⬢ DragonFlyBSD Kernel Audit
DF-5314 / run.log
← back to finding ↓ download raw
# DF-5314 baseline, variant A (USB_FS_CLOSE x USB_FS_START hammer),
# UNPATCHED kernel (fresh boot, DragonFly 6.5-DEVELOPMENT #0), maxx:
$ timeout 150 ./df5314 200000
[*] 0 cycles (close_ok=1 open_ok=1)
[*] 1024 cycles (close_ok=1025 open_ok=25)
[*] 2048 cycles (close_ok=2049 open_ok=2049)
[*] 3072 cycles (close_ok=3073 open_ok=3073)
RUN_RC=124        <- timeout: 3072 CLOSE/OPEN cycles survived

# documented rerun (fresh boot, 45 s cap):
[*] 0 cycles (close_ok=1 open_ok=1)
[*] 1024 cycles (close_ok=1025 open_ok=1025)
RUNA_RC=124
# => variant A does NOT crash on this kernel: the freed usb_xfer block
# is only ever reclaimed by same-shape M_USB allocations (DFly kmalloc
# zones are per-malloc-type single-size, kern_kmalloc.c:52) and the
# 256-slot delayed-free ring (usb_transfer.c:1333-1357) shields the
# block, so stale derefs read intact memory.  Analyzed in VERDICT.md.