⬢ DragonFlyBSD Kernel Audit
DF-5033 / oracle_baseline.log
← back to finding ↓ download raw
== BASELINE build: idr_find() takes NO lock (as in the kernel) ==
V1 preemption-in-window: allocated=dddddddd data=dddddddddddddddd -> *** USE-AFTER-FREE READ of freed idr_nodes[] (value returned to caller; kernel hands it to kref_get_unless_zero) ***
V2 load-reorder:          allocated=dddddddd data=dddddddddddddddd -> *** OOB READ past freed 255-entry chunk (id 400 vs 255 entries) + UAF ***
BASELINE RESULT: both interleavings dereference freed idr_nodes[] memory
1