⬢ DragonFlyBSD Kernel Audit
DF-0876 / manifest.json
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
{
  "finding_id": "DF-0876",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "kernel memory/pointer leak; see leak_sample.txt / run.log."
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_csum.c:666",
    "sys/vfs/ext2fs/ext2_csum.c:684",
    "sys/vfs/ext2fs/ext2_csum.c:685",
    "sys/vfs/ext2fs/ext2_csum.c:686",
    "sys/vfs/ext2fs/ext2_csum.c:708",
    "sys/vfs/ext2fs/ext2_vfsops.c:549",
    "sys/vfs/ext2fs/ext2_vfsops.c:647",
    "sys/vfs/ext2fs/ext2_vfsops.c:688",
    "sys/vfs/ext2fs/ext2fs.h:94",
    "sys/vfs/ext2fs/ext2fs.h:372"
  ],
  "artifacts": [
    {
      "path": "harness.c",
      "type": "trigger-source",
      "desc": "deterministic C harness transcribing ext2_gd_csum verbatim; proves OOB read length 65503 + page-boundary SIGSEGV"
    },
    {
      "path": "craft_img.py",
      "type": "trigger-source",
      "desc": "host-side image crafter: mke2fs -O metadata_csum,^64bit + binary-patch s_desc_size=0xFFFF + recompute superblock CRC32C"
    },
    {
      "path": "ext2_bad.img",
      "type": "crafted-input",
      "desc": "4MB crafted ext2 image (s_desc_size=0xFFFF, metadata_csum on, 64bit off)"
    },
    {
      "path": "ext2_bad_tiny.img",
      "type": "crafted-input",
      "desc": "1MB crafted ext2 image variant"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -O2 -o harness harness.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "./harness; documents in-kernel reproduce steps"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "full harness compile output"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "full harness run output (CASE A/B/C/D + SIGSEGV)"
    },
    {
      "path": "run.baseline.raw.log",
      "type": "run-log",
      "desc": "baseline (unpatched ext2fs.ko) in-kernel reproduction: EIO + csum-diff info leak, 3 runs"
    },
    {
      "path": "fix_run.log",
      "type": "run-log",
      "desc": "patched ext2fs.ko in-kernel result: EINVAL on bad image (no OOB read), 3 runs"
    },
    {
      "path": "fix_run.raw.log",
      "type": "run-log",
      "desc": "raw patched run capture"
    },
    {
      "path": "fix_build.log",
      "type": "build-log",
      "desc": "full patched ext2fs.ko module build output (rc=0)"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "no kernel panic observed; the OOB read leaks silently via csum diff on this heap layout; harness demonstrates the page-fault path deterministically"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "git-apply-able two-hunk fix: vfsops.c mount-time desc_size validation + ext2_csum.c defense-in-depth clamp"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "guest uname, compiler version, kernel build"
    },
    {
      "path": "env.raw.txt",
      "type": "environment",
      "desc": "raw env capture"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full narrative: mechanism, impact, fix validation"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "summary + reproduce instructions"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this file"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}