⬢ DragonFlyBSD Kernel Audit
DF-5573 / run.log
← back to finding ↓ download raw
MSQHX: --- DF-5575 ppb_MS_loop() DBRA(-1) off-by-one ---
MSQHX: DF-5575 iter=5 -> prolog=1 body=1 epilog=1 dbra_spins=4 ret=0
MSQHX: DF-5575 expected body=5; observed body=1 -> BODY EXECUTED ONCE (off-by-one CONFIRMED)
MSQHX: --- DF-5573 ppb_MS_init_msq() unchecked `ins' ---
MSQHX: sizeof(struct ppb_microseq)=32
MSQHX: in-bounds ins=2 arg=1: ret=0 probe[2].arg[1].i=0x11223344 (expect 0x11223344)
MSQHX: OOB ins=60 (1792B past 4-ins array): probe[60].arg[0].i=0x41424344 <-- CONTROLLED WRITE LANDED
MSQHX: OOB ins=200 arg=2 (+6416B): probe[200].arg[2].i=0x1234dead <-- CONTROLLED WRITE LANDED
MSQHX: DF-5573 MS_INS(param) is 8 bits wide (ppb_msq.h:38), ppb_msq.c:206 checks only `arg' -- `ins' write index is unvalidated
MSQHX: harness case=0 done
MSQHX: harness case=6 start (production ppb_msq.c)
MSQHX: --- DF-5577 xfer-loop failure swallowed ---
MSQHX: DF-5577 hook_failed=1 (rc=0 ret=0x0): FAILURE SWALLOWED - reported success (bug)
MSQHX: harness case=6 done