⬢ DragonFlyBSD Kernel Audit
DF-4666 / run.log
← back to finding ↓ download raw
=== baseline [safe]: wild-read address math for count=0 ===
[safe] count=0 -> fallback reads entries[i-1] = entries[0xffffffff]
[safe] entries base        = 0x8004924cc
[safe] wild read address   = 0x10004924c4
[safe] effective byte offset = 34359738360 (0x7fffffff8)
[safe] entry size = 8 -> offset = 0xFFFFFFFF * 8
WILD-READ CONFIRMED (address math): kernel would read ~32 GiB past the heap object -> non-canonical/unmapped -> page fault panic

=== baseline [deref]: verbatim function with count=0 (expect SIGSEGV) ===
[deref] calling verbatim phm_find_closest_vddci(count=0)...
Segmentation fault (core dumped)
deref child exit status: 139 (139 = 128+SIGSEGV)

=== baseline [normal]: control, count=4 ===
vddci is larger than max value in vddci_table
[normal] count=4 -> returns entries[3].value = 830 (in bounds)

=== patched twin ===
[patched] count=0 -> returned 1000 (caller's request), NO wild access
vddci is larger than max value in vddci_table
[patched] count=4 -> returned 830 (normal path intact)
FIX VALIDATED: empty table no longer indexes entries[0xFFFFFFFF]