⬢ DragonFlyBSD Kernel Audit
DF-0932 / manifest.json
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
{
  "finding_id": "DF-0932",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "b9a306d0f9e7f73e4c245b4cc038294a3be6c13dd327ab55b89b5a9764a94a47",
  "tested_at": "2026-07-22T18:10:00Z",
  "verdict": "REPRODUCED",
  "impact": "leak:16",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "kernel memory/pointer leak; see leak_sample.txt / run.log."
  },
  "kernel_refs": [
    "sys/vfs/ntfs/ntfs_compr.c:74",
    "sys/vfs/ntfs/ntfs_compr.c:75",
    "sys/vfs/ntfs/ntfs_compr.c:76",
    "sys/vfs/ntfs/ntfs_compr.c:77",
    "sys/vfs/ntfs/ntfs_compr.c:78",
    "sys/vfs/ntfs/ntfs_compr.c:79",
    "sys/vfs/ntfs/ntfs_compr.c:80",
    "sys/vfs/ntfs/ntfs_compr.c:81",
    "sys/vfs/ntfs/ntfs_compr.c:82",
    "sys/vfs/ntfs/ntfs_subr.c:1687",
    "sys/vfs/ntfs/ntfs_subr.c:1689",
    "sys/vfs/ntfs/ntfs_subr.c:1705",
    "sys/vfs/ntfs/ntfs_subr.c:1718",
    "sys/vfs/ntfs/ntfs_subr.c:1719",
    "sys/vfs/ntfs/ntfs_subr.c:1723",
    "sys/vfs/ntfs/ntfs_compr.h:31",
    "sys/vfs/ntfs/ntfs.h:67"
  ],
  "artifacts": [
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full narrative: bug, harness, live repro, fix, fix-validation before/after"
    },
    {
      "path": "README.md",
      "type": "readme",
      "desc": "concise reproducer + expected output"
    },
    {
      "path": "harness.c",
      "type": "trigger-source",
      "desc": "deterministic transcription of ntfs_uncompblock on a poisoned/sentinel buffer"
    },
    {
      "path": "craft_img.py",
      "type": "trigger-source",
      "desc": "builds minimal mountable NTFS image with a compressed file whose LZNT1 trigger 02 80 01 FF FF drives pos+boff<0"
    },
    {
      "path": "ntfs_evil.img",
      "type": "trigger-source",
      "desc": "crafted NTFS image (524288 B); compressed file F at MFT record 32"
    },
    {
      "path": "build.sh",
      "type": "build-log",
      "desc": "builds harness (guest) + ntfs_evil.img (host)"
    },
    {
      "path": "run.sh",
      "type": "run-log",
      "desc": "end-to-end: harness + mount + read as root/maxx"
    },
    {
      "path": "build.log",
      "type": "build-log",
      "desc": "host-side craft_img.py output"
    },
    {
      "path": "run.log",
      "type": "run-log",
      "desc": "live in-kernel leak demonstration: kernel heap bytes returned to root and maxx"
    },
    {
      "path": "harness.log",
      "type": "run-log",
      "desc": "harness output (variant 1 LEAK CONFIRMED; variant 2 SIGSEGV)"
    },
    {
      "path": "leak_sample.txt",
      "type": "leak-sample",
      "desc": "raw leaked kernel heap bytes across runs (incl. kernel pointers and $UpCase table tail)"
    },
    {
      "path": "baseline_repro.log",
      "type": "run-log",
      "desc": "baseline (#0) leak bytes (00 70 bd 00 08 ... c0 34 6a 00 08 ...)"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "git-apply-able: reject malformed back-ref with return 0 in ntfs_uncompblock"
    },
    {
      "path": "fix_build.log",
      "type": "build-log",
      "desc": "patched ntfs.ko module build (rc=0) + sha256"
    },
    {
      "path": "fix_run.log",
      "type": "run-log",
      "desc": "patched read returns EINVAL; before/after comparison"
    },
    {
      "path": "fix_run_maxx.log",
      "type": "run-log",
      "desc": "patched read as unprivileged maxx: EINVAL, 0 bytes"
    },
    {
      "path": "fix_baseline.log",
      "type": "run-log",
      "desc": "baseline leak bytes (used for before/after)"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, cc, sysctl vfs.usermount=0, ntfs.ko sha256"
    },
    {
      "path": "manifest.json",
      "type": "verdict",
      "desc": "this file"
    },
    {
      "path": "fix_apply.log",
      "type": "apply-log",
      "desc": "patch --dry-run output proving fix.diff applies cleanly on with-src"
    },
    {
      "path": "../fix_build_combined.log",
      "type": "build-log",
      "desc": "Combined 41-finding kernel build (rc=0, -Werror clean)"
    },
    {
      "path": "../fix_build_summary.txt",
      "type": "build-summary",
      "desc": "Summary of the combined 41-finding kernel build"
    }
  ]
}