⬢ DragonFlyBSD Kernel Audit
DF-5720 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "finding_id": "DF-5720",
  "title": "ddb '/'-modifier parsing copies stale db_tok_string for numeric modifier tokens — modifier silently substituted with the previous identifier (usually the command's own name)",
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "./build.sh (no-op — no compilation; pure serial-console ddb session)",
    "run": "./run.sh  (socket-serial guest boot + root sysctl debug.enter_debugger=ddb + drive_ddb.py battery)",
    "expected": "examine/4 db_active -> mixed hex/pointer/disassembly walk; print/4 0x41 -> empty line; write/4 ... -> 'Unknown size'; controls x/x, print/x, write/l behave normally"
  },
  "kernel_refs": [
    "sys/ddb/db_command.c:361-370",
    "sys/ddb/db_command.c:289",
    "sys/ddb/db_lex.c:170-216",
    "sys/ddb/db_lex.c:225-256",
    "sys/ddb/db_examine.c:55-59",
    "sys/ddb/db_examine.c:78-193",
    "sys/ddb/db_examine.c:204-248",
    "sys/ddb/db_write_cmd.c:47-67"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "drive_ddb.py",
    "experiment.py",
    "ab_cycle.sh",
    "run.sh",
    "build.sh",
    "build.log",
    "run.log",
    "run.wedge-session1.log",
    "serial.full.txt",
    "serial.wedge-session1.txt",
    "exp.A-short-none.drain.log",
    "env.txt",
    "fix.diff",
    "hashes.txt",
    "verdict.json",
    "manifest.json"
  ]
}