⬢ DragonFlyBSD Kernel Audit
DF-2360 / panic.txt
← back to finding ↓ download raw
(baseline runs, DFBATCH kernels, captured from serial console)

--- grp7null: db_disasm(0f 01 db) ---
DFB-dism[grp7null]: db_disasm(0f 01 db): db_Grp7_11[3] is NULL -> dispatch dereferences NULL+3*8 -> page fault NOW
Fatal user address access from kernel mode from sysctl at ffffffff80b99909
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x18
Stopped at      db_disasm+0x1049:       movq    (%rax,%rdx,8),%rsi
[0x18 == NULL + 3*8: db_Grp7_11[3] == NULL indexed by [3]]

--- rexgrp7: db_disasm(44 0f 01 c0) ---
DFB-dism[rexgrp7]: db_disasm(44 0f 01 c0): REX.R -> f_reg=8 -> db_Grp7_11[8] past the 6-entry table -> wild pointer NOW
Stopped at      strlen: cmpb    $0,(%rdi)
[db_Grp7_11[8] read past the 6-entry array yielded a garbage pointer;
 db_printf("%s") -> strlen() faulted on it]

--- rexseg: db_disasm(44 8c c0) (no fault; silent corruption) ---
DFB-dism[rexseg]: returned next=... (no fault)
	mov	%al,%ax
[db_seg_reg[8] read past the 8-entry table returned an adjacent .rodata
 pointer; the disassembly printed garbage ("mov %al,%ax" instead of
 "mov %es,%eax") -- OOB read confirmed by wrong output, no fault on this
 kernel's layout]