⬢ DragonFlyBSD Kernel Audit
DF-2285 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
{
  "finding_id": "DF-2285",
  "title": "Use-after-free in scsi_targ_bh target teardown: fixed hz/2 sleep before kfree(softc) does not drain in-flight CTIOs",
  "verdict": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "fix_status": "fixed",
  "fix_summary": "active_ctios counter + wakeup drain in targbhdtor before kfree (fix.diff, A/B validated: no panic, canary intact, controls bit-identical)",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1 Sun Oct 18 03:32:40 UTC 2026 x86_64 (harness kernels; stock INVARIANTS config)",
  "code_hash": "8acf92baf610bf5dbe2c097d00ab23499a7ee807a0165afae40e1429d42f8095",
  "reproduce": {
    "build": "cd findings/poc/DF-2285/rig && ./build.sh",
    "run": "cd findings/poc/DF-2285/rig && ./run.sh   # A/B: ./make_fix.sh && ./build.sh && ./run_fixed.sh",
    "expected": "baseline S2: kfree(softc) with CTIO still HELD, dtor returns after fixed 65 ticks, canary victim SAME CHUNK reclaimed, late completion (699 ticks outstanding) -> panic Bad link elm prev->next != elm from targbhdone+0x439 (panic.txt); S0/S1 controls clean; fixed kernel: completion lands with softc_freed=0, dtor drains (192 ticks), damaged_qwords=0, no panic"
  },
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_targ_bh.c:402-424",
    "sys/bus/cam/scsi/scsi_targ_bh.c:420-421",
    "sys/bus/cam/scsi/scsi_targ_bh.c:329-382",
    "sys/bus/cam/scsi/scsi_targ_bh.c:342",
    "sys/bus/cam/scsi/scsi_targ_bh.c:347-363",
    "sys/bus/cam/scsi/scsi_targ_bh.c:419",
    "sys/bus/cam/scsi/scsi_targ_bh.c:497",
    "sys/bus/cam/scsi/scsi_targ_bh.c:522",
    "sys/bus/cam/scsi/scsi_targ_bh.c:638-695",
    "sys/bus/cam/scsi/scsi_targ_bh.c:648",
    "sys/bus/cam/scsi/scsi_targ_bh.c:676-689",
    "sys/bus/cam/cam_periph.c:600-632",
    "sys/sys/queue.h:528-534",
    "sys/conf/files:46"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "verdict.json",
    "manifest.json",
    "fix.diff",
    "env.txt",
    "patched_env.txt",
    "build.log",
    "installkernel.log",
    "fix_gen.log",
    "fix_build.log",
    "fix_installkernel.log",
    "run.log",
    "panic.txt",
    "panic.serial.log",
    "fix_run.log",
    "rig/df_pre.c",
    "rig/df_post.c",
    "rig/gen.sh",
    "rig/check_verbatim.sh",
    "rig/build.sh",
    "rig/run.sh",
    "rig/run_fixed.sh",
    "rig/make_fix.sh",
    "rig/run_reclaim.sh",
    "rig/run_panic.sh"
  ]
}