DF-0768 / run.log
=== DF-0768 BASELINE run (unpatched 6.5-DEVELOPMENT #0) === Guest uname: Connection timed out during banner exchange Trigger: unprivileged 'ls -f /mnt' (getdents) as maxx against malicious NFSv3 server mounted with -o rdirplus. Malicious READDIRPLUS entry: attrflag=0 then i=0x7FFFFFFD. --- run output (ssh timed out = 124 => guest panicked mid-syscall) --- outer_rc=124 (ssh dropped: kernel panicked during getdents) --- panic signature (dfbsd-qemu/boot.log) --- 205:Fatal trap 12: page fault while in kernel mode 206-cpuid = 4; lapic id = 4 207-fault virtual address = 0xfffff7ff8f7a3ff8 208-fault code = supervisor read data, page not present 209-instruction pointer = 0x8:0xffffffff80bcab4f 210-stack pointer = 0x10:0xfffff8011841f2b0 211-frame pointer = 0x10:0xfffff8011841f308 212-code segment = base 0x0, limit 0xfffff, type 0x1b 213- = DPL 0, pres 1, long 0, def32 0, gran 1 214-processor eflags = interrupt enabled, resume, IOPL = 0 215-current process = 870 216-current thread = pri 10 217-kernel: type 12 trap, code=0 218- 219-CPU4 stopping CPUs: 0x0000002f 220- stopped 221-Stopped at memmove+0x24f: repe movsq (%rsi),%es:(%rdi) 222-db>