⬢ DragonFlyBSD Kernel Audit
DF-3167 / fixrun1-overlap.log
← back to finding ↓ download raw
# Intermediate fix-v1 run (bounds-check only, no containment guard):
# the OOB write was prevented (forged record moved to a buffer-aligned
# destination), but the source-side 64KB getblk overlapped cached 16KB
# buffers on the device -> separate panic of the same unvalidated data_len class:
bgetvp: overlapl 0000000022088000/65536 000000002208c000 bx ... bp ...
panic: bgetvp - overlapping buffer
bgetvp() at bgetvp+0x129
getblk() at getblk+0x18b
breadnx() at breadnx+0x284
hammer_io_read() at hammer_io_read+0x7b
hammer_load_buffer() at hammer_load_buffer+0x12f