⬢ DragonFlyBSD Kernel Audit
DF-4321 / run.2.log
← back to finding ↓ download raw
DF-4321: ath_hal_getregdump() signed/unsigned bounds bug
buffer: 32 bytes at 0x800473000, guard page at 0x800474000
payload: outsize=32; regs[0]={0x8000,0x800c}, regs[1..4095]={0x9000,0x9000}
legitimately writable: 32 bytes (8 header + 6 values)

=> WROTE PAST THE GUARD PAGE (fault at +4KB)
   bytes written before fault: 4096 (buffer was 32) = 4064-byte overflow
first 16 bytes past the 32-byte buffer (offset 32..48): a5a5a5a50090000000900000a5a5a5a5  <- 0xA5A5A5A5 'register value' words smeared over heap
RC=0