DragonFlyBSD Kernel Audit
DF-0797 / fix_run.log
← back to finding ↓ download raw
[+] build OK
-rwxr-xr-x  1 root  wheel   9744 Jul  5 14:26 craft_img
-rwxr-xr-x  1 root  wheel  10328 Jul  5 14:26 harness
=== recreate crafted image (vol_no=0x7FFFFFFF) ===
1073741824 bytes transferred in 1.540805 secs (696870763 bytes/sec)
You may have to run 'hammer prune-everything' and 'hammer reblock'
quite often, even if using a nohistory mount.
[!] volume_map is the LAST field of struct hammer_mount (hammer.h:875)
[!]   -> write lands in adjacent kernel heap / unmapped page
[!]   -> idx*8 = 255 MiB past volume_map -> guaranteed fatal page fault
[+] vol_no patched in-place (CRC left as-is -- not validated at mount)
=== PATCHED #1 MOUNT (expect clean EFTYPE, no panic) ===
mount rc=1
[+] MOUNT REJECTED CLEANLY (no panic) on patched kernel -- fix verified
mount: Invalid argument
=== second confirmation: re-mount the SAME crafted image ===
mount: Invalid argument
mount rc=1
=== small-OOB variant (vol_no=256): must also be rejected by the fix ===
1073741824 bytes transferred in 1.523859 secs (704620037 bytes/sec)
quite often, even if using a nohistory mount.
/bin/sh: ./craft_img: not found
mount(vol_no=256) rc=0
=== negative vol_no (-1): must also be rejected ===
/bin/sh: ./craft_img: not found
vnconfig: VNIOCATTACH: Device busy
mount: Device busy
mount(vol_no=-1) rc=1
=== FINAL: guest still alive, no panic ===
DragonFly 6.5-DEVELOPMENT #1: Sun Jul  5 14:18:31 UTC 2026
=== small-OOB variant (vol_no=256): must be rejected by the fix ===
1073741824 bytes transferred in 0.836218 secs (1284045076 bytes/sec)
vnconfig: VNIOCATTACH: Device busy
newfs_hammer: alloc_volume: Failed to open /dev/vn0: Device busy
mount: Device busy