⬢ DragonFlyBSD Kernel Audit
DF-5474 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5474",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The stock VKERNEL64 platform cannot link on this tree: kern.pre.mk:135 adds -Wl,--build-id=sha1 to ELDFLAGS for all kernels and kern_mib.c:101-102/111/132 references __build_id_start/__build_id_end, which only the pc64 ldscript PROVIDEs (pc64/conf/ldscript.x86_64:74-77). vkernel64s SYSTEM_LD override (vkernel64/conf/Makefile:23-25) neither passes ${ELDFLAGS} nor uses the platform ldscript (proven dead: patching the PROVIDE block into it changes nothing, vk_build3.log), so the stock build fails at linking kernel.debug with undefined references (vk_build2.log). Build-regression: the platform has been unbuildable since the build-id change, and the security-relevant kern.build_id provenance sysctl cannot exist on vkernel. Fixed and validated: appending -Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0 to SYSTEM_LD links cleanly (vk_fixbuild2.log, RC=0) and the resulting vkernel boots and behaves (kern_mib.c:124-127 turns the 0-length into a graceful ENOENT).",
  "exploit_chain": "",
  "evidence": "vk_build2.log (stock link failure, undefined __build_id_*), vk_build3.log (ldscript patch proves it unused), vk_build5.log + vk_fixbuild2.log (defsym fix -> clean link), vkrun_fixed.log (fixed vkernel boots; DF-5472/5473 rig re-run on it)",
  "kernel_refs": [
    "sys/conf/kern.pre.mk:135",
    "sys/kern/kern_mib.c:101",
    "sys/kern/kern_mib.c:111",
    "sys/kern/kern_mib.c:132",
    "sys/platform/pc64/conf/ldscript.x86_64:74",
    "sys/platform/vkernel64/conf/Makefile:23",
    "sys/platform/vkernel64/conf/ldscript.x86_64"
  ],
  "poc_changes": "n/a \u2014 finding discovered while building the DF-5472/5473 rig: the stock platform build failed before any rig code was involved",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root cd /usr/src && make nativekernel KERNCONF=VKERNEL64",
  "run_cmd": "build-only finding; fixed kernel booted via sh /root/vkrig/run_vk.sh fixed",
  "code_hash": "n/a (build-break finding; fix.diff sha256 computed at filing)",
  "notes": "severity Low (platform availability, no runtime vuln); alternative upstream fix: give vkernel64 a real build-id via its ldscript + -T, not attempted because it changes link mode for a userland-executable kernel",
  "recommended_fix": "append -Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0 to SYSTEM_LD in sys/platform/vkernel64/conf/Makefile (or provide a real build-id via the platform ldscript)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "with the defsym line in conf/Makefile, config+make nativekernel KERNCONF=VKERNEL64 links kernel.debug successfully and the vkernel boots to single-user; without it the link fails deterministically",
  "fix_evidence": "findings/poc/DF-5474/vk_build2.log (failure), findings/poc/DF-5474/vk_fixbuild2.log (linking kernel.debug -> size line, RC=0), findings/poc/DF-5474/fix.diff (git apply --check clean)"
}