{
  "finding_id": "DF-5358",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED on the QEMU DragonFly guest (X86_64_GENERIC #0 Jul 2 2026): pc64 pmap_kextract() (pmap.c:1865-1888) dereferences the recursive map (*vtopt(va), pmap.c:1872) and tests no paging level, so kvm_access_check() (vm_machdep.c:1284-1287) - whose whole job is to verify /dev/kmem ranges page-by-page - page-faults unrecoverably (no pcb_onfault) on any kernel VA whose PDPT/PD page is not yet allocated. A single 8-byte pread() on a root-opened /dev/kmem at such a KVA panics the box: Fatal trap 12 ... Stopped at pmap_kextract.part.23+0x16, fault VA = the unmapped recursive-map PDE-slot address. Read access to /dev/kmem is allowed at ANY securelevel (only FWRITE is gated), but opening it requires SYSCAP_RESTRICTEDROOT, so impact is a root-gated local DoS (Low), not unprivileged. Second mode confirmed by module: with the PT page present and PTE==0, pmap_kextract() returns (va & PAGE_MASK)-style garbage (0x30 for va+0x30) instead of 0 - the pc64 kextract twin of DF-5245/DF-5290 - meaning the documented all pages currently resident guarantee (kern_memio.c:266-270) is enforced only by the accident that the gate queries page-aligned VAs (aligned garbage == 0); unaligned in-tree callers (kern_memio.c:784/797/821) query always-mapped objects today, so this half is a latent landmine. FIX VALIDATED: fix.diff (DMAP-based 4-level walk + PG_V at each level, return 0 when absent) built via make nativekernel + installkernel; the identical trigger then returns EFAULT with the guest up, mapped-KVA /dev/kmem reads still succeed (kernel `version` symbol read: 24 bytes, errno=0), and the system boots and runs (vtophys()==pmap_kextract() globally exercised). No memory-corruption primitive: the fault is a read of an unmapped address inside the validator, and the garbage PA is only compared against 0 - never used as an access target - so no uid=0 chain exists; the trigger itself already requires root.",
  "exploit_chain": "",
  "evidence": "panic.txt: Fatal trap 12 ... Stopped at pmap_kextract.part.23+0x16: movq (%rax,%rdx,1),%rdx with fault VA 0xffff80403e005000 (recursive-map PDE slot for KVA 0xfffff80140000000), current process = pmx_user (the /dev/kmem pread trigger); run.log (baseline transcript incl. module proofs); pmxtest.c output lines: PT-present/PTE-0: unaligned pmap_kextract(va+0x30) = 0000000000000030 (stock garbage) vs 0000000000000000 (patched); fix_run.log: pread returned -1 errno=14 (Bad address); kernel survived (no panic) + control read pread returned 24 errno=0 on the patched kernel; fix.diff; fix_build.log (nativekernel+installkernel rc=0).",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/vm_machdep.c:1276-1291",
    "sys/platform/pc64/x86_64/pmap.c:1865-1888",
    "sys/platform/pc64/x86_64/pmap.c:1872",
    "sys/kern/kern_memio.c:257-290",
    "sys/kern/kern_memio.c:266-270",
    "sys/vm/vm_kern.c:494-537",
    "sys/vm/pmap.h:249"
  ],
  "poc_changes": "Seed-less (pack built from scratch). Three iterations were needed vs the initial design: (1) first module version passed the handler function to DECLARE_MODULE where a moduledata_t is required -> linker strcmp GPF during kldload (my bug, fixed); (2) honest analysis correction: aligned PTE-0 extraction returns 0 on pc64 (va & PAGE_MASK == 0), so the gate bypass half of the claim is only live for UNALIGNED queries - module extended to prove both aligned and unaligned; absent-level probe constrained to KVA >= KvaStart (first probe landed below KvaStart where the range check rejects); (3) fix.diff v1 skipped the PDPT->PD level and panicked at boot (vm_page_free_contig wire_count assert via ata_dmaalloc) - corrected to a full 4-level DMAP walk (v2) which boots and passes.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline) / #1: Sat Oct 3 10:46:28 UTC 2026 (patched)",
  "runtime_sec": 2880,
  "guest_dirty": 0,
  "build_cmd": "guest root, /root/df5358: make (bsd.kmod.mk: pmxtest.ko) && cc -O2 -o pmx_user pmx_user.c ; fix build: cd /usr/src && patch -p1 < fix.diff && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "guest root: kldload ./pmxtest.ko ; ./pmx_user 0xfffff80140000000 8",
  "code_hash": "30c153cb8a3313aca73ba47e8367625f5fd71029720d4a0a70405948ec490300 (sha256 of pmxtest.c+pmx_user.c concatenated; pmxtest.c=340bfeec8f918c18074302510fac08d4fccfd378ae72092cfb7a8ad94f4ab9a2, pmx_user.c=e7109c409123f6c518eff20e5e79df5fd12c90b44a8534cf27fb36ffcda84cd2)",
  "notes": "Trigger KVA 0xfffff80140000000 is guest-specific (PML4[496] present / PDPT[5] absent, above kernel_vm_end 0xfffff80118800000); the module re-probes it on any boot. kvm_access_check is the ONLY in-tree pc64 consumer that queries arbitrary (attacker-chosen) KVA; /dev/kmem open gate = caps_priv_check(SYSCAP_RESTRICTEDROOT|__SYSCAP_NOROOTTEST) (kern_memio.c:152); reads permitted at securelevel>0 / kernel_mem_readonly, so the panic crosses the securelevel promise for reads. Related: DF-5245 (pc64 pmap_extract - no live KVA caller then), DF-5290 (vkernel pmap_extract+kextract, vkernel kvm_access_check), DF-0081 (INVALID: /dev/kmem uiomove (int)c sign-extension). kernacc int-length truncation at vm_machdep.c:1288 killed as unreachable-in-isolation (any >=2^31 range hits the page walk first) - see VERDICT.md negative results. Guest left clean (vm.sh reset with-src; stock kernel #0, unpatched /usr/src verified).",
  "recommended_fix": "pmap_kextract(): walk the kernel page tables through the DMAP (pmap_pdp -> pmap_pdp_to_pd -> pmap_pd_to_pt -> pmap_pt_to_pte) requiring PG_V at each level and returning 0 when absent, instead of the unvalidated recursive-map *vtopt() dereference (fix.diff, applied and validated on the guest).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff applied to guest /usr/src (patch -p1), make -j6 nativekernel KERNCONF=X86_64_GENERIC + installkernel (rc=0, Werror), reboot into build #1 Oct 3 2026. Identical trigger (./pmx_user 0xfffff80140000000 8): baseline stock kernel panicked (Fatal trap 12 at pmap_kextract+0x16, guest down in DDB); patched kernel returns EFAULT with the guest up and responsive. Unaligned PTE-0 extraction now returns 0 (was 0x30). No regression: /dev/kmem read of a mapped kernel VA (kernel `version` symbol) still returns data (24 bytes, errno=0), and the patched kernel boots and runs the full system (vtophys() alias exercised by busdma/contig paths during boot and the kernel build itself). Bad behavior eliminated.",
  "fix_evidence": "fix_run.log (EFAULT + control read + module output on patched kernel); fix_build.log (nativekernel+installkernel tail, INSTALL_DONE); panic.txt (baseline Fatal trap 12); fix.diff (git-apply-clean vs this tree)"
}