⬢ DragonFlyBSD Kernel Audit
DF-2687 / run.poison1.log
← back to finding ↓ download raw
# DF-2687 round 2 — INVARIANTS-poison control on snapshot #1 (2026-10-16)
# The round-1 panic used `sysctl debug.use_weird_array=1` on the INVARIANTS
# kernel #0.  This reset snapshot ships kernel #1 (same source lineage,
# v6.5.0.1712.g89e6a) built WITHOUT INVARIANTS: the sysctl node exists but
# its poison code is #ifdef INVARIANTS (sys/kern/kern_slaballoc.c:1433-1438),
# so it cannot poison and the deterministic panic cannot be reproduced here.

root# sysctl debug.use_weird_array=1
debug.use_weird_array: 0 -> 1
root# sysctl -n kern.conftxt | grep -ci invariants
0

$ cc -O2 -o /tmp/df2687 df2687.c && /tmp/df2687 3   (as maxx, BEFORE poison)
round 0 done
round 1 done
round 2 done
SURVIVED_3_ROUNDS_NO_POISON

root# su -m maxx -c "/tmp/df2687 1"                   (AFTER poison=1)
round 0 done
RC=0
# no panic: kernel #1 is non-INVARIANTS, poison sysctl is inert.
# The bug itself is present (see run.pin.log: sessions pinned across
# leader-reap is only possible with the orphaning defect live).