DF-0026 — Proof of Concept

The bug

bioq_reorder_minor_interval (sys/kern/subr_disk.c:1325-1327) is a SYSCTL_INT(..., CTLFLAG_RW, ...) with no bounds validation. It is used directly as a modulus divisor at :1376:

if (bioq->reorder % bioq_reorder_minor_interval == 0) {

Setting kern.bioq_reorder_minor_interval=0 (root) causes an integer divide-by-zero (FPE_INTDIV, trap 18) panic in bioqdisksort() the next time a READ bio is sorted into a bioq that already has a pending WRITE (transition != NULL).

Root-only (sysctl writes gated by SYSCAP_NOSYSCTL_WR). Low severity.

Files

How to reproduce

Prerequisites

• DragonFlyBSD 6.5-DEVELOPMENT (master DEV) guest, default X86_64_GENERIC kernel
• Root access (sysctl write + kldload)

Build the harness

./build.sh

Run (root, disposable VM)

./run.sh

Expected (bug present — unpatched #0 kernel)

Fatal trap 18: integer divide fault while in kernel mode
Stopped at      bioqdisksort+0x9f:      idivl   0xa4b82b(%rip),%eax
db>

Expected (fixed — patched #1 kernel)

DF-0026: harness loaded. bioq_reorder_minor_interval=0
DF-0026: queuing WRITE (transition before=0)
DF-0026: queued WRITE, transition=0xfffff8008d640840. Now queuing READ -> DIV0
DF-0026: BUG NOT TRIGGERED (unexpected!)

Guest stays up, no panic.

Why a kernel module harness?

The div0 code path requires bioq->transition != NULL (a WRITE bio already queued) when a READ bio enters bioqdisksort(). On real hardware/virtio, the disk strategy drains the bioq immediately after each bioqdisksort() call, making the window where transition != NULL extremely tight from userspace. The finding is root-only (sysctl write), so a root-loaded harness module is a legitimate proof: it constructs the exact bioq state and calls the real bioqdisksort() (the actual vulnerable function), not a simulation. The sysctl is still set from userspace — the module only sets up the I/O state.

DF-0026 — VERDICT

Verdict: REPRODUCED (panic / root-only DoS)

The bug is real and confirmed. bioq_reorder_minor_interval is a root-writable SYSCTL_INT (sys/kern/subr_disk.c:1325-1327) used as a modulus divisor at :1376 (bioq->reorder % bioq_reorder_minor_interval) with no lower-bound validation. Setting it to 0 via sysctl(8) (root) causes an integer divide-by-zero (Fatal trap 18: integer divide fault) in bioqdisksort() on the next READ bio that enters a bioq with transition != NULL (pending write).

Mechanism

1. Attacker sets the divisor to 0 (root only): sysctl kern.bioq_reorder_minor_interval=0 The sysctl is CTLFLAG_RW SYSCTL_INT (subr_disk.c:1326) — no validator, accepts any int including 0. SYSCAP_NOSYSCTL_WR gates the write, so root is required.

2. A WRITE bio is queued in a disk's bioq. In bioqdisksort() (subr_disk.c:1391-1399), BUF_CMD_WRITE appends to the tail and sets bioq->transition to point at the first write if it was NULL.

3. A READ bio arrives while the WRITE is still in the bioq (bioq->transition != NULL). The READ branch (:1368-1382) executes: c TAILQ_INSERT_BEFORE(bioq->transition, bio, bio_act); ++bioq->reorder; if (bioq->reorder % bioq_reorder_minor_interval == 0) { /* :1376 — div0 */ reorder is now 1 (or any positive int); 1 % 0 triggers idivl → trap 18 (integer divide fault) → kernel panic.

Evidence

Baseline (unpatched #0 kernel)

Fatal trap 18: integer divide fault while in kernel mode
Stopped at      bioqdisksort+0x9f:      idivl   0xa4b82b(%rip),%eax
db>

The idivl at bioqdisksort+0x9f is the modulus at :1376. The RIP-relative operand 0xa4b82b(%rip) is the global bioq_reorder_minor_interval (value 0).

Trigger method

A kernel module harness (df26_harness.c) constructs the exact bioq state: initializes a bio_queue_head, queues a WRITE bio (sets transition), then queues a READ bio (hits the divisor). The module calls the real bioqdisksort() — the actual vulnerable function — not a simulation. The sysctl is set from userspace (root) before loading.

Userspace-only triggers (parallel dd / C programs doing mixed read/write on vtblk and md devices) were attempted extensively but the race window is extremely tight: vtblk_strategy drains its bioq into the virtqueue immediately after each bioqdisksort(), and mdstrategy clears transition via bioq_remove() before the processing memcpy begins. The harness module is the appropriate proof for a root-only DoS where the runtime race window is sub-microsecond.

Impact

Root-only self-DoS (kernel panic). No privilege escalation, no info leak, no memory corruption. Rated Low (privileged trigger, availability-only impact). Same class as DF-0019.

Fix (validated)

Consumer-side divisor clamp at subr_disk.c:1376 (fix.diff):

-           if (bioq->reorder % bioq_reorder_minor_interval == 0) {
+           int minor_interval = bioq_reorder_minor_interval;
+           if (minor_interval < 1)
+               minor_interval = 1;
+           if (bioq->reorder % minor_interval == 0) {

Fix validation (Phase 8)

• Unpatched baseline (#0): kldload df26.ko (after sysctl=0) → Fatal trap 18: integer divide fault ... bioqdisksort+0x9f: idivl → guest in DDB.
• Patched kernel (#1, fix applied): same kldload df26.ko (after sysctl=0) → module prints "BUG NOT TRIGGERED", guest stays up, no panic. Verified twice (deterministic).

The fix supersedes the finding markdown's proposal (which additionally clamped burst_interval); since burst_interval is only used in a >= comparison (:1378), not as a divisor, clamping it is unnecessary for preventing the div0 — though it remains good defense-in-depth.

PoC changes

• Added df26_harness.c — kernel module harness that directly triggers the div0 by calling bioqdisksort() with a constructed bioq state.
• Added Makefile — kld module build (SYSDIR=/usr/src/sys).
• Added trigger.c, trigger_md.c, trigger_md2.c — userspace I/O flood triggers (attempted but race window too tight from userspace).
• Added fix.diff — standalone git-apply-able fix.
• Added build.sh / run.sh — repro scripts.
• Original bioq_div0.sh unchanged.