DF-5778 / run.log
===== GUEST BUILD ===== Warning: Object directory not changed from original /root/df5778 cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/usr/obj/usr/src/sys/X86_64_GENERIC -I/usr/obj/usr/src/sys/X86_64_GENERIC/include -Idragonfly/../include -DHAVE_KERNEL_OPTION_HEADERS -include /usr/obj/usr/src/sys/X86_64_GENERIC/opt_global.h -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c df5778_harness.c cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o df5778_harness.ko df5778_harness.o ===== GUEST LOAD + RUN ===== DF5778: ==== B1 find_irq_source_info bounds sweep ==== DF5778: B1 src=0 -> ENTRY (in-table) DF5778: B1 src=1 -> ENTRY (in-table) DF5778: B1 src=45 -> ENTRY (in-table) DF5778: B1 src=89 -> ENTRY (in-table) DF5778: B1 src=90 -> NULL (rejected) DF5778: B1 src=91 -> NULL (rejected) DF5778: B1 src=95 -> NULL (rejected) DF5778: B1 src=255 -> NULL (rejected) DF5778: B1 src=65535 -> NULL (rejected) DF5778: B1 src=2147483647 -> NULL (rejected) DF5778: B1 src=4294967295 -> NULL (rejected) DF5778: B1 RESULT: PASS (accepts exactly 0..89 incl. INVALID-dummy slot; rejects one-past-end 90 and above) DF5778: ==== B2 adjacent guard canaries ==== DF5778: B2 guard_lo=0x11223344 guard_hi=0x55667788 -> PASS (intact) DF5778: ==== B3 DF-4731 macro cross-proof ==== DF5778: B3 DAL_VALID_IRQ_SRC_NUM(90) = true (macro off-by-one, DF-4731) / find_irq_source_info(90) = NULL DF5778: B3 dispatcher `>=` (irq_service.c:82) DEFUSES the macro off-by-one for the set/ack paths of this file DF5778: ==== B4 upstream v4.17 divergence ==== DF5778: B4 upstream-v4.17 `>` predicate accepts src=90: YES (returns &info[90] = one-past-end); DFly `>=` rejects: YES DF5778: ==== T1 THE FINDING: unguarded service deref ==== DF5778: T1 zeroed irq_service=0xfffff801186257b0 svc->funcs (off+16) = 0 DF5778: T1 VERDICT: dal_irq_service_to_irq_source (irq_service.c:165) double-derefs svc->funcs->to_dal_irq_source with NO guard: the verbatim line FAULTS on this object (latent NULL deref, DF-5778; unreachable via in-tree callers M-bM^@M^T see VERDICT.md) DF5778: ==== T2 verbatim to_irq_source happy path ==== DF5778: T2 src_id=0x7 -> 1 (expect 1=HPD1): PASS DF5778: ==== T3 dummy-slot dispatch (slot 0 INVALID, slot 25 TIMER) ==== DF5778: [DC_LOG_ERROR] dummy_ack: called for non-implemented irq source DF5778: [DC_LOG_ERROR] dummy_set: called for non-implemented irq source DF5778: [DC_LOG_ERROR] dummy_ack: called for non-implemented irq source DF5778: T3 set(INVALID)=0 ack(TIMER)=0 ; reg traffic: reads=0 writes=0 -> PASS (dummy entries log-and-fail; no reg access) DF5778: ==== T4 generic-slot dispatch (slot 1 HPD1) ==== DF5778: T4 set(HPD1)=1 reads=2 writes=2 DF5778: T4 ack: r[0]=0xdead0002 w[0]=0xdead0002 wval[0]=0xa5a5a5b5 (expect r/w 0xDEAD0002, 0xA5A5A5B5) DF5778: T4 set: r[1]=0xdead0001 w[1]=0xdead0001 wval[1]=0xa5a5a5a7 (expect r/w 0xDEAD0001, 0xA5A5A5A7) DF5778: T4 PASS (generic RMW uses exactly the in-table synthetic regs) DF5778: ==== all proofs complete ==== Id Refs Address Size Name 1 5 0xffffffff80200000 1ad8538 kernel 2 1 0xffffffff81cd9000 7c288 ehci.ko 3 1 0xffffffff81d56000 8c778 xhci.ko ===== GUEST UNAME ===== DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 cc 8.3 [DragonFly] Release/2019-02-22