⬢ DragonFlyBSD Kernel Audit
DF-3528 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-3528",
  "status": "build_failed",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "LATENT, source-certain: ng_car.c arms its SHAPE timer with the item-carrying ng_callout() (ng_car.c:656-660) and the only cancel is ng_car_shutdown()s ng_uncallout() (ng_car.c:539-540); on this kernel every armed-cancel leaks the ng_item plus one node and one hook reference (DF-3515 contract violation makes the cleanup unreachable, and netgraph7s flag-only NG_FREE_ITEM leaks it even when reached - both layers measured in-guest by DF-3523 on the same ng_base.c functions). HOWEVER ng_car.c was never ported to DragonFly (struct bintime / getbinuptime / bintime_sub / mtx_* do not exist in this tree): the in-guest KLD build fails with 68 errors (build.log), sys/conf/files:1696 marks it optional netgraph7_car which no kernel config enables, so the leak cannot manifest on any kernel built from this tree. Rearm-leak (lead a) is NOT reachable via ng_car: q_event is a writer item serialized against rcvdata readers (ng_base.c:1993-1999), so ng_car_schedule only re-arms an idle callout. Trigger is root-only control-plane (setconf SHAPE + rmnode), so even when ported the ceiling is Low.",
  "exploit_chain": "",
  "evidence": "build.log (295 lines, 68 -Werror errors, first fatal: struct bintime lastRefill ng_car.c:62, getbinuptime ng_car.c:592); VERDICT.md (layer-by-layer reasoning); mechanism precedent: findings/poc/DF-3523 (measured 5.76K allocs/830KB per 30k arm/cancel cycles on ng_pptpgre, flat after fix)",
  "kernel_refs": [
    "sys/netgraph7/ng_car.c:656",
    "sys/netgraph7/ng_car.c:539",
    "sys/netgraph7/netgraph/ng_base.c:3248",
    "sys/netgraph7/netgraph/ng_base.c:3291",
    "sys/netgraph7/netgraph.h:787",
    "sys/conf/files:1696"
  ],
  "poc_changes": "n/a - the PoC is the build attempt itself (orchestrator seed pattern from DF-3523 adapted to ng_car: out-of-tree kmod.mk Makefile with SYSDIR=/usr/src/sys and -I/usr/src/sys/netgraph7)",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/ngcar && make  (KMOD=ng_car SRCS=ng_car.c via sys/conf/kmod.mk)",
  "run_cmd": "sh run.sh (documentation-only; kldload ng_car impossible)",
  "code_hash": "",
  "notes": "Confirms pass-1 DF-0622 record (dead code, does not compile) and explains DF-0623s source-only status. Negative results this pass: rearm-while-armed unreachable (writer/reader serialization ng_base.c:1993-1999); negative/truncated SHAPE delay clamped by kern_timeout callout_reset (kern_timeout.c:786-788 a minimum timeout of 1 tick will be enforced); SET_CONF u64 *1024/*125 wrap cannot store out-of-range values (post-multiply values are what get stored and checked).",
  "recommended_fix": "Fix ng_base ng_callout/ng_uncallout to actually free callout items (fix.diff; DF-3523 layer-2) AND port ng_car.c to DragonFly time/lock APIs or delete the dead file."
}