{
  "finding_id": "DF-2853",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on stock X86_64_GENERIC (DF 6.5-DEVELOPMENT #0, INVARIANTS): a single KLD load shows rman_reserve_resource handing out [0x2000,0x2000] from INSIDE allocated B=[0x1FFF,0x2FFF] (alignment roundup 0x1F00->0x2000 overflows fragment end 0x1FFE; (rend-rstart+1) wraps unsigned and passes the size check for count=1), then inflating the free fragment across B and DOUBLE-ALLOCATING 0x1FFF to a second request. Silent metadata corruption: guest stays up, list loses sort order and non-overlap invariants, poisoning later merges (cf. DF-0089) and the unprivileged hw.bus.rman walk (panic amplifier with stale r_dev, demonstrated in panic-sysctl-walk.txt). No direct unpriv->root chain (rman inputs are kernel/firmware supplied; cardbus CIS BAR sizing is the hardware-attacker path), so impact recorded as dos with memcorrupt-bucket metadata-corruption primitive (overlapping MMIO/IRQ ownership). Fix (rstart>rend guard, as FreeBSD rman_reserve_resource_step already has) validated on a rebuilt kernel: both evil allocations correctly return NULL, list stays pristine, unload clean.",
  "exploit_chain": "KLD harness: manage [0,0x2FFF]; A=[0,0x1EFF], B=[0x1FFF,0x2FFF] legit -> free F=[0x1F00,0x1FFE]; E=reserve(0,0xFFFF,count=1,RF_ALIGNMENT_LOG2(12)) -> roundup(0x1F00,0x1000)=0x2000 > 0x1FFE -> wrap -> E=[0x2000] inside B; F inflated to [0x1F00,0x1FFF]; X=reserve(0x1FFF,0x1FFF,1) -> 0x1FFF owned by B AND X. Real-world trigger: fragmented rman + alignment-seeking request (e.g. rman_make_alignment_flags(size) from cardbus CIS BAR decode, acpi _CRS, driver requests) -> two devices own the same MMIO/IRQ range.",
  "evidence": [
    "run.log: 'EVIL1 E=... [0x2000,0x2000] ==> REPRODUCED: allocated inside allocated B=[0x1FFF,0x2FFF] and outside free fragment F=[0x1F00,0x1FFE]'",
    "run.log: 'EVIL2 X=... [0x1fff,0x1fff] ==> REPRODUCED: 0x1FFF now owned by B AND X (double allocation)'",
    "run.log list dumps: after-E '[0x2000-0x2000]A' precedes '[0x1fff-0x2fff]A' (sort order destroyed)",
    "panic-sysctl-walk.txt: unprivileged hw.bus.rman reader faults in device_get_name(res->r_dev) while walking the corrupted list",
    "fix_run.log: patched kernel => 'EVIL1 E=0 ==> not reproduced (guard present?)', 'EVIL2 X=0 ==> correctly denied', list intact",
    "fix_build.log: make -j6 nativekernel RC=0 (patched subr_rman.c compiled)"
  ],
  "kernel_refs": [
    "sys/kern/subr_rman.c:247-254",
    "sys/kern/subr_rman.c:285-327",
    "sys/kern/subr_rman.c:257-263",
    "sys/platform/pc64/x86_64/nexus.c:398",
    "sys/dev/acpica/acpi.c:1156",
    "sys/dev/pccard/cardbus/cardbus_cis.c:533-539"
  ],
  "poc_changes": "No seed PoC (pass-2 original). DEV_MODULE does not exist in DragonFly -> DECLARE_MODULE(...,SI_SUB_DRIVERS,SI_ORDER_MIDDLE); kmod.mk include path unusable in guest -> manual machine/cpu symlink + cc -DKLD_MODULE -mcmodel=kernel -mno-red-zone + ld.bfd -d -r (ld.gold output panics link_elf_obj_reloc_local with 'lost base for relatab' - one reset consumed); fake device_t args -> NULL after they crashed the unpriv sysctl walk.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1450,
  "guest_dirty": 0,
  "build_cmd": "in guest: cd /tmp/ov && ./build.sh (cc -c -O2 -DKLD_MODULE -D_KERNEL -nostdinc ... rman_overlap.c && ld.bfd -d -warn-common -r -o rman_overlap.ko rman_overlap.o)",
  "run_cmd": "kldload /tmp/ov/rman_overlap.ko && dmesg | grep rman_overlap",
  "code_hash": "b7a92ca402dfbe74021a667e5c8a5179ba0bb0a2011fd474f7a508cbe101587c",
  "notes": "Impact recorded dos (no unpriv->root chain from rman alone); bucket memcorrupt: demonstrated kernel metadata corruption primitive (overlapping/out-of-region resource grants). Amplifier: corrupted list is walked by unprivileged sysctl hw.bus.rman readers. Two guest resets consumed during development (one ld.gold linker artifact panic, one fake-dev sysctl-walk panic) - both harness-caused, documented in VERDICT.md. FreeBSD carries the missing guard as 'if (rstart > rend) continue;' in rman_reserve_resource_step.",
  "recommended_fix": "Add 'if (rstart > rend) continue;' after computing rend in rman_reserve_resource's unshared scan (mirrors FreeBSD rman_reserve_resource_step), and validate count/window arithmetic (count==0, count-1>end, start+count-1 overflow - the latter also covers DF-0090 and the DF-2855 window-escape variant).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 12:02:45 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (rstart>rend guard) applied to guest /usr/src together with DF-2854's bzero fix; make -j6 nativekernel KERNCONF=X86_64_GENERIC RC=0; installkernel + reboot into kernel #1. Re-run of the exact PoC: EVIL1 returns NULL ('not reproduced (guard present?)'), EVIL2 NULL ('correctly denied'), resource list remains [0-0x1eff]A [0x1f00-0x1ffe]f [0x1fff-0x2fff]A, module unloads with fini=0. Baseline corruption is gone.",
  "fix_evidence": [
    "findings/poc/DF-2853/fix_run.log (patched-kernel dmesg)",
    "findings/poc/DF-2853/fix_build.log (build RC=0)",
    "findings/poc/DF-2853/fix.diff"
  ]
}