⬢ DragonFlyBSD Kernel Audit
DF-5464 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
  "finding_id": "DF-5464",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh (guest, root, /usr/src present; in-tree kmod recipe; builds icu_msiabi_probe.ko icu_msiabi_neg.ko icu_msiabi_livelock.ko)",
    "run": "sh run.sh — kldload each .ko on a kernel without INVARIANTS (stock GENERIC or X86_64_NOINV); livelock run uses caller-side timeout",
    "expected": "probe: msi_alloc rc=0 + '32/96 canary words overwritten' + zone[32]=160 (OOB write past 32-int contract); neg: Fatal trap 12, Stopped at icu_abi_msi_alloc_intern+0x5a; livelock: kldload never returns + guest stops servicing ssh (wedge)"
  },
  "kernel_refs": [
    "sys/platform/pc64/icu/icu_abi.c:460",
    "sys/platform/pc64/icu/icu_abi.c:473",
    "sys/platform/pc64/icu/icu_abi.c:498",
    "sys/platform/pc64/icu/icu_abi.c:524",
    "sys/platform/pc64/icu/icu_abi.c:533",
    "sys/bus/pci/pci.c:1952",
    "sys/sys/systm.h:94"
  ],
  "artifacts": ["icu_msiabi_probe.c", "icu_msiabi_neg.c", "icu_msiabi_livelock.c", "build.sh", "run.sh", "build.log", "run.log", "run_invkernel.log", "run_fixed.log", "panic_neg_count.txt", "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}