⬢ DragonFlyBSD Kernel Audit
DF-2460 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
{
  "finding_id": "DF-2460",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "816dca0d6bafaad3cbf6683ac1e0e7d282a3edbfaf4dbbf92cb75ae454fe07cb",
  "tested_at": "2026-08-09T08:20:00Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "UNPATCHED: kernel panic 'Fatal trap 12 page fault va=0x10 Stopped at ism_recv+0xee'; PATCHED: idrv 'still alive after 6s', dmesg '>>> _reject: REJECT with NULL mbuf - dropping'"
  },
  "kernel_refs": [
    "sys/dev/disk/iscsi/initiator/isc_sm.c:87",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:79",
    "sys/dev/disk/iscsi/initiator/isc_soc.c:428",
    "sys/dev/disk/iscsi/initiator/iscsi.c:430"
  ],
  "artifacts": [
    {
      "path": "mtarget.c",
      "type": "trigger-source",
      "desc": "malicious iSCSI target: injects data-less REJECT"
    },
    {
      "path": "idrv.c",
      "type": "trigger-source",
      "desc": "minimal initiator driver: ISCSISETSOC starts receiver pre-login"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc -o mtarget mtarget.c; cc -o idrv idrv.c"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "launch mtarget reject + idrv"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "Fatal trap 12 va=0x10 ism_recv+0xee"
    },
    {
      "path": "dmesg.txt",
      "type": "dmesg",
      "desc": "patched: _reject NULL-mbuf drop message"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, kern.version, cc, module sha256"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "NULL-check pq->mp in _reject, drop data-less REJECT"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full analysis"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this catalog"
    }
  ]
}