⬢ DragonFlyBSD Kernel Audit
DF-2552 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-2552",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "d4ae29520c645a1a16ed25a11b3a2a19604472260e55668a9ae5502ac71a9fac",
  "tested_at": "2026-08-08T21:10:00Z",
  "verdict": "REPRODUCED (latent code defect, primitive confirmed at harness level)",
  "impact": "none (latent — not reachable from unprivileged userspace)",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "Arithmetic proof shows int-truncation producing 16-byte allocation for 4096-byte buffer (4080-byte overflow). Kernel-module harness shows post-overflow s_size=16 on unpatched, s_size=4096 on patched."
  },
  "kernel_refs": [
    "sys/kern/subr_sbuf.c:132",
    "sys/kern/subr_sbuf.c:143",
    "sys/kern/subr_sbuf.c:151",
    "sys/kern/subr_sbuf.c:158",
    "sys/kern/subr_sbuf.c:162",
    "sys/sys/sbuf.h:50"
  ],
  "artifacts": [
    {"path": "arith_proof.c", "type": "trigger-source", "desc": "userspace arithmetic proof replicating exact sbuf_extendsize/sbuf_extend logic"},
    {"path": "trigger.c", "type": "trigger-source", "desc": "userspace trigger for the kernel-module harness"},
    {"path": "sbuftest_mod/sbuftest.c", "type": "exploit-chain", "desc": "kernel module that calls sbuf_bcopyin with crafted length to trigger int-truncation heap overflow"},
    {"path": "sbuftest_mod/Makefile", "type": "build-script", "desc": "kld module Makefile"},
    {"path": "build.sh", "type": "build-script", "desc": "builds arith_proof and trigger"},
    {"path": "run.sh", "type": "run-script", "desc": "runs the arithmetic proof"},
    {"path": "fix.diff", "type": "suggested-fix", "desc": "overflow guard in sbuf_extend: reject s_size+addlen > INT_MAX"},
    {"path": "build.log", "type": "build-log", "desc": "arithmetic proof + trigger build output"},
    {"path": "run.log", "type": "run-log", "desc": "arithmetic proof run output showing int-truncation"},
    {"path": "module_baseline.log", "type": "run-log", "desc": "kernel-module harness baseline output (unpatched #0): post-overflow s_size=16"},
    {"path": "fix_run.log", "type": "run-log", "desc": "kernel-module harness output on patched #1 kernel: post-overflow s_size=4096 (no overflow)"},
    {"path": "env.txt", "type": "environment", "desc": "uname, cc version, sysctl state"},
    {"path": "VERDICT.md", "type": "verdict", "desc": "full analysis: mechanism, reachability, fix validation"},
    {"path": "README.md", "type": "readme", "desc": "how to reproduce"},
    {"path": "manifest.json", "type": "manifest", "desc": "this file"}
  ]
}