{
  "finding_id": "DF-5535",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "minidumpsys() walk-1 indexes the KPDPPHYS_KVA-based KPDPphys[] array with a VM_MIN_KERNEL_ADDRESS-relative index; VM_MIN_KERNEL_ADDRESS sits at PDP slot 1 (slot 0 reserved), so the walk reads the slot below va and never reaches pdp[8191]. Proven on the live guest: a page mapped at va 0xffffffffd0000000 (slot 8191) is silently absent from the produced minidump while an identically-created page in slot 8190 is present (bitmap parse of the savecored vmcore). Impact is silent crash-dump incompleteness for the last 1GB of kernel VA (its PD page, PTs, and data pages) - a forensics/correctness defect, not a privilege boundary.",
  "exploit_chain": "",
  "evidence": "run.log: rig prints VMINK=0xfffff80040000000 vs KPDPPHYS_KVA=0xfffff80000000000 (slot 1), walk1 max i=8190; dumpchk of baseline vmcore: pa 0xaa603000 (slot 8191) CLEAR vs pa 0xaae01000 (slot 8190) SET. run.patched.log: with fix.diff both SET.",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/minidump_machdep.c:238",
    "sys/platform/pc64/x86_64/minidump_machdep.c:252",
    "sys/platform/pc64/x86_64/minidump_machdep.c:385",
    "sys/platform/pc64/include/vmparam.h:116",
    "sys/platform/pc64/x86_64/pmap.c:1022"
  ],
  "poc_changes": "PoC authored fresh for this finding: KLD rig (mddiag.c) with report/maptest modes and a sysctl trigger; dumpchk.c parser for the minidump bitmap; no seed existed.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline); #1: Wed Oct 7 03:43:23 UTC 2026 (patched)",
  "runtime_sec": 2400,
  "guest_dirty": 1,
  "build_cmd": "cd /root/mddiag && make obj >/dev/null 2>&1 && make && cp /usr/obj/root/mddiag/mddiag.ko . ; cc -O -o dumpchk dumpchk.c",
  "run_cmd": "kldload /root/mddiag/mddiag.ko; sysctl debug.debugger_on_panic=0; sysctl debug.mddiag=maptest; (after reboot+savecore) /root/mddiag/dumpchk /var/crash/vmcore.N 0xaa603000 0xaae01000",
  "code_hash": "4417cc4784717abb94cb42c21f08e0c8d61111a275440c77f698b42af4a4982e",
  "notes": "Scaffolding pages in the affected slot are pre-seeded into the bitmap by vm/vm_page.c:454-458 at boot, so the airtight test maps runtime-allocated pages verified bitmap-CLEAR pre-panic. Two baseline runs and one patched run; dump completes normally in all three. Post-dump reset wedge is a QEMU-guest quirk seen on clean dumps too.",
  "recommended_fix": "Compute the walk-1 PDP index from KPDPPHYS_KVA (i = ((va - KPDPPHYS_KVA) >> PDPSHIFT) & (NPML4EPG*NPDPEPG-1)) at both :238 and :252, matching walk-2s kpdp base.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "Applied fix.diff in the guest /usr/src, rebuilt (nativekernel) and rebooted into the patched kernel; identical maptest now yields the slot-8191 page SET in the dump (baseline: CLEAR) with the slot-8190 control still SET and a normal Dump complete.",
  "fix_evidence": "run.patched.log (dumpchk output on patched-kernel vmcore: both pages SET; Dumping 644 MB ... Dump complete)"
}