⬢ DragonFlyBSD Kernel Audit
DF-3850 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "verdict": "inconclusive",
  "verdict_detail": "mechanism PROVEN on guest via protocol replica (first attempt); dc-specific runtime hardware-gated per DF-3715 family convention",
  "impact_class": "permanent kernel deadlock (DoS): wedged interface + wedged stopper thread + one-CPU softclock blackout + Giant MP lock held (non-MPSAFE callout)",
  "severity": "Medium",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/kmod && make   # dc_callout_replica.c, out-of-tree kmodule, guest /usr/src required",
    "run": "kldload /root/kmod/dc_callout_replica.ko; sysctl kern.dcreplica_arm=1; sleep 1; (sysctl kern.dcreplica_stop=1 >/dev/null 2>&1 &); sleep 6; ps -o pid,stat,wchan,command -ax | grep dcreplica_stop",
    "expected": "serial console: 'tick INPROG and PARKED on the serializer (fired=21 ran=20)' then terminal marker; ps shows stopper D1/costp and (softclock 0) B0/slize; guest survives but cannot shut down cleanly; reset required"
  },
  "kernel_refs": [
    "sys/dev/netif/dc/if_dc.c:1847",
    "sys/dev/netif/dc/if_dc.c:2725",
    "sys/dev/netif/dc/if_dc.c:2786",
    "sys/dev/netif/dc/if_dc.c:3489",
    "sys/dev/netif/dc/if_dc.c:2213",
    "sys/dev/netif/dc/if_dc.c:3196",
    "sys/dev/netif/dc/if_dc.c:3546",
    "sys/kern/kern_timeout.c:567",
    "sys/kern/kern_timeout.c:583",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/lwkt_serialize.c:105"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "dc_callout_replica.c",
    "dc_callout_replica_fixed.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "fix_validation.log",
    "fix.diff",
    "manifest.json",
    "verdict.json",
    "env.txt"
  ]
}