⬢ DragonFlyBSD Kernel Audit
DF-2461 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
{
  "finding_id": "DF-2461",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "1546594c7d8547d9cc0fd42785fd7a7c9fd3924c3af2075d5dd34e684bae345f",
  "tested_at": "2026-08-09T08:45:08Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "UNPATCHED: test (A2) negative-maxBurst bypass -> panic 'overflowed mbuf' in isc_sendPDU; PATCHED: (A)/(A2)/(B) all return E2BIG, dmesg 'pdu len exceeds 32 bits'"
  },
  "kernel_refs": [
    "sys/dev/disk/iscsi/initiator/isc_subr.c:99",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:291",
    "sys/dev/disk/iscsi/initiator/isc_sm.c:293",
    "sys/dev/disk/iscsi/initiator/iscsi.c:461",
    "sys/dev/disk/iscsi/initiator/isc_soc.c:120",
    "sys/dev/disk/iscsi/initiator/iscsi.c:641"
  ],
  "artifacts": [
    {
      "path": "df2461.c",
      "type": "trigger-source",
      "desc": "root ISCSISEND ioctl driver: E2BIG-bypass + truncation demos"
    },
    {
      "path": "mtarget.c",
      "type": "trigger-source",
      "desc": "hold mode: keeps session socket connected"
    },
    {
      "path": "build.sh",
      "type": "build-script",
      "desc": "cc mtarget + cc -I<iscsi.h> df2461"
    },
    {
      "path": "run.sh",
      "type": "run-script",
      "desc": "mtarget hold + df2461"
    },
    {
      "path": "panic.txt",
      "type": "panic-signature",
      "desc": "baseline: panic overflowed mbuf in isc_sendPDU"
    },
    {
      "path": "dmesg.txt",
      "type": "dmesg",
      "desc": "patched: i_prepPDU 'pdu len exceeds 32 bits' (E2BIG)"
    },
    {
      "path": "env.txt",
      "type": "environment",
      "desc": "uname, kern.version, module sha256"
    },
    {
      "path": "fix.diff",
      "type": "suggested-fix",
      "desc": "i_setopt reject negative maxBurst; i_prepPDU reject len>32bit"
    },
    {
      "path": "VERDICT.md",
      "type": "verdict",
      "desc": "full analysis"
    },
    {
      "path": "manifest.json",
      "type": "manifest",
      "desc": "this catalog"
    }
  ]
}