⬢ DragonFlyBSD Kernel Audit
DF-3466 / run.2.log
← back to finding ↓ download raw
# DF-3466 fix-validation run (kernel #1, built from /usr/src with fix.diff)
#
# $ uname -a
# DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sun Sep 13 09:29:00 UTC 2026
#     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
# $ kldload wlan           (already in base set)
# $ kldload /tmp/poc/DF-3466/ageqpoc.ko && echo ===AGEQPOC-LOADED-NO-PANIC===
# ===AGEQPOC-LOADED-NO-PANIC===
# $ sleep 1; kldunload ageqpoc && echo UNLOADED-CLEAN
# UNLOADED-CLEAN
# $ dmesg | grep ageqpoc | tail -5
# ageqpoc: append #1 age=781 (listen-intval 2000)
# ageqpoc: append #1 rc=0 aq_len=1
# ageqpoc: append #2 age=0 (reassoc listen-intval 1) -> relative age 0-781 = -781
# ageqpoc: append #2 rc=0 aq_len=2 (KASSERT off?)
#
# (the stale "(KASSERT off?)" string is just PoC message text written before the
#  fix existed: INVARIANTS is still compiled into kernel #1; the KASSERT no
#  longer fires because fix.diff clamps the negative relative age to 0 before
#  it.  Guest stayed up; module loaded and unloaded cleanly.)