DF-0019 / run.sh
#!/bin/sh # DF-0019 run script โ triggers the panic on the UNPATCHED kernel. # Must be run as root on the DragonFlyBSD guest. # # The PoC: # 1. Switches the current process to the bsd4 scheduler via usched_set(2). # (The default scheduler is "dfly" โ the bsd4 code path is dormant # unless a process explicitly opts in.) # 2. Writes kern.usched_bsd4.queue_checks=0 (root sysctl, no lower bound). # 3. Forks CPU-bound children to force bsd4_chooseproc_locked_cache_coherent. # # On an UNPATCHED kernel: panic "chooseproc: at least the first lp was good" # (KASSERT at usched_bsd4.c:1548 trips because min_level_lwp is NULL โ # the while loop at :1483 was skipped since checks(0) < queue_checks(0) # is false). # On a FIXED kernel: sysctl returns EINVAL, PoC exits 0 cleanly. # # WARNING: panics an unpatched kernel. Disposable VM only. set -e cd "$(dirname "$0")" ./df0019 24 |