# VERDICT — DF-2778: mq_notify_proc dangling `struct proc *` (UAF)

**Status: REPRODUCED** · impact: dos (cross-process signal injection through freed
kernel heap + UAF atomic writes; full uid0 chain not developed this run) ·
confidence: certain

## What was proven on the guest (stock kernel, build #0 2026-07-02)

`./uaf_notify` hit on **round 0, every run, in all three modes**:

1. `signo=10` (SIGUSR1): innocent sleeping victim killed by alien SIGUSR1 —
   dmesg: `pid 880 (uaf_notify), uid 1001: exited on signal 10 (core dumped)`.
2. handler mode: `[VICTIM] *** ALIEN SIGUSR1 RECEIVED THROUGH FREED struct proc ***`
3. `signo=9`: innocent victim killed by alien **SIGKILL** — cross-process
   signal-kill injection through a freed struct proc.

Mechanism (all unprivileged, deterministic, no race needed):
- registrant R registers SIGEV_SIGNAL via its inherited fd (`sys_mqueue.c:988`,
  raw pointer, no PHOLD), exits while parent M still holds the descriptor;
- M's `wait4(R)` frees R's `struct proc` (`kern_exit.c:1336`, kfree M_PROC —
  general kernel heap) — `mq_close_fop` never ran for R because it only runs at
  LAST file reference (`kern_descrip.c:3180-3181`) and M still holds one;
- M forks victim V whose proc allocation recycles R's chunk (same CPU, LIFO
  magazine — hence round-0 hits);
- M's `mq_send` on the empty queue executes the notify path
  (`sys_mqueue.c:875-885`): `notify = mq_notify_proc` (freed), then
  `PHOLD(notify)` = `atomic_add_int(&p->p_lock, 1)` on freed memory
  (`kern_proc.c:341`), then `ksignal(notify, signo)` → `lwpsignal` takes
  `lwkt_gettoken(&p->p_token)`, reads `p_flags`/`p_sigignore`, executes
  `SIGADDSET_ATOMIC(p->p_siglist, sig)` — all on the recycled chunk — and the
  signal is delivered to V, the process now occupying the freed object.

## Exploitability assessment

Primitive inventory per trigger: (a) two atomic-increment writes at fixed
offset `p_lock`; (b) lwkt token acquire/release writes on the freed chunk
(`p_token`); (c) atomic bit-set write at `p_siglist.__bits[k]`, k
signo-derived; (d) cross-process delivery of an arbitrary valid signal
(1..63) to whichever process reoccupies the chunk — demonstrated kill of an
arbitrary innocent process. Because `struct proc` is served from the general
kernel heap (`kmalloc(..., M_PROC, ...)`), a groomed attacker can aim these
fixed-offset writes at a same-size-class victim object of a *different* type
and the SIGKILL at a privileged process. A complete uid0 chain (slab groom →
victim credential-adjacent object → controlled field corruption) was not
developed in this run; the demonstrated deterministic UAF-write + arbitrary
process kill stands on its own as High severity.

## Fix validation (patched kernel, build #1 2026-09-01 04:57)

`fix.diff` adds `mqueue_proc_exit()` (clears registrations at exit1, after
fdfree). Same PoC, patched kernel: **0 hits in 116 rounds (build #1 04:10)
plus 104 rounds (build #1 04:57)** across all three modes — victims
"undisturbed" every round, guest stable. Baseline vs patched in
`fix_validation.log`.

fix_status: **fixed** (fix_baseline_reproduced=1, fix_patched_reproduced=0).