{
 "finding_id": "DF-2848",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Deterministic heap OOB write proven on the stock INVARIANTS kernel: taskqgroup_create() kmallocs sizeof(struct taskqgroup) (<=6252 bytes: fixed tqg_queue[MAXCPU]=6144B plus tail) and taskqgroup_cpu_create() then stores a fresh gtaskqueue heap pointer + int + LIST_INIT NULL into tqg_queue[i] for every i < cnt with no bound check. With cnt=MAXCPU+16 the readback probe shows all 11 slots at offsets 6264..6527 (provably past the allocation, which is M_ZERO) containing non-NULL kernel pointers (0xfffff8008bb07198 etc), plus intra-object clobbering of tqg_lock/tqg_name (slot[256] tgc_cpu=-2134490742, thread names garbage beyond 257). cnt is an unvalidated caller int, so the overwrite distance/size is caller-chosen (smash variant: ~48KB). No panic was coaxed in the observation window (DFly slab has no redzones; corruption is silent), hence impact recorded as dos-class (heap-corruption instability) rather than a demonstrated crash. No unprivileged trigger exists: the API has zero in-tree consumers beyond the ncpus-bounded softirq SYSINIT, so reaching it requires a root-loaded KLD. Same latent-API-hazard family as DF-0085 (not re-reported).",
 "exploit_chain": "",
 "evidence": [
  "run.log: 'slot[261] off=6264 [PAST ALLOC] tgc_taskq=0xfffff8008bb07198' (11 consecutive non-NULL past-alloc slots)",
  "run.log: 'sizeof(struct taskqgroup) <= 6252 bytes (kmalloc size)'",
  "run.log: 'slot[256] off=6144 tgc_taskq=0xfffff8008bb06f90 tgc_cpu=-2134490742' (tail clobbered)",
  "run.smash.log: cnt=MAXCPU+2048 (~48KB overrun) survives 30s - corruption silent",
  "run.fixed.log: clamp message + all past-alloc slots zero + FIXED_THREAD_COUNT=256"
 ],
 "kernel_refs": [
  "sys/kern/subr_gtaskqueue.c:574",
  "sys/kern/subr_gtaskqueue.c:788",
  "sys/kern/subr_gtaskqueue.c:793",
  "sys/kern/subr_gtaskqueue.c:592"
 ],
 "poc_changes": "Added #include <sys/conf.h> for DEV_MODULE (first build failed); replaced planned struct-deref readback with a 24-byte-slot layout replica of the leading tqg_queue[] array (struct taskqgroup is opaque outside subr_gtaskqueue.c, array is at offset 0 so replica offsets are exact); symlinked generated headers device_if.h/bus_if.h from /usr/obj/usr/src/sys/X86_64_GENERIC for the out-of-tree KLD build.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 1500,
 "guest_dirty": 0,
 "build_cmd": "cd /root/gtq_oob && make -m /usr/share/mk SYSDIR=/usr/src/sys",
 "run_cmd": "kldload /root/gtq_oob/gtq_oob.ko (then dmesg/ps/kldunload)",
 "code_hash": "6bb917abb52f7754a4011fc8f69133c01d52a77ed49fb29e44210d4a3daed3a6",
 "notes": "Subsystem has NO in-tree consumers beyond TASKQGROUP_DEFINE(softirq, ncpus, 1); trigger requires root KLD. Guest reset to clean snapshot after the run (guest_dirty=0). Smash variant created 2304 taskqueue threads - do not leave loaded on a box you care about.",
 "recommended_fix": "Clamp/validate cnt in taskqgroup_create(): if (cnt < 1) cnt = 1; if (cnt > MAXCPU) { kprintf(...); cnt = MAXCPU; }",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 09:11:43 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff applied in-guest to /usr/src, kernel rebuilt+installed (nativekernel, BUILD_OK, #1 Wed Sep 2 09:11:43 UTC 2026) and the exact PoC re-run: clamp message printed, every [PAST ALLOC] slot reads zero (no kernel writes past the allocation), exactly 256 gtq_oob_* threads created. Baseline OOB writes gone.",
 "fix_evidence": [
  "run.fixed.log: 'taskqgroup_create: gtq_oob cnt 272 > MAXCPU 256, clamping'",
  "run.fixed.log: 'slot[261] off=6264 [PAST ALLOC] tgc_taskq=0 tgc_cpu=0' (all 11 zero)",
  "run.fixed.log: 'FIXED_THREAD_COUNT=256'",
  "fixbuild.log: '>>> Kernel install for X86_64_GENERIC completed' + BUILD_OK"
 ]
}