⬢ DragonFlyBSD Kernel Audit
DF-5667 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5667",
  "status": "reproduced",
  "verdict": "Runtime-proven latent API hazard, Info grade: on a stock VKERNEL64, is_globaldata_space() (globaldata.c:82-89) blesses the entire 256-slot (8MB, S=32KB measured) SMP_MAXCPU per-CPU KVA window while only ncpus (2) slots are ever mapped, so the MI kernacc() returns TRUE for ~7.9MB of unmapped KVA (DDB call probes: igds(dead)=1, kernacc(dead)=1). No in-tree impact today: the only kernacc consumer chain (/dev/kmem -> kvm_access_check) page-table-validates via pmap_kextract before kernacc and uniformly EFAULTs dead pages (1700-page scan: PG0-15 OK, PG16+ EFAULT, no panic, vkernel alive). Any future/direct kernacc consumer inherits a silent TRUE and panics the vkernel on touch. Fix (bound by ncpus) validated on-guest: igds(dead) 1->0, live probes and scan unchanged.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log (baseline DDB battery + scan; decisive lines: call 0x...720f10(0x8000420123, 0x800042012b) -> 1; kernacc(dead) -> 1; kvm_access_check(0x8000420000,...) -> e; PG 0 OK/PG 16 EF); run.fixed.log (patched: igds(dead) -> 0, all else unchanged); VERDICT.md sections 2-3; env.txt measured layout",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/globaldata.c:82",
    "sys/platform/vkernel64/platform/globaldata.c:85",
    "sys/platform/vkernel64/platform/init.c:727",
    "sys/platform/vkernel64/platform/init.c:733",
    "sys/platform/vkernel64/platform/init.c:389",
    "sys/platform/vkernel64/x86_64/mp.c:407",
    "sys/vm/vm_glue.c:119",
    "sys/platform/vkernel64/x86_64/vm_machdep.c:322",
    "sys/cpu/x86_64/include/param.h:71",
    "sys/platform/pc64/x86_64/machdep.c:2964"
  ],
  "poc_changes": "Rebuilt the whole rig (DF-5655s artifacts were gone): nativekernel VKERNEL64 needed a -Wl,--defsym relink workaround (kern_mib.c __build_id_* vs conf/Makefile:23 userspace link); image needs /usr/bin tools (grep/head/tail/od) and devfs mount in vkinit; vkernel DDB has no symbols (kdb_init #if 0) so all probes use raw nm addresses; ddb args must be 0x-hex (input radix 16 \u2014 decimal args caused probe v3s artifact panic, kept as ddb_artifact_panic.txt); base pointer parsed from an in-vkernel /dev/kmem od read (DDB x/x truncates to 32 bits).",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 1,
  "build_cmd": "make -j6 nativekernel KERNCONF=VKERNEL64 + manual relink with -Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0 (see README.md)",
  "run_cmd": "sh vk_probe4.sh (boots kernel.debug -m 512m -r /vkroot.img -n 2, DDB battery + /dev/kmem page scan)",
  "code_hash": "3a950ed33eecc2ca4d370fbfd68884e58fc674ab4f26027d104f6115824d5c75",
  "notes": "Out-of-file leads surfaced and recorded in VERDICT.md section 5: (1) vkernel64 pmap_kextract() returns va&PAGE_MASK as a bogus nonzero PA for PDE==0 unaligned KVA (runtime-proven 0x123); (2) kernacc()/kernel_map bless ALL unmapped vkernel KVA (kernel_map spans [0x8000000000,0x1000000000000); kernacc TRUE below/in/above the window) \u2014 kvm_access_checks PTE loop is the sole real gate; (3) VKERNEL64 does not link on current HEAD (build regression). File-level negative results in VERDICT.md section 4 (globaldata_find bounds, cpu_gdinit stack push, gd_prvspace ordering, vanished-export fields, PRIVATESPACE_SEGPAD, sizing chain).",
  "recommended_fix": "Bound is_globaldata_space() by the number of online CPUs: eaddr <= (vm_offset_t)&CPU_prvspace[ncpus] (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Single-line fix applied to the guests /usr/src copy, globaldata.o rebuilt, kernel relinked, identical driver re-run: is_globaldata_space(dead) 1->0 while all live-slot probes (kernacc=1, pmap_kextract=0x197040, igds=1) and the /dev/kmem page scan (PG0-15 OK, PG16+ EFAULT) are byte-identical. Residual kernacc TRUE on dead slots via the kernel_map fallback is a separate vm-subsystem issue (VERDICT.md section 3).",
  "fix_evidence": "run.fixed.log DDB battery (igds(dead)->0) and scan section; VERDICT.md section 3 table"
}