{
 "finding_id": "DF-2875",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Pipelined BLK_WRITE messages in one dmsg transaction hit a single-slot aux tracker (iost->data): each kdmsg_detach_aux_data overwrites the slot (subr_diskiocom.c:440) and ANY READ/WRITE completion frees whatever the slot currently holds (:606) - i.e. the MOST RECENT aux while its bio is still in flight. Verified on the stock guest: 3/10 W2 slots and several reclaimer slots on the raw disk contained other messages' payloads (0xAA) or raw kernel heap bytes ('63 61 6c 73', '53 ff 00 f0') instead of the data actually sent - a deterministic premature-free/UAF on bp->b_data with attacker-controlled sizes (512B..1MB) and timing, plus a linear memory leak (dmsg_disk 2.19K->4.67M over 20 rounds). Fixed kernel shows zero leak and byte-exact writes.",
 "exploit_chain": "dmsg peer -> BLK_WRITE|CREATE txn -> stream W1(small)+W2(big)+reclaimers(big) -> W1 completion kfree()s W2/R4's aux under its in-flight bio -> peer's subsequent message aux allocations (same kmalloc zone, reader thread) reclaim the slot -> victim bio's DMA reads replacement object bytes and persists them to attacker-chosen disk offsets (kernel heap disclosure onto disk, proven with 'cals'/53ff00f0) -> repeat with target zone for contents/pointer harvest; write-side grooming yields full kernel memory corruption (uid0 route on hardening-free hosts; peer here already ran privileged, so uid0 was not the demo target)",
 "evidence": [
  "run.log (readscan anomalies: aa-cross-writes at W2 slots; 63 61 6c 73 at off+004/011/013/037/055; 53 ff 00 f0 in first run)",
  "f2_mem_before/after.txt (dmsg_disk 2.19K -> 2.28M / 4.67M)",
  "VERDICT.md",
  "run.fix.log (fix kernel: zero leak, byte-exact slots)"
 ],
 "kernel_refs": [
  "sys/kern/subr_diskiocom.c:440",
  "sys/kern/subr_diskiocom.c:442",
  "sys/kern/subr_diskiocom.c:445",
  "sys/kern/subr_diskiocom.c:606",
  "sys/kern/kern_dmsg.c:1863"
 ],
 "poc_changes": "Seed sketch was a hypothetical; wrote a full dmsg wire peer (dfpeer.c): socketpair + DIOCRECLUSTER + hand-crafted DMSG_BLK frames (kernel rx path verifies no CRCs); pipeline/readscan/hold modes; fixed header padding to hbytes=128 for 96-byte blk structs and enlarged the header parser buffer to DMSG_HDR_MAX after the LNK_CONN frame desynced it",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 1450,
 "guest_dirty": 1,
 "build_cmd": "cc -O -Wall -o /tmp/dfpeer dfpeer.c",
 "run_cmd": "sh run_f2.sh (root; pkill -f hammer2 first)",
 "code_hash": "e748ca2203c63d4fc7c412513eefcdf465800329f3e8ff3c36dbd9f5d0583722",
 "notes": "Impact field reflects the DEMONSTRATED effect: kernel heap bytes persisted to attacker-readable disk + wrong-data corruption + leak; the underlying primitive is a deterministic premature-free (memcorrupt bucket) and was not driven to uid0/panic in this run - see exploit_chain for the route. DF-0117/DF-0118 remain open in the same file.",
 "recommended_fix": "Track detached aux per-bio (bio_caller_info2.ptr owns a kdmsg_data_t; diskiodone frees exactly that) instead of the shared iost->data slot",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 18:43:16 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix.diff applied, make nativekernel)",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Fix kernel (all four diffs applied, rebuilt, rebooted): pipelines run shows dmsg_disk 320B before AND after (no leak) and every readback slot byte-exact - no cross-writes, no kernel heap on disk. Premature free and leak both dead.",
 "fix_evidence": [
  "run.fix.log"
 ]
}