⬢ DragonFlyBSD Kernel Audit
DF-5327 / runB.log
← back to finding ↓ download raw
== DF-5327 stage B (vulnerable EVIL kernel, magazine-churn rig attempt) ==
[child1] open#1 done, fd OPEN, refcount=0 (*** 0: free-on-invalidate armed ***)
[parent] pre-invalidate refcount=0 (fd open)
[parent] invalidate done with the descriptor still open
[parent] postmortem(freed): periph 0xfffff8008d640840 size=144 refcnt_off=88: 00000000 00000000 ffffffff 00000000 802c6e40 ffffffff 802c6b20 ffffffff 802c6f30 ffffffff 80c3ca44 ffffffff 8d6c11e0 fffff800 8fa6bc00 fffff800 | fake_built=0 uaf_hits=0 fakeref@hit=00000000 premortem_refcnt=00000000
[parent] postmortem(regroomed): periph 0xfffff8008d640840 size=144 ... (identical: chunk parked in full zalloc magazine, not yet recycled)
[child1] close on (freed) periph: refcount=-1
[parent] done
EXIT=0
(ch0:evilcd0:0:1:0): removing device entry
[EVILCD] sprayfake: chunk 0xfffff8008d640840 NOT reused