⬢ DragonFlyBSD Kernel Audit
DF-5716 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5716",
  "status": "reproduced",
  "verdict": "sys/libkern/flsl.c is dead code with a latent build hazard, same class as DF-5714 (ffs.c): absent from sys/conf/files (libkern block 2195-2237; grep -c = 0 verified on host and guest), superseded on the only supported arch by the cpufunc.h:290-296 static __inline flsl (HAVE_INLINE_FLSL, bsrq-based; the libkern.h:111-112 prototype is itself gated), and non-compilable in-kernel as committed: the #include <sys/libkern.h> at flsl.c:32 pulls libkern.h:51 -> systm.h:50 -> machine/cpufunc.h, so the out-of-line definition at flsl.c:37-47 collides with the static __inline \u2014 gcc 8.3 error: redefinition of flsl vs previous definition at cpufunc.h:293 (dead_compile_flsl.log, kernel-style -nostdinc -D_KERNEL compile per kern.pre.mk:61). The latent find-LAST-set body was proven arithmetically correct: verbatim body vs the live cpufunc.h inline (bsrq asm copied verbatim from cpufunc.h:119-126) and vs the 64-__builtin_clzl reference, 0 mismatches over 58,454,211 structure-complete cases (0, ~0, sign word, all 64 single bits, exhaustive low-22 and top-22 bit patterns, every MSB position x1024 randoms below it, 50M splitmix64 randoms) \u2014 i.e. flsl(x) = 64-clz(x) for x!=0 and 0 for x==0 across the whole 64-bit domain structure, clearing the loop termination (flsl.c:44) and unsigned refill (flsl.c:45). Consumer census: the live call sites (kern_slaballoc.c:784 inside powerof2_size, guarded size==0/powerof2 at :781-782 so 1UL<<i can never shift by 64; ata-ahci.c:102; bitops.h:162 ilog2; drm linux/bitops.h:79, linux/log2.h:40,52) all resolve to the inline. Impact none (nothing links the file); Info hygiene finding, same class as DF-5714/DF-5700.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "build.log sections == conf/files census (libkern/flsl.c in conf/files: 0) and == dead-file proof (DEADPROOF-OK: flsl.c ... error: redefinition of flsl; cpufunc.h:293 previous definition) with full gcc output in dead_compile_flsl.log; run.log T2 flsl : 58454211 cases, 0 mism vs live-inline, 0 mism vs clz-ref + HARNESS-PASS; FIXCOMPILE-OK: gated flsl.c compiles kernel-style; global flsl symbols in object: 0 (fix validation); env.txt pins guest cksums == audit tree (flsl.c 2802750667 1878).",
  "kernel_refs": [
    "sys/libkern/flsl.c:32",
    "sys/libkern/flsl.c:37-47",
    "sys/cpu/x86_64/include/cpufunc.h:290-296",
    "sys/cpu/x86_64/include/cpufunc.h:119-126",
    "sys/sys/libkern.h:111-112",
    "sys/sys/libkern.h:51",
    "sys/conf/files:2195-2237",
    "sys/conf/kern.pre.mk:61",
    "sys/kern/kern_slaballoc.c:775-785"
  ],
  "poc_changes": "No seed PoC existed (pass 1 filed nothing). Rig authored per the DF-5714 pattern (same shared rig as DF-5715/DF-5717): verbatim bodies compiled from the guests own /usr/src with only the kernel-only include line stripped and identifiers renamed via -D; the fls-family reference is the cpufunc.h inline implementation copied byte-faithfully (bsrq asm from :119-126). First-shot success.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "sh /tmp/df5715/build.sh   (guest root; cksum identity pin, conf/files census, verbatim renamed compiles, kernel-style deadproof, HAVE_INLINE_FLSL-gate fix validation)",
  "run_cmd": "sh /tmp/df5715/run.sh     (guest root; ./p2_harness \u2014 3 s decisive run, 58,454,211 cases/fn)",
  "code_hash": "2c25fef20470dc6e65011dcd6257910ccfe5271c163e1e6e8fa01bb217e07e2a",
  "notes": "Decisive run 3 s. Guest left clean (only /tmp/df5715 scratch). The only security-relevant consumer, kern_slaballoc.c:784 flsl(size) in powerof2_size(), was hand-checked: size==0 and powerof2(size) are guarded at :781-782 before the call, so the 64-bit shift at :785 can never see flsl()==64 \u2014 no truncation/misuse finding there. Family context: DF-5714 (ffs.c), DF-5715 (ffsl.c, this batch), DF-5717 (flsll.c, this batch); DF-5700 (bcmp.c) precedent.",
  "recommended_fix": "Adopt fix.diff (#if !defined(HAVE_INLINE_FLSL) gate around the body), or simply delete sys/libkern/flsl.c \u2014 it is unreferenced by conf/files and cannot compile in-kernel as committed.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "Validation is at the compile level, which is exactly the level where the defect manifests (the file is linked nowhere, so there is no runtime behavior to A/B and no kernel rebuild to do). Baseline reproduced: the committed flsl.c fails kernel-style compile with redefinition of flsl against cpufunc.h:293s static __inline (DEADPROOF-OK, dead_compile_flsl.log). Patched (fix.diff = HAVE_INLINE_FLSL gate around the body): compiles kernel-style with zero errors (fix_compile_flsl.log contains only the pre-existing harmless conflicting types for built-in log warning from systm.h:216) and the nm census shows 0 global flsl symbols in the object \u2014 the body compiles away on x86_64 exactly as the live tree expects (FIXCOMPILE-OK, fix_run.log).",
  "fix_evidence": "dead_compile_flsl.log (baseline failure: error: redefinition of flsl, previous definition at cpufunc.h:293); fix_compile_flsl.log (gated compile, error-free); fix_run.log (baseline symbol k_flsl present vs patched census 0); build.log sections == dead-file proof / == fix validation; fix.diff"
}