DragonFlyBSD Kernel Audit
DF-2681 / run.log
← back to finding ↓ download raw
DF-2681 runtime evidence (DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC, stock kernel)

$ kldload /tmp/df2681/dfrec.ko
(serial console:)
dfrec0 on motherboard
dfrec: attached, calling bus_delete_resource() on child

... kldload never returns ...

$ date                        (still works, minutes later)
Sun Aug 30 14:33:32 UTC 2026
$ ps -ax -o pid,stat,command  (hangs)
$ kldstat                     (hangs -- module lock held by the spinning thread)
$ shutdown -p now             (times out; guest has to be force-killed)

Observations:
- "dfrec: returned (no bug)" never printed: bus_delete_resource() never
  returned.
- kldload held the kernel module lock while spinning, so kldstat and any
  further module operations hang; ps -ax also hung; the guest could not
  be shut down cleanly and had to be reset from the host.
- The recursion is a self-dispatch: bus_generic_delete_resource(dev, ...)
  calls BUS_DELETE_RESOURCE(dev, ...) -- dispatch on *dev itself* instead
  of dev->parent, matching every other bus_generic_* wrapper in the file.
  With -O2 the tail call is a jmp, giving an unbounded kernel loop; with
  non-tail-call frame layout it is an unbounded kernel stack overflow.