{
  "finding_id": "DF-4132",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "tokenize() (vinumparser.c:163) writes one pointer per token into the callers fixed 64-entry static array token[MAXTOKEN] (vinumconfig.c:78) with no bound check, via parse_config (vinumconfig.c:1627). A VINUM_CREATE ioctl line with >64 tokens overwrites kernel static data with pointers into the attackers ioctl buffer; on the tested build the smashed statics include the command_fail jmp_buf, so the parse-error longjmp restores an attacker-smashed RIP and the kernel EXECUTES attacker-supplied bytes (demonstrated twice: Fatal trap 1, RIP inside the kmallocd ioctl buffer, executing 0x61 a token bytes decoded as popal). Same parser runs on config text read verbatim from vinum-labelled disks (vinum read / vinum.drives autodetect), so malicious media reaches the identical overflow. Root/operator-gated on the ioctl path; malicious-media vector for the disk path. Fix (bound the write by the callers array size) validated on a rebuilt kernel: identical PoC returns cleanly, no overflow, guest stable.",
  "exploit_chain": "VINUM_CREATE ioctl (0xC4004640) with 500-token line -> sys_ioctl kmalloc(1024)+copyin -> parse_user_config -> parse_config -> tokenize writes token[64..499] past the 512-byte static array (~3.5KB of .bss smashed with heap pointers) -> command_fail jmp_buf saved RIP/RSP replaced by token pointers -> config error -> throw_rude_remark -> longjmp(command_fail) -> kernel jumps into the attacker buffer -> executes token bytes (0x61=a=POPAL observed; quoted tokens allow arbitrary opcodes incl. NOP sleds). Escape/impact ceiling: arbitrary kernel code execution for anyone with /dev/vinum/control (0600 root:wheel) or with their media read by vinum.",
  "evidence": "panic.txt (two crash signatures), serial_full_crash1.txt, run.log (baseline panic vs fixed-kernel clean return), fix.diff, vinum_tokensmash.c + vinum_codeexec.c",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumconfig.c:58",
    "sys/dev/raid/vinum/vinumconfig.c:78",
    "sys/dev/raid/vinum/vinumconfig.c:1627",
    "sys/dev/raid/vinum/vinumparser.c:163",
    "sys/dev/raid/vinum/vinumparser.c:175",
    "sys/dev/raid/vinum/vinumioctl.c:61",
    "sys/dev/raid/vinum/vinumconfig.c:144",
    "sys/kern/sys_generic.c:675"
  ],
  "poc_changes": "Added lowercase /dev/vinum/control fallback (non-debug kernels reject the uppercase Control node); computed VINUM_CREATE via _IOC macros; staged token counts for reach control.",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o vinum_tokensmash vinum_tokensmash.c",
  "run_cmd": "kldload vinum; ./vinum_tokensmash 500",
  "code_hash": "7388786813f2611fe9947d3eb6914c8b3863d51a078c4d0126d8f686c06549d6",
  "notes": "Crash reproduced twice from fresh boots on stock kernel; deterministic given >=~430 overflow pointers. Stage-2 NOP-sled variant overflowed silently (no crash) - shows the smash is not always immediately fatal, but the a-token runs panic deterministically.",
  "recommended_fix": "Pass the token array size to tokenize() and return -1 instead of writing past it (fix.diff: signature + bound check + call site).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied fix.diff to guest /usr/src, rebuilt kernel (#1 Fri Sep 18 04:22) + vinum.ko, rebooted, re-ran ./vinum_tokensmash 500: tokenize returns -1, reply.error=-1, guest stays up (run.log). Bad behavior gone.",
  "fix_evidence": "run.log fixed section; build.log (BUILD_RC=0); dmesg clean after run."
}