⬢ DragonFlyBSD Kernel Audit
DF-3666 / run.log
← back to finding ↓ download raw
BUILD_OK
== DF-3666: sumo_rlc_init save/restore BO sizing ==

reg_list entries (dws)          : 81
BO allocated (evergreen.c:4155) : 324 bytes (81 dwords)
loop exit i                     : 82
end-marker index (evergreen.c:4205): 123
highest dword written           : 123 (byte offset 492)
bytes actually required         : 496
OOB write past BO size          : 43 dwords = 172 bytes
TTM backing (page-rounded)      : 4096 bytes -> overrun stays inside the object's own backing page

RESULT: BUG REPRODUCED - writes need 496 bytes but the BO is 324 bytes.
Contained only by TTM page rounding; a latent CWE-787 that must be fixed at the allocation site.
exit=0
rerun_exit=0