{
  "finding_id": "DF-4781",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Unchecked M_NOWAIT contigmalloc in dcons_drv_init (dcons_os.c:462-464) feeds NULL straight into dcons_init(), whose first header store (buf->osize[0], dcons.c:147) faults: Fatal trap 12, va=0x14, Stopped at dcons_init_port+0x83 (movl %edi,0x14(%rcx)) \u2014 reproduced via a KLD invoking the identical exported sink (mode 1) with a negative control (mode 0) proving the crash is NULL-specific. Natural trigger is kldload dcons under kernel-memory pressure (allocation failure not fault-injected on the guest); root-only, panic/DoS, no further corruption.",
  "exploit_chain": "",
  "evidence": "panic.txt (Fatal trap 12, fault va=0x14, dcons_init_port+0x83 store); run.log (mode-0 NEGCTRL OK vs mode-1 panic); dconsnull.c (sink = exported dcons_init, same call dcons_os.c:464 makes)",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons_os.c:462",
    "sys/dev/misc/dcons/dcons_os.c:464",
    "sys/dev/misc/dcons/dcons.c:147",
    "sys/dev/misc/dcons/dcons_os.c:584",
    "sys/dev/misc/dcons/dcons_os.c:586"
  ],
  "poc_changes": "Seed sketch did not exist; harness written from scratch: kenv-selectable modes (0=negative control, 1=dcons_init(NULL), 2=dcons_putc(NULL)); needed local copy of dcons.h and #include <sys/conf.h> for DEV_MODULE.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /root/dconsrig && make",
  "run_cmd": "kldload dcons; kenv dconsnull.mode=1; kldload /root/dconsrig/dconsnull.ko",
  "code_hash": "9e316bf715ac7ed67b343dac6b2480bc816d9420e9ea0ac0b10a8df7bb213b2f",
  "notes": "fix_status not_applicable (panic-only finding, no memory-corruption primitive; fix.diff authored against read-only sys/ tree, not build-validated).",
  "recommended_fix": "Check contigmalloc for NULL and fail dcons_drv_init; skip dcons_attach on failure; NULL-guard dg.buf on MOD_UNLOAD.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not validated: baseline is a NULL-deref panic with no corruption primitive; fix is a straightforward guard and was not kernel-rebuilt on the guest",
  "fix_evidence": "fix.diff (three hunks: NULL-check + attach guard + unload guard)"
}