⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0067

add_buffer_randomness_src passes full remaining length (bytes) instead of chunk size (n), defeating cross-CPU entropy splitting

Field Value
ID DF-0067
Status new
Severity Low
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE CWE-682 Incorrect Calculation of Transfer Size
File sys/kern/kern_nrandom.c
Lines 650-668
Area kern (crypto/RNG)
Confidence likely
Discovered 2026-06-30
Reported pending

Summary

add_buffer_randomness_src computes a 256-byte chunk size n (:657, capped :662-663) to split large entropy buffers across per-CPU CSPRNG pools, but the call at :665 passes bytes (the full remaining length) instead of n:

n = bytes;               /* :657 */
...
if (n > 256)             /* :662  cap for cross-CPU splitting */
    n = 256;
...
add_buffer_randomness_state(state, buf, bytes, srcid);  /* :665 BUG: bytes, not n */
bytes -= n;              /* :666  advances by n */
buf += n;                /* :667 */

Each iterated CPU receives the entire remaining suffix (CPU0=[0,total), CPU1=[256,total), …), so the per-CPU pools get massively redundant overlapping data instead of disjoint chunks. The comment at :638-640 ("Large amounts of generic random data will be split across available cpus") is not honored.

No memory-safety violation: buf += n and bytes -= n advance in lockstep, so accesses stay in-bounds. Impact is purely entropy-distribution quality: the Fortuna-style design intention of spreading entropy sources across independent per-CPU pools is defeated for large buffer sources (e.g. /dev/random write-seeding up to PAGE_SIZE, TPM entropy). The RAND_SRCF_PCPU path is unaffected (n == bytes, single iteration).

--- a/sys/kern/kern_nrandom.c
+++ b/sys/kern/kern_nrandom.c
@@ -662,6 +662,6 @@
        }
-       add_buffer_randomness_state(state, buf, bytes, srcid);
+       add_buffer_randomness_state(state, buf, n, srcid);
        bytes -= n;
        buf += n;

Timeline

  • 2026-06-30 Discovered during automated file-by-file audit of sys/kern/kern_nrandom.c.
  • pending Reported to DragonFlyBSD security contact.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0067 · 5 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff 323 B view raw
VERDICT.md verdict source-trace and fix validation 1.3 KB ↓ raw
README.md readme reproduce instructions 863 B ↓ raw
build.sh build-log build script 329 B view raw
run.sh run-log run script 392 B view raw
README.md readme reproduce instructions
↓ download raw

DF-0067 — REPRODUCED (source-only)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (entropy split correctness) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/kern_nrandom.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

add_buffer_randomness_src at :665 calls add_buffer_randomness_state(state,buf,bytes,srcid) passing bytes (full remaining) instead of n (256-byte chunk computed :657 and capped :662-663). Comment :638-640 intends large buffers to be split across CPUs; passing bytes feeds the whole buffer to one state per iteration, defeating the split.

VERDICT.md verdict source-trace and fix validation
↓ download raw

DF-0067 — REPRODUCED (source-only)

Verdict

REPRODUCED (source-only)

Mechanism

add_buffer_randomness_src at :665 calls add_buffer_randomness_state(state,buf,bytes,srcid) passing bytes (full remaining) instead of n (256-byte chunk computed :657 and capped :662-663). Comment :638-640 intends large buffers to be split across CPUs; passing bytes feeds the whole buffer to one state per iteration, defeating the split.

Source trace

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

  • fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
  • Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
  • Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Pass n (the chunk size) instead of bytes. Matches finding proposal.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: passes bytes / patched: passes n, build rc=0.
↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (entropy split correctness; no memory-safety impact)

Evidence (decisive lines)

kern_nrandom.c:665 passes bytes not n.

PoC changes

Authored fix.diff: pass n instead of bytes.

Verified recommended fix

Pass n (chunk size) instead of bytes to add_buffer_randomness_state. Matches finding proposal.

Verdict

REPRODUCED (source-only). kern_nrandom.c:665 add_buffer_randomness_src calls add_buffer_randomness_state(state,buf,bytes,srcid) passing bytes (full remaining) instead of n (256-byte chunk computed :657, capped :662-663). Comment :638-640 intends large buffers split across CPUs; passing bytes defeats the split.