DragonFlyBSD Kernel Audit
DF-1539 / run.log
← back to finding ↓ download raw
Per-channel bytes (fresh)   : 213
Per-channel bytes (stressed): 377
Header bytes (conservative) : 600
NG_TEXTRESPONSE buffer      : 1024

Overflow starts at >= 2 open channels (fresh)
All 32 channels open:
  fresh    used=7416  OOB=6392 bytes
  stressed used=12664  OOB=11640 bytes

CONFIRMED: ngmn_rcvmsg writes ~7416 bytes into a 1024-byte kmalloc(M_NETGRAPH) response buffer -> 6392-byte heap overflow with all 32 channels open. Reliable panic + heap grooming on hosts that have the Siemens Easy321-R1 mn NIC.
RUN_EXIT=0