DragonFlyBSD Kernel Audit
DF-1283 / run.log
← back to finding ↓ download raw
[DF-1283] mapping_table max_devices=264, sizeof(entry)=32

--- Case A: slot too large (firmware u16, no upper bound) ---
[DF-1283] start_index=10 slot=300 start_slot=0 -> map_idx=310 (0x136)
[DF-1283]   BUG: map_idx=310 >= max_devices=264 -> write at mapping_table[310]

--- Case B: unsigned underflow (slot < start_slot) ---
[DF-1283] start_index=0 slot=0 start_slot=5 -> map_idx=4294967291 (0xfffffffb)
[DF-1283]   BUG: map_idx=4294967291 >= max_devices=264 -> write at mapping_table[4294967291] -- WILD POINTER (in-kernel: out-of-slab write / panic; in userspace: SIGSEGV)

[DF-1283] RESULT: OOB write into adjacent slab region DEMONSTRATED

--- Fix demonstration ---
[DF-1283] FIX: map_idx=310 >= max_devices=264 -> SKIP write (no corruption)
RUN_EXIT=0