⬢ DragonFlyBSD Kernel Audit
DF-5813 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5813",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "The four pointer-printing kprintfs (vm_pageout.c:1340/1350/1356 rebusy %p failed(A|B|C) in vm_pageout_page() and :1728 WARNING! page race during find/busy: %p in vm_pageout_scan_cache()) are certain by inspection and verified present in the running guest kernel (strings check), and the msgbuf is world-readable by unprivileged users (verified: uid 1001/1002 ran /sbin/dmesg). However the guarded interleavings never fired on this guest: five adversarial stress-rig designs over ~25 minutes (mmap dirty/msync/madvise/ftruncate churn, persistent dirty maps, dirty-then-abandon WINATCFLS cycling, UFS and HAMMER2 targets, anon hogs 500-2700MB) kept the pagedaemon demonstrably busy (1862 wakeups, 1.31M pages examined, 295k freed, vnode putpages +60k) yet vm.pageout_lock_miss stayed 0 and no marker line ever appeared in dmesg. The defect (raw vm_page_t pointer disclosure on race-recovery paths, sibling of DF-2689 at :1932) stands as Info severity; the race is empirically rare on this fast-disk single-tenant guest, so the PoC is honestly recorded as not_reproduced with the full rig history for future re-testing on busier hardware.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-5813/strings_check.txt \u2014 all 4 format strings in /boot/kernel/kernel; unprivileged dmesg works",
    "findings/poc/DF-5813/run.log \u2014 5 rig designs, all runs markers=0, pageout_lock_miss=0",
    "sys/vm/vm_pageout.c:1262-1359 \u2014 the vget window and the (A)/(B)/(C) recovery prints",
    "sys/vm/vm_pageout.c:1727-1731 \u2014 the scan_cache find/busy race print",
    "README.md \u2014 design rationale for why each rig targeted a specific print"
  ],
  "kernel_refs": [
    "sys/vm/vm_pageout.c:1340",
    "sys/vm/vm_pageout.c:1350",
    "sys/vm/vm_pageout.c:1356",
    "sys/vm/vm_pageout.c:1728"
  ],
  "poc_changes": "v1 crashed on ftruncate-beyond-EOF shared maps (SIGSEGV/SIGBUS); replaced truncation with msync(MS_INVALIDATE). v2/v3 kept pages too clean or too referenced to be deactivated; v4 implements dirty-then-ABANDON cycling so pages reach the daemons WINATCFLS laundering branch while a syncer competes as cleaner.",
  "attempts": 8,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o df5813_leakstress df5813_leakstress.c -lpthread",
  "run_cmd": "./df5813_leakstress <workdir> <seconds> <hog_MB> ; dmesg | grep -E rebusy|page race during find/busy",
  "code_hash": "943ed63d578d4406983ff4c4f455f612bdc25a662c8e475bb57a2764224b1716",
  "notes": "Guest left clean (rigs exit normally; /boot scratch files removed; final state: fresh reset). The vulnerability class matches DF-2689 (Info, kernleak bucket); these are four additional distinct sites with distinct triggers, hence a separate finding. On hardened/KASLR deployments the disclosed vm_page_array offset defeats heap-layout randomization.",
  "recommended_fix": "Delete the four kprintfs or strip the %p (keep a counter); mirrors the DF-2689 fix for :1932.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No kernel fix-build performed: finding did not reproduce (race too rare on this guest) and severity is Info; fix is a one-line kprintf removal validated by inspection.",
  "fix_evidence": "fix.diff authored against sys/vm/vm_pageout.c (not applied to sys/)."
}