⬢ DragonFlyBSD Kernel Audit
DF-3203 / run.2.log
← back to finding ↓ download raw 
===== DF-3203 T2: canary 0xc3 =====
 | DF3203 T2 attempt 1: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T2 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg) | DF3203 T2 attempt 3: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417)
--- verbatim console lines (expected status=-1010580541 = (int)0xc3c3c3c3):
rpc denied, status=943337777
dfrig13: DF3203 T2 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=153789694
dfrig13: DF3203 T22 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=357452694
dfrig13: DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T2 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff12 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff13 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff14 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)

===== DF-3203 T22: canary 0x5a (different byte, value must track) =====
 | DF3203 T22 attempt 1: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T22 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg) | DF3203 T22 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
--- verbatim console lines (expected status=1515870810 = (int)0x5a5a5a5a):
rpc denied, status=357452694
dfrig13: DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T2 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=-1010580541
dfrig13: DF3203 T22 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T22 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff15 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff16 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff17 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)

===== DF-3203 T23: groom32(0x00000002) -> stale PROGMISMATCH leak exit =====
 | DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg) | DF3203 T23 attempt 2: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T23 attempt 3: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417)
--- verbatim console lines:
rpc denied, status=943337779
dfrig13: DF3203 T2 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=-1010580541
dfrig13: DF3203 T22 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T22 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=-1010580541
dfrig13: DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff18 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff19 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff1a from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
mbufs before T23: 7/146632 mbufs in use (current/max):
mbufs after  T23: 7/146632 mbufs in use (current/max):

--- leak_sample.txt (all stale values this boot):
rpc denied, status=943337777
dfrig13: DF3203 T2 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=153789694
dfrig13: DF3203 T22 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=357452694
dfrig13: DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T2 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=-1010580541
dfrig13: DF3203 T22 attempt 2: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=943337779
dfrig13: DF3203 T22 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
rpc denied, status=-1010580541
dfrig13: DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg)

DF-3203 BASELINE RUN DONE