DragonFlyBSD Kernel Audit
DF-1557 / run.3.log
← back to finding ↓ download raw
== DF-1557 control run: PhysDiskMap=9 (last valid in-bounds slot) ==
$ ./run.sh 9 65 1

== DF-1557 harness: PhysDiskMap OOB write in mps_wd_config_pages ==
sizeof(struct mps_column_map)  = 4 (kernel: 4 w/ pad)
MPS_MAX_DISKS_IN_VOL          = 10 (kernel: 10)
DD_column_map array bytes     = 40
firmware PhysDiskMap          = 9 (U8, 0..255)
firmware PhysDiskNum          = 0x41 (written value)
firmware NumPhysDisks         = 1 (passes line-400 gate <=8)

write target: &DD_column_map[9].phys_disk_num = byte offset 38 from DD_column_map base
PhysDiskMap=9 < MPS_MAX_DISKS_IN_VOL=10: in-bounds write, no OOB.
(use: ./harness <PhysDiskMap> [num] [cnt]  with map>=10)
wrote in-bounds: DD_column_map[9].phys_disk_num = 0x41
RUN_EXIT=0