⬢ DragonFlyBSD Kernel Audit
DF-3210 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3210",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "krpc_call() chains the callers request mbuf onto mhead only at krpc_subr.c:275-276; its early error exits (socreate :220, sosetopt :231, sobind :263) jump to out: with mhead==NULL so *data is never freed, while both md_mount (nfs_mountrpc.c:163-166) and md_lookup_swap (:258-259) return on krpc_call error under the comment message already freed \u2014 the ownership contract is false and the request chain leaks (md_mounts v3->v2 fallback additionally reassigns m at :160 without freeing). Inspection-certain defect; impact bounded to <=~6 mbufs per boot and the trigger failures are practically unreachable in single-threaded early boot, so filed Info. Not runtime-testable: boot-path-only code, guest boots hammer2 from disk (same ceiling as DF-3203/3204/3205).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3210/VERDICT.md steps 1-4; decisive lines: krpc_subr.c:275-276 (chaining point), :220-221/:231-232/:263-265 (pre-chain error exits), :437-441 (out: frees only mhead/from), nfs_mountrpc.c:146->160 (fallback reassign), :166/:259 (false message already freed comments)",
  "kernel_refs": [
    "sys/vfs/nfs/krpc_subr.c:275",
    "sys/vfs/nfs/krpc_subr.c:220",
    "sys/vfs/nfs/krpc_subr.c:437",
    "sys/vfs/nfs/nfs_mountrpc.c:146",
    "sys/vfs/nfs/nfs_mountrpc.c:160",
    "sys/vfs/nfs/nfs_mountrpc.c:166",
    "sys/vfs/nfs/nfs_mountrpc.c:259"
  ],
  "poc_changes": "none \u2014 no runnable seed exists for a boot-path mbuf leak; verdict is an ownership/lifetime derivation over both files",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC; hammer2 disk root \u2014 boot path never executes)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Cross-file contract bug: root cause in krpc_subr.c (callee), manifestation and false comments in nfs_mountrpc.c (this files audit). Distinct from DF-3204 (reply-chain leak on PROGMISMATCH). Verified no UAF/double-free: post-chaining exits free the request exactly once and callers never dereference m after a failed call.",
  "recommended_fix": "in krpc_call out: free *data when mhead==NULL (request never chained), matching the callers krpc_call consumes the request contract"
}