⬢ DragonFlyBSD Kernel Audit
DF-2458 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
{
  "finding_id": "DF-2458",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "6add123d032280b9cd845b56f35447e491b5006d4ba5d988fe9c637592e2ae26",
  "tested_at": "2026-08-09T09:04:18Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh [bo]",
    "expected": "UNPATCHED: kernel panic 'supervisor WRITE data' in memcpy (i_mbufcopy from scsi_decap); PATCHED: dmesg 'scsi_decap: bad data-in offset=... - dropping', no panic"
  },
  "kernel_refs": [
    "sys/dev/disk/iscsi/initiator/iscsi_subr.c:566",
    "sys/dev/disk/iscsi/initiator/iscsi_subr.c:572",
    "sys/dev/disk/iscsi/initiator/iscsi_subr.c:573",
    "sys/dev/disk/iscsi/initiator/iscsi_subr.c:574",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:144"
  ],
  "artifacts": [
    {
      "path": "mtarget2458.c",
      "type": "trigger-source",
      "desc": "malicious iSCSI target: login + bad-bo Data-In"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -o mtarget2458 mtarget2458.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "mtarget2458 + iscontrol login->FFP->CAM INQUIRY"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "write fault in memcpy (scsi_decap i_mbufcopy)"
    },
    {
      "path": "dmesg.txt",
      "type": "dmesg",
      "desc": "patched: scsi_decap bad data-in dropped"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, kern.version, module sha256"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "bounds-check rcmd->bo in scsi_decap"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full analysis + escalation analysis"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this catalog"
    }
  ]
}