# DF-2775 evidence pack — sysctl_intrnames unsynchronized walk (UAF read / heap disclosure / panic)

Finding: `sys/kern/kern_intr.c:1100-1116` — `sysctl_intrnames` traverses every
CPU's `i_reclist` chains with no synchronization (no crit section, no token,
reader runs on any CPU) while `unregister_int` unlinks (under a critical
section on the owning CPU only, kern_intr.c:438-448) and then frees
`rec->name` + `rec` (kern_intr.c:486-487). A reader that has loaded a `rec`
pointer can dereference `rec->name` after the free.

`hw.intrnames` is world-readable (CTLFLAG_RD), so the reader side is any
unprivileged user (systat/vmstat use it).

## What is in this pack

- `src/df_harness.c` — kernel harness compiled into the test kernel:
  - exact copy of the stock walk with a stall point between rec load and
    `rec->name` use (deterministic primitive proof),
  - churn thread on cpu1 driving register/unregister + an interposed
    unregister (unlink -> kfree -> immediate same-cpu kmalloc reclaim of the
    freed intrec, filled with a chosen `rec->name`: harness token / kernel
    `version` string / arbitrary address),
  - fixed-walk variant (migrate+crit snapshot) for the A/B illustration.
- `src/df2775_reader.c` — UNPRIVILEGED userland reader hammering
  `sysctl hw.intrnames`, scanning every entry for anomaly markers; writes
  O_SYNC logs so evidence survives crashes.
- `src/pin_drop.c` — root helper: pin to a cpu, drop to uid 1001, exec the
  reader (USCHED_SET_CPU needs privilege; the mask survives the uid drop).
- `src/chk.c` — output-correctness checker for the fixed sysctl.
- `build.log.gz` — full untrimmed kernel build log (stock K1c build).
- `run.log` — the decisive outputs (rigged token/version capture, organic
  panic signature x4, fix A/B).
- `panic.txt`, `logs/boot.after4thpanic.log` — organic panic from the
  unprivileged reader (`Stopped at strlen` on the reader's cpu).
- `logs/hits*.log`, `logs/reader_*.log` — reader runs (stock + fixed).
- `env.txt` — guest environment.
- `fix.diff` — canonical fix (pristine -> fixed), applies to stock
  `sys/kern/kern_intr.c` (covers DF-2775/2776/2777).

## Build (on the guest)

    scp src/df_harness.c root@guest:/usr/src/sys/kern/
    echo 'kern/df_harness.c    standard' >> /usr/src/sys/conf/files
    cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC
    install kernel.stripped as /boot/kernel/kernel, reboot
    cc -O2 -o df2775_reader.bin src/df2775_reader.c
    cc -O2 -o pin_drop src/pin_drop.c

## Run

    # deterministic primitive (groomed token, then kernel version string):
    sysctl dfh.mode2775=2 dfh.target2775=0 dfh.run2775=2
    sysctl dfh.target2775=1 dfh.run2775=2
    # organic race: unpriv reader on cpu0, churn on cpu1 (EXPECT PANIC):
    nohup /root/pin_drop 0 1001 ./df2775_reader.bin 90 0 /home/maxx/logs/hits.log &
    sysctl dfh.mode2775=2 dfh.persist2775=1 dfh.secs2775=85 dfh.run2775=1

## Expected

- Stock: rig prints `.../dfh7/DF2775-SECRET-LEAK-TOKE` and
  `.../dfh7/DragonFly 6.5-DEVELOPME` (freed+reclaimed rec->name read);
  organic runs panic in `strlen` on the reader's cpu (4/4 runs).
- Fixed (fix.diff applied): same organic PoC -> 0 anomalies, no panic,
  identical sysctl output (1536 entries, correct slot contents).