⬢ DragonFlyBSD Kernel Audit
DF-3203 / run.log
← back to finding ↓ download raw
===== DF-3203 T2: canary 0xc3 =====
 | DF3203 T2 attempt 1: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T2 attempt 2: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T2 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
--- verbatim console lines (expected status=-1010580541 = (int)0xc3c3c3c3):
rpc denied, status=943337777
dfrig13: DF3203 T2 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff09 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff0a from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff0b from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)

===== DF-3203 T22: canary 0x5a (different byte, value must track) =====
 | DF3203 T22 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg) | DF3203 T22 attempt 2: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T22 attempt 3: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417)
--- verbatim console lines (expected status=1515870810 = (int)0x5a5a5a5a):
rpc denied, status=943337777
dfrig13: DF3203 T2 attempt 3: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=-1010580541 (check dmesg)
rpc denied, status=153789694
dfrig13: DF3203 T22 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=1515870810 (check dmesg)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff0c from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff0d from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff0e from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)

===== DF-3203 T23: groom32(0x00000002) -> stale PROGMISMATCH leak exit =====
 | DF3203 T23 attempt 1: groom done, call err=0 payload='SERV' -> stale rp_status was != 0 and != RPC_PROGMISMATCH: verbatim console line is: rpc denied, status=2 (check dmesg) | DF3203 T23 attempt 2: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417) | DF3203 T23 attempt 3: err=ENOBUFS -> stale rp_status read as 0 -> gotreply -> m_pullup(24) on the 16-byte reply failed (krpc_subr.c:417)
attacker: mode=short port=7771 blind=0
attacker: REQ #1 len=60 xid=0xffffff0f from 127.0.0.1:1023 (blind prediction for this call: 0xffffff00 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #2 len=60 xid=0xffffff10 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff01 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
attacker: REQ #3 len=60 xid=0xffffff11 from 127.0.0.1:1023 (blind prediction for this call: 0xffffff02 differ)
attacker: 16-byte short reply sent (bytes 16..23 do not exist)
mbufs before T23: 7/146632 mbufs in use (current/max):
mbufs after  T23: 7/146632 mbufs in use (current/max):

DF-3203 BASELINE RUN DONE