DF-0006 — PoC

leak_ttys.c — unprivileged leak of kernel function/heap pointers via the kern.ttys sysctl.

The issue

sysctl_kern_ttys() (sys/kern/tty.c:2891-2921) emits each struct tty verbatim:

t = *tp;                                  /* tty.c:2911  whole struct */
if (t.t_dev) t.t_dev = devid_from_dev(..);/* only t_dev sanitized */
SYSCTL_OUT(req, &t, sizeof(t));           /* tty.c:2914 */

struct tty (sys/sys/tty.h) carries kernel .text function pointers (t_oproc/t_stop/t_param/t_unhold → exact KASLR-defeat), kernel heap object pointers (t_pgrp/t_session/t_sigio/t_sc/t_slsc), per-clist c_data buffer pointers, and an embedded lwkt_token. Only t_dev is sanitized. The OID is CTLTYPE_OPAQUE|CTLFLAG_RD (tty.c:2923) and sysctl reads are not privilege-gated (kern_sysctl.c:1446-1450 gates only writes), so any unprivileged local user can dump them all.

Build

cc -o leak_ttys leak_ttys.c      # or: ./build.sh

Run

As an unprivileged user (e.g. maxx, uid 1001):

./leak_ttys       # or: ./run.sh

Expected output (bug present)

got 3760 bytes from kern.ttys
raw blob written to ttys.bin (3760 bytes)
  blob offset   256 (word    32): 0xffffffff80b8b800   <- t_oproc = scstart
  blob offset   264 (word    33): 0xffffffff806b7eb0   <- t_stop  = nottystop
  blob offset   272 (word    34): 0xffffffff80b86930   <- t_param = scparam
  ...
total kernel-range pointer-sized values leaked: 102

The 0xffffffff80???????? values match nm /boot/kernel/kernel symbols exactly (see leak_sample.txt) — proving real kernel .text addresses are leaked and KASLR is defeated. The 0xfffff8?????????? values are live slab / direct-map heap addresses (clist buffers, pgrp/session objects). Stable across runs in the same boot (run.log/run.2.log/run.3.log). On a fixed kernel, zero kernel-range pointers appear and the program exits 2.

Cross-referencing against nm (optional, reproduces the leak_sample.txt table)

nm -n /boot/kernel/kernel > kernel.nm        # world-readable
./leak_ttys                                  # writes ttys.bin
# then for each candidate value, find the nearest nm symbol:
python3 -c "import bisect,struct; ..."       # see leak_sample.txt for results

DF-0006 — kern.ttys sysctl leaks kernel function/heap pointers to unprivileged users

Verdict

REPRODUCED → FIX VALIDATED. kern.ttys is world-readable and copies each struct tty verbatim to userland, leaking 102 kernel-range pointer-sized values per read (including exact .text function-pointer addresses that defeat KASLR). Confirmed on the unpatched audit-source kernel DragonFly 6.5-DEVELOPMENT #0 (Thu Jul 2 06:02:54 UTC 2026). The improved fix.diff in this folder, built as a single-fix kernel (#1), reduces the leak to 0 (deterministic across 3 runs) — the previous aggregate-fix run that dropped 102→20 is now fully closed.

Mechanism (confirmed by source + run)

sysctl_kern_ttys (sys/kern/tty.c:2891-2921) iterates the global tty_list and, for each struct tty, does:

t = *tp;                                      /* tty.c:2911  whole-struct copy */
if (t.t_dev)
    t.t_dev = (cdev_t)(uintptr_t)devid_from_dev(t.t_dev);   /* ONLY t_dev sanitized */
error = SYSCTL_OUT(req, (caddr_t)&t, sizeof(t));            /* tty.c:2914 */

The OID is registered CTLTYPE_OPAQUE|CTLFLAG_RD (tty.c:2923-2924) — a plain read. sysctl_root (sys/kern/kern_sysctl.c:1446-1450) applies its privilege check only when req->newptr is set (a write). A read sets no newptr, so no privilege check runs; any unprivileged user reads kern.ttys.

struct tty (sys/sys/tty.h) carries, all copied raw, these pointer-bearing fields (intra-struct offsets observed in the leaked blob in parentheses):

(struct lwkt_token is { long t_count; struct lwkt_tokref *t_ref; long t_collisions; const char *t_desc; } — sys/sys/thread.h:159; struct kqinfo is { struct klist ki_note; } — sys/sys/event.h:160, a single SLIST head pointer.)

Why the original fix.diff left a 102→20 residual

The first fix.diff zeroed t_token, the three clist.c_data, t_pgrp, t_session, t_sigio, t_oproc/t_stop/t_param/t_unhold, t_sc, t_slsc — but omitted t_list (the TAILQ_ENTRY linkage). During the sysctl walk the handler inserts a stack-resident marker after each tp (tty.c:2905-2908), so every snapshotted tty has:

• t.t_list.tqe_next == &marker (identical kernel-stack address across all ttys)
• t.t_list.tqe_prev → the previous tty (or &tty_list.tqh_first for the head)

Those are 2 kernel pointers per tty × 10 ttys = exactly the 20-pointer residual seen on the prior aggregate all-25-fixes kernel. The improved fix.diff adds t.t_list.tqe_next = NULL; t.t_list.tqe_prev = NULL; and, for defense-in-depth, bzero(&t.t_rkq, ...) / bzero(&t.t_wkq, ...) (the klist pointer inside each kqinfo, which is NULL on unwatched console ttys but would leak a knote * if any process held a kqueue on the tty).

Proof (before / after)

Unpatched #0 baseline (./leak_ttys as maxx, uid 1001, not in wheel):

got 3760 bytes from kern.ttys
raw blob written to ttys.bin (3760 bytes)
  blob offset    24 (word    3): 0xffffffff80c64d8d   <- t_token.t_desc (.rodata ptr)
  blob offset    48 (word    6): 0xfffff8008bbbb400   <- t_rawq.c_data (heap)
  blob offset    80 (word   10): 0xfffff8008dcf1000   <- t_canq.c_data (heap)
  blob offset   112 (word   14): 0xfffff8008d202600   <- t_outq.c_data (heap)
  blob offset   160 (word   20): 0xfffff8004f1c6190   <- t_pgrp (slab)
  blob offset   168 (word   21): 0xfffff8008bb1f320   <- t_session (slab)
  blob offset   256 (word   32): 0xffffffff80b8c0f0   <- t_oproc = scstart (.text)
  blob offset   264 (word   33): 0xffffffff806b87a0   <- t_stop  = nottystop (.text)
  blob offset   272 (word   34): 0xffffffff80b87220   <- t_param = scparam (.text)
  blob offset   352 (word   44): 0xfffff801182eb600   <- t_list.tqe_next = &marker
  blob offset   360 (word   45): 0xffffffff810e5200   <- t_list.tqe_prev = &tty_list
  ...
total kernel-range pointer-sized values leaked: 102
RUN_EXIT=0

Single-fix #1 kernel (improved fix.diff, same PoC, same user):

got 3760 bytes from kern.ttys
raw blob written to ttys.bin (3760 bytes)
total kernel-range pointer-sized values leaked: 0
RUN_EXIT=2

Reproduced 3× on the patched kernel — 0 every time (deterministic, not masking). Full logs: unpatched baseline in run.log; patched runs in fix_run.log.

Impact

Information disclosure: precise kernel .text base + kernel heap layout to any local unprivileged user. Not a memory-corruption primitive itself, but a KASLR-defeat and slab-grooming enabler that escalates the practical severity of any local heap/stack corruption bug into reliable exploitation. Rated Low standalone (info disclosure, no integrity/availability impact).

PoC changes

The leak_ttys.c trigger is unchanged from the prior run (it already detects the full canonical-upper-half range and dumps the raw blob). The only change this run is the improved fix.diff: - added t.t_list.tqe_next = NULL; t.t_list.tqe_prev = NULL; (the TAILQ_ENTRY that caused the 102→20 residual); - added bzero(&t.t_rkq, sizeof(t.t_rkq)); bzero(&t.t_wkq, sizeof(t.t_wkq)); (the embedded kqinfo klist pointers — defense-in-depth, NULL on console ttys but leakable when a kqueue watches the tty); - kept the existing zeroing of t_token, the three clist.c_data, t_pgrp, t_session, t_sigio, the four .text function pointers, t_sc, t_slsc, and the t_dev → devid rewrite.

Recommended fix

The verified fix.diff in this folder supersedes the finding markdown's initial proposal (which, like the first fix.diff, omitted t_list). It is a minimal, targeted change: zero every pointer-bearing field of the local copy before SYSCTL_OUT at sys/kern/tty.c:2911, preserving t_dev sanitization and every field pstat(8) reads. A stronger long-term fix is a dedicated pointer-free struct kinfo_tty mirroring the kinfo_file pattern in kern_descrip.c.

Fix validation (Phase 8)

• Baseline (#0, unpatched audit-source kernel): 102 kernel pointers leaked via sysctl kern.ttys as uid 1001 — bug reproduced.
• Single-fix kernel (#1, only this finding's improved fix.diff applied to clean /usr/src, built make -j6 nativekernel KERNCONF=X86_64_GENERIC, rc=0): 0 pointers leaked, deterministic across 3 runs — leak gone.
• Patched-kernel kern.version: DragonFly 6.5-DEVELOPMENT #1: Thu Jul 2 08:12:37 UTC 2026; /boot/kernel/kernel sha256 d462dfb3... (matches the installed kernel.stripped).
• Build log: fix_build.log (35599 lines, full nativekernel output, clean — no errors). Patched run: fix_run.log.
• Note on install procedure: the first reboot attempt failed at the loader (Unable to load /kernel/kernel / EFTYPE). Root cause was NOT a bad kernel — the built kernel.stripped is structurally identical to the original /boot/kernel/kernel (same ELF64/ET_EXEC/x86-64, identical entry point 0xffffffff802aad90, identical program headers). The failure was an unclean shutdown: vm.sh down force-killed qemu at its 90s timeout while the 119 MB kernel.debug copy was still syncing to HAMMER, leaving the disk inconsistent. Fix: sync explicitly (and wait) after the copies, before reboot. After that the #1 kernel booted cleanly.