⬢ DragonFlyBSD Kernel Audit
DF-4026 / run.log
← back to finding ↓ download raw
/tmp/mmap_resize_uaf.c: In function 'main':
/tmp/mmap_resize_uaf.c:131:19: warning: unused variable 'freed_page' [-Wunused-variable]
  int racefd = -1, freed_page = -1;
                   ^~~~~~~~~~
===RUN===
DF-4026 mmap-vs-resizebuf UAF: pid 829 attempts=3000
round 0...
round 2: HIT — shrink ok (size now 256), stale 128K mapping held over freed kernel buffer
stale baseline byte: 0x53
applying 3072 MB anon page pressure...
READ-after-free (mutation): 31/32 stale pages rewritten by kernel after the free (0x53 -> 0x53 ...) — mapping covers freed, reused kernel heap
RESULT: UAF read over freed M_DEVBUF kernel heap CONFIRMED (mutation proof; alias/VM-recycle proofs are timing-dependent, see pack logs)
EXIT=0