โฌข DragonFlyBSD Kernel Audit
DF-1043 / run.log
โ† back to finding โ†“ download raw
=== Baseline kernel: 6.5-DEVELOPMENT #0 (unpatched) ===
$ sysctl dev.ufoma.0.supportmode
sysctl: unknown oid 'dev.ufoma.0.supportmode'
sysctl_rc=1

$ timeout 2 ./ufoma_uaf dev.ufoma.0.supportmode
(0 lines of output โ€” all sysctlbyname calls fail ENOENT)

run_rc=124 (reader loop killed by timeout โ€” expected, it is an infinite loop)

=== RESULT: cannot reproduce โ€” no USB hardware on this guest ===
The ufoma driver only creates dev.ufoma.* OIDs inside ufoma_attach(), which
runs only when a USB CDC-ACM mobile device matching ufoma_probe() is connected.
This QEMU guest has NO USB host controller (pciconf -l shows 0 USB devices),
so ufoma_attach() never runs, the OIDs never exist, and sysctlbyname returns
ENOENT. The bug is real (confirmed by source trace) but latent on this guest.