⬢ DragonFlyBSD Kernel Audit
DF-5016 / generic-ioctl-token-assert.txt
← back to finding ↓ download raw
# Generic DragonFly issue discovered during DF-5016 verification (NOT syscons):
# ANY tight unprivileged ioctl loop on /dev/ttyv0 panics the STOCK kernel
# (fresh reset, no modules) within ~60-100s with:
#   panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref
#          at /usr/src/sys/kern/lwkt_token.c:458
#   (panic with 1 spinlocks held; degenerate lwkt_relalltokens trace)
# Reproduced 4/4 with: ioctl(CONS_HISTORY,250) const loop; ioctl(CONS_CLRHIST)
# loop; ioctl(TIOCGWINSZ) loop (never enters scioctl/syscons driver code!);
# and during the DF-5016 race campaign. Distinct signature from the wild
# sc_vtb_bcopy write fault (panic #1). Route to a kern/tty/lwkt audit.