# DF-5630 VERDICT

## Status: reproduced (OOB read proven by value differential) — fix validated

Guest: DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC), cc 8.3.
Trigger runs as unprivileged `maxx` (uid 1001); observability via a
root-loaded KLD sysctl harness (`df_osrel.ko`, in this pack) that exposes
`struct proc::p_osrel` — the exact field the OOB read fills.

## Chain

execve(crafted ELF, uid 1001)
 → exec_elf64_imgact (imgact_elf.c:602)
 → get_brandinfo loop 1 (imgact_elf.c:550-561) — DragonFly brand has
   BI_BRAND_NOTE (elf_machdep.c:66) with brandnote {10,4,1,"DragonFly"}
   (imgact_elf.c:129-136)
 → check_note → check_PT_NOTE (imgact_elf.c:1721)
 → note_overflow (imgact_elf.c:1700) bounds ONLY n_namesz → 22 bytes
   proven; note fields {10,4,1} + vendor "DragonFly\0" all within those
   22 bytes → match (imgact_elf.c:1786-1790)
 → BN_TRANSLATE_OSREL set (imgact_elf.c:134) → bsd_trans_osrel called
   (imgact_elf.c:1792-1794)
 → `*osrel = *(const int32_t *)(note + 1 + roundup2(10,4))` =
   *(int32_t*)(note+24) (imgact_elf.c:1870-1872) — reads 4 bytes at
   offsets 24..27 of a 22-byte-proven region
 → with the note at file offsets [4072, 4094): read lands at
   image_header[4096..4099] — past the first mapped page into the
   adjacent physical page via the DMAP (kern_exec.c:838-839 →
   cpu/x86_64/misc/lwbuf.c:95 PHYS_TO_DMAP)
 → imgp->proc->p_osrel = <those 4 bytes> (imgact_elf.c:867).

## Proof (vulnerable kernel #0)

- control binary (full 28-byte note, descriptor 0x44332211 inside the
  segment): execs; KLD harness reads `p_osrel = 1144201745 (0x44332211)` —
  the harness and note plumbing work exactly.
- bug binary (22-byte note, declared descriptor beyond segment/page):
  execs; `p_osrel = 537537071 (0x200a2a2f)` = bytes "/*\n " — present
  nowhere in the 4095-byte crafted file. 3/3 runs. Only possible source:
  memory past the mapped first page (DMAP neighbor physical page), i.e.
  the OOB read.
- nonote binary: ENOEXEC (the note was the only branding path).

Impact ceiling on this guest: the 4 bytes land in p_osrel which has no
userspace-visible reader (checked: only writes at kern_exec.c:298,
imgact_elf.c:867, init_main.c:385) and the read hits DMAP/kmalloc-adjacent
memory that stays mapped — no panic, no disclosure today. It is a
genuine CWE-125 whose impact is one future p_osrel consumer away (e.g.
procstat/sysctl exposure would turn it into a repeatable 4-byte kernel
memory oracle), and it can read past a kmalloc chunk in the heap path
(imgact_elf.c:1757-1769).

## Fix validation (kernel #1, patched, built 23:30 UTC)

- bug binary → "Exec format error" (ENOEXEC): the truncated note is now
  rejected by the strengthened note_overflow (whole declared note must
  fit), so no brand, no trans_osrel call.
- control binary → still execs, `p_osrel = 0x44332211` — legitimate
  ABI notes (every real DragonFly binary) are unaffected.
- nonote binary → ENOEXEC as before.

Root cause lines: sys/kern/imgact_elf.c:1700-1707 (note_overflow) +
1866-1875 (bsd_trans_osrel), enabled by elf_machdep.c:66-67 brandnote
wiring.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.