⬢ DragonFlyBSD Kernel Audit
DF-5558 / leak_sample.txt
← back to finding ↓ download raw 
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=YES kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
    0000: ff ff ff ff ff ff ff ff 41 4c 45 48 45 41 50 21
    0010: 62 00 00 00 00 00 00 00 00 01 00 00 5a 5a 5a 5a
    0020: 62 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0030: 62 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0040: 62 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0050: 62 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=YES kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=YES kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=YES kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=YES kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=YES kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=YES kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=YES kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=YES kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=YES kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=YES kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=YES kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
groomed attempts done: leak_observed=12
ungroomed hunt: leak_iters=0/200 total_nonprefill=0 total_markers=0 total_kptr_qwords=0
RESULT: UNINITIALIZED KERNEL HEAP DISCLOSED TO USERSPACE

=== repeat run (run2-full.log, first-boot baseline, marker shifted +8 by allocator header) ===
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
    0000: ff ff ff ff ff ff ff ff 41 4c 45 48 45 41 50 21
    0010: 02 00 00 00 00 00 00 00 00 01 00 00 5a 5a 5a 5a
    0020: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0030: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0040: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0050: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0

=== patched (fix_run.log): buffer stays at 0xAA prefill ===
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=0     marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=0     marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=0     marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=0     marker=no  kptr-qwords=0