⬢ DragonFlyBSD Kernel Audit
DF-3202 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3202",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "wildCaseCmp() recurses once per * (devfs_core.c:2902-2903) with 80-byte frames (objdump-verified: push %rbp + 5 regs + sub $0x18 + ret). Rule names may be up to PATH_MAX-1, so a few hundred stars = a few hundred nested frames inside devfs_rule_checkname on the devfs core thread. Minimal PoC (300-star name, PERM cmd, one APPLY): Fatal double fault, rip = wildCaseCmp+6 (push %r15), panic: double fault. Incidental reproductions at 252 and ~95 stars put the stock-kernel threshold between ~60 and ~95 stars.",
  "exploit_chain": "privileged ADD {NAME <300 stars>, PERM} + APPLY * -> per-node wildCaseCmp recursion -> stack exhaustion double fault",
  "evidence": [
    "panic.txt: Fatal double fault rip=0xffffffff8091c316 = wildCaseCmp+6",
    "run.fixed.log: ADD rejected EINVAL (star cap)"
  ],
  "kernel_refs": [
    "sys/vfs/devfs/devfs_core.c:2875",
    "sys/vfs/devfs/devfs_core.c:2902",
    "sys/vfs/devfs/devfs_core.c:2903",
    "sys/vfs/devfs/devfs_rules.c:306"
  ],
  "poc_changes": "none beyond compile fixes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 1,
  "build_cmd": "cc -static -O -o star_rec star_rec.c",
  "run_cmd": "./star_rec",
  "code_hash": "0c27a45c6b9fe94048b2c7d659ca411a5b8bfec4b7abcdd00af8eaa85f6bd33e",
  "notes": "threshold ~<100 stars on this kernel; an iterative matcher rewrite would be the thorough fix, the audit ships a >32-star rejection at rule-add",
  "recommended_fix": "reject NAME patterns with more than 32 *s at rule-add (or make wildCaseCmp iterative)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Sep  8 10:25:07 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed kernel rejects the 300-star name at ADD with EINVAL; apply never runs",
  "fix_evidence": [
    "DF-3202/run.fixed.log"
  ]
}