⬢ DragonFlyBSD Kernel Audit
DF-5768 / fix.log
← back to finding ↓ download raw
# DF-5768 fix validation — patched kernel run (identical PoC)
#
# Patched kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Oct 11 18:02:40 UTC 2026
# (guest /usr/src/sys/bus/mmc/mmc.c patched with fix.diff:
#  MAX(erase_sector * write_bl_len / 512, 1) at mmc.c:1478/1597)
# Harness rebuilt against the patched source (the module compiles the
# production mmc.c in verbatim), then the EXACT same trigger:

kldload ./df5768.ko
kldload rc=0
DFH: probing mmc child
mmc0: <MMC/SD bus> on dfhbr0
mmcsd0: 2MB <MMC Memory Card> at mmc0 26MHz/1bit
DFH: mmc child probe_and_attach -> 0
DFH: probe_and_attach(dfhbr0) -> 0
DF-5768: production enumeration finished:
DF-5768:   rca=0x0002 mode=0 spec_vers=5 read_bl_len=512
DF-5768:   csd.erase_sector=1 csd.write_bl_len=1 -> ivar->erase_sector=1 (mmc.c:1595-1596)
DF-5768:   sec_count=4096 cmd6_time=500000 us
DF-5768: issuing BUF_CMD_FREEBLKS to mmcsd0 (exactly devfs_spec_freeblks, devfs_vnops.c:2031-2045)...
DF-5768: biowait returned - divide-by-zero did NOT occur
DF-5768: NOT reproduced (exit)
kldunload df5768
kldunload rc=0
# guest stayed up; vm.sh status => up.  Baseline behavior (Fatal trap 18,
# idivl in mmcsd_task+0x6cb) GONE.