⬢ DragonFlyBSD Kernel Audit
DF-2948 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-2948",
  "manifest": {
    "title": "kern.ncallout fetched after the only clamp -> int-overflowed/truncated callwheel sizing in swi_softclock_setup -> boot panic (latent OOB init loop)",
    "file": "sys/kern/subr_param.c",
    "verdict": "reproduced",
    "impact": "panic",
    "severity": "Low",
    "trust_boundary": "/boot/loader.conf (root/loader-prompt/console) — same class as DF-0173/DF-0174",
    "reproduce": {
      "build": "none — boot-tunable trigger, no compilation",
      "setup": "in guest as root: printf 'kern.ncallout=\"2147483647\"\\n' >> /boot/loader.conf; sync",
      "run": "vm.sh run_root 'shutdown -r now'; sleep 80; vm.sh status (expect down); vm.sh log (expect 'panic: vm_map_entry_link: dup addr'); vm.sh reset with-src",
      "expected": "panic: vm_map_entry_link: dup addr map 0x... ent 0x... right after 'Initialize MI interrupts for 6 cpus'; guest dead in DDB, ssh never up"
    },
    "kernel_refs": [
      "sys/kern/subr_param.c:327-330",
      "sys/kern/kern_timeout.c:374-413",
      "sys/kern/kern_timeout.c:386",
      "sys/kern/kern_timeout.c:388-391",
      "sys/kern/kern_timeout.c:398",
      "sys/kern/kern_timeout.c:406-413"
    ],
    "artifacts": [
      "README.md", "VERDICT.md", "plant.sh", "run.sh", "panic.txt",
      "env.txt", "fix.diff", "sha256.txt", "verdict.json"
    ]
  }
}