⬢ DragonFlyBSD Kernel Audit
DF-2719 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-2719",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-certain race, crash not observed. generic_elf_coredump's each_segment (imgact_elf.c:1199 RB_FOREACH) traverses the vm_map rb-tree with no vm_map lock, while proc_stop (kern_sig.c:1598-1612) pre-counts sleeping siblings as stopped and AST-stops running ones only at userret - so a sibling inside one long munmap keeps unlinking/freeing vm_map_entry objects throughout the dump's traversals. Mid-teardown core files (8.5k of 20k entries present at dump time) prove the overlap occurred across thousands of children, but ~13,400 attempts across 3 stress configurations produced no panic on the INVARIANTS guest: freed-but-unreused entries stay readable and RB walks over stale fragments remain self-consistent. Assessed impact if it lands: kernel panic (local DoS); speculative cross-process fhandle leak into the core via reused entries.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2719/run.log — calibration (munmap 40000 entries = 11.14 ms), run configs, mid-teardown core size evidence, 0 panics in ~13,400 attempts",
    "findings/poc/DF-2719/racedump.c — stress harness (parent map of N PROT_READ MAP_NOCORE file mappings; child worker = one whole-range munmap; main = usleep(delay) + SIGSEGV)",
    "VERDICT.md — narrative incl. why not false_positive"
  ],
  "kernel_refs": [
    "sys/kern/imgact_elf.c:1193",
    "sys/kern/imgact_elf.c:1199",
    "sys/kern/imgact_elf.c:1004",
    "sys/kern/imgact_elf.c:1393",
    "sys/kern/imgact_elf.c:1656",
    "sys/kern/kern_sig.c:1598",
    "sys/kern/kern_sig.c:1614",
    "sys/kern/kern_sig.c:2394"
  ],
  "poc_changes": "Stress harness written from scratch; delay sweep calibrated to the measured 11.1ms munmap duration; per-pid core files (kern.corefile='%N.%P.core') to avoid flock serialization of dumps; 20k/40k/100k-entry map configurations with parallel racers",
  "attempts": 13400,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -D__BSD_VISIBLE=1 -include sys/resource.h -include sys/time.h -o racedump racedump.c -lpthread",
  "run_cmd": "./racedump 2500 40000 500 10000  (plus 3x parallel and 2x100k-entry variants; see run.log)",
  "code_hash": "c6e7fc60d7e25ef5c48492e38ea06a5dfc64ff980155c2ed98449aa96a07b16a",
  "notes": "Race overlap proven; torn-read manifestation probabilistic and not landed within budget. Guest stayed up through all runs.",
  "recommended_fix": "Hold the vm_map lock across each each_segment RB_FOREACH in generic_elf_coredump's passes (or snapshot the entry list under the lock before walking)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline crash never reproduced, so a patched-kernel run cannot demonstrate a delta; fix.diff provided for review.",
  "fix_evidence": []
}