DragonFlyBSD Kernel Audit
DF-0827 / run.log
← back to finding ↓ download raw
=== DF-0827: build image crafter ===

============================================================
DF-0827: CONTROL image (FAT[681]=0xff8, chain ends cleanly)
============================================================
Wrote fat12_eof.img (350720 bytes, 685 sectors) [mode=eof]
FAT12: FATsecs=2  maxcluster=681  chain 2..681 (EOF)
TRIGGER.TXT: start=2  size=349184 bytes (682 clusters)
-rw-r--r--  1 root  wheel  350720 Jul 14 00:32 fat12_eof.img
ls -l MNT:
total 682
-rwxr-xr-x  1 root  wheel  349184 Dec 30  1979 TRIGGER.TXT
  cat returned 1
  bytes read by cat:   348213  (expect 340992 = 680 clusters)
  last 32 bytes of control output:
00000000  47 45 52 2e 54 58 54 3a  20 41 72 67 75 6d 65 6e  |GER.TXT: Argumen|
00000010  74 20 6c 69 73 74 20 74  6f 6f 20 6c 6f 6e 67 0a  |t list too long.|
00000020

============================================================
DF-0827: BUG image (FAT[681]=682, chain walks OOB to FAT[682])
============================================================
Wrote fat12_oob.img (350720 bytes, 685 sectors) [mode=bug]
FAT12: FATsecs=2  maxcluster=681  chain 2..682 (OOB)
TRIGGER.TXT: start=2  size=349184 bytes (682 clusters)
Bug: pcbmap(findcn=681) -> cn=682 -> FATOFS(682)=1023
     bo=1023, bsize=1024, check(1023>=1024)=FALSE -> OOB read of byte 1024
     byte[1023]=0xAA set -> cn = 0xAA | ((OOB & 0x0F)<<8)
-rw-r--r--  1 root  wheel  350720 Jul 14 00:32 fat12_oob.img
ls -l MNT:
total 682
-rwxr-xr-x  1 root  wheel  349184 Dec 30  1979 TRIGGER.TXT
  bytes read by cat:   349184  (file claims 349184 = 682 clusters)
  last 32 bytes of bug output:
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000020

  cluster 170 first byte (in case cn=0xAA=170 maps there):
00000000  aa 00 4f 4f                                       |..OO|
00000004
  cluster 682 (last sector) first bytes (in case cn=682 maps there):
00000000  00 00 00 00                                       |....|
00000004

=== DF-0827: dmesg tail (look for FAT warnings) ===
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
Warning: number of clusters (683) exceeds FAT capacity (682)
Warning: number of clusters (683) exceeds FAT capacity (682)

============================================================
DF-0827: VERDICT
============================================================
Control (eof.img): cat read   348213 bytes.
Bug    (oob.img): cat read   349184 bytes.
=> BUG CONFIRMED (baseline): with FAT[681]=682, pcbmap returned success
   for findcn=681 -- only possible by reading FAT[682] OOB. The extra
   cluster returned is whatever the OOB byte produced.