โฌข DragonFlyBSD Kernel Audit
DF-4060 / fix_run.log
โ† back to finding โ†“ download raw
=== DF-4059 + DF-4060 fix validation on the patched kernel ===
kernel: DragonFly 6.5-DEVELOPMENT #1: Thu Oct 15 11:59:40 UTC 2026
        (nativekernel, gcc 8.3, RC=0; installkernel RC=0 โ€” fix_build.log)
rig:    rebuilt against the patched KERNBUILDDIR; production statics
        re-resolved from the patched /boot/kernel/kernel
        (amr_std_poll_command 0xffffffff803455a0, +0x50 vs baseline โ€”
        the enlarged fixed function) and prologue-verified (magic: all 4 OK)

--- prime/magic (patched kernel) ---
[prime] kern.dfamr_a_amrstdpoll = 0xffffffff803455a0
[magic] all four runtime prologues == file OK

--- DF-4059B: id-0 completion with busy slots (baseline: NULL store at
     softc+3088, decrement at softc+5128 [1208 past softc], status store
     corrupting busycmd[0]) ---
[4059B] NULL store @softc+3088: 0x0000133700001337 -> 0x0000133700001337
    (unchanged โ€” NO store happened)
[4059B] busyslots decr @softc+5128: 0x4000 -> 0x4000
    (unchanged โ€” NO out-of-softc decrement happened)
[4059B] ac_status store corrupted busycmd[0] byte4: 0x0 (mb_status 0x5a)
    (byte untouched โ€” status never stored)
dmesg: "unknown: bad completion id 0"   <- the fix rejecting the id

--- DF-4059 leak: mb_nstatus=255 (baseline: 255 entries, 209 stack bytes
     disclosed incl. kernel heap pointers) ---
dmesg: "unknown: excessive completion count 255"
entries processed: exactly 46 ("bad slot 127..172")
stack-derived bytes disclosed: 0

--- DF-4060 tmo WITH the former panic finale enabled (baseline:
     panic: amr: slot 2 busy? โ€” guest dead) ---
[4060TMO] poll_err=5 ticks=104
[4060TMO] after timeout: BUSY_still_set=0 busycmd_holds_ac=0 busyslots=0
    (the fix detached the slot)
[4060TMO] after releasecmd: freelist_head_is_ac=1;
    busyslots after 100x amr_done=0
    (amr_rescan_drives' while(sc->amr_busyslots) livelock precondition gone)
[4060TMO] recycled_same_cmd=1 start_err=0
    (production amr_start on the recycled command returns 0 โ€” NO PANIC)

--- DF-4060 late completion of the stale id (baseline: completion
     callback + status store into the free-listed command) ---
dmesg: "unknown: bad slot 2 completed"   (tolerated as a bad slot)
[4060LATE] status 0.0->0x0 busy 0->0 still_on_freelist=0
    (probe never fired โ€” no completion of the recycled command)

--- DF-4059A: idle controller + completion id 0 (baseline: panic: amr:
     slot 0 not busy? โ€” guest dead) ---
ioctl returned normally ("bad completion id 0" in dmesg); guest alive.

---UPTIME---
12:14PM  up 2 mins, 0 users, load averages: 0.08, 0.04, 0.01
 (guest survived the entire validation including both former panic
  finales; benign completion of real ids still works through the
  patched loop โ€” dmesg_patched.txt)