# DF-5712 VERDICT — index/rindex (char)ch truncation divergence

**Status: REPRODUCED** (deterministic, 3/3 runs) · **Impact: none** (no memory
unsafety; semantic/conformance divergence, latent) · **Confidence: certain**

## What was audited

Pass-2 twin audit of `sys/libkern/rindex.c` (53 LOC) and `sys/libkern/index.c`
(52 LOC) — the kernel's `strchr`/`strrchr` backend (`sys/sys/libkern.h:164-174`
inline-wraps `strchr`→`index`, `strrchr`→`rindex`; registered standard in
`sys/conf/files:2208,2216`).

## The primitives family checklist

**(a) c==0 tail handling / NUL-walk bounds — CLEAN, harness-proven.**
`index` tests `*u.p == ch` *before* the NUL test (sys/libkern/index.c:46-49), so
`index(p,0)` returns the pointer to the terminating NUL — exact `strchr` semantics.
`rindex` executes the match test on the NUL byte itself (`sys/libkern/rindex.c:47-48`
sets `save = u.p` when `ch==0`), then returns at rindex.c:49-50 — exact `strrchr`
semantics. Harness Part 2: `CH0_SEMANTICS: OK — match libc exactly (0 bad)` across
the whole corpus. The NUL-walk bound is: halt at the first zero byte —
byte-at-a-time, no word-at-a-time shape exists in either file.

**(b) Consumer census.** Direct callers (all NUL-safe):
- `sys/vfs/smbfs/smbfs_vfsops.c:170,173` — `index(strncpy(...),0)`: the entire
  `f_mntfromname[MNAMELEN]` is `bzero`d first (line 167), so the scan for the
  terminator is intrinsically bounded. (Legacy bucket.)
- `sys/vfs/smbfs/smbfs_vnops.c:975-1000` — NUL-terminated name parsing (legacy).
- `sys/netgraph/ksocket/ng_ksocket.c:222,579,586` — operates on a
  `ksnprintf(name, sizeof(name), "%s", ...)` copy (line 577) / the ng_parse
  NUL-terminated text buffer — bounded.
- `sys/ddb/db_input.c:249` — static, always-terminated ddb line buffer (privileged).
- `sys/libkern/fnmatch.c:99,105` — fnmatch contract requires NUL-terminated args.
- `sys/dev/raid/vinum/{vinumio.c:707,vinummemory.c:56,151}` — NUL-terminated
  config strings (privileged ioctl path).
- `sys/dev/disk/nata/ata-disk.c:511-512` — `index(param.model, ' ')` where
  `model[40]` (ata-raid.h:781) is device-supplied identify data; a hostile drive
  could in theory present 40 non-space/non-NUL bytes making the scan continue
  into the surrounding `ata_params` (it stops at the first zero byte of the
  512-byte identify image in the same softc — cosmetic `ad_describe()` string
  split only). Hardware-trust wart, not a primitive defect, not attacker-reachable.
Indirect: **every** kernel `strchr`/`strrchr` call site compiles to these two
functions. A grep for high-bit search arguments across `sys/` found **zero**
callers passing ch outside ASCII — the divergence below is latent.

**(c) Guard-page differential — CLEAN, harness-proven.** With the string's NUL
placed on the last byte before a `PROT_NONE` page, all scans (including `ch==0`,
returning exactly `guard-1`) complete without touching the guard page:
`GUARDPAGE_RESULT: byte-exact, halts at NUL (0 unexpected faults)`. The
deliberate no-NUL demo faults at the guard — that is the documented
NUL-termination contract, reachable in-kernel only via a consumer bug (none found).

**(d) Word-at-a-time overread — NONE.** Both loops are pure byte-at-a-time
(`for (;; ++u.p)` index.c:45 / rindex.c:46). Unlike vectorized libc `strchr`,
these never read past the terminator. Safest possible shape.

## The finding (reproduced)

`if (*u.p == ch)` (index.c:46, rindex.c:47) compares `int`-promoted `char`
against the untruncated `int ch`. ISO C requires the `char` conversion. On
x86_64 (signed char): for `ch ∈ [128,255]` (and any other out-of-range value,
e.g. ±256), the kernel never matches; libc matches `(char)ch`. Concrete samples
from run.log: `str="" ch=-256 kernel=-1 libc=0` (libc finds `(char)(-256)==0`,
the terminator); `str="a" ch=256 kernel=-1 libc=1`. Totals: **58 index + 58
rindex = 116 mismatches**, 3/3 runs identical.

Security framing: fail-to-match, never OOB. A ported parser searching a
high-bit delimiter (≥0x80) would treat delimited fields as one lump — a
field-separation/auth-confusion shape. No current in-tree trigger → Low, latent.

## Exploit chain

None — there is no memory-corruption primitive and no in-tree trigger; this is
a correctness/conformance defect in a pure function. Pushing to uid=0 is not
applicable to this class; the differential harness *is* the demonstration.

## Fix validation (function-level, in-harness)

`fix.diff` casts the comparison: `if (*u.p == (char)ch)` in both files. The
exact patched bodies (sed-applied to the verbatim kernel sources, one char
changed — diff shown in build.log) were compiled into the same harness:
`PATCHED_TOTAL_MISMATCHES=0` (3/3 runs). `(char)ch` is the libc-exact fix on
both signednesses of `char`: on signed-char machines `(char)128 == (char)0x80 ==
-128` matches the sign-extended byte; on unsigned-char machines the same cast
matches the zero-extended byte, mirroring libc byte comparison. A kernel rebuild
is not meaningful for this pure function beyond the object-level equivalence
already demonstrated; the rig did not need to be reset (no kernel state touched,
guest stayed clean, no panic).

## Guest

DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64,
cc 8.3, page size 4096 (env.txt). Guest `/usr/src/sys/libkern/{index,rindex}.c`
sha256-identical to the audited repo tree (build.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.