DragonFlyBSD Kernel Audit
DF-0880 / fix_run.log
← back to finding ↓ download raw
== DF-0880 FIX VALIDATION (patched udf.ko, single-fix module) ==
Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
udf module (patched, hot-swapped):  4    1 0xffffffff82600000     4000 udf.ko
udf.ko sha256: ed9e3e402b81c30ee83f4dac48e37bcb3f3eaf9624b9ba44d97f5ccddfe5ef71

BASELINE (unpatched udf.ko, same #0 kernel):
  mount OK; ls /mnt -> Fatal trap 12 page-fault in memmove+0x10a (READ fault)
  backtrace: memmove <- udf_root <- udf_vget bcopy @udf_vfsops.c:530

PATCHED (this run): fresh mountpoint + vn device, ls/stat as maxx.
VNCONFIG_OK (vn3)
MOUNT_OK (/mnt2)
>> ls /mnt2 (as maxx) -- UNPATCHED panics here
ls: /mnt2: Invalid argument
  ls rc=1
>> stat /mnt2 (as maxx)
stat: /mnt2: stat: Invalid argument
  stat rc=1
>> dmesg: patched bounds check firing (proves the fixed path executes):
udf_vget: file entry too large (65711 > 2048)
udf_vget: file entry too large (65711 > 2048)

RESULT: mount succeeds, ls/stat return EINVAL, NO PANIC, guest UP.
        udf_vget now rejects size(65711) > bsize(2048) before the bcopy.
        => fix closes DF-0880.