⬢ DragonFlyBSD Kernel Audit
DF-3887 / run.log
← back to finding ↓ download raw
entries[] at shadow+124, size 16 bytes (4 slots x 4 bytes)
OOB WRITE: shadow+120 (entries+-4) = 0x0002
in-bounds: entries+2 = 0x0011
in-bounds: entries+4 = 0x0001
in-bounds: entries+6 = 0x0022
OOB WRITE: shadow+1324 (entries+1200) = 0x012c
OOB WRITE: shadow+1326 (entries+1202) = 0xbeef
OOB WRITE: shadow+1328 (entries+1204) = 0x012d
OOB WRITE: shadow+1330 (entries+1206) = 0xcafe
OOB WRITE: shadow+1332 (entries+1208) = 0x012e
OOB WRITE: shadow+1334 (entries+1210) = 0x1234
num_entries after construct = 2
7 OOB 16-bit writes landed OUTSIDE the 16-byte entries array
kernel reach: kv_dpm_init -> kv_parse_sys_info_table (kv_dpm.c:2613) at every KV boot