⬢ DragonFlyBSD Kernel Audit
DF-3201 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-3201",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "devfs_allocp() applies rules to every new node (devfs_core.c:291-292); a LINK rule whose own output matches itself (name *, linkname y: foo -> yfoo -> yyfoo -> ...) recurses check_apply -> create_link -> alias_create -> allocp without bound, each level carrying ~3KB of stack (checknames PATH_MAX buffer + create_links two PATH_MAX buffers). A single ADD+APPLY double-faulted the devfs core thread; rip symbolized to devfs_rule_create_link+0x1c. Even where the stack survives, the same self-match drives unbounded node creation under devfs_lock (system-wide devfs livelock + memory exhaustion).",
  "exploit_chain": "privileged ADD {NAME *, LINK, y} + APPLY * -> unbounded nested rule application -> stack exhaustion double fault (or devfs_lock livelock)",
  "evidence": [
    "panic.txt: Fatal double fault, rip=devfs_rule_create_link+0x1c (nm-verified)",
    "run.fixed.log: SURVIVED with depth cap + heap buffers"
  ],
  "kernel_refs": [
    "sys/vfs/devfs/devfs_core.c:291",
    "sys/vfs/devfs/devfs_core.c:292",
    "sys/vfs/devfs/devfs_rules.c:331",
    "sys/vfs/devfs/devfs_rules.c:241",
    "sys/vfs/devfs/devfs_rules.c:365"
  ],
  "poc_changes": "none beyond compile fixes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 1,
  "build_cmd": "cc -static -O -o selflink_rec selflink_rec.c",
  "run_cmd": "./selflink_rec",
  "code_hash": "6aa37f6d34b27f6da6d0bbe5a991040e1a564083c8e8a86a6a0bb9897ff641fd",
  "notes": "trigger privileged (root or jailed root via DF-3197); deterministic panic",
  "recommended_fix": "depth-cap rule-driven LINK creation and move create_link/checkname PATH_MAX buffers off the stack",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Sep  8 10:25:07 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "same PoC on fixed kernel: SURVIVED, bounded alias creation, guest up",
  "fix_evidence": [
    "DF-3201/run.fixed.log"
  ]
}