⬢ DragonFlyBSD Kernel Audit
DF-2412 / run.log
← back to finding ↓ download raw
===DF-2412: q_no=25 (sense_buffers[24], 16-entry array)===
df2412: sense_buffers=0xfffff80118708a00 (16 entries, 512 bytes)
df2412: dispatching production adv_intr with q_no=25 (sense_buffers[24] = OOB read at +768)
df2412: ccb status=0x200 AUTOSNS=1 sense_data dump (copied from sense_buffers[24]):
   0000000000000000000000000000000000000000000000000000000000000000
   canary 0xC7 present: no  0xD8: no  0xE9: no
(32 bytes struct-copied from 768 bytes past the array -- the heap there
held zeros this run; AUTOSNS=1 proves the copy; index 24 of a 16-entry
array is OOB by construction)

===DF-2412: q_no=0 (u_int wrap -> sense_buffers[0xFFFFFFFF])===
df2412w: dispatching production adv_intr with q_no=0 (u_int wrap -> sense_buffers[0xFFFFFFFF]) ...
df2412w: adv_intr RETURNED; sense_data copied from sense_buffers + 0x1FFFFFFE0 (q_no=0 u_int wrap):
   0000000000000000000000000000000000000000000000000000000000000000
   AUTOSNS=1
(read at base + 0x1FFFFFFE0 (128GB span) succeeded; copied into the
CAM_AUTOSNS_VALID sense data)