⬢ DragonFlyBSD Kernel Audit
DF-4592 / run.patched.log
← back to finding ↓ download raw
+ date
Mon Sep 21 23:38:30 UTC 2026
+ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
+ kldstat
+ grep -c vinum
1
+ kldload vinum
kldload: can't load vinum: module already loaded or in kernel
+ sleep 1
+ dd 'if=/tmp/label.bin' 'of=/dev/md0' 'bs=512' 'seek=1' 'conv=notrunc'
1+0 records in
1+0 records out
512 bytes transferred in 0.029683 secs (17249 bytes/sec)
+ sleep 1
+ ls /dev/md0s0a
/dev/md0s0a
+ vinum list
+ sleep 1
+ printf 'drive d1 device /dev/md0s0a\n'
+ printf 'sd name det1 drive d1 len 1m detached\n'
+ printf 'volume v0\nplex name p0 org concat\nsd name s0 drive d1 plex p0 len 1m\nsd name s1 drive d1 plex p0 len 1m\n'
+ vinum create -f /tmp/c1
1 drives:
D d1                    State: up	Device /dev/md0s0a	Avail: 9/9 MB (100%)

0 volumes:
0 plexes:
0 subdisks:
+ sleep 2
+ vinum create -f /tmp/c2
1 drives:
D d1                    State: up	Device /dev/md0s0a	Avail: 8/9 MB (89%)

0 volumes:
0 plexes:
1 subdisks:
S det1                  State: empty	(detached)	Size:       1024 kB
+ sleep 3
+ echo '==== DF-4592 evidence: det1 config line (plex-name field is heap bytes from before the plex[] array) ===='
==== DF-4592 evidence: det1 config line (plex-name field is heap bytes from before the plex[] array) ====
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=9' 'count=16'
+ strings /tmp/line.bin
+ grep det1
sd name det1 drive d1 len 2048s driveoffset 265s state empty detached 
+ grep det1
+ head -1
+ strings -t d /tmp/line.bin
+ awk '{print $1}'
+ OFF=0
+ dd 'if=/tmp/line.bin' 'bs=1' 'skip=20' 'count=48'
+ hexdump -C
00000000  31 20 6c 65 6e 20 32 30  34 38 73 20 64 72 69 76  |1 len 2048s driv|
00000010  65 6f 66 66 73 65 74 20  32 36 35 73 20 73 74 61  |eoffset 265s sta|
00000020  74 65 20 65 6d 70 74 79  20 64 65 74 61 63 68 65  |te empty detache|
00000030
+ vinum create -f /tmp/c3
1 drives:
D d1                    State: up	Device /dev/md0s0a	Avail: 6/9 MB (68%)

1 volumes:
V v0                    State: up	Plexes:       1	Size:       2048 kB

1 plexes:
P p0                  C State: up	Subdisks:     2	Size:       2048 kB

3 subdisks:
S det1                  State: empty	(detached)	Size:       1024 kB
S s0                    State: up	PO:        0  B Size:       1024 kB
S s1                    State: up	PO:     1024 kB Size:       1024 kB
+ sleep 3
+ echo '==== DF-4593 evidence: plex line (expect no " sd s0 sd s1" list) ===='
==== DF-4593 evidence: plex line (expect no " sd s0 sd s1" list) ====
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=9' 'count=16'
+ strings
+ grep ^plex
plex name p0 state up org concat vol v0  sd s0 sd s1
+ vinum l
+ grep -A1 plexes:
1 plexes:
P p0                  C State: up	Subdisks:     2	Size:       2048 kB
+ dd 'if=/dev/zero' 'of=/tmp/plain.img' 'bs=1m' 'count=4'
4+0 records in
4+0 records out
4194304 bytes transferred in 0.012826 secs (327024163 bytes/sec)
+ vnconfig -c vn1 /tmp/plain.img
+ cc -O -o /tmp/stick /tmp/stick.c
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=8' 'count=1'
+ md5
+ A=af81168ce0c72a694c9a343a571af4a5
+ vinum saveconfig
+ sleep 3
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=8' 'count=1'
+ md5
+ B=cae4f0c8f15581482ef848d905a31c25
+ echo '==== DF-4594 evidence: control save  af81168ce0c72a694c9a343a571af4a5 -> cae4f0c8f15581482ef848d905a31c25 ===='
==== DF-4594 evidence: control save  af81168ce0c72a694c9a343a571af4a5 -> cae4f0c8f15581482ef848d905a31c25 ====
+ /tmp/stick /dev/vn1
kernel replied: error=2 msg=no drives found
+ md5
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=8' 'count=1'
+ C=cae4f0c8f15581482ef848d905a31c25
+ vinum saveconfig
+ sleep 4
+ md5
+ dd 'if=/dev/md0s0a' 'bs=512' 'skip=8' 'count=1'
+ D=861d727dc568436abc2e6ea21af1b063
+ echo '==== DF-4594 evidence: post-stick save cae4f0c8f15581482ef848d905a31c25 -> 861d727dc568436abc2e6ea21af1b063 (identical == saves wedged) ===='
==== DF-4594 evidence: post-stick save cae4f0c8f15581482ef848d905a31c25 -> 861d727dc568436abc2e6ea21af1b063 (identical == saves wedged) ====
+ dmesg
+ tail -4
vinumioctl: invalid ioctl from process 898 (stick): 40906468
vinum: no additional drives found
vinumioctl: invalid ioctl from process 902 (vinum): 40906468
vinumioctl: invalid ioctl from process 903 (vinum): 40906468