⬢ DragonFlyBSD Kernel Audit
DF-5729 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-5729",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Source-proven ordering flaw, not driven live: lwkt_gettoken/lwkt_gettoken_shared/lwkt_trytoken publish td_toks_stop BEFORE _lwkt_tokref_init() initializes the refs tr_tok (sys/kern/lwkt_token.c:660-663, 731-733, 797-799). db_dump_td_tokens (sys/ddb/db_ps.c:193-197), reached from DDB ps for every runnable thread (db_ps.c:149,172), walks [td_toks_base, td_toks_stop) of CPUs frozen by DDBs stop-IPI and dereferences ref->tr_tok unguarded. A thread frozen inside the ~3-instruction window presents a stale tr_tok (valid leftover pointer -> wrong token printed, cosmetic) or zeros in a never-used slot (-> tok->t_ref deref of NULL+small offset -> page fault inside DDB -> trap_fatal/kdb_trap nested re-entry/wedge, the DF-2241 consequence family). The window is nanoseconds wide; the stop-IPI must land inside it, so on-demand reproduction is impractical - filed as speculative. Positive control: ps in a live DDB session on the same kernel walks tokens normally (../DF-5728/postfix-run.log TOKENS lines). Fix: init-then-publish reorder at all three sites plus a NULL-guard in the walker (fix.diff, applies clean against sys/).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full source trace with path:line); fix.diff (applies clean); ../DF-5728/postfix-run.log (healthy ps TOKENS walk - positive control)",
  "kernel_refs": [
    "sys/kern/lwkt_token.c:660",
    "sys/kern/lwkt_token.c:663",
    "sys/kern/lwkt_token.c:731",
    "sys/kern/lwkt_token.c:733",
    "sys/kern/lwkt_token.c:797",
    "sys/kern/lwkt_token.c:799",
    "sys/ddb/db_ps.c:193",
    "sys/ddb/db_ps.c:194",
    "sys/ddb/db_ps.c:197",
    "sys/ddb/db_ps.c:149",
    "sys/ddb/db_ps.c:172"
  ],
  "poc_changes": "No seed PoC; none written - the race window (~3 instructions) cannot be hit deterministically from the DDB console rig.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-trace finding; positive control run in the DF-5728 session)",
  "run_cmd": "in a DDB session: ps (positive control - healthy walk)",
  "code_hash": "0",
  "notes": "Filed speculative per audit convention: ordering flaw is real and source-proven; worst case is a DDB-context page fault (wedge), best case a misprinted token. The lwkt_token.c reorder hunk deserves upstream memory-ordering review (cpu_ccfence placement) - the db_ps.c NULL-guard is unconditionally safe.",
  "recommended_fix": "Initialize the tokref before publishing td_toks_stop (all three gettoken variants) and skip NULL tr_tok refs in db_dump_td_tokens (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored post-verification against the read-only sys/ tree (git apply --check clean); not rebuilt/run - the nanosecond race cannot be triggered on demand to demonstrate before/after.",
  "fix_evidence": "findings/poc/DF-5729/fix.diff"
}