DragonFlyBSD Kernel Audit
DF-0852 / run.2.log
← back to finding ↓ download raw
=== DECISIVE: crafted ISO (VSS=0x7FFFFFF0), ssector=16 -> line-427 overflow ===
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=16 (0x10)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=32   100+ssector=116
[poc] mount() rc=0 errno=2 (No such file or directory)
[poc] statfs f_blocks = -2147483648  (0xffffffff80000000)  f_bsize=2048
[poc] !!! BOGUS f_blocks: signed-integer overflow confirmed !!!
RC=0

=== loop-overflow variant: ssector=INT_MAX (2147483647) ===
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=2147483647 (0x7fffffff)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=-2147483633   100+ssector=-2147483549
[poc] mount() rc=-1 errno=22 (Invalid argument)
[poc] mount failed; overflow arithmetic may still have executed inside the kernel before the failure.
RC=1

=== ENV ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc 8.3 [DragonFly] Release/2019-02-22
vfs.usermount: 1
=== get_fscap cd9660 -> SYSCAP_RESTRICTEDROOT (root-only mount) ===