⬢ DragonFlyBSD Kernel Audit
DF-2946 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-2946",
  "manifest": {
    "title": "kern.stathz boot tunable fetched unvalidated -> integer divide fault at systimer registration",
    "file": "sys/kern/subr_param.c",
    "verdict": "reproduced",
    "impact": "panic",
    "severity": "Low",
    "trust_boundary": "/boot/loader.conf (root/loader-prompt/console) — same as DF-0173 family",
    "reproduce": {
      "build": "none — boot-tunable trigger, no compilation",
      "setup": "in guest as root: printf 'kern.stathz=\"0\"\\n' >> /boot/loader.conf; sync",
      "run": "vm.sh run_root 'shutdown -r now'; sleep 75; vm.sh status (expect down); vm.sh log (expect Fatal trap 18 / idivq); vm.sh reset with-src",
      "expected": "Fatal trap 18: integer divide fault while in kernel mode, Stopped at ... idivq, right after 'Initialize MI interrupts for 6 cpus'; guest dead in DDB, ssh never up"
    },
    "kernel_refs": [
      "sys/kern/subr_param.c:200-207",
      "sys/kern/subr_param.c:202",
      "sys/kern/kern_clock.c:415-445",
      "sys/kern/kern_systimer.c:268-273",
      "sys/kern/kern_cputimer.c:197-200",
      "sys/kern/kern_clock.c:1337"
    ],
    "artifacts": [
      "README.md", "VERDICT.md", "plant.sh", "run.sh", "panic.txt",
      "env.txt", "fix.diff", "sha256.txt", "verdict.json"
    ]
  }
}