⬢ DragonFlyBSD Kernel Audit
DF-2657 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-2657",
  "title": "hammer2 sync-thread xop quorum counts the excluded node: h2nod collects can never reach quorum (DF-2631 wedge family root cause)",
  "verdict": "reproduced",
  "impact": "dos",
  "severity": "Medium",
  "bucket": "hammer2",
  "confidence": "certain",
  "reproduce": {
    "build": "none (unmodified images): dd-clone pair of one newfs_hammer2 -L testvol image; fix kernel: cd /usr/src && patch -p1 < fix.diff && make nativekernel && make installkernel",
    "run": "sh trigger_df2657.sh  (stock: wedge) ; sh fix_validate.sh  (kernel #1: clean)",
    "expected": "stock: 4x h2nod in h2coll pre-umount, umount -f D4 h2twait ~65s then rc=1 with threads stranded forever, third mount D3 mntlk. fixed: h2idle parks, umount -f RC=0 in 0s, third mount instant, single-device sanity OK"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:411",
    "sys/vfs/hammer2/hammer2_synchro.c:454",
    "sys/vfs/hammer2/hammer2_synchro.c:672",
    "sys/vfs/hammer2/hammer2_synchro.c:421",
    "sys/vfs/hammer2/hammer2_cluster.c:348",
    "sys/vfs/hammer2/hammer2_cluster.c:462",
    "sys/vfs/hammer2/hammer2_cluster.c:522",
    "sys/vfs/hammer2/hammer2_admin.c:479",
    "sys/vfs/hammer2/hammer2_admin.c:988",
    "sys/vfs/hammer2/hammer2_admin.c:996"
  ],
  "fix": {
    "fix_status": "fixed",
    "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Aug 30 04:30:11 UTC 2026",
    "fix_baseline_reproduced": 1,
    "fix_patched_reproduced": 0,
    "fix_verdict": "wedge eliminated (A_H2COLL_COUNT=0 vs 4; umount -f 0s/RC=0 vs 65s/rc=1; mntlk released; 6/6 single-device control clean; diverged rw cluster no-regression + clean teardown). Residual: pre-existing DF-2620-family UAF exposed by any completed cluster teardown (4x +0x2d9 traps, control clean, identical site to DF-2631's builds) - separate defect, documented.",
    "fix_evidence": "findings/poc/DF-2657/fix_run.log, fix_build.log.tgz, panic_serial.log"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "run.log", "fix_run.log", "fix_run.truncated.log",
    "trigger_df2657.sh", "fix_validate.sh", "fix.diff", "fix2657.diff",
    "fix_build.log.tgz", "panic_serial.log", "code_hashes.txt",
    "guest_fix_artifacts.tgz", "verdict.json", "manifest.json"
  ]
}