⬢ DragonFlyBSD Kernel Audit
DF-5715 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5715",
  "status": "reproduced",
  "verdict": "sys/libkern/ffsl.c is dead code with a latent build hazard, completing the ffs-family picture of DF-5714: absent from sys/conf/files (libkern block 2195-2237; grep -c = 0 verified on host and guest), superseded on the only supported arch by the cpufunc.h:274-280 static __inline ffsl (__builtin_ffsl, HAVE_INLINE_FFSL; the libkern.h:105-106 prototype is itself gated), and non-compilable in-kernel as committed: the #include <sys/libkern.h> at ffsl.c:32 resolves fine (unlike ffs.cs string.h) but drags in libkern.h:51 -> systm.h:50 -> machine/cpufunc.h, so the out-of-line definition at ffsl.c:37-47 collides with the static __inline \u2014 gcc 8.3 error: redefinition of ffsl vs previous definition at cpufunc.h:277 (dead_compile_ffsl.log, kernel-style -nostdinc -D_KERNEL compile per kern.pre.mk:61). The latent body was proven arithmetically correct: verbatim body vs the live cpufunc.h inline and vs __builtin_ffsl, 0 mismatches over 58,454,211 structure-complete cases (0, ~0, sign word, all 64 single bits, exhaustive low-22 and top-22 bit patterns, MSB-position sweep x1024, 50M splitmix64 randoms). Consumer census: no .c call site calls ffsl directly (uses are inside evdev freebsd-bitstring.h:308,361 and drm linux/bitops.h:61 via __ffsl); all resolve to the inline. Impact none (nothing links the file); Info hygiene finding, same class as DF-5714 (ffs.c) and DF-5700 (bcmp.c).",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "build.log sections == conf/files census (libkern/ffsl.c in conf/files: 0) and == dead-file proof (DEADPROOF-OK: ffsl.c ... error: redefinition of ffsl; cpufunc.h:277 previous definition) with full gcc output in dead_compile_ffsl.log; run.log T1 ffsl : 58454211 cases, 0 mism vs live-inline, 0 mism vs clz-ref + HARNESS-PASS; FIXCOMPILE-OK: gated ffsl.c compiles kernel-style; global ffsl symbols in object: 0 (fix validation); env.txt pins guest cksums == audit tree (ffsl.c 1444671719 1875).",
  "kernel_refs": [
    "sys/libkern/ffsl.c:32",
    "sys/libkern/ffsl.c:37-47",
    "sys/cpu/x86_64/include/cpufunc.h:274-280",
    "sys/sys/libkern.h:105-106",
    "sys/sys/libkern.h:51",
    "sys/conf/files:2195-2237",
    "sys/conf/kern.pre.mk:61"
  ],
  "poc_changes": "No seed PoC existed (pass 1 filed nothing). Rig authored per the DF-5714 pattern: verbatim bodies compiled from the guests own /usr/src with only the kernel-only include line stripped and identifiers renamed via -D; kernel-style deadproof uses the machine/ union include dir (platform/pc64 + cpu/x86_64) with -D_KERNEL; fix variants generated by awk exactly as fix.diff. First-shot success; one host-side aborted harness draft (p2_harness_scratch.c) was accidentally scpd with the rig and removed from the guest scratch before evidence capture (never compiled, not part of provenance).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "sh /tmp/df5715/build.sh   (guest root; cksum identity pin, conf/files census, verbatim renamed compiles, kernel-style deadproof, HAVE_INLINE_FFSL-gate fix validation)",
  "run_cmd": "sh /tmp/df5715/run.sh     (guest root; ./p2_harness \u2014 3 s decisive run, 58,454,211 cases/fn)",
  "code_hash": "2c25fef20470dc6e65011dcd6257910ccfe5271c163e1e6e8fa01bb217e07e2a",
  "notes": "Decisive run 3 s; whole guest session well under 1 min. Guest left clean (only /tmp/df5715 scratch; no kernel state, modules, or sysctls touched; no panic \u2014 no reset needed). Family context: DF-5714 (ffs.c) proved the same dead-file class with the string.h failure mode; DF-5716/DF-5717 (this batch) carry flsl.c and flsll.c with the redefinition failure mode; DF-5700 (bcmp.c) is the earlier precedent. The live-inline reference in the harness is byte-faithful to cpufunc.h (asm copied verbatim from :110-126), so the differential target is exactly the code the running kernel executes.",
  "recommended_fix": "Adopt fix.diff (#if !defined(HAVE_INLINE_FFSL) gate around the body), or simply delete sys/libkern/ffsl.c \u2014 it is unreferenced by conf/files and cannot compile in-kernel as committed.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "Validation is at the compile level, which is exactly the level where the defect manifests (the file is linked nowhere, so there is no runtime behavior to A/B and no kernel rebuild to do). Baseline reproduced: the committed ffsl.c fails kernel-style compile with redefinition of ffsl against cpufunc.h:277s static __inline (DEADPROOF-OK, dead_compile_ffsl.log). Patched (fix.diff = HAVE_INLINE_FFSL gate around the body): compiles kernel-style with zero errors (fix_compile_ffsl.log contains only the pre-existing harmless conflicting types for built-in log warning from systm.h:216) and the nm census shows 0 global ffsl symbols in the object \u2014 the body compiles away on x86_64 exactly as the live tree expects (FIXCOMPILE-OK, fix_run.log).",
  "fix_evidence": "dead_compile_ffsl.log (baseline failure: error: redefinition of ffsl, previous definition at cpufunc.h:277); fix_compile_ffsl.log (gated compile, error-free); fix_run.log (baseline symbol k_ffsl present vs patched census 0); build.log sections == dead-file proof / == fix validation; fix.diff"
}