium	6.4	Lockless driver: interrupt handler races musycc_disconnect freeing tx/rx descriptor rings (UAF) Kernel memory corruption (UAF / OOB write) · sys/dev/misc/musycc/musycc.c:1341	none	inconclusive
DF-1759	Medium	6.4	isc_sm: UAF on pduq via early pdu_free in proc_out racing network-stack ext_free Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:530	none	inconclusive
DF-1768	Medium	6.4	ar9285_reset: unbounded EEPROM pwrPdg delta causes OOB write/read in GetGainBoundariesAndPdadcs Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:650	none	inconclusive
DF-1829	Medium	6.4	isc_soc: UAF/refcount corruption via ext_free on reused pduq in send path Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:70	none	inconclusive
DF-1961	Medium	6.4	Heap OOB write in k8pnow_decode_pst insertion sort from unchecked pst->n_states>16 Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/powernow/powernow.c:99	none	inconclusive
DF-2397	Medium	6.4	Unsynchronized AGP memory list operations enable UAF and TAILQ corruption via concurrent ioctls Kernel memory corruption (UAF / OOB write) · sys/dev/agp/agp.c:455	none	not_reproduced
DF-2499	Medium	6.4	TAILQ_FOREACH iterates pending_hcbs while freeing each element use-after-free read Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-cam.c:885	none	not_reproduced
DF-2500	Medium	6.4	In-flight ATA requests outlive atapi_cam_detach atapi_cb dereferences freed hcb and destroyed state_lock Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-cam.c:619	none	not_reproduced
DF-2536	Medium	6.4	Sense-data bcopy length not capped to 32-byte sense buffer kernel heap overflow into CCB and info leak of request-frame memory Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_cam.c:3141	none	not_reproduced
DF-0593	Info	6.4	Latent UAF: fairq_class_destroy does not clear dangling pif_default pointer (currently unreachable via pf ioctls) Kernel memory corruption (UAF / OOB write) · sys/net/altq/altq_fairq.c:428	none	not_reproduced
DF-0546	High	6.3	OOB read of lut[] in netmap_mem_ofstophys: page-padding offset maps garbage physical page into userspace Kernel memory leaks / uninitialized disclosure · sys/net/netmap/netmap_mem2.c:165	none	not_reproduced
DF-0974	Medium	6.3	xpt_action_sasync_cb use-after-free race on async_node during concurrent register/unregister Kernel memory corruption (UAF / OOB write) · sys/bus/cam/cam_xpt.c:3353	none	not_reproduced
DF-1194	Medium	6.3	ciss_init_logical and ciss_free use <= instead of < on ciss_logical array (off-by-one OOB write/kfree) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/ciss/ciss.c:1376	none	not_reproduced
DF-1285	Medium	6.3	INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN write fixed-size replies past dxfer_len-sized kernel buffer Kernel memory corruption (UAF / OOB write) · sys/dev/raid/hptmv/entry.c:2709	none	inconclusive
DF-1287	Medium	6.3	siba_pci_sprom dispatches rev-4/5/8 parsers without validating buffer size -> heap OOB read past 64-word buffer Kernel memory leaks / uninitialized disclosure · sys/dev/netif/bwn/siba/siba_core.c:1398	none	inconclusive
DF-1362	Medium	6.3	Integer overflow in mps_diag_read_buffer bounds check enables OOB read of fw_diag_buffer Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_user.c:1583	none	inconclusive
DF-1398	Medium	6.3	Off-by-one OOB array access in all four remove_*_entry functions (index==allocated passes > check) Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumconfig.c:1728	none	inconclusive
DF-1418	Medium	6.3	OOB read of vddc_dependency_on_sclk via clock_info_index clamped to wrong bound Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1350	none	inconclusive
DF-1475	Medium	6.3	Off-by-one in PhyNum target-ID fallback allows heap OOB write past sassc->targets[] Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas_lsi.c:885	none	inconclusive
DF-1814	Medium	6.3	tw_cl_init: tw_cli_init_connection double-inserts req into FREE_Q on any submit_and_poll failure -> queue list corruption Kernel memory corruption (UAF / OOB write) · sys/dev/raid/twa/tw_cl_init.c:677	none	inconclusive
DF-1039	Medium	6.2	NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote when CIS lacks VERS_1 tuple Base system — bus / platform / cpu · sys/bus/pccard/pccard.c:1020	none	not_reproduced
DF-1238	Medium	6.2	trm_Reselect walks circular DCB ring with no termination -> infinite loop / hard system hang Base system — drivers · sys/dev/disk/trm/trm.c:2426	none	not_reproduced
DF-1377	Medium	6.2	btccbptov() performs no bounds validation on HBA-supplied ccb_addr yielding OOB kernel read/write Base system — drivers · sys/dev/disk/buslogic/bt.c:104	none	inconclusive
DF-1438	Medium	6.2	Divide-by-zero in sumo_calculate_bsp via BIOS-controlled high_clk=0 Base system — drivers · sys/dev/drm/radeon/sumo_dpm.c:323	none	inconclusive
DF-2317	Medium	6.2	Kernel panic on attacker-controlled SD CSD structure version Base system — bus / platform / cpu · sys/bus/mmc/mmc.c:1056	none	not_reproduced
DF-2350	Medium	6.2	Heap OOB read in VS frame descriptor interval parsing leaks kernel memory to userspace Privilege escalation (general use) · sys/bus/u4b/uvc/uvc_drv.c:1900	none	not_reproduced
DF-2411	Medium	6.2	Divide-by-zero DoS in XPT_CALC_GEOMETRY via target-controlled block_size Base system — drivers · sys/dev/disk/advansys/advansys.c:441	none	not_reproduced
DF-1210	High	6.1	OOB read in DHRS error path: device-controlled CCS slot index dereferenced before bounds check Kernel memory leaks / uninitialized disclosure · sys/dev/disk/ahci/ahci.c:2843	none	not_reproduced
DF-2024	High	6.1	size_t underflow in multi-part SSIF write loop causes unbounded kernel heap OOB read and DoS Kernel memory corruption (UAF / OOB write) · sys/dev/misc/ipmi/ipmi_ssif.c:126	none	inconclusive
DF-2083	High	6.1	Heap OOB read in amdgpu_dm_set_degamma_lut via unvalidated blob size before __is_lut_linear Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:259	none	not_reproduced
DF-0997	Medium	6.1	RX mbuf m_len set from device-controlled RX descriptor flags with no bound -> heap OOB read Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_rum.c:1146	none	not_reproduced
DF-1012	Medium	6.1	Heap underflow write when VS_COLORFORMAT or VS_FRAME precedes any VS_FORMAT descriptor Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/uvc/uvc_drv.c:1836	none	not_reproduced
DF-1182	Medium	6.1	Heap OOB read via unbounded state-record clock indices into VBIOS dep tables Kernel memory leaks / uninitialized disclosure · DF-1168 · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2970	none	not_reproduced
DF-1200	Medium	6.1	Unvalidated BIOS-supplied array indices in power table parsing cause OOB heap reads Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_atombios.c:606	none	not_reproduced
DF-1223	Medium	6.1	XPT_RESET_DEV frees a regular-pool command via the high-priority free list, corrupting command-pool accounting Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_sas.c:3351	none	inconclusive
DF-1253	Medium	6.1	uint32 underflow in vega20_apply_clocks_adjust_rules: count-1 wraps to UINT32_MAX causing ~4B-iteration heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:3035	none	inconclusive
DF-1388	Medium	6.1	Integer overflow in find_section block-size check lets crafted MIPI block bypass bounds for OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:96	none	inconclusive
DF-1389	Medium	6.1	get_lvds_dvo_timing uses unvalidated VBT offsets for pointer arithmetic -> OOB read of LVDS timing Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:169	none	inconclusive
DF-1390	Medium	6.1	parse_mipi_config indexes config[6]/pps[6] with panel_type 0-15 -> OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_bios.c:808	none	inconclusive
DF-1456	Medium	6.1	Signed integer overflow in drm_mode_set_crtcinfo via unchecked vscan on user-supplied modes Base system — drivers · sys/dev/drm/drm_modes.c:1102	none	inconclusive
DF-1547	Medium	6.1	Missing cdb_len bounds check overflows the LRAM queue slot (sibling of DF-1356) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/advansys.c:548	none	inconclusive
DF-1576	Medium	6.1	Unbounded VBIOS USHORT offsets and VCE state indices cause OOB reads from BIOS image Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:283	none	inconclusive
DF-1810	Medium	6.1	cardbus_cis: unbounded CIS tuple-chain offset allows OOB read past BAR mapping (panic / MAC info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/pccard/cardbus/cardbus_cis.c:451	none	inconclusive
DF-1920	Medium	6.1	Cleanup loop reads uninitialized stack arrays when copyin fails partway through SGL loop Base system — drivers · sys/dev/raid/mrsas/mrsas_ioctl.c:153	none	inconclusive
DF-0660	High	6.0	Heap memory corruption: kfree() on mbuf data pointer in ng_device_rcvdata Base system — network stack · sys/netgraph/ng_device.c:363	none	not_reproduced
DF-1250	High	6.0	Hardcoded EDID parser over-reads rdev->bios by up to 32KB, disclosing kernel heap via EDID ioctl Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_combios.c:373	none	not_reproduced
DF-1251	High	6.0	Unbounded BIOS table-walking loops read past rdev->bios and drive WREG32 with OOB garbage Base system — drivers · sys/dev/drm/radeon/radeon_combios.c:291	none	not_reproduced
DF-2570	High	6.0	Heap corruption: kfree() of in-mbuf data pointer on every received packet in ng_device_rcvdata Base system — network stack · sys/netgraph/ng_device.c:363	none	not_reproduced
DF-0276	Medium	6.0	Wrong-pointer kfree in DIOCADDADDR error path frees framework pointer instead of allocated pooladdr Base system — network stack · sys/net/pf/pf_ioctl.c:2160	none	not_reproduced
DF-1408	Medium	6.0	Integer underflow / unbounded num_indices in multiple ATOM table parsers yields OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:106	none	inconclusive
DF-1733	Medium	6.0	vinumio: heap overflow on drivelist[] - DRIVEPARTS(35) smaller than loop bound (240) in vinum_scandisk Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumio.c:678	none	inconclusive
DF-1750	Medium	6.0	amdgpu_acpi: heap OOB read and ACPI_OBJECT type confusion in 4 ATIF/ATCS return buffer parsers Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:199	none	inconclusive
DF-1769	Medium	6.0	ar9285_reset: chain loop uses AR5416_MAX_CHAINS=3 on 4k EEPROM struct with calPierData2G[1][3] -> OOB type-confusion via txMask Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:607	none	inconclusive
DF-1875	Medium	6.0	Unvalidated PSP firmware header fields cause heap OOB write in fw_pri_buf (sysdrv + sos load) — variant of DF-1838 for Vega20/Navi10 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/psp_v11_0.c:122	none	inconclusive
DF-1895	Medium	6.0	parse_csr_fw never validates fw->datasize before indexing fw->data: multiple OOB-read paths Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_csr.c:297	none	inconclusive
DF-1964	Medium	6.0	Orphaned worker thread / use-after-free when write-side _init fails in dm_target_delay_init Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/delay/dm_target_delay.c:104	none	inconclusive
DF-0302	Medium	5.9	Failover state machine in input path runs without synchronization: concurrent state corruption Base system — network stack · sys/netinet/ip_carp.c:1108	dos	inconclusive
DF-0391	Medium	5.9	pf_fragcache: m_dup NULL dereferenced before NULL check in m_adj argument: remote DoS under memory pressure with fragcrop Base system — network stack · sys/net/pf/pf_norm.c:661	panic	inconclusive
DF-0423	Medium	5.9	Stale reg_mif_num after MRT6_DEL_MIF: remote NULL-deref panic via PIM REGISTER to freed register mif Kernel memory corruption (UAF / OOB write) · sys/netinet6/ip6_mroute.c:642	panic	inconclusive
DF-1155	Medium	5.9	Heap overflow in isp_handle_platform_atio CDB copy (parallel SCSI target mode) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/isp/isp_freebsd.c:1926	none	not_reproduced
DF-0044	Medium	5.8	mount_get_by_nc returns struct mount without a hold -> use-after-free via cache_fullpath racing dounmount Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_mount.c:1235	none on this non-INVARIANTS kernel (race too tight); theoretical local DoS / info-leak if the race is won (unprivileged if vfs.usermount=1, else races a privileged unmount)	not_reproduced
DF-0565	Medium	5.8	Callout lifetime: ng_uncallout non-synchronizing + nglmi_shutdown omits ng_uncallout — ng7 twin of DF-0557 Kernel memory corruption (UAF / OOB write) · sys/netgraph7/lmi/ng_lmi.c:1053	panic	not_reproduced
DF-1212	Medium	5.8	OOB array access in FBSS saved-commands reissue loop (hardcoded 32 vs sc_ncmds) Base system — drivers · sys/dev/disk/ahci/ahci.c:3972	none	inconclusive
DF-1383	Medium	5.8	Out-of-bounds write in tl_encap when TX mbuf chain has exactly TL_MAXFRAGS non-empty mbufs totaling <64 bytes Kernel memory corruption (UAF / OOB write) · sys/dev/netif/tl/if_tl.c:1794	none	inconclusive
DF-2417	Medium	5.8	ADW_TARGET_GROUP macro off-by-factor-4 causes heap OOB write/read on user_sdtr[4] for all wide-SCSI targets (tid >= 4) Kernel memory corruption (UAF / OOB write) · sys/dev/disk/advansys/adwlib.c:754	none	not_reproduced
DF-2572	High	5.7	Use-after-free / NULL-deref: connection list mutated and traversed with no synchronization Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_device.c:309	none	not_reproduced
DF-0965	Medium	5.7	twofish_set_key performs no key-length validation, allowing OOB stack writes and ctx corruption if reached with unsupported keylen Kernel memory corruption (UAF / OOB write) · sys/crypto/twofish/twofish.c:425	none	not_reproduced
DF-0988	Medium	5.7	cdsize accepts blksize=0 from READ_CAPACITY, cdstart divide-by-zero panics on read Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_cd.c:3058	none	not_reproduced
DF-0989	Medium	5.7	cdreaddvdstructure integer underflow in length math leaks kernel heap to userspace Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_cd.c:4288	none	not_reproduced
DF-1072	Medium	5.7	pnp_create_devices ANSI tag trim loop reads/writes stack below buf[0] with no lower bound Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnp.c:398	none	not_reproduced
DF-1090	Medium	5.7	pnp_parse_desc accesses fixed descriptor offsets without validating payload length, causing heap OOB read and OOB byte-write Kernel memory corruption (UAF / OOB write) · sys/bus/isa/pnpparse.c:90	none	not_reproduced fixed
DF-1214	Medium	5.7	Unchecked rxcd->len vs cluster size yields mbuf OOB read (guest kernel heap info leak) on RX Kernel memory leaks / uninitialized disclosure · sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2216	none	inconclusive
DF-1396	Medium	5.7	Firmware-controlled desc_count/desc_len in oce_get_profile_config/oce_get_func_config walks OOB past DMA buffer Kernel memory leaks / uninitialized disclosure · sys/dev/netif/oce/oce_mbox.c:2013	none	inconclusive
DF-1464	Medium	5.7	Unbounded scatter/gather list copy overflows per-CCB sg_list when CAM_SCATTER_VALID is set Kernel memory corruption (UAF / OOB write) · sys/dev/raid/dpt/dpt_scsi.c:730	none	inconclusive
DF-1709	Medium	5.7	iwm_scan: integer overflow in iwm_scan_size()/iwm_config_umac_scan via unbounded firmware n_scan_channels -> heap OOB write Kernel memory corruption (UAF / OOB write) · sys/dev/netif/iwm/if_iwm_scan.c:486	none	inconclusive
DF-1713	Medium	5.7	evdev: use-after-free race on ev_absinfo/ev_mt vs concurrent device detach in unlocked ioctls Kernel memory corruption (UAF / OOB write) · sys/dev/misc/evdev/cdev.c:351	none	inconclusive
DF-1784	Medium	5.7	radeon_bios: OOB read in radeon_get_bios - attacker-controlled BIOS offsets index into potentially tiny BIOS buffer Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_bios.c:752	none	inconclusive
DF-2000	Medium	5.7	UAF race in icioctl SIOCSIFMTU vs concurrent icoutput (TX) and icintr (RX) Kernel memory corruption (UAF / OOB write) · sys/dev/netif/ic/if_ic.c:205	none	inconclusive
DF-2336	Medium	5.7	Unbounded MMIO read/write in xHCI extended-capability list traversal Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/controller/xhci_pci.c:398	none	not_reproduced
DF-1399	Medium	5.6	vol->plex[] set to -1 by kw_prefer logic bug causing PLEX[-1] OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/raid/vinum/vinumconfig.c:1537	none	inconclusive
DF-1734	Medium	5.6	vinumio: remove_drive indexes drive[] with no bounds check; caller off-by-one > instead of >= Base system — drivers · sys/dev/raid/vinum/vinumio.c:237	none	inconclusive
DF-1739	Medium	5.6	vinumioctl: validdrive/validsd/validplex/validvol/resetstats accept negative indices -> OOB heap read/write via DRIVE[idx]/SD[idx]/PLEX[idx]/VOL[idx] Base system — drivers · sys/dev/raid/vinum/vinumioctl.c:381	none	inconclusive
DF-1884	Medium	5.6	Missing bounds check on plexno in parityops allows OOB read/write on PLEX array Kernel memory corruption (UAF / OOB write) · sys/dev/raid/vinum/vinumrevive.c:259	none	inconclusive
DF-1327	High	5.5	Kernel heap info leak in mpr_user_pass_thru: copyout uses user-controlled ReplySize with no upper bound Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_user.c:857	none	inconclusive
DF-1328	High	5.5	Kernel heap info leak in mpr_user_event_report: copyout of user-supplied Size from fixed-size recorded_events[40000] Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_user.c:2069	none	inconclusive
DF-1329	High	5.5	Integer overflow in mpr_diag_read_buffer bounds check allows OOB read of diag DMA buffer Kernel memory corruption (UAF / OOB write) · sys/dev/raid/mpr/mpr_user.c:1772	none	inconclusive
DF-1360	High	5.5	Kernel heap memory disclosure via mps_user_event_report copyout with attacker-controlled length Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mps/mps_user.c:1856	none	inconclusive
DF-1976	High	5.5	flush_workqueue hangs forever in uninterruptible tsleep (permanent kernel thread DoS) Base system — drivers · sys/dev/drm/linux_workqueue.c:309	none	inconclusive
DF-2163	High	5.5	tsleep while holding queue_lock deadlocks interrupt handler permanently hanging IPS controller Base system — drivers · sys/dev/raid/ips/ips_ioctl.c:125	none	not_reproduced
DF-2164	High	5.5	get_user_pages() KKASSERT inverts td_proc polarity, panicking on every user-context call Base system — drivers · sys/dev/drm/linux_shmem.c:137	none	not_reproduced
DF-2222	High	5.5	wait_for_completion_interruptible spins forever on signal (no break on ERESTART/EINTR) unkillable CPU-bound local DoS Base system — drivers · sys/dev/drm/linux_completion.c:38	none	not_reproduced
DF-2281	High	5.5	sgwrite: size_t->int truncation of uio_resid into buf_len plus unchecked kmalloc/M_ZERO memset-on-NULL yields local kernel panic Kernel memory corruption (UAF / OOB write) · sys/bus/cam/scsi/scsi_sg.c:648	none	not_reproduced
DF-0705	Medium	5.5	Local DoS / panic via out-of-order ioctls, kthread_create failure, and negative count in show_conf Base system — network stack · sys/net/ipfw3_basic/ip_fw3_sync.c:239	none	not_reproduced
DF-0808	Medium	5.5	dirfs_nrename NULL deref panic on over-length or unlinked rename paths Base system — filesystems · sys/vfs/dirfs/dirfs_vnops.c:977	none	not_reproduced
DF-0940	Medium	5.5	Integer truncation in vm_map_growstack grow_amount enables unbounded kernel-memory-growth local DoS Base system — virtual memory · sys/vm/vm_map.c:4110	none	not_reproduced
DF-0952	Medium	5.5	sys_vmspace_destroy leaks ve->refs on EBUSY, causing kernel panic in rb_vmspace_delete at proc exit Base system — virtual memory · sys/vm/vm_vmspace.c:222	none	not_reproduced
DF-0996	Medium	5.5	pmap_unwire dereferences NULL pte when page table page does not exist -> vkernel crash Base system — bus / platform / cpu · sys/platform/vkernel64/platform/pmap.c:2637	none	not_reproduced
DF-1028	Medium	5.5	OOB heap read in READ ELEMENT STATUS response parsing (device-controlled desclen/avail/flags) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:1118	none	not_reproduced
DF-1029	Medium	5.5	OOB heap read via unchecked blk_desc_len in MODE SENSE parsing (chdone/chgetparams) Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:494	none	not_reproduced
DF-1059	Medium	5.5	FW_SBINDADDR / FW_CBINDADDR dereference ir (= d->ir) without NULL check — local kernel NULL-deref DoS Base system — bus / platform / cpu · sys/bus/firewire/fwdev.c:600	none	not_reproduced
DF-1113	Medium	5.5	Unbounded ACPI table Length in sdt_sdth_map enables deterministic boot-time panic DoS Base system — bus / platform / cpu · sys/platform/pc64/acpica/acpi_sdt.c:137	none	not_reproduced
DF-1143	Medium	5.5	Divide-by-zero in ci_thermal_setup_fan_table from VBIOS-controlled fan temperature deltas Base system — drivers · DF-1129 · sys/dev/drm/amd/amdgpu/ci_dpm.c:1094	none	not_reproduced
DF-1152	Medium	5.5	BUG_ON kernel panic in atomic_check via MST connector without dc_sink Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:5290	none	not_reproduced
DF-1183	Medium	5.5	Heap OOB read in vega10_get_soc_index_for_max_uclk: hardcoded entries[3] without count check Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:3444	none	not_reproduced
DF-1193	Medium	5.5	CISS_BIG_MAP_BUS divide-by-zero: drives_per_scsi_bus==0 from controller ID_CTLR panics the kernel Base system — drivers · sys/dev/raid/ciss/ciss.c:4026	none	not_reproduced
DF-1245	Medium	5.5	Divide-by-zero DoS in evergreen_cs_track_validate_cb via user-controlled CB_COLOR_PITCH Base system — drivers · sys/dev/drm/radeon/evergreen_cs.c:1396	none	inconclusive
DF-1260	Medium	5.5	AIOGCAP ioctl dereferences d->mixer_dev without NULL check, causing kernel panic Base system — drivers · sys/dev/sound/pcm/dsp.c:1285	none	inconclusive
DF-1274	Medium	5.5	Divide-by-zero in SCLK/MCLK spread-spectrum math from VBIOS-controlled zero rates Base system — drivers · sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:591	none	inconclusive
DF-1393	Medium	5.5	Off-by-one in seq_fetch_mid yields NULL kobj dereference (local kernel panic via 0666 device) Base system — drivers · sys/dev/sound/midi/sequencer.c:724	none	inconclusive
DF-1403	Medium	5.5	Unprivileged OOB read / kernel memory leak in cik_get_register_value via attacker-controlled SE/SH index Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/cik.c:1026	none	inconclusive
DF-1431	Medium	5.5	Divide-by-zero in radeon_compute_pll_avivo via sub-10 kHz mode clock Base system — drivers · sys/dev/drm/radeon/radeon_display.c:959	none	inconclusive
DF-1433	Medium	5.5	NULL pointer dereference in radeon_wb_init on GPU resume/reset (kernel panic) Base system — drivers · sys/dev/drm/radeon/radeon_device.c:454	none	inconclusive
DF-1434	Medium	5.5	CDRIOCSETBLOCKSIZE with arg=0 causes kernel divide-by-zero panic via rounddown() Privilege escalation (general use) · sys/dev/disk/nata/atapi-cd.c:723	none	inconclusive
DF-1453	Medium	5.5	NULL pointer dereference in radeon_legacy_tv_dac_mode_set via unguarded enc_priv Base system — drivers · sys/dev/drm/radeon/radeon_legacy_encoders.c:1159	none	inconclusive
DF-1467	Medium	5.5	vi_get_register_value OOB read of gfx.config.rb_config[se][sh] via AMDGPU_INFO_READ_MMR_REG (DF-1403 twin) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/vi.c:550	none	inconclusive
DF-1471	Medium	5.5	NULL deref DoS in init_overdrive_limits and cac_dtp_table allocation path Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1062	none	inconclusive
DF-1494	Medium	5.5	midistat_read OOB kernel heap read via unchecked negative uio_offset Kernel memory leaks / uninitialized disclosure · sys/dev/sound/midi/midi.c:1038	none	inconclusive
DF-1495	Medium	5.5	qlock leak in midi_read/midi_write/midisynth_writeraw blocks device permanently (local DoS) Base system — drivers · sys/dev/sound/midi/midi.c:762	none	inconclusive
DF-1509	Medium	5.5	Unbounded multicast CAM index in bfe_set_rx_mode enables local NIC hang DoS Base system — drivers · sys/dev/netif/bfe/if_bfe.c:844	none	inconclusive
DF-1520	Medium	5.5	Heap OOB read in ath_hal_getregdump via HAL_DIAG_REGS — loop bound on output space, not on input array size Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ah.c:848	none	inconclusive
DF-1521	Medium	5.5	NULL-deref kernel panic via HAL_DIAG_REGS / HAL_DIAG_EEREAD when caller passes result=NULL or args=NULL Privilege escalation (general use) · sys/dev/netif/ath/ath_hal/ah.c:880	none	inconclusive
DF-1537	Medium	5.5	Unbounded WS operand index and NULL dereference when ws=0 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/atom.c:233	none	inconclusive
DF-1555	Medium	5.5	Memory leak of drm_pending_vblank_event on out-fence error path in complete_signaling() Base system — drivers · sys/dev/drm/drm_atomic_uapi.c:1083	none	inconclusive
DF-1559	Medium	5.5	Signedness bug in copy_batch min_t causes kernel heap overflow with large batch_len Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/i915_cmd_parser.c:1104	none	inconclusive
DF-1575	Medium	5.5	NULL pointer dereference in get_pcie_table/get_gpio_table when vdd_dep_on_sclk is NULL Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:522	none	inconclusive
DF-1587	Medium	5.5	NULL pointer dereference in get_pcie_table when usGfxclkDependencyTableOffset is zero Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:765	none	inconclusive
DF-1593	Medium	5.5	rv515_debugfs_ga_info issues destructive GPU reset on every read of world-readable debugfs file Base system — drivers · sys/dev/drm/radeon/rv515.c:259	none	inconclusive
DF-1595	Medium	5.5	Divide-by-zero in UVD decode message parser crashes the kernel Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524	none	inconclusive
DF-1708	Medium	5.5	radeon_clocks: divide-by-zero in calc_eng_mem_clock via zeroed reference_freq from crafted VBIOS Base system — drivers · sys/dev/drm/radeon/radeon_clocks.c:371	none	inconclusive
DF-1717	Medium	5.5	amdgpu_display: GEM object reference leak on imported dma-buf framebuffer creation path (local memory-exhaustion DoS) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_display.c:531	none	inconclusive
DF-1724	Medium	5.5	radeon_cs: unchecked IB chunk length_dw in non-VM path triggers BUG_ON kernel panic Base system — drivers · sys/dev/drm/radeon/radeon_cs.c:608	none	inconclusive
DF-1726	Medium	5.5	radeon_cs: NULL parser->ib.fence dereference in radeon_cs_parser_fini when CS has relocs but no IB chunk Base system — drivers · sys/dev/drm/radeon/radeon_cs.c:414	none	inconclusive
DF-1774	Medium	5.5	mpt_user: uninitialized kernel-heap memory leak via MPTIO_READ_CFG_PAGE / READ_EXT_CFG_PAGE Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_user.c:186	none	inconclusive
DF-1775	Medium	5.5	mpt_user: kernel panic via len==0 kmalloc(0) returns ZERO_LENGTH_PTR -> page fault in copyin/hdr deref Base system — drivers · sys/dev/disk/mpt/mpt_user.c:186	none	inconclusive
DF-1789	Medium	5.5	ar2316: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> kernel OOB read (mirrors DF-1766) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:384	none	inconclusive
DF-1855	Medium	5.5	Unbounded busy-wait in psp_cmd_submit_buf hangs kernel thread on PSP submission failure or non-response Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_psp.c:130	none	inconclusive
DF-1907	Medium	5.5	acp_poweron dereferences powerplay.pp_funcs without NULL guard: kernel panic Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_acp.c:145	none	inconclusive
DF-1921	Medium	5.5	Early-return error paths leak mfi cmds and DMA resources: cmd-pool exhaustion DoS Base system — drivers · sys/dev/raid/mrsas/mrsas_ioctl.c:193	none	inconclusive
DF-1932	Medium	5.5	kfree(NULL) kernel panic on any PCI attach failure path Base system — drivers · sys/dev/raid/aac/aac_pci.c:358	none	inconclusive
DF-1944	Medium	5.5	afd_reinit frees softc without destroying disk cdev: orphan /dev/afd* NULL-deref/UAF on next I/O Kernel memory corruption (UAF / OOB write) · sys/dev/disk/nata/atapi-fd.c:168	none	inconclusive
DF-1951	Medium	5.5	Kernel heap info leak: uninitialized BIOS buffer exposed to unprivileged userspace via AMDGPU_INFO_VBIOS_IMAGE ioctl on ATRM path Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_bios.c:338	none	inconclusive
DF-1954	Medium	5.5	OOB kernel heap info leak in sndstat_read via signed/unsigned truncation in min() length math Kernel memory leaks / uninitialized disclosure · sys/dev/sound/pcm/sndstat.c:206	none	inconclusive
DF-1957	Medium	5.5	Divide-by-zero in clip_scaled when destination rectangle has zero width or height Base system — drivers · sys/dev/drm/drm_rect.c:53	none	inconclusive
DF-1981	Medium	5.5	Missing feature-arg-count validation in _init_features allows kernel panic via crafted dmsetup table string Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/flakey/dm_target_flakey.c:131	none	inconclusive
DF-1987	Medium	5.5	BUG_ON panic on oversize SA allocation request converts user-triggerable error into kernel panic (Local DoS) Base system — drivers · sys/dev/drm/radeon/radeon_sa.c:321	none	inconclusive
DF-2003	Medium	5.5	Unbounded busy-wait polling in SMIC allows permanent kernel thread hang / CPU DoS Base system — drivers · sys/dev/misc/ipmi/ipmi_smic.c:53	none	inconclusive
DF-2215	Medium	5.5	Unconditional memset on FREEBLKS bios writes to unmapped KVA causing kernel panic Kernel memory corruption (UAF / OOB write) · sys/dev/disk/dm/dm_target_zero.c:43	none	not_reproduced
DF-2245	Medium	5.5	Unbounded recursion in kqsort causes kernel stack overflow on adversarial input Kernel memory corruption (UAF / OOB write) · sys/libkern/qsort.c:173	none	not_reproduced
DF-2463	Medium	5.5	NULL-deref panic in so_input: pdu_alloc retry uses M_NOWAIT instead of M_WAITOK then dereferences pq unconditionally Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_soc.c:540	none	inconclusive
DF-2472	Medium	5.5	ISP_FC_GETDINFO ioctl missing channel bounds check -> kernel heap OOB read / info leak Kernel memory leaks / uninitialized disclosure · sys/dev/disk/isp/isp_freebsd.c:471	none	not_reproduced
DF-2479	Medium	5.5	Divide-by-zero in mmcsd_delete via attacker-controlled CSD erase-sector size Base system — drivers · sys/dev/disk/mmcsd/mmcsd.c:407	none	not_reproduced
DF-2486	Medium	5.5	Kernel heap info leak via uninitialized DMA buffer in MPTIO_READ_CFG_PAGE / MPTIO_READ_EXT_CFG_PAGE Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_user.c:203	none	not_reproduced
DF-2503	Medium	5.5	TOCTOU info leak in CDIOCREADSUBCHANNEL via double-fetch of args->data_len Kernel memory leaks / uninitialized disclosure · sys/dev/disk/nata/atapi-cd.c:502	none	not_reproduced
DF-2512	Medium	5.5	Admin request leak on failed Identify NS exhausts pool and panics kernel Base system — drivers · sys/dev/disk/nvme/nvme_admin.c:624	none	not_reproduced
DF-2514	Medium	5.5	Divide-by-zero kernel panic in XPT_CALC_GEOMETRY from block_size > 1MB Base system — drivers · sys/dev/disk/sbp/sbp.c:2384	none	not_reproduced
DF-2535	Medium	5.5	OOB read / deterministic panic in mpt_disable_lun via wildcard LUN (loop indexes trt[lun] not trt[i]) Kernel memory leaks / uninitialized disclosure · sys/dev/disk/mpt/mpt_cam.c:4334	none	not_reproduced
DF-2561	Medium	5.5	Accept-filter NULL-deref/UAF race in soisconnected vs do_setopt_accept_filter Kernel memory corruption (UAF / OOB write) · sys/kern/uipc_socket2.c:252	none	not_reproduced
DF-2568	Medium	5.5	NULL-deref panic in hammer2_flush retry loop when chain loses parent during flush Hammer2 · sys/vfs/hammer2/hammer2_flush.c:404	panic	not_reproduced
DF-2390	Low	5.5	Boot-time kernel panic from inconsistent DPF handling between resource counter and link_add_crs Base system — drivers · sys/dev/acpica/acpi_pci_link.c:180	none	not_reproduced
DF-0282	Medium	5.4	Signed tx_cred overflow and OOB credit byte read in UIH reception Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2409	none	inconclusive
DF-0431	Medium	5.4	Dead expire-scaling code: imported state expiry is always raw attacker value, enabling infinite-lifetime states Base system — network stack · sys/net/pf/if_pfsync.c:402	none	inconclusive
DF-0526	Medium	5.4	ng_fec_choose_port dereferences ether/IP headers without mbuf length validation: OOB read Kernel memory leaks / uninitialized disclosure · sys/netgraph/fec/ng_fec.c:897	none	not_reproduced
DF-1239	Medium	5.4	iwi_frame_intr frame->len bound too loose: up to 28-byte OOB read past mbuf cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwi/if_iwi.c:1248	none	not_reproduced
DF-2578	Medium	5.4	OOB heap write via unchecked tdma_slot in ieee80211_parse_tdma Kernel memory corruption (UAF / OOB write) · sys/netproto/802_11/wlan/ieee80211_tdma.c:657	none	not_reproduced
DF-1145	High	5.3	Unbounded firmware-supplied MPDU length in RX paths causes kernel heap OOB read Kernel memory leaks / uninitialized disclosure · DF-1123 · sys/dev/netif/iwm/if_iwm.c:3221	none	inconclusive
DF-0162	Medium	5.3	Global modules TAILQ mutated without mod_token: unpriv readers race with privileged kldload/unload Kernel memory corruption (UAF / OOB write) · sys/kern/kern_module.c:141	none	not_reproduced fixed
DF-0176	Medium	5.3	cttyioctl forwards ioctls to ttyvp without vnode reference (UAF race) Kernel memory corruption (UAF / OOB write) · sys/kern/tty_tty.c:238	none	not_reproduced fixed
DF-0271	Medium	5.3	NULL deref in bridge_input: unchecked bridge_lookup_member_if result (race with member deletion) Base system — network stack · sys/net/bridge/if_bridge.c:2738	panic	not_reproduced
DF-0406	Medium	5.3	in_delayed_cksum: unchecked m_pullup return leads to NULL pointer write panic Base system — network stack · sys/netinet/ip_output.c:940	panic	inconclusive
DF-0522	Medium	5.3	thread0 root-credential fallback for socket operations (DF-0510 v1 twin) Privilege escalation (general use) · sys/netgraph/ksocket/ng_ksocket.c:559	none	not_reproduced
DF-0566	Medium	5.3	ACL reassembly want is uint16_t: overshoot wraps -> L2CAP RX stall + unbounded memory growth Base system — network stack · sys/netbt/hci_link.c:421	none	not_reproduced
DF-0928	Medium	5.3	UFS inode-hash has no lock; concurrent ffs_vget() inserts orphan an inode and panic on reclaim (dual-vnode on production) Base system — filesystems · sys/vfs/ufs/ufs_ihash.c:78	none	not_reproduced
DF-1070	Medium	5.3	Teardown race in scsi_targ_bh: fixed hz/2 sleep with no wakeup allows CTIO completion after softc kfree (UAF) Kernel memory corruption (UAF / OOB write) · DF-1045 · sys/bus/cam/scsi/scsi_targ_bh.c:342	none	not_reproduced
DF-1231	Medium	5.3	Use-after-free race in aac_getnext_aif: AIF context list traversed and dereferenced without aac_aifq_lock Kernel memory corruption (UAF / OOB write) · sys/dev/raid/aac/aac.c:3519	none	not_reproduced
DF-1254	Medium	5.3	OD8 capability/settings arrays indexed by constants but allocated to VBIOS-supplied length -> heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:894	none	inconclusive
DF-1371	Medium	5.3	oce_rx/oce_discard_rx_comp loop past empty RQ ring on firmware-misreported fragment count, NULL-deref panic Base system — drivers · sys/dev/netif/oce/oce_if.c:1274	none	inconclusive
DF-1484	Medium	5.3	Missing size validation for AMDGPU_CHUNK_ID_IB allows OOB read of drm_amdgpu_cs_chunk_ib fields Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_cs.c:166	none	inconclusive
DF-1492	Medium	5.3	Missing minimum COUNT validation in r300_packet3_check allows OOB read/write past IB buffer Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/r300.c:1176	none	inconclusive
DF-1761	Medium	5.3	isc_sm: remote memory leak / pdu-pool exhaustion via TASK_RSP/default cases never freeing received pduq Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred · sys/dev/disk/iscsi/initiator/isc_sm.c:451	none	inconclusive
DF-1909	Medium	5.3	acp_hw_fini frees genpd without pm_genpd_remove: dangling UAF in global genpd list Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/amdgpu_acp.c:217	none	inconclusive
DF-1953	Medium	5.3	Unmasked ioread32(vaddr+head+4) reads 4 bytes past ring-buffer mapping in semaphore_waits_for Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_hangcheck.c:103	none	inconclusive
DF-2271	Medium	5.3	Device-controlled avail in chgetelemstatus walks desc past data buffer -> kernel heap info leak via copyout Kernel memory leaks / uninitialized disclosure · sys/bus/cam/scsi/scsi_ch.c:1159	none	not_reproduced
DF-2589	Medium	5.3	Unchecked AcpiEvaluateObject return in acpi_panasonic_sinf causes NULL-deref panic and heap OOB read Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:277	none	not_reproduced
DF-0365	Medium	5.2	ieee80211_media_setup unbounded rate-set merge overflows stack buffer rs_rates[15]: 17 unique rates across 11a/b/g/HALF/QUARTER Kernel memory corruption (UAF / OOB write) · disputed · 👤 orchestrator · sys/netproto/802_11/wlan/ieee80211.c:1564	none	not_reproduced
DF-0633	Medium	5.2	ip_fw3_ctl_state_get reads every other CPU RB tree without synchronization Kernel memory corruption (UAF / OOB write) · sys/net/ipfw3_basic/ip_fw3_state.c:422	none	not_reproduced
DF-0683	Medium	5.2	hci_disable modifies queues and link list without hci_devlock, racing with hci_intr (panic / mbuf UAF) Kernel memory corruption (UAF / OOB write) · sys/netbt/hci_unit.c:250	none	not_reproduced
DF-0689	Medium	5.2	Unsynchronized encaptab list yields use-after-free in encap4_input/encap6_input dispatch Kernel memory corruption (UAF / OOB write) · sys/netinet/ip_encap.c:174	none	not_reproduced
DF-1217	Medium	5.2	Unprivileged users get raw I2C-bus, EEPROM-write, and GPIO control over the capture card Privilege escalation (general use) · sys/dev/video/bktr/bktr_core.c:2058	none	inconclusive
DF-1415	Medium	5.2	Unchecked gpio pin count from u16 structuresize indexes fixed gpio_pin[8] array Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:353	none	inconclusive
DF-1498	Medium	5.2	Unvalidated VBIOS USHORT offsets and UCHAR counts in atomctrl_get_leakage_vddc_base_on_leakage allow OOB read of BIOS image Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1498	none	inconclusive
DF-1804	Medium	5.2	snp: UAF / infinite-loop race between snpclose and concurrent snplwrite/snp_in on snooped tty Kernel memory corruption (UAF / OOB write) · sys/dev/misc/snp/snp.c:484	none	inconclusive
DF-1874	Medium	5.2	Signed int32 (daddr_t) overflow in block/offset math corrupts data.data pointer for >1 TiB SDXC cards Base system — drivers · sys/dev/disk/mmcsd/mmcsd.c:338	none	inconclusive
DF-2219	Medium	5.2	Unbounded array index in encode_pcie_lane_width() allows OOB .rodata read via crafted GPU VBIOS Privilege escalation (general use) · sys/dev/drm/amd/powerplay/hwmgr/pppcielanes.c:56	none	not_reproduced
DF-1252	Medium	5.1	Unvalidated 16-bit BIOS offsets dereferenced in LVDS mode-table and GPIO voltage-table parsing (OOB read up to 64KB) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/radeon_combios.c:1246	none	inconclusive
DF-1386	Medium	5.1	Divide-by-zero panic in cypress_calculate_burst_time when memory_clock<=1 Base system — drivers · sys/dev/drm/radeon/cypress_dpm.c:907	none	inconclusive
DF-1530	Medium	5.1	hpt_get_channel_info uses caller-controlled bus with no bounds check (OOB read + kernel pointer leak / panic) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/hptmv/gui_lib.c:446	none	inconclusive
DF-1540	Medium	5.1	Use-after-free read of dangling sch->hook in NGM_TEXT_STATUS after hook disconnect Kernel memory corruption (UAF / OOB write) · sys/dev/netif/mn/if_mn.c:474	none	inconclusive
DF-1802	Medium	5.1	snp: SNPSTTY with NOUDEV drops snp_token before snp_down/snp_detach -> ASSERT_LWKT_TOKEN_HELD panic or unlocked race Base system — drivers · sys/dev/misc/snp/snp.c:540	none	inconclusive
DF-1978	Medium	5.1	queue_delayed_work silently ignores caller workqueue always runs on system_wq breaking ordered/highpri semantics Base system — drivers · sys/dev/drm/linux_workqueue.c:151	none	inconclusive
DF-1989	Medium	5.1	No BAR bounds validation on TPM-reported buffer offsets and sizes Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm_crb.c:187	none	inconclusive
DF-2027	Medium	5.1	All VBIOS table parsers dereference attacker-controlled offsets without bounds validation -- OOB heap read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:42	none	inconclusive
DF-2410	Medium	5.1	TPM-reported CRB buffer offsets/sizes used as BAR offsets without any BAR bounds check (and off-by-one in offset normalization) Kernel memory corruption (UAF / OOB write) · sys/dev/crypto/tpm/tpm_crb.c:188	none	not_reproduced
DF-0008	Low	5.1	vfs_setpublicfs() use-after-vput of root vnode + refcount leak on VFS_VPTOFH error Kernel memory corruption (UAF / OOB write) · sys/kern/vfs_subr.c:2255	none	not_reproduced
DF-0610	Low	5.1	Heap OOB read in NGM_NAT_PROXY_RULE via non-NUL-terminated user string Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_nat.c:643	none	not_reproduced
DF-0726	Low	5.1	if_cloners list and if_cloners_count accessed without synchronization — unprivileged SIOCIFGCLONERS races module load/unload UAF Kernel memory corruption (UAF / OOB write) · sys/net/if_clone.c:43	none	not_reproduced fixed
DF-2303	Low	5.1	Latent negative-length bcopy in fwohci_arcv split-header reassembly can cause kernel panic Kernel memory corruption (UAF / OOB write) · sys/bus/firewire/fwohci.c:2729	corruption	not_reproduced fixed
DF-0106	Medium	5.0	dkcksum32 OOB read via crafted disklabel in writedisklabel path Kernel memory corruption (UAF / OOB write) · sys/kern/subr_disklabel32.c:358	no observable runtime panic/leak on the writedisklabel path (bug real in source); sibling DF-0107 demonstrates the shared root-cause panic	not_reproduced
DF-0484	Medium	4.8	SYN-cookie crypto state global unsynchronized across netisr CPUs: racy MD5_CTX + tcp_secret[] defeats SYN-flood mitigation Base system — network stack · sys/netinet/tcp_syncache.c:1351	none	not_reproduced
DF-2165	High	4.7	shem_read_mapping_page() leaks VM_OBJECT_LOCK and hold_count on every error path Base system — drivers · sys/dev/drm/linux_shmem.c:52	none	not_reproduced
DF-2166	High	4.7	pagecache_write_begin() stores shmem ERR_PTR in *pagep and returns success, causing kmap panic Base system — drivers · sys/dev/drm/linux_shmem.c:102	none	not_reproduced
DF-0014	Medium	4.7	enterpgrp() lwkt_reltoken on an un-acquired token -> race-triggered kernel panic Base system — kernel core (kern) · sys/kern/kern_proc.c:763	none	not_reproduced
DF-0039	Medium	4.7	ptsopen check-then-use TOCTOU on dev->si_drv1 -> NULL-deref kernel panic (local DoS) Base system — kernel core (kern) · sys/kern/tty_pty.c:313	none	not_reproduced
DF-0047	Medium	4.7	mtx_wait_link lock-leak race: chain can grant lock during mtx_delete_link window, caller returns error despite holding the lock (permanent deadlock) Base system — kernel core (kern) · sys/kern/kern_mutex.c:1002	none	not_reproduced
DF-0325	Medium	4.7	Deadlock: callout_stop under pcb_lock while timeout callback requires pcb_lock Base system — network stack · sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2765	none	inconclusive
DF-0366	Medium	4.7	Lockless sc_count pre-check in lagg_start races with port destroy causing divide-by-zero panic Base system — network stack · sys/net/lagg/if_lagg.c:1758	none	inconclusive
DF-0696	Medium	4.7	Missing return after NG_FREE_DATA in ng_etf_rcvdata turns discard path into NULL-deref panic Kernel memory corruption (UAF / OOB write) · sys/netgraph/etf/ng_etf.c:381	none	not_reproduced
DF-0813	Medium	4.7	NULL deref in hammer2_flush() retry loop when chain->parent becomes NULL during concurrent flush — missing NULL guards present in setup/teardown Hammer2 · sys/vfs/hammer2/hammer2_flush.c:397	none	not_reproduced
DF-0847	Medium	4.7	Global dquot hash/free-list manipulated with no lock - concurrent ufs_dqget cache-miss corrupts lists and panics Base system — filesystems · sys/vfs/ufs/ufs_quota.c:769	none	not_reproduced
DF-0955	Medium	4.7	Race-induced kernel panic in vm_contig_pg_alloc when first iteration of alloc loop fails (vm_contig_pg_free called with size=0) Base system — virtual memory · sys/vm/vm_contig.c:398	none	not_reproduced
DF-1035	Medium	4.7	bus_dmamap_load_uio uses stale absolute segment index after advancing segs pointer -> KKASSERT panic or OOB write Kernel memory corruption (UAF / OOB write) · sys/platform/pc64/x86_64/busdma_machdep.c:961	none	not_reproduced
DF-1151	Medium	4.7	Divide-by-zero DoS in ci_thermal_setup_fan_table from unvalidated VBIOS fan temperatures Base system — drivers · DF-1129 · sys/dev/drm/radeon/ci_dpm.c:1018	none	not_reproduced
DF-1391	Medium	4.7	VBIOS power-table parsing dereferences attacker-controlled offsets with no bounds checks Kernel memory leaks / uninitialized disclosure · sys/dev/drm/radeon/rv6xx_dpm.c:1889	none	inconclusive
DF-1424	Medium	4.7	TOCTOU race: interrupt completion re-reads unchecked user buffer sizes from ioctl ucmd Kernel memory leaks / uninitialized disclosure · sys/dev/raid/iir/iir.c:1600	none	inconclusive
DF-1527	Medium	4.7	i915_request_skip reads uninitialized rq->postfix, causing ring-buffer memset with stale slab offset Base system — drivers · sys/dev/drm/i915/i915_request.c:1019	none	inconclusive
DF-1581	Medium	4.7	Off-by-one SMID bounds check in mfi_tbolt_complete_cmd allows OOB read of mfi_cmd_pool_tbolt[] Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mfi/mfi_tbolt.c:666	none	inconclusive
DF-1796	Medium	4.7	ar2413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> deterministic kernel OOB read panic (mirrors DF-1766/DF-1789) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:353	none	inconclusive
DF-1806	Medium	4.7	ar2317: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:363	none	inconclusive
DF-1815	Medium	4.7	ppatomfwctrl: voltage-object VBIOS walk uses attacker-controlled structuresize/object_size -> OOB read + infinite-loop DoS Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:33	none	inconclusive
DF-1834	Medium	4.7	NULL pointer deref in drm_sched_job_timedout first loop (missing parent check) Base system — drivers · sys/dev/drm/scheduler/sched_main.c:259	none	inconclusive
DF-1949	Medium	4.7	ASSERT-only divide-by-zero guard in fixed-point division panics kernel in production builds Base system — drivers · sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43	none	inconclusive
DF-1974	Medium	4.7	NULL pointer dereference in radeon_dig_monitor_is_duallink when encoder has no linked connector Base system — drivers · sys/dev/drm/radeon/radeon_encoders.c:368	none	inconclusive
DF-1985	Medium	4.7	u32 to uint16 truncation of pitch into fb_info.stride enables syscons mmap SIZE_MAX bound-check bypass (kernel memory read primitive) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_fb.c:261	none	inconclusive
DF-2025	Medium	4.7	Missing upper-bound on BMC-supplied response byte count causes kernel stack OOB read into userspace reply Kernel memory leaks / uninitialized disclosure · sys/dev/misc/ipmi/ipmi_ssif.c:183	none	inconclusive
DF-2026	Medium	4.7	Multi-part SSIF response read loop has no iteration cap -- infinite-loop DoS via malicious BMC Kernel memory corruption (UAF / OOB write) · sys/dev/misc/ipmi/ipmi_ssif.c:255	none	inconclusive
DF-2509	Medium	4.7	ast_reinit frees softc/NULLs ivars; ast_detach then NULL-derefs (same class as DF-2507 never fixed here) Base system — drivers · sys/dev/disk/nata/atapi-tape.c:202	none	not_reproduced
DF-0800	Low	4.7	Missing NULL check on hammer2_inode_chain in truncation reset path — panic + %s OOB read on crafted image filename Hammer2 · sys/vfs/hammer2/hammer2_xops.c:1600	none	not_reproduced fixed
DF-0818	Low	4.7	Integer divide-by-zero in bulkfree_pass progress computation for total_size<10000 (crafted image volu_size=0) Hammer2 · sys/vfs/hammer2/hammer2_bulkfree.c:727	none	not_reproduced fixed
DF-0935	Low	4.7	Stack buffer overflow via unbounded ksprintf into psbuf[512] in /proc/<pid>/rlimit Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_rlimit.c:64	none	not_reproduced
DF-2299	Low	4.7	Missing NULL check on kmalloc return in fwdma_malloc_multiseg Base system — bus / platform / cpu · sys/bus/firewire/fwdma.c:162	none	not_reproduced
DF-2396	Low	4.7	UAF: sysctl sensor read races kfree of sensor arrays in detach Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/aibs/atk0110.c:268	corruption	not_reproduced
DF-2208	Info	4.7	Missing NULL checks on kzalloc/kasprintf returns in drm_sysfs_connector_add cause NULL-deref panic under OOM Base system — drivers · sys/dev/drm/drm_sysfs.c:39	none	not_reproduced fixed
DF-1017	High	4.6	Untrusted READ_CAPACITY block_len=0 causes kernel divide-by-zero panic (secsize used as divisor without validation) Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_da.c:2280	none	inconclusive
DF-0621	Medium	4.6	Privilege bypass: rip6_output uses cr_uid==0 instead of caps_priv_check for per-packet IPv6 options Privilege escalation (general use) · sys/netinet6/raw_ip6.c:297	none	not_reproduced
DF-0990	Medium	4.6	PCI capability-list walk has no cycle detection, malicious device hangs kernel forever Base system — bus / platform / cpu · sys/bus/pci/pci.c:847	none	not_reproduced
DF-1023	Medium	4.6	Kernel panic on unrecognized SD CSD version from malicious SD card (csd_structure=2 or 3 triggers panic not graceful error) Base system — bus / platform / cpu · sys/bus/mmc/mmc.c:1056	none	not_reproduced
DF-1038	Medium	4.6	NULL pointer dereference in wsp_intr_callback when ntouch==0 (malicious USB / TYPE1 regression) Base system — bus / platform / cpu · sys/bus/u4b/input/wsp.c:845	none	not_reproduced
DF-1040	Medium	4.6	Unvalidated 32-bit CIS longlink/MFC target address causes wild bus_space_read_1 and kernel panic Kernel memory corruption (UAF / OOB write) · sys/bus/pccard/pccard_cis.c:386	panic	inconclusive
DF-1093	Medium	4.6	NULL pointer dereference in ppb_pnp_detect via crafted IEEE 1284 PnP string Base system — bus / platform / cpu · sys/bus/ppbus/ppbconf.c:242	none	not_reproduced fixed
DF-1106	Medium	4.6	Unbounded XHCI extended-capability pointer walk allows OOB MMIO read/write and kernel DoS from malicious PCI controller Kernel memory leaks / uninitialized disclosure · DF-1092 · sys/bus/u4b/controller/xhci_pci.c:398	none	not_reproduced
DF-1240	Medium	4.6	iwi_checkforqos unbounded notif->len allows up to 292-byte OOB read past RX mbuf on crafted ASSOC RESP Kernel memory leaks / uninitialized disclosure · sys/dev/netif/iwi/if_iwi.c:1368	none	not_reproduced
DF-1269	Medium	4.6	Missing bounds checks on VBIOS-supplied indices in kv_parse_power_table (OOB reads) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/kv_dpm.c:2745	none	inconclusive
DF-1278	Medium	4.6	Infinite recursion in mpt_configure_ioc due to tn++ post-increment bypasses retry limit -> stack overflow Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt.c:2630	none	inconclusive
DF-1279	Medium	4.6	Divide-by-zero panic if malicious IOC reports RequestFrameSize == 0 Base system — drivers · sys/dev/disk/mpt/mpt.c:2654	none	inconclusive
DF-1414	Medium	4.6	Unchecked VBIOS number_of_path (u8) indexes fixed display_path[8] at 6 call sites Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/dc/bios/bios_parser2.c:162	none	inconclusive
DF-1452	Medium	4.6	ae_rxeof lacks upper-bound check on NIC-controlled rxd->len allowing OOB heap read via m_devget Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ae/if_ae.c:609	none	inconclusive
DF-1463	Medium	4.6	Divide-by-zero panic in XPT_CALC_GEOMETRY from block_size==0 Base system — drivers · sys/dev/raid/dpt/dpt_scsi.c:1025	none	inconclusive
DF-1809	Medium	4.6	ar2425: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796/1806) Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:264	none	inconclusive
DF-1923	Medium	4.6	Detach loop indexes mem_res[] by slot position rather than slot->num: NULL-deref panic + resource leak after partial slot-init failure Base system — drivers · sys/dev/disk/sdhci/sdhci_pci.c:350	none	inconclusive
DF-1940	Medium	4.6	Divide-by-zero in ata_intel_31244_tf_write via crafted IDENTIFY CHS geometry (heads=0 or sectors=0) Base system — drivers · sys/dev/disk/nata/chipsets/ata-intel.c:471	none	inconclusive
DF-1966	Medium	4.6	NULL pointer dereference in dm_dp_mst_get_modes via unchecked dc_link_add_remote_sink return Base system — drivers · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:237	none	inconclusive
DF-2338	Medium	4.6	NULL-deref in wsp_intr_callback when first HID report yields ntouch=0 (always for TYPE1 devices) Base system — bus / platform / cpu · sys/bus/u4b/input/wsp.c:884	none	not_reproduced
DF-2415	Medium	4.6	Divide-by-zero panic in XPT_CALC_GEOMETRY from device-controlled block_size Base system — drivers · sys/dev/disk/advansys/adwcam.c:734	none	not_reproduced
DF-0510	Medium	4.5	Credential bypass via thread0 fallback in socket operations: root creds for all ksocket ops Privilege escalation (general use) · sys/netgraph7/ksocket/ng_ksocket.c:546	none	not_reproduced
DF-2272	Info	4.5	TOCTOU on user-supplied chio.h ioctl structs enables re-validation bypass in move/exchange/position/setvoltag Base system — bus / platform / cpu · sys/bus/cam/scsi/scsi_ch.c:805	none	not_reproduced
DF-2571	High	4.4	Kernel stack overflow via user-controlled VLA in ngdread() and ngdwrite() Kernel memory corruption (UAF / OOB write) · sys/netgraph/ng_device.c:509	none	not_reproduced
DF-0234	Medium	4.4	Signed-integer overflow in callout timer calc (min_period*hz/2) -> self-perpetuating CPU-burn or watchdog defeat Base system — kernel core (kern) · sys/kern/kern_wdog.c:94	dos	not_reproduced
DF-0236	Medium	4.4	Driver callbacks (wdog_fn) invoked under global spinlock with interrupts disabled Base system — kernel core (kern) · sys/kern/kern_wdog.c:84	dos	not_reproduced
DF-0411	Medium	4.4	Infinite loop in ng_parse_skip_value on unclosed quoted string inside brackets: kernel thread hang DoS Base system — network stack · sys/netgraph7/netgraph/ng_parse.c:1651	none	not_reproduced
DF-0436	Medium	4.4	Heap OOB read + security-filter bypass via OGF=0/event=0: negative bitstr index into ng_btsocket_hci_raw_sec_filter Privilege escalation (general use) · sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:669	none	not_reproduced
DF-0495	Medium	4.4	rn_delete integer underflow: klen-head_off wraps to huge size_t when key sa_len < tree offset -> kernel panic Kernel memory leaks / uninitialized disclosure · sys/net/radix.c:884	none	not_reproduced
DF-0502	Medium	4.4	ng_fec_shutdown infinite loop when member interface destroyed: dangling pointer + unkillable loop Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_fec.c:1335	dos	inconclusive
DF-0527	Medium	4.4	ng_fec_choose_port NULL dereference when computed port index removed: reachable panic after port delete Base system — network stack · sys/netgraph/fec/ng_fec.c:896	none	not_reproduced
DF-0528	Medium	4.4	ng_fec_rmnode infinite loop when member interface vanished: dangling ptr + unkillable loop Kernel memory corruption (UAF / OOB write) · sys/netgraph/fec/ng_fec.c:1224	none	not_reproduced
DF-0535	Medium	4.4	Integer underflow in ngc_send path-length math: sg_len<2 -> bcopy with SIZE_MAX -> kernel heap smash Base system — network stack · sys/netgraph7/socket/ng_socket.c:245	none	not_reproduced
DF-0622	Medium	4.4	NULL-pointer dereference panic: ng_car_disconnect does not cancel the pending SHAPE callout, ng_car_q_event dereferences purged queue Base system — network stack · sys/netgraph7/ng_car.c:553	none	not_reproduced
DF-0666	Medium	4.4	NULL mbuf deref/panic on m_devget failure in ngdwrite Base system — network stack · sys/netgraph/ng_device.c:589	none	not_reproduced
DF-1095	Medium	4.4	iicsmb_bwrite leaves I2C bus in STARTED state on write failure — permanent SMBus bridge lockup Base system — bus / platform / cpu · sys/bus/iicbus/iicsmb.c:462	none	not_reproduced fixed
DF-1204	Medium	4.4	Divide-by-zero in spread spectrum clock calculation via ss.rate == 0 Base system — drivers · sys/dev/drm/radeon/ni_dpm.c:2044	none	not_reproduced
DF-1234	Medium	4.4	Kernel heap info leak via u_int16_t truncation in ASR_fillMessage on user-controlled reply size Kernel memory leaks / uninitialized disclosure · sys/dev/raid/asr/asr.c:486	none	not_reproduced
DF-1364	Medium	4.4	Unchecked fd_formb_nsecs in FD_FORMAT causes OOB heap read via DMA/bcopy Kernel memory leaks / uninitialized disclosure · sys/dev/disk/fd/fd.c:2272	none	inconclusive
DF-1423	Medium	4.4	Integer overflow in raw-service ioctl bounds check bypasses scratch-size guard Kernel memory corruption (UAF / OOB write) · sys/dev/raid/iir/iir.c:1036	none	inconclusive
DF-1474	Medium	4.4	Topology/IR-config/PCIe-config change list loops trust firmware NumEntries/NumElements without bounding to allocation (heap OOB read) Kernel memory leaks / uninitialized disclosure · sys/dev/raid/mpr/mpr_sas_lsi.c:216	none	inconclusive
DF-1480	Medium	4.4	Signed integer underflow in P-state sysctl readers leaks kernel stack to unprivileged users Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/acpi_cpu_pstate.c:1255	none	inconclusive
DF-1516	Medium	4.4	Integer overflow in buffer bounds check bypasses offset validation in check_overlay_src Kernel memory corruption (UAF / OOB write) · sys/dev/drm/i915/intel_overlay.c:1033	none	inconclusive
DF-1798	Medium	4.4	smu_helper: heap OOB read in phm_get_sclk_for_voltage_evv via unvalidated vddInd from VBIOS Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:468	none	inconclusive
DF-1801	Medium	4.4	snp: NULL-deref panic when read/kqfilter issued on unattached /dev/snpN device Base system — drivers · sys/dev/misc/snp/snp.c:263	none	inconclusive
DF-1965	Medium	4.4	Unconditional _objcache_destroy in MOD_UNLOAD leaves module obj_cache NULL while still in use Base system — drivers · sys/dev/disk/dm/delay/dm_target_delay.c:440	none	inconclusive
DF-2333	Medium	4.4	UAC2.0 Feature Unit descriptor accepted too short causing OOB read of bmaControls[0] Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/audio/uaudio.c:4000	none	not_reproduced
DF-0607	Low	4.4	BPF write to ng_iface reads uninitialized sa_data, can KASSERT-panic the kernel Kernel memory leaks / uninitialized disclosure · sys/netgraph7/iface/ng_iface.c:428	none	not_reproduced
DF-0648	Low	4.4	NULL-deref panic in NGM_NETFLOW_INFO and NGM_NETFLOW_IFINFO response allocation Base system — network stack · sys/netgraph7/netflow/ng_netflow.c:305	panic	inconclusive
DF-0649	Low	4.4	Per-node ~1.5 MB kernel-memory amplification via fixed NG_NETFLOW_MAXIFACES array Base system — network stack · sys/netgraph7/netflow/ng_netflow.c:172	dos	inconclusive
DF-2439	Low	4.4	FREEBLKS bio falls through delay target switch and is dispatched to underlying pdev without offset translation Base system — drivers · sys/dev/disk/dm/delay/dm_target_delay.c:213	none	not_reproduced
DF-2455	Low	4.4	FD_STYPE accepts unvalidated fd_type enabling divide-by-zero panics and shift UB Base system — drivers · sys/dev/disk/fd/fd.c:2325	none	not_reproduced
DF-2483	Low	4.4	mpt_pci_attach returns success on every failure path causing NULL-deref / linked-list corruption on detach Base system — drivers · sys/dev/disk/mpt/mpt_pci.c:576	none	not_reproduced
DF-2487	Low	4.4	Modifying ioctls (MPTIO_WRITE_CFG_PAGE MPTIO_RAID_ACTION) allowed via read-only file descriptor Privilege escalation (general use) · sys/dev/disk/mpt/mpt_user.c:116	none	not_reproduced
DF-2540	Low	4.4	Signed integer overflow in amdsb_watchdog() timeout calc programs watchdog count=0 -> deterministic reboot Base system — drivers · sys/dev/misc/amdsbwd/amdsbwd.c:217	none	not_reproduced
DF-2308	Info	4.4	I2CREAD ioctl leaks uninitialized kernel heap memory to userspace Kernel memory leaks / uninitialized disclosure · sys/bus/iicbus/iic.c:343	none	not_reproduced
DF-0540	Medium	4.3	Uninitialized cmd.ident sent in Command Reject: remote 1-byte kernel stack info leak Kernel memory leaks / uninitialized disclosure · sys/netbt/l2cap_signal.c:70	none	not_reproduced
DF-1481	Medium	4.2	vr_rxeof trusts 11-bit NIC-reported RX length as m_devget copy size without MCLBYTES bound: OOB heap read past RX mbuf cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/vr/if_vr.c:1005	none	inconclusive
DF-1514	Medium	4.2	ste_rxeof trusts 13-bit NIC-reported FRAMELEN as m_len without MCLBYTES bound: large OOB heap read past RX mbuf cluster Kernel memory leaks / uninitialized disclosure · sys/dev/netif/ste/if_ste.c:678	none	inconclusive
DF-1968	Medium	4.2	Integer overflow in radeon fbcon size math yields undersized GEM object with stale full pitch Kernel memory corruption (UAF / OOB write) · sys/dev/drm/radeon/radeon_fb.c:154	none	inconclusive
DF-1392	Medium	4.1	Divide-by-zero panic when VBIOS supplies zero SCLK or zero spread-spectrum rate Base system — drivers · sys/dev/drm/radeon/rv6xx_dpm.c:411	none	inconclusive
DF-1497	Medium	4.1	Missing NULL check on voltage_object in atomctrl_get_svi2_info dereferences lookup result Base system — drivers · sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1444	none	inconclusive
DF-1511	Medium	4.1	TOCTOU NULL-pointer dereference of handler in vga_switcheroo_force_migd causes kernel panic Base system — drivers · sys/dev/video/vga/vga_switcheroo.c:1231	none	inconclusive
DF-1699	Medium	4.1	vn: unsynchronized UAF race between vnstrategy I/O path and VNIOCDETACH/vnclear Kernel memory corruption (UAF / OOB write) · sys/dev/disk/vn/vn.c:260	none	inconclusive
DF-1744	Medium	4.1	mpt_pci: use-after-free - DMA request pool freed before interrupt handler torn down Kernel memory corruption (UAF / OOB write) · sys/dev/disk/mpt/mpt_pci.c:657	none	inconclusive
DF-1821	Medium	4.1	vinumraid5: missing plex->subdisks bounds check enables division-by-zero panic via config-race Base system — drivers · sys/dev/raid/vinum/vinumraid5.c:142	none	inconclusive
DF-2481	Medium	4.1	Divide-by-zero kernel panic via unchecked IOCFACTS RequestFrameSize Base system — drivers · sys/dev/disk/mpt/mpt.c:2683	none	not_reproduced
DF-2607	Medium	4.1	TOCTOU/UAF on bus->ifp between usbpf_xfertap (bus-locked) and usbpf_clone_destroy (unlocked) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/usb_pf.c:362	none	not_reproduced
DF-0587	Low	4.1	NULL vap deref in scan_curchan_task: scan state not re-validated after dropping IEEE80211_LOCK across ic_set_channel Base system — network stack · sys/netproto/802_11/wlan/ieee80211_scan_sw.c:741	panic	not_reproduced
DF-0637	Low	4.1	ngt_close frees sc while ngt_timeout callout can still reference it (UAF / deadlock) Kernel memory corruption (UAF / OOB write) · sys/netgraph/tty/ng_tty.c:256	none	not_reproduced
DF-0713	Low	4.1	cac_timeout assigns dfs->newchan (may be NULL) to iv_des_chan — downstream hostap/adhoc/mesh dereference NULL via IEEE80211_IS_CHAN_RADAR Base system — network stack · sys/netproto/802_11/wlan/ieee80211_dfs.c:154	none	inconclusive
DF-1906	Low	4.1	UAF on clockmod_dom in clockmod_dom_sysctl_select across sysctl_handle_string sleep Kernel memory corruption (UAF / OOB write) · sys/dev/powermng/clockmod/clockmod.c:430	none	not_reproduced fixed
DF-2228	Low	4.1	ACPI notify-handler use-after-free in detach via DragonFly no-op AcpiOsWaitEventsComplete stub Kernel memory corruption (UAF / OOB write) · sys/gnu/dev/misc/apple_gmux/apple-gmux.c:919	none	not_reproduced
DF-2326	Low	4.1	pci_devq traversal in PCIOCGETCONF is unprotected: pci_token is single-taker races pci_freecfg (UAF) Kernel memory corruption (UAF / OOB write) · sys/bus/pci/pci_user.c:59	none	not_reproduced
DF-2374	Low	4.1	Use-after-free race between acpiioctl() hook dispatch and acpi_deregister_ioctl() Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi.c:3407	corruption	not_reproduced
DF-2377	Low	4.1	Missing cst_cx_count==0 guard causes OOB heap read in set_lowest_oncpu and NULL-deref panic in idle Base system — drivers · sys/dev/acpica/acpi_cpu_cstate.c:504	panic	not_reproduced
DF-2378	Low	4.1	HT-sibling C-state copy in acpi_cst_cx_probe_cst writes another CPU live softc without synchronization Base system — drivers · sys/dev/acpica/acpi_cpu_cstate.c:621	panic	inconclusive
DF-2393	Low	4.1	Use-after-free of softc in notify handler during detach (AcpiOsWaitEventsComplete is a no-op) DF-2381 class Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:273	panic	not_reproduced
DF-2408	Low	4.1	tpm_legacy_read unconditionally writes through a NULL count pointer panicking on every multi-chunk read of a legacy TPM Base system — drivers · sys/dev/crypto/tpm/tpm.c:1092	none	not_reproduced
DF-2528	Low	4.1	Unlocked vn_softc state in vnstrategy/vnget races vnclear -> NULL deref or UAF Kernel memory corruption (UAF / OOB write) · sys/dev/disk/vn/vn.c:272	none	not_reproduced
DF-2243	Info	4.0	Early-boot RC4 stream keyed with uninitialized kernel stack because read_random() returns 0 before CSPRNG initialized Base system — libkern / libprop / ddb · sys/libkern/arc4random.c:53	none	not_reproduced
DF-2313	Info	3.9	IIC_LOCK/IIC_UNLOCK are empty no-op macros - all shared state access is unsynchronized Base system — bus / platform / cpu · sys/bus/iicbus/iic.c:60	—	not_reproduced
DF-0514	Low	3.7	REJECT_RST copies full 20-byte tcphdr after PULLUP_TO guaranteed only 14: stale mbuf buffer leak in RST Kernel memory leaks / uninitialized disclosure · sys/net/ip6fw/ip6_fw.c:629	none	not_reproduced
DF-0303	Medium	3.6	HMAC precomputed context torn-read race between config and input paths Base system — network stack · sys/netinet/ip_carp.c:504	dos	inconclusive
DF-1960	Medium	3.6	Uninitialized heap memory leaked to any local user via sysctl when BIOS PSB has no matching PST Kernel memory leaks / uninitialized disclosure · sys/dev/powermng/powernow/powernow.c:366	none	inconclusive
DF-0851	Low	3.6	Stale dereference of rootp after pribp released — use-after-free style read on buffer cache recycle Kernel memory corruption (UAF / OOB write) · sys/vfs/isofs/cd9660/cd9660_vfsops.c:435	none	not_reproduced fixed
DF-1043	Low	3.6	ufoma sysctl handlers access freed sc_modetable after detach (UAF) Kernel memory corruption (UAF / OOB write) · sys/bus/u4b/serial/ufoma.c:453	none	not_reproduced
DF-1765	Low	3.6	amdgpu_dm_debugfs: uninitialized stack read of param[] in dp_link_settings_write / dp_phy_settings_write Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:155	none	inconclusive
DF-0266	Medium	3.5	Uninitialized inflate window: kernel heap info leak via stale window data Kernel memory leaks / uninitialized disclosure · sys/net/zlib.c:3706	leak	not_reproduced
DF-1091	Medium	3.4	Slave-controlled block-read count drives OOB MMIO reads and inflates returned byte count (amdsmb_bread) Kernel memory leaks / uninitialized disclosure · DF-1076 · sys/bus/smbus/amdsmb/amdsmb.c:517	none	not_reproduced fixed
DF-0722	Low	3.4	Unit-number bitmap length tracked in unsigned char: truncates after ~2040 nodes causing duplicate unit allocation (LATENT — file does not compile) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_sppp.c:103	dos	inconclusive
DF-0185	Medium	3.3	Uninitialized kernel stack memory leaked via acl_get_file/acl_get_fd Kernel memory leaks / uninitialized disclosure · sys/kern/kern_acl.c:92	none	not_reproduced fixed
DF-1078	Medium	3.3	vkernel DDB backtrace leaks kernel addresses to world-readable msgbuf (DF-1077 class) + missing Xfast_syscall boundary stop Kernel memory corruption (UAF / OOB write) · DF-1077 · sys/platform/vkernel64/x86_64/db_trace.c:280	none	not_reproduced
DF-1712	Medium	3.3	intel_fbdev: stolen-memory framebuffer exposed unzeroed on DragonFly (info leak) Kernel memory leaks / uninitialized disclosure · sys/dev/drm/i915/intel_fbdev.c:276	none	inconclusive
DF-1982	Medium	3.3	GEM object refcount leak on amdgpufb_create error path (VRAM buffer permanently leaked) Base system — drivers · sys/dev/drm/amd/amdgpu/amdgpu_fb.c:308	none	inconclusive
DF-2379	Medium	3.3	Integer underflow in P-state sysctl readers leaks uninitialized kernel stack Privilege escalation (general use) · sys/dev/acpica/acpi_cpu_pstate.c:1258	none	not_reproduced
DF-0690	Low	3.3	mbuf + item leak on debug-hook data path (unreachable free condition) in dormant template Base system — network stack · sys/netgraph7/ng_sample.c:337	none	inconclusive
DF-1764	Low	3.3	amdgpu_dm_debugfs: memory leak on put_user failure in dp_link_settings_read / dp_phy_settings_read Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:89	none	inconclusive
DF-2217	Low	3.3	Missing privilege check on NVMEIOCGETLOG allows unprivileged NVMe admin command execution Privilege escalation (general use) · sys/dev/disk/nvme/nvme_ioctl.c:37	none	not_reproduced
DF-2434	Low	3.3	ii_index terminator allocation leaked on every CCDIOCSET/CCDIOCCLR cycle (ileave>0) Base system — drivers · sys/dev/disk/ccd/ccd.c:629	none	not_reproduced
DF-2581	Low	3.3	radix_node_head leak on table_delete and on table re-create enables kernel memory exhaustion DoS Base system — network stack · sys/net/ipfw3_basic/ip_fw3_table.c:100	none	not_reproduced
DF-2608	Low	3.3	Uninitialized kernel stack memory leaked to userspace via USB FIFO in packet reassembly Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/input/uep.c:200	none	not_reproduced
DF-0724	Low	3.1	Unsynchronized timer-vs-caller double-close race in rfcomm_dlc_close — no lock/atomic on CLOSED transition Base system — network stack · sys/netbt/rfcomm_dlc.c:156	none	not_reproduced
DF-2516	Low	3.1	Missing payload length validation in sbp_recv1 allows stale/uninitialized heap data to drive control flow and leak to userspace Kernel memory leaks / uninitialized disclosure · sys/dev/disk/sbp/sbp.c:1572	none	not_reproduced
DF-2542	Low	3.0	mfc entries kmalloc without M_ZERO only [0 numvifs) of mfc_ttls/mfc_flags initialized later add_vif exposes uninitialized heap bytes via forwarding decisions Kernel memory leaks / uninitialized disclosure · sys/net/ip_mroute/ip_mroute.c:1055	none	not_reproduced
DF-0505	Low	2.9	ng_fec_input defined 2 params but assigned to 4-param if_input slot: calling-convention UB Base system — network stack · sys/netgraph7/ng_fec.c:862	none	not_reproduced
DF-0245	Medium	2.5	Per-cpu iowbytes counter underflow via thread migration accounting break Privilege escalation (general use) · sys/kern/kern_iosched.c:79	dos	not_reproduced
DF-0031	Low	2.5	pipe->open_count underflow on pipe_create partial failure leaks kernel KVA and pipe struct Kernel memory leaks / uninitialized disclosure · sys/kern/sys_pipe.c:433	none	not_reproduced
DF-2363	Low	2.5	Sensitive key material left on kernel stack across multiple paths Kernel memory leaks / uninitialized disclosure · sys/crypto/chachapoly.c:52	none	not_reproduced
DF-2433	Low	2.5	TOCTOU on CCDF_INITED allows concurrent CCDIOCSET to leak memory and vnodes Kernel memory corruption (UAF / OOB write) · sys/dev/disk/ccd/ccd.c:1310	none	not_reproduced
DF-0601	Info	2.5	ng_source_rcvdata races unsynchronized on snd_queue (latent: file is orphaned and non-compiling) Kernel memory corruption (UAF / OOB write) · sys/netgraph7/ng_source.c:270	none	not_reproduced
DF-2211	Info	2.5	Uninitialized res.clock field returned by value from amdgpu_afmt_acr() Kernel memory leaks / uninitialized disclosure · sys/dev/drm/amd/amdgpu/amdgpu_afmt.c:90	—	not_reproduced
DF-2218	Info	2.5	Missing NULL check on nvme_get_admin_request return potential kernel NULL-deref panic Base system — drivers · sys/dev/disk/nvme/nvme_ioctl.c:49	—	not_reproduced
DF-2375	Info	2.5	Off-by-one NUL heap write in acpi_battery_clean_str past the _BIF oeminfo field Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_battery.c:321	none	not_reproduced
DF-2402	Info	2.5	Partial MMIO key read returns success without zeroing unfilled buffer tail enabling uninitialized-stack leak through sysctl Kernel memory leaks / uninitialized disclosure · sys/dev/apple/smc/smc_mmio.c:75	leak	not_reproduced
DF-1790	Medium	2.4	amdgpu_atombios_dp: OOB kernel-stack read in DP link training via malicious sink MAX_LANE_COUNT > 4 Kernel memory corruption (UAF / OOB write) · sys/dev/drm/amd/amdgpu/atombios_dp.c:264	none	inconclusive
DF-2588	Low	2.4	Signed/unsigned comparison in RX aggregation loop permits heap OOB read of RX descriptor Kernel memory leaks / uninitialized disclosure · sys/bus/u4b/wlan/if_urtwn.c:984	none	not_reproduced
DF-0723	Low	2.3	Error-path kfree uses wrong malloc type M_NETGRAPH_SPPP for M_IFNET allocation and bypasses if_free (LATENT — file does not compile) Base system — network stack · sys/netgraph7/ng_sppp.c:261	dos	inconclusive
DF-2400	Info	2.3	agp_mmap off-by-one allows mapping one physical page past the AGP aperture BAR Base system — drivers · sys/dev/agp/agp.c:860	—	not_reproduced
DF-0530	Low	1.9	ng_fec_free_unit increments usage counter instead of decrementing + global bitmap mutated without locks Base system — network stack · sys/netgraph/fec/ng_fec.c:290	none	not_reproduced
DF-2395	Low	1.9	Heap OOB read via zero-element ACPI SIF package - no count check before o[0] Kernel memory leaks / uninitialized disclosure · sys/dev/acpica/aibs/atk0110.c:169	corruption	inconclusive
DF-2257	Info	1.6	Unbounded while(1) loop in ar9300_rf_gain_cap_apply can walk past rx_gain_table[256] (defense-in-depth; not exploitable with current static data) Vendored third-party (contrib) · sys/contrib/dev/ath/ath_hal/ar9300/ar9300_attach.c:3397	—	not_reproduced
DF-0602	Info	1.1	NGM_SOURCE_GET_COUNTER dereferences msg->data without arglen check (latent: file is orphaned and non-compiling) Kernel memory leaks / uninitialized disclosure · sys/netgraph7/ng_source.c:479	none	not_reproduced
DF-1858	Low	0.8	Negative framebuffer offset in bmp_SetPix via RLE delta-move: OOB write below va_window Kernel memory corruption (UAF / OOB write) · sys/dev/video/fb/bmp/splash_bmp.c:258	none	not_reproduced
DF-2388	Info	0.5	Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class Kernel memory corruption (UAF / OOB write) · sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:210	—	not_reproduced
DF-1977	High	—	destroy_workqueue is #if 0 no-op; drain_workqueue does not wait for in-flight works; driver teardown UAF + permanent memory/thread leak Kernel memory corruption (UAF / OOB write) · sys/dev/drm/linux_workqueue.c:243	none	inconclusive

Unverified 43

Findings raised by static analysis that have no PoC verification yet. The writeup describes a suspected defect and its theoretical impact; it has not been confirmed against a running kernel.

ID	Sev	CVSS	Title	Impact	PoC
DF-5848	Low	5.9	kernel nfsd panics under pipelined TCP load - m_dup_data MT_DATA assert via nfs_realign nfsrv_rcv Base system — kernel core (kern) · sys/kern/uipc_mbuf.c:1806 · pass 2 · new	—	—
DF-5846	Medium	5.5	Unguarded NULL nc_parent dereference in nlookup dotdot walk on topology-disconnected cwd - unprivileged reliable local DoS Base system — kernel core (kern) · sys/kern/vfs_nlookup.c:756 · pass 2 · new	—	—
DF-5847	Low	4.1	nd6_timer panics under full-rate SIOCDIFADDR_IN6 cycling - neighbor-cache rt_llinfo invariant corruption Base system — network stack · sys/netinet6/nd6_nbr.c · pass 2 · new	—	—
DF-3075	Info	3.9	nfs_statfs/nfs_statvfs apply server-claimed filesystem geometry unvalidated: v3 f_blocks/f_bfree/f_bavail cast (long)(u_quad/1024) can go negative, v2 f_bsize is an arbitrary server int, statvfs 64-bit fields unclamped Base system — filesystems · sys/vfs/nfs/nfs_vfsops.c:357 · pass 2 · new	—	—
DF-3390	Info	3.7	Handshake replay timestamp compare uses non-constant-time memcmp (OpenBSD hardened this to fixedtime_bcmp) Base system — network stack · sys/net/wg/wg_noise.c:1143 · pass 2 · new	—	—
DF-3036	Info	3.3	ffs_reallocblks reads start_ap[-1] (stack OOB) when a cluster spans direct→indirect blocks — DIAGNOSTIC-only Kernel memory leaks / uninitialized disclosure · sys/vfs/ufs/ffs_alloc.c:430 · pass 2 · new	—	—
DF-3051	Info	3.3	statfs/statvfs accounting overflow and unvalidated compat feature bits (has_journal RW without replay) Kernel memory corruption (UAF / OOB write) · sys/vfs/ext2fs/ext2_vfsops.c:296 · pass 2 · new	—	—
DF-3136	Info	3.3	dirfs_node_stat computes nanosecond timestamp fields as tv_sec * 1000000000 (wrong field, int32 overflow) — guest-visible garbage nanoseconds on every dirfs stat Base system — filesystems · sys/vfs/dirfs/dirfs_subr.c:357 · pass 2 · new	—	—
DF-3217	Info	3.3	EXT2F_INCOMPAT_EXTENTS advertised as supported (EXT2F_INCOMPAT_SUPP) but the entire extents I/O path is EINVAL stubs — every extents-flagged inode (any real ext4 filesystem) fails read/write/truncate after a successful mount, and unlink of extents inodes leaks their blocks Base system — filesystems · sys/vfs/ext2fs/ext2_bmap.c:84 · pass 2 · new	—	—
DF-3243	Info	3.3	ufs_quotactl Q_GETQUOTA self-authorization is quota-type-blind: uid==cr_ruid satisfies the check for GRPQUOTA too, letting any user read the group-quota record for gid numerically equal to their uid Privilege escalation (general use) · sys/vfs/ufs/ufs_vfsops.c:119 · pass 2 · new	—	—
DF-3375	Info	3.1	MGT path guarantees m_pkthdr.len >= 24 but never m_pullup's; sta_recv_mgmt parses off m_len — chained management frames yield stale-byte reads past the first mbuf (sta.c mirror of DF-0348) Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_sta.c:878 · pass 2 · new	—	—
DF-3185	Info	2.5	vfs_findname() bcmp of buflen+1 bytes can read past the NUL of kernel rodata name tables (match/no-match oracle on adjacent .rodata bytes) Kernel memory corruption (UAF / OOB write) · sys/vfs/procfs/procfs_subr.c:491 · pass 2 · new	—	—
DF-3413	Info	2.5	tkip_detach() frees tkip_ctx without zeroing derived key material (tx/rx_rc4key, tx/rx_ttak) while the framework memsets the master key — freed-heap key residue Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:131 · pass 2 · new	—	—
DF-3220	Info	2.3	Mount/unmount error-path hygiene family: KTR_LOG reads freed dmp->dm_path after kfree, dirfs_root KTR prints uninitialized `error`, and mp->mnt_data is left dangling over freed dmp on failed mounts Kernel memory corruption (UAF / OOB write) · sys/vfs/dirfs/dirfs_vfsops.c:131 · pass 2 · new	—	—
DF-3221	Info	2.3	dirfs_statfs/dirfs_statvfs bcopy the host statfs/statvfs over mnt_stat, clobbering the per-mount f_fsid assigned by vfs_getnewfsid — all dirfs mounts over one host filesystem share a fsid Base system — filesystems · sys/vfs/dirfs/dirfs_vfsops.c:156 · pass 2 · new	—	—
DF-3244	Info	2.3	ufs_quotactl returns success (0) without performing the operation when vfs_busy(mp, LK_NOWAIT) fails — Q_QUOTAON/Q_SETQUOTA/Q_QUOTAOFF silently no-op during unmount contention, a security-control fail-open Base system — filesystems · sys/vfs/ufs/ufs_vfsops.c:141 · pass 2 · new	—	—
DF-3285	Info	2.3	ieee80211_beacon_update writes the Quiet IE in place at bo_quiet even when no Quiet IE was constructed - corrupts the beacon IE chain in-bounds (malformed beacons on air) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_output.c:3172 · pass 2 · new	—	—
DF-3391	Info	2.3	ip_fw3_ctl discards ip_fw3_ctl_x() error in the IP_FW_X case: nested opcode failures are reported as success to the firewall operator Base system — network stack · sys/net/ipfw3/ip_fw3.c:1058 · pass 2 · new	—	—
DF-2986	Info	1.9	cv_destroy performs no waiters/queued-state validation — destroy-with-waiter goes undiagnosed, leaving a stale wchan in td_wchan (divergence from FreeBSD INVARIANTS probe) Base system — kernel core (kern) · sys/kern/kern_condvar.c:14 · pass 2 · new	—	—
DF-2989	Info	1.9	RB tree engine has zero INVARIANTS-mode structural validation, and scan_info_done walks the inprog list without a termination guard Base system — kernel core (kern) · sys/kern/subr_rbtree.c:460 · pass 2 · new	—	—
DF-3121	Info	1.9	ufs_dqsync drops DQ_MOD on write failure — quota record silently never written, permanent under-accounting after I/O errors Base system — filesystems · sys/vfs/ufs/ufs_quota.c:887 · pass 2 · new	—	—
DF-3176	Info	1.9	ext2_update clears IN_MODIFIED/IN_LAZYMOD/IN_LAZYACCESS before attempting the write — dirty inode state silently lost on I/O error Base system — filesystems · sys/vfs/ext2fs/ext2_inode.c:79 · pass 2 · new	—	—
DF-3257	Info	1.9	cd9660_ioctl's catch-all ENOTTY hides FIOSEEKDATA/FIOSEEKHOLE from cd9660 (lseek SEEK_DATA returns EINVAL) and leaves cd9660_bmap's alignment-only contract one wiring away from an unprivileged INVARIANTS panic Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_bmap.c:76 · pass 2 · new	—	—
DF-3309	Info	1.9	ip6_getmoptions(): IPV6_MULTICAST_LOOP default echoes the hop-limit default instead of the loop default Base system — network stack · sys/netinet6/ip6_output.c:2511 · pass 2 · new	—	—
DF-4747	Info	1.9	DragonFly's linux/hash.h hash_64() shim returns identically 0 for every bits <= 32, collapsing the chash (amdgpu retry-fault hash) so all keys probe from slot 0 Base system — drivers · sys/dev/drm/amd/lib/chash.c:397 · pass 2 · new	—	—
DF-3458	Info	1.3	radiotap_offset() walks items[] past the end of the table (loop bound 31 vs array size 20) — latent OOB read of kernel rodata with attacker-of-driver arithmetic; plus missing table entries silently disable channel tracking for bits 14-17/20 Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_radiotap.c:369 · pass 2 · new	—	—
DF-2982	Info	1.1	Stale comments describe retired page-swapblk design, misdocumenting the OBJT_DEFAULT no-swap-metadata invariant that three files silently depend on Kernel memory corruption (UAF / OOB write) · sys/vm/default_pager.c:33 · pass 2 · new	—	—
DF-3246	Info	1.1	isofncmp ';version' parse: signed int overflow (UB) enables false-positive filename matches via modular wrap Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_util.c:118 · pass 2 · new	—	—
DF-3247	Info	1.1	KICONV mounts: invalid-charset input yields 0-rune without consuming input, so isofncmp returns 0 (match) for non-equal names Base system — filesystems · sys/vfs/isofs/cd9660/cd9660_util.c:110 · pass 2 · new	—	—
DF-3249	Info	1.1	ext2_clusteracct computes a negative shift count (1 << (start % NBBY) with start=-1) when freeing/accounting cg-relative bit 0 — C99 undefined behavior, no observable effect on x86 Base system — filesystems · sys/vfs/ext2fs/ext2_subr.c:175 · pass 2 · new	—	—
DF-3472	Info	1.1	raw_attach failure contract violated by callers: rts_attach frees the rawcb while so->so_pcb still points at it and the pcb socket reference is never dropped (latent — soreserve cannot fail in current DF) Kernel memory corruption (UAF / OOB write) · sys/net/raw_cb.c:81 · pass 2 · new	—	—
DF-3042	Info	0.8	Volume-header CRC (vol_crc) is never verified — hammer_crc_test_volume has zero callers; all mount-time header consumption is integrity-unchecked Base system — filesystems · sys/vfs/hammer/hammer_ondisk.c:180 · pass 2 · new	—	—
DF-2981	Info	0.5	bus_dmamem_coherent reports success when the underlying bus_dmamap_load fails (error swallowed in callback), yielding dmem_busaddr==0 Base system — kernel core (kern) · sys/kern/subr_busdma.c:46 · pass 2 · new	—	—
DF-2987	Info	0.5	refcount_release/_n have no underflow floor or INVARIANTS assert — double-release silently wraps the count to 0xFFFFFFFF and hides DF-2941-class double-put/double-free bugs at runtime Kernel memory corruption (UAF / OOB write) · sys/kern/kern_refcount.c:54 · pass 2 · new	—	—
DF-3034	Info	0.5	KKASSERT is the only bounds check before bcopy/hammer_datacrc in hammer_indirect_callback (defense-in-depth gap on non-INVARIANTS kernels) Base system — filesystems · sys/vfs/hammer/hammer_io.c:1658 · pass 2 · new	—	—
DF-3039	Info	0.5	msdosfs_mkdir truncates cntobn() block number to int — new-directory metadata written at wrong device offset on FAT volumes >1 TiB Base system — filesystems · sys/vfs/msdosfs/msdosfs_vnops.c:1332 · pass 2 · new	—	—
DF-3089	Info	0.5	nfs_getauth()/nfs_savenickauth() take NFSKERBKEY_T (u_char[2]) as a parameter but bcopy sizeof(NFSKERBKEY_T) == 8 bytes into/out of 2-byte struct members — padding-absorbed today, latent overflow on any layout change Kernel memory corruption (UAF / OOB write) · sys/vfs/nfs/nfs_syscalls.c:1075 · pass 2 · new	—	—
DF-3245	Info	0.5	devfs clone bitmap helpers accept unvalidated unit numbers: negative unit yields OOB bitmap access and UB shifts (latent; one semi-reachable benign instance) Kernel memory leaks / uninitialized disclosure · sys/vfs/devfs/devfs_helper.c:141 · pass 2 · new	—	—
DF-3256	Info	0.5	at_exit(procfs_exit) registration races on an unsynchronized vfc_refcount==1 gate: two concurrent procfs mounts can both skip registration, leaving every exited process's pfsnode unmarked (PFS_DEAD never set) Base system — filesystems · sys/vfs/procfs/procfs_vfsops.c:73 · pass 2 · new	—	—
DF-3412	Info	0.5	fairq_add_queue()/fairq_class_create() lack a lower-bound check on priority — negative pri is an OOB write below pif_classes[] (DF-0444 twin; currently typed-away by u_int8_t pf_altq.priority) Kernel memory leaks / uninitialized disclosure · sys/net/altq/altq_fairq.c:206 · pass 2 · new	—	—
DF-3464	Info	0.5	Action registry index validation is one-sided: ieee80211_{send,recv}_action_register() accept negative act (OOB write below the function-pointer tables) and the send dispatch accepts negative act (OOB function-pointer read + indirect call) Base system — network stack · sys/netproto/802_11/wlan/ieee80211_action.c:83 · pass 2 · new	—	—
DF-3471	Info	0.5	One-sided bound checks in the ratectl registry: ieee80211_ratectl_register/unregister/set accept negative type (OOB access below the ratectls[] function-pointer table); currently unreachable — all call sites pass constants Kernel memory leaks / uninitialized disclosure · sys/netproto/802_11/wlan/ieee80211_ratectl.c:60 · pass 2 · new	—	—
DF-4746	Info	0.5	am79900_start_locked feeds unbounded mbuf chains into lance_put, which memcpy's them into a fixed LEBLEN(1522)-byte TX buffer slot with no length clamp Kernel memory corruption (UAF / OOB write) · sys/dev/netif/lnc/am79900.c:560 · pass 2 · new	—	—