⬢ DragonFlyBSD Kernel Audit
DF-3218 / manifest.json
← back to finding ↓ download raw
{
 "finding_id": "DF-3218",
 "verdict": "reproduced",
 "impact": "panic",
 "reproduce": {
  "build": "see README.md: nativekernel KERNCONF=VKDIRFS (VKERNEL64 + options DIRFS) inside the guest, after the documented bit-rot include fixes; root image with minimal userland",
  "run": "sh /tmp/vkpoc2.sh  (pack: run.sh) \u2014 boots vkernel, mounts dirfs from /dirfs-host, swaps it to a dangling symlink, then: ls /hostroot",
  "expected": "baseline: Fatal trap 12, fault VA 0x128, Stopped at movq $0,0x128(%r13) in dirfs_free_vp; fixed: ls: /hostroot: No such file or directory, vkernel alive"
 },
 "kernel_refs": [
  "sys/vfs/dirfs/dirfs_vfsops.c:246",
  "sys/vfs/dirfs/dirfs_vfsops.c:250",
  "sys/vfs/dirfs/dirfs_vfsops.c:258",
  "sys/vfs/dirfs/dirfs_vfsops.c:261",
  "sys/vfs/dirfs/dirfs_vfsops.c:262",
  "sys/vfs/dirfs/dirfs_subr.c:300",
  "sys/vfs/dirfs/dirfs_subr.c:305",
  "sys/vfs/dirfs/dirfs_subr.c:96"
 ],
 "artifacts": [
  "run.baseline.log",
  "run.fixed.log",
  "run.driver-output.log",
  "run.driver-output-fixed.log",
  "run.sh",
  "vkmount.c",
  "vkinit.c",
  "applyfix.sh",
  "fix.diff",
  "build.log",
  "build.vkernel-full.log",
  "fix-build.log",
  "env.txt",
  "VERDICT.md",
  "manifest.json",
  "verdict.json"
 ]
}