⬢ DragonFlyBSD Kernel Audit
DF-5769 / run.log
← back to finding ↓ download raw
# DF-5769 baseline run (mutating-CID variant) — guest DragonFly 6.5-DEVELOPMENT
# stock X86_64_GENERIC (INVARIANTS), 4 GB RAM.  Module: /tmp/df5769/df5769.ko
# (production sys/bus/mmc/mmc.c compiled in, fake mmcbr bridge answering every
# CMD2 with a fresh CID).

kldload /tmp/df5769/df5769.ko   -> rc=0 (loop runs in dfh_boot kthread)

Serial console (vm.sh log):
  DFH: MOD_LOAD (variant: DF-5769 mutating-CID)
  DFH: boot thread: creating dfhbr0
  DFH: dfhbr_probe(dfhbr0) invoked
  DFH: dfhbr_attach
  DFH: probing mmc child
  mmc0: <MMC/SD bus> on dfhbr0            <- production mmc.c discovery now
                                               looping forever in this thread

Memory samples (vmstat -m, M_DEVBUF row = "type  in-use ...  freed"):
  t0 (fresh boot, before kldload):        devbuf    102K   ... 
  t+~6 min:                               devbuf    102K   89.1M   0   390M   102K
  t+~7.5 min:                             devbuf    108K   94.1M   0   390M   108K
  (total kernel malloc in use: 143M -> 149M; ~110,000 mmc_ivars + bus
   children allocated and still growing; never freed; loop never exits)

  => monotonic unbounded kernel-memory growth from a single card insertion.

System impact:
  - first monitored ssh session timed out after 480 s (guest saturated),
  - ~12 min after kldload the guest stopped accepting new ssh sessions
    entirely (serial console still alive, no crash: pure resource
    exhaustion / wedge),
  - the discovery thread never terminates (no exit condition in
    mmc_discover_cards() for a card that keeps answering CMD2),
  - kldunload is impossible (module in use by the never-returning scan);
    the mmc bus is permanently wedged.

Run attempts: 2 (first attempt used a build without the variant flag and
hit the DF-5768 static path — discarded; second attempt = this log).