⬢ DragonFlyBSD Kernel Audit
DF-2641 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-2641",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Low/hardening skip per audit contract (Low/Info findings). The sinks at xops.c:403/539/664-678/737/1618 are provably unguarded consumers of the DF-2617 silent-NULL primitive (chain.c:938 load early-return; chain.c:1467 modify-succeeds-with-NULL), but on every traced path an earlier same-class consumer faults first - the dirent_test call sites at xops.c:282/368/610/771 (crash verified as DF-2640 on this guest: 'Fatal trap 12, fault VA 0x0, bcmp+0xf0, current process Idle') or the frontend hammer2_inode_get gdata read (inode.c:866). They are therefore latent/defense-in-depth: DF-2640's fix.diff (validated on rebuilt kernel #1 in ../DF-2640/) guards every one of these lines in the same regression-tested build.",
  "exploit_chain": "",
  "evidence": [
    "README.md (site-by-site analysis with fault addresses)",
    "../DF-2640/VERDICT.md (shadow-path analysis + verified fix covering these lines)",
    "../DF-2640/fix.diff (guards at xops.c:402/543/post-modify/755/1636)"
  ],
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_xops.c:403",
    "sys/vfs/hammer2/hammer2_xops.c:539",
    "sys/vfs/hammer2/hammer2_xops.c:670",
    "sys/vfs/hammer2/hammer2_xops.c:718",
    "sys/vfs/hammer2/hammer2_xops.c:737",
    "sys/vfs/hammer2/hammer2_xops.c:1618",
    "sys/vfs/hammer2/hammer2_chain.c:938",
    "sys/vfs/hammer2/hammer2_chain.c:1467"
  ],
  "poc_changes": "n/a (skip; no trigger built for these latent lines)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (stock INVARIANTS)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "PoC status vocabulary per audit/persist_poc.py ('untested'; contract-level 'skipped' for Low hardening). The write-variant (bzero/bcopy at NULL+0x100, xops.c:672) and the meta-write at :1618 are fixed-address faults - no attacker-addressable memory, ceiling is panic; and they are unreachable-first regardless.",
  "recommended_fix": "Already included and regression-validated in DF-2640's fix.diff: chain->data/chain->error guards at all listed sites."
}