⬢ DragonFlyBSD Kernel Audit
DF-2739 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
{
  "finding_id": "DF-2739",
  "file": "sys/kern/kern_linker.c",
  "title": "linker_file_unload() veto-path refcount underflow -> premature teardown -> UAF",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "severity": "Medium",
  "privilege_required": "root (SYSCAP_NOKLD)",
  "reproduce": {
    "build": "cd /tmp/kldtest && csh build.sh",
    "run": "cd /tmp/kldtest && ./poc",
    "expected": "VULNERABLE: step2 EBUSY but kldstat shows refs=0 on live file; step4 kldunload succeeds and kldfind(vetoa)=ENOENT while depb still loaded; step5 kldunload(depb) -> panic 'Bad link elm ... next->prev != elm' with nested linker_file_unload frames. FIXED: refs sequence 1->1->2->1, vetoa survives step4, clean unload, no panic."
  },
  "kernel_refs": [
    "sys/kern/kern_linker.c:514-520 (veto path, erroneous file->refs-- at :518)",
    "sys/kern/kern_linker.c:494-497 (refs>1 fast path)",
    "sys/kern/kern_linker.c:540-549 (teardown + recursive dep unload)",
    "sys/kern/kern_linker.c:556 (ops->unload indirect call on freed object)",
    "sys/kern/kern_linker.c:1636 (dependency refs++)",
    "sys/kern/kern_linker.c:841,853-856 (privilege gate + userrefs accounting)"
  ],
  "fix_validated": true,
  "fix_kernel": "DragonFly 6.5-DEVELOPMENT #1: Mon Aug 31 12:46:55 UTC 2026",
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "poc.c",
    "vetoa_mod/vetoa.c",
    "vetoa_mod/Makefile",
    "depb_mod/depb.c",
    "depb_mod/Makefile",
    "Makefile",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log (baseline: underflow + premature teardown + panic)",
    "run.fixed.log (patched kernel: clean)",
    "panic.txt",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}