DragonFlyBSD Kernel Audit
DF-0796 / fix_run.log
← back to finding ↓ download raw
DF-0796 fix-validation on single-fix kernel
DragonFly 6.5-DEVELOPMENT #1: Fri Jul 10 13:40:09 UTC 2026  (built from /usr/src
with fix.diff applied; bare /boot/kernel/kernel overwritten with
/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped)
sha256(/boot/kernel/kernel) = b0b47f5500c8de9c3ddc0f5784c696cbab69b8974b558988405577529d8d972e

Command (as root):  kldload /root/df0796/df0796_harness.ko   (same PoC as baseline)

Result on #1 (FIXED):
  == kern.version ==
  DragonFly 6.5-DEVELOPMENT #1: Fri Jul 10 13:40:09 UTC 2026
  == loading harness on PATCHED #1 kernel ==
  KLDLOAD_RC=0
  == guest still up? ==
   1:48PM  up 1 min, 0 users, load averages: 0.07, 0.04, 0.01

  dmesg:
  DF-0796: loading NULL-cluster-slot harness
  DF-0796: invoking hammer2_inode_chain_and_parent on inode with NULL chain slot (clindex=0, nchains=2)
  DF-0796: expect NULL-deref panic at hammer2_inode_chain_and_parent+0x.. (chain->parent)
  DF-0796: SURVIVED -- chain=0 parent=0 (bug is fixed or not present)

Determinism: loaded twice (kldunload/kldload), both returned rc=0, both printed
"SURVIVED -- chain=0 parent=0", guest stayed up.  No panic.

CONTRAST (baseline #0, same PoC, before fix):
  Fatal trap 12: page fault while in kernel mode
  fault virtual address   = 0x118
  Stopped at hammer2_inode_chain_and_parent.cold.9+0x15:  movq 0x118,%rax
  => guest dead in DDB.

=> fix.diff closes the bug.  fix_status = fixed.