DragonFlyBSD Kernel Audit
DF-2558 / run.3.log
← back to finding ↓ download raw
[*] planted 8 bound AF_UNIX SOCK_DGRAM sockets (sun_len~17, sizeof(xunpcb)=912)
[*] oid net.local.dgram.pcblist -> miblen=4
[*] off_au=224 len_au=256  off_cau=480 len_cau=256  off_ah=904 len_ah=8

=== iter 0: 10944 bytes / 12 records (recsize=912) ===
  rec 0 (xu_unpp=0xfffff8008edf0660 sun_path="/var/run/log"):
    xu_addr.sun_len=14 -> tail[238..480) non-zero=155
    xu_addr tail                 (242 B): 00009837 b01701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff 
                                        ffff0000 4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 
                                        00009837 b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff 
                                        ffff0000 00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff 
                                        ffff0000 01000000 0000eef7 9a80ffff ffff2000 00000000 0000ccec 814900f8 
                                        ffff805c 7281ffff ffff80ec 814900f8 ffff4836 b01701f8 ffffb43d 9b80ffff 
                                        ffff0700 00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff 
                                        ffff0010 00000000 00000000 00000004 0000
    xu_caddr.sun_len=172 -> leak[480..736) non-zero=168
    xu_caddr leak                (256 B): acee7581 ffffffff acee7281 ffffffff 00000100 00000000 cb339a80 480e0000 
                                        80ee7581 ffffffff 00f9f816 01f8ffff 20000000 00000000 480e0000 00000000 
                                        01000000 47020000 7036b017 01f8ffff 48020000 49010000 80ec8149 00f8ffff 
                                        a0b7258d 00f8ffff a0000000 00000000 03000000 00000000 80ec8149 00f8ffff 
                                        a836b017 01f8ffff 00000000 00000000 00000000 00000000 20a56b81 ffffffff 
                                        80b6258d 00f8ffff 00004a00 08000000 8836b017 01f8ffff 357a9a80 ffffffff 
                                        f837b017 01f8ffff f837b017 01f8ffff a836b017 01f8ffff facc9980 ffffffff 
                                        00000000 00000000 00000000 00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 0 leaked = 331 / 506 possible
  rec 1 (xu_unpp=0xfffff8008edf0730 sun_path="/var/run/logpriv����"):
    xu_addr.sun_len=18 -> tail[242..480) non-zero=153
    xu_addr tail                 (238 B): b01701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff ffff0000 
                                        4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 00009837 
                                        b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff ffff0000 
                                        00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff ffff0000 
                                        01000000 0000eef7 9a80ffff ffff2000 00000000 0000ccec 814900f8 ffff805c 
                                        7281ffff ffff80ec 814900f8 ffff4836 b01701f8 ffffb43d 9b80ffff ffff0700 
                                        00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff ffff0010 
                                        00000000 00000000 00000004 0000
    xu_caddr.sun_len=172 -> leak[480..736) non-zero=168
    xu_caddr leak                (256 B): acee7581 ffffffff acee7281 ffffffff 00000100 00000000 cb339a80 480e0000 
                                        80ee7581 ffffffff 00f9f816 01f8ffff 20000000 00000000 480e0000 00000000 
                                        01000000 47020000 7036b017 01f8ffff 48020000 49010000 80ec8149 00f8ffff 
                                        a0b7258d 00f8ffff a0000000 00000000 03000000 00000000 80ec8149 00f8ffff 
                                        a836b017 01f8ffff 00000000 00000000 00000000 00000000 20a56b81 ffffffff 
                                        80b6258d 00f8ffff 00004a00 08000000 8836b017 01f8ffff 357a9a80 ffffffff 
                                        f837b017 01f8ffff f837b017 01f8ffff a836b017 01f8ffff facc9980 ffffffff 
                                        00000000 00000000 00000000 00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 1 leaked = 329 / 502 possible
  rec 2 leaked = 313 / 484 possible (al=18 cl=18)
  rec 3 leaked = 313 / 484 possible (al=18 cl=18)
  rec 4 leaked = 312 / 483 possible (al=19 cl=18)
  rec 5 leaked = 312 / 483 possible (al=19 cl=18)
  rec 6 leaked = 312 / 483 possible (al=19 cl=18)
  rec 7 leaked = 312 / 483 possible (al=19 cl=18)
  rec 8 leaked = 312 / 483 possible (al=19 cl=18)
  rec 9 leaked = 312 / 483 possible (al=19 cl=18)
  rec 10 leaked = 312 / 483 possible (al=19 cl=18)
  rec 11 leaked = 312 / 483 possible (al=19 cl=18)
  --- iter 0 subtotal: 3782 leaked non-zero bytes / 5840 possible ---

=== iter 1: 10944 bytes / 12 records (recsize=912) ===
  rec 0 (xu_unpp=0xfffff8008edf0660 sun_path="/var/run/log950_7���"):
    xu_addr.sun_len=14 -> tail[238..480) non-zero=156
    xu_addr tail                 (242 B): 3935305f 371701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff 
                                        ffff0000 4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 
                                        00009837 b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff 
                                        ffff0000 00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff 
                                        ffff0000 01000000 0000eef7 9a80ffff ffff0100 00000000 00004cc4 734900f8 
                                        ffff805c 7281ffff ffff00c4 734900f8 ffff4836 b01701f8 ffffb43d 9b80ffff 
                                        ffff0700 00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff 
                                        ffff0010 00000000 00000000 00000004 0000
    xu_caddr.sun_len=44 -> leak[524..736) non-zero=132
    xu_caddr leak                (212 B): ffffffff 01000000 00000000 120e0000 00000000 00906289 00f8ffff 00000000 
                                        01f8ffff 12020000 49010000 00c47349 00f8ffff a0b7258d 00f8ffff 74000000 
                                        00000000 03000000 00000000 00c47349 00f8ffff a836b017 01f8ffff 00000000 
                                        00000000 00000000 00000000 a8a56b81 ffffffff 80b6258d 00f8ffff 00404700 
                                        08000000 8836b017 01f8ffff 357a9a80 ffffffff f837b017 01f8ffff f837b017 
                                        01f8ffff a836b017 01f8ffff facc9980 ffffffff 00000000 00000000 00000000 
                                        00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 0 leaked = 296 / 462 possible
  rec 1 (xu_unpp=0xfffff8008edf0730 sun_path="/var/run/logpriv7���"):
    xu_addr.sun_len=18 -> tail[242..480) non-zero=152
    xu_addr tail                 (238 B): 371701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff ffff0000 
                                        4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 00009837 
                                        b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff ffff0000 
                                        00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff ffff0000 
                                        01000000 0000eef7 9a80ffff ffff0100 00000000 00004cc4 734900f8 ffff805c 
                                        7281ffff ffff00c4 734900f8 ffff4836 b01701f8 ffffb43d 9b80ffff ffff0700 
                                        00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff ffff0010 
                                        00000000 00000000 00000004 0000
    xu_caddr.sun_len=44 -> leak[524..736) non-zero=132
    xu_caddr leak                (212 B): ffffffff 01000000 00000000 120e0000 00000000 00906289 00f8ffff 00000000 
                                        01f8ffff 12020000 49010000 00c47349 00f8ffff a0b7258d 00f8ffff 74000000 
                                        00000000 03000000 00000000 00c47349 00f8ffff a836b017 01f8ffff 00000000 
                                        00000000 00000000 00000000 a8a56b81 ffffffff 80b6258d 00f8ffff 00404700 
                                        08000000 8836b017 01f8ffff 357a9a80 ffffffff f837b017 01f8ffff f837b017 
                                        01f8ffff a836b017 01f8ffff facc9980 ffffffff 00000000 00000000 00000000 
                                        00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 1 leaked = 292 / 458 possible
  rec 2 leaked = 313 / 484 possible (al=18 cl=18)
  rec 3 leaked = 313 / 484 possible (al=18 cl=18)
  rec 4 leaked = 312 / 483 possible (al=19 cl=18)
  rec 5 leaked = 312 / 483 possible (al=19 cl=18)
  rec 6 leaked = 312 / 483 possible (al=19 cl=18)
  rec 7 leaked = 312 / 483 possible (al=19 cl=18)
  rec 8 leaked = 312 / 483 possible (al=19 cl=18)
  rec 9 leaked = 312 / 483 possible (al=19 cl=18)
  rec 10 leaked = 312 / 483 possible (al=19 cl=18)
  rec 11 leaked = 312 / 483 possible (al=19 cl=18)
  --- iter 1 subtotal: 3710 leaked non-zero bytes / 5752 possible ---

=== iter 2: 10944 bytes / 12 records (recsize=912) ===
  rec 0 (xu_unpp=0xfffff8008edf0660 sun_path="/var/run/log950_7���"):
    xu_addr.sun_len=14 -> tail[238..480) non-zero=156
    xu_addr tail                 (242 B): 3935305f 371701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff 
                                        ffff0000 4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 
                                        00009837 b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff 
                                        ffff0000 00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff 
                                        ffff0000 01000000 0000eef7 9a80ffff ffff0200 00000000 00004cc5 754900f8 
                                        ffff805c 7281ffff ffff00c5 754900f8 ffff4836 b01701f8 ffffb43d 9b80ffff 
                                        ffff0700 00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff 
                                        ffff0010 00000000 00000000 00000004 0000
    xu_caddr.sun_len=108 -> leak[480..736) non-zero=170
    xu_caddr leak                (256 B): 6ce17581 ffffffff 6ce17281 ffffffff 69760100 00000000 cb339a80 130e0000 
                                        40e17581 ffffffff 407df816 01f8ffff 02000000 00000000 130e0000 00000000 
                                        01000000 12020000 7036b017 01f8ffff 13020000 49010000 00c57549 00f8ffff 
                                        a0b7258d 00f8ffff 75000000 00000000 03000000 00000000 00c57549 00f8ffff 
                                        a836b017 01f8ffff 00000000 00000000 00000000 00000000 a8a56b81 ffffffff 
                                        80b6258d 00f8ffff 00504700 08000000 8836b017 01f8ffff 357a9a80 ffffffff 
                                        f837b017 01f8ffff f837b017 01f8ffff a836b017 01f8ffff facc9980 ffffffff 
                                        00000000 00000000 00000000 00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 0 leaked = 334 / 506 possible
  rec 1 (xu_unpp=0xfffff8008edf0730 sun_path="/var/run/logpriv7���"):
    xu_addr.sun_len=18 -> tail[242..480) non-zero=152
    xu_addr tail                 (238 B): 371701f8 ffff0000 00000000 00009835 b01701f8 ffff8341 9a80ffff ffff0000 
                                        4a000800 000080b6 258d00f8 ffff0000 00000000 00000000 00000000 00009837 
                                        b01701f8 ffff0000 00000000 00009835 b01701f8 ffff2741 9a80ffff ffff0000 
                                        00000700 000075df 9a80ffff ffff7835 b01701f8 ffffad00 9b80ffff ffff0000 
                                        01000000 0000eef7 9a80ffff ffff0200 00000000 00004cc5 754900f8 ffff805c 
                                        7281ffff ffff00c5 754900f8 ffff4836 b01701f8 ffffb43d 9b80ffff ffff0700 
                                        00000000 000080b6 258d00f8 ffff2837 b01701f8 ffff6a9c 9a80ffff ffff0010 
                                        00000000 00000000 00000004 0000
    xu_caddr.sun_len=108 -> leak[480..736) non-zero=170
    xu_caddr leak                (256 B): 6ce17581 ffffffff 6ce17281 ffffffff 69760100 00000000 cb339a80 130e0000 
                                        40e17581 ffffffff 407df816 01f8ffff 02000000 00000000 130e0000 00000000 
                                        01000000 12020000 7036b017 01f8ffff 13020000 49010000 00c57549 00f8ffff 
                                        a0b7258d 00f8ffff 75000000 00000000 03000000 00000000 00c57549 00f8ffff 
                                        a836b017 01f8ffff 00000000 00000000 00000000 00000000 a8a56b81 ffffffff 
                                        80b6258d 00f8ffff 00504700 08000000 8836b017 01f8ffff 357a9a80 ffffffff 
                                        f837b017 01f8ffff f837b017 01f8ffff a836b017 01f8ffff facc9980 ffffffff 
                                        00000000 00000000 00000000 00000000 0839b017 01f8ffff 9de69980 ffffffff 
    xu_alignment_hack -> [904..912) non-zero=8
    xu_alignment_hack            (8 B): 90870e81 ffffffff 
    >>> rec 1 leaked = 330 / 502 possible
  rec 2 leaked = 312 / 484 possible (al=18 cl=18)
  rec 3 leaked = 312 / 484 possible (al=18 cl=18)
  rec 4 leaked = 311 / 483 possible (al=19 cl=18)
  rec 5 leaked = 311 / 483 possible (al=19 cl=18)
  rec 6 leaked = 311 / 483 possible (al=19 cl=18)
  rec 7 leaked = 311 / 483 possible (al=19 cl=18)
  rec 8 leaked = 311 / 483 possible (al=19 cl=18)
  rec 9 leaked = 311 / 483 possible (al=19 cl=18)
  rec 10 leaked = 311 / 483 possible (al=19 cl=18)
  rec 11 leaked = 311 / 483 possible (al=19 cl=18)
  --- iter 2 subtotal: 3776 leaked non-zero bytes / 5840 possible ---

==== SUMMARY over 3 iters, 36 records: 11268 leaked non-zero bytes (of 17432 possible) ====
result: LEAK CONFIRMED (kernel-stack residue in xunpcb via pcblist sysctl)