⬢ DragonFlyBSD Kernel Audit
DF-3684 / run.log
← back to finding ↓ download raw
sizeof(amd_pp_clocks)=132, dep->count=255, max array elems=16
caller frame offsets: pp_clks@0 validation_clks@132 canary@144 retaddr@152
first OOB clock[] index: 16 (offset +0 bytes past array end)
OOB u32 writes past clock[16] and latency[16]: 239 each (956 bytes each)
bytes written past end of amd_pp_clocks struct: 892
validation_clks.engine_max_clock corrupted to: 0x1b7740
caller-frame canary: 0x1cfde0001c9c38 (expected 0x4141414141414141)
return-address model slot: 0x1dc130001d5f88 (expected 0xdeadbeef00000000)
RESULT: STACK OVERFLOW CONFIRMED (phase 1 accounting) - clock values written past amd_pp_clocks into adjacent caller stack locals; phase 2 now performs the smash on a live stack frame
phase 2: overflowing a real stack-local amd_pp_clocks (marker=5a5a5a5a5a5a5a5a)...
exit=139