⬢ DragonFlyBSD Kernel Audit
DF-5717 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5717",
  "status": "reproduced",
  "verdict": "sys/libkern/flsll.c is dead code with a latent build hazard, same class as DF-5714 (ffs.c): absent from sys/conf/files (libkern block 2195-2237; grep -c = 0 verified on host and guest), superseded on the only supported arch by the cpufunc.h:298-304 static __inline flsll (HAVE_INLINE_FLSLL, delegating to flsl((long)mask); the libkern.h:114-115 prototype is itself gated), and non-compilable in-kernel as committed: the #include <sys/libkern.h> at flsll.c:32 pulls libkern.h:51 -> systm.h:50 -> machine/cpufunc.h, so the out-of-line definition at flsll.c:37-47 collides with the static __inline \u2014 gcc 8.3 error: redefinition of flsll vs previous definition at cpufunc.h:301 (dead_compile_flsll.log, kernel-style -nostdinc -D_KERNEL compile per kern.pre.mk:61). The latent find-LAST-set long long body was proven arithmetically correct on three axes: verbatim body vs the live cpufunc.h inline (byte-faithful copy of :300-304 with the bsrq flsl), vs the 64-__builtin_clzll reference, and vs the verbatim kernel flsl twin \u2014 0 mismatches over 58,454,211 structure-complete cases per axis (0, ~0, sign word, all 64 single bits, exhaustive low-22 and top-22 bit patterns, every MSB position x1024, 50M splitmix64 randoms). The (unsigned long long) refill at flsll.c:45 vs the inlines (long) delegation are output-identical on LP64 as expected. Consumer census: tmpfs_vnops.c:1952 (flsll(tm_pages_max * PAGE_SIZE)) and drm linux/log2.h:133 resolve to the inline; none references the dead object. Impact none; Info hygiene finding, same class as DF-5714/DF-5700.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "build.log sections == conf/files census (libkern/flsll.c in conf/files: 0) and == dead-file proof (DEADPROOF-OK: flsll.c ... error: redefinition of flsll; cpufunc.h:301 previous definition) with full gcc output in dead_compile_flsll.log; run.log T3 flsll: 58454211 cases, 0 mism vs live-inline, 0 mism vs clz-ref, 0 mism vs kernel-flsl-twin + HARNESS-PASS; FIXCOMPILE-OK: gated flsll.c compiles kernel-style; global flsll symbols in object: 0 (fix validation); env.txt pins guest cksums == audit tree (flsll.c 1445885582 1884).",
  "kernel_refs": [
    "sys/libkern/flsll.c:32",
    "sys/libkern/flsll.c:37-47",
    "sys/cpu/x86_64/include/cpufunc.h:298-304",
    "sys/sys/libkern.h:114-115",
    "sys/sys/libkern.h:51",
    "sys/conf/files:2195-2237",
    "sys/conf/kern.pre.mk:61",
    "sys/vfs/tmpfs/tmpfs_vnops.c:1952"
  ],
  "poc_changes": "No seed PoC existed (pass 1 filed nothing). Rig authored per the DF-5714 pattern (same shared rig as DF-5715/DF-5716); the flsll reference is the cpufunc.h:300-304 inline copied byte-faithfully, plus a third comparison axis against the verbatim kernel flsl body (the twin check) to cover the inlines (long) delegation vs the files own (unsigned long long) loop. First-shot success.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "sh /tmp/df5715/build.sh   (guest root; cksum identity pin, conf/files census, verbatim renamed compiles, kernel-style deadproof, HAVE_INLINE_FLSLL-gate fix validation)",
  "run_cmd": "sh /tmp/df5715/run.sh     (guest root; ./p2_harness \u2014 3 s decisive run, 58,454,211 cases/fn)",
  "code_hash": "2c25fef20470dc6e65011dcd6257910ccfe5271c163e1e6e8fa01bb217e07e2a",
  "notes": "Decisive run 3 s. Guest left clean (only /tmp/df5715 scratch). On ILP32 the inlines flsl((long)mask) delegation would truncate where this files body would not \u2014 moot on the x86_64-only kernel (sys/cpu contains only x86_64; established in DF-5714). Family context: DF-5714 (ffs.c), DF-5715 (ffsl.c), DF-5716 (flsl.c) \u2014 with this file the whole ffs/fls C family is proven dead, unlistable, and latently correct; DF-5700 (bcmp.c) precedent.",
  "recommended_fix": "Adopt fix.diff (#if !defined(HAVE_INLINE_FLSLL) gate around the body), or simply delete sys/libkern/flsll.c \u2014 it is unreferenced by conf/files and cannot compile in-kernel as committed.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "Validation is at the compile level, which is exactly the level where the defect manifests (the file is linked nowhere, so there is no runtime behavior to A/B and no kernel rebuild to do). Baseline reproduced: the committed flsll.c fails kernel-style compile with redefinition of flsll against cpufunc.h:301s static __inline (DEADPROOF-OK, dead_compile_flsll.log). Patched (fix.diff = HAVE_INLINE_FLSLL gate around the body): compiles kernel-style with zero errors (fix_compile_flsll.log contains only the pre-existing harmless conflicting types for built-in log warning from systm.h:216) and the nm census shows 0 global flsll symbols in the object \u2014 the body compiles away on x86_64 exactly as the live tree expects (FIXCOMPILE-OK, fix_run.log).",
  "fix_evidence": "dead_compile_flsll.log (baseline failure: error: redefinition of flsll, previous definition at cpufunc.h:301); fix_compile_flsll.log (gated compile, error-free); fix_run.log (baseline symbol k_flsll present vs patched census 0); build.log sections == dead-file proof / == fix validation; fix.diff"
}