⬢ DragonFlyBSD Kernel Audit
DF-0877 / manifest.json
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
{
  "finding_id": "DF-0877",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "kernel memory/pointer leak; see leak_sample.txt / run.log."
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_csum.c:240",
    "sys/vfs/ext2fs/ext2_csum.c:253",
    "sys/vfs/ext2fs/ext2_csum.c:261",
    "sys/vfs/ext2fs/ext2_csum.c:268",
    "sys/vfs/ext2fs/ext2_csum.c:280",
    "sys/vfs/ext2fs/ext2_csum.c:281",
    "sys/vfs/ext2fs/ext2_csum.c:282",
    "sys/vfs/ext2fs/ext2_csum.c:286",
    "sys/vfs/ext2fs/ext2_csum.c:287",
    "sys/vfs/ext2fs/ext2_csum.c:296",
    "sys/vfs/ext2fs/ext2_csum.c:311",
    "sys/vfs/ext2fs/ext2_csum.c:312",
    "sys/vfs/ext2fs/ext2_csum.c:339",
    "sys/vfs/ext2fs/ext2_subr.c:78",
    "sys/vfs/ext2fs/ext2_subr.c:95",
    "sys/vfs/ext2fs/ext2_lookup.c:185",
    "sys/vfs/ext2fs/htree.h:53",
    "sys/vfs/ext2fs/htree.h:58"
  ],
  "artifacts": [
    {
      "path": "harness.c",
      "type": "trigger-source",
      "desc": "deterministic C harness transcribing ext2_dx_csum/ext2_dx_csum_verify verbatim; proves OOB read length 524312 + page-boundary SIGSEGV"
    },
    {
      "path": "craft_img.py",
      "type": "trigger-source",
      "desc": "host-side image crafter: mke2fs -O metadata_csum,dir_index,^64bit + debugfs bmap + binary-patch htree count=65535"
    },
    {
      "path": "df0877.ext2",
      "type": "crafted-input",
      "desc": "4MB crafted ext2 image (htree count=65535, metadata_csum on, 64bit off)"
    },
    {
      "path": "df0877_control.ext2",
      "type": "crafted-input",
      "desc": "control image with count=1 (legitimate, for path comparison)"
    },
    {
      "path": "df0877_clean.ext2",
      "type": "crafted-input",
      "desc": "clean ext2 image (no poisoning, for regression test)"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -O2 -o harness harness.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "./harness; documents in-kernel reproduce steps"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "harness compile output"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "harness run output (CASE A/B/C + SIGSEGV)"
    },
    {
      "path": "inkernel_run.raw.log",
      "type": "run-log",
      "desc": "in-kernel unprivileged trigger: mount OK + ls EIO (OOB read happened), guest survives"
    },
    {
      "path": "fix_baseline.raw.log",
      "type": "run-log",
      "desc": "baseline (unpatched ext2fs.ko) in-kernel reproduction: mount OK + EIO"
    },
    {
      "path": "fix_run.log",
      "type": "run-log",
      "desc": "patched ext2fs.ko in-kernel result: mount OK + EIO (count>limit early return, no OOB read), root dir OK (no regression)"
    },
    {
      "path": "fix_build.log",
      "type": "build-log",
      "desc": "full patched ext2fs.ko module build output (rc=0)"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "no kernel panic observed; OOB read walks mapped buffer-cache pages silently (info-leak); harness demonstrates the page-fault path deterministically"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "git-apply-able two-hunk fix: if (count > limit) return EIO/return; in ext2_dx_csum_verify and ext2_dx_csum_set"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "guest uname, compiler version, ext2fs module info, sysctls"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full narrative: mechanism, impact, fix validation"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "summary + reproduce instructions"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this file"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}