โฌข DragonFlyBSD Kernel Audit
DF-3017 / fix_build.log
โ† back to finding โ†“ download raw
fix_build.log โ€” DF-3017 fix validation build (captured from guest console via vm.sh; full log lost with guest reset, these are the decisive lines)

Patched source applied:
  Checking patch sys/sys/devfs.h...
  Checking patch sys/vfs/devfs/devfs_core.c...
  Applied patch sys/sys/devfs.h cleanly.
  Applied patch sys/vfs/devfs/devfs_core.c cleanly.

v2 build (fix.diff final: allocv/freep interlock only):
  >>> Kernel build for X86_64_GENERIC completed on Sat Sep  5 10:36:32 UTC 2026
  >>> Kernel install for X86_64_GENERIC completed on Sat Sep  5 10:40:44 UTC 2026
  /boot/kernel/kernel Sep  5 10:39

Booted patched kernel:
  DragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Sep  5 10:33:01 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Baseline (stock #0, Thu Jul  2 06:02:54 UTC 2026): panicked twice under the
same PoC (see panic.txt, panic.run2.txt) โ€” sysref_get SRF_PUTAWAY assertion,
reference_dev <- v_associate_rdev <- devfs_allocv <- devfs_vop_nresolve.

Patched rerun: racer started as nobody, 480s budget:
  DF-3017 racer: 3 churn + 8 stat threads for 480s
  [  5s] open+close=17326 stat_ok=29060 enoent=468068 err=46 ANOMALIES=0
  ... no sysref panic during the entire run (baseline panicked <=4min, 2/2).
  At ~6 min the guest wedged via the SEPARATE pre-existing lock-order bug
  (DF-3022: cache_zap indefinite wait + cache_lock_shared cascade) โ€” not a
  regression of fix.diff v2 (v2 touches no namecache locking; the AB-BA is
  between stock nresolve-under-ncp and stock unlinkp-under-devfs_lock).