# DF-0024 — PoC

`kldload_overflow.c` — root-only heap overflow in `linker_search_path()`.

## The bug

`linker_search_path` (`sys/kern/kern_linker.c:1458`) `kmalloc(MAXPATHLEN=1024)`
then `:1476` `strcpy(result + prefix_len, name)` + `:1480` ext with no bounds
check. A 1023-byte bare module name (the max `copyinstr` allows at `:798`) with
the default `linker_path` "/boot/kernel" (13 prefix) + ".ko" (3) + NUL = 1040
into a 1024-byte buffer → ~16-byte heap overflow into adjacent `M_LINKER`
objects.

## Reachability

Gated behind `SYSCAP_NOKLD` (`sys_kldload` `:794`) — **root only**. Root can
already `kldload` an arbitrary `.ko` for kernel code execution, so this is a
defense-in-depth / local-DoS finding, not a new privilege.

## Build & run (root, disposable VM)

```
cc -o kldload_overflow findings/poc/DF-0024/kldload_overflow.c
./kldload_overflow
```

## Expected output (bug present)

Kernel panic from heap corruption / slab assertion ("freed pointer ... was
modified", malloc red-zone, etc.).