# DF-3269 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Reproduced against the kernel source file itself: sys/net/zlib.c compiled without _KERNEL (a configuration its own ifdef ladder supports), driven by an instrumented allocator that 0xAA-fills every allocation (provably uninitialized, matching ng_deflates kmalloc without M_ZERO) and fails the Nth allocation. With the window allocation failing, deflateInit2_ returns Z_MEM_ERROR after 5 allocations, and the error-path deflateEnd returns Z_STREAM_ERROR - because s->status is 0xAAAAAAAA garbage that matches no valid state - with FOUR allocations still live (leaked); a clean init+End leaves zero live. The return value of deflateEnd is decided by uninitialized memory exactly as claimed, and the leak is ~4 allocations per failed init (up to ~256KB at windowBits 15/memLevel 8 for the later allocations). Kernel trigger requires kmem exhaustion inside ng_deflate; the userland harness exercises the identical defect code path in the identical source.

## Kernel references
- sys/net/zlib.c:785-800
- sys/net/zlib.c:1108-1127

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

s->status = INIT_STATE immediately after the state allocation; the same harness against the patched file returns Z_OK on the failure path with zero live allocations

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: guest: cc -O -o zharness zharness.c zlib_userland.c -I.

run: guest: ./zharness

expected: deflateEnd -> Z_STREAM_ERROR (status garbage) and 4 live allocations after the failed init; clean case leaks nothing

## Notes on the PoC (what changed vs the finding sketch)

zlib.c compiles userland natively except MODULE_VERSION(zlib,1) which is now ifdeffed _KERNEL in the packed copy; MAX() is defined for the non-kernel build

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.