DF-0071

Missing sign/upper-bound validation on vpcount before heap alloc + file read (negative->huge kmalloc M_WAITOK DoS)

Field	Value
ID	DF-0071
Status	new
Severity	Low
CVSS 3.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-20 Improper Input Validation
File	sys/kern/kern_checkpoint.c
Lines	561-569
Area	kern (checkpoint/restore)
Confidence	likely
Discovered	2026-06-30
Reported	pending

Summary

elf_gettextvp (sys/kern/kern_checkpoint.c:561): vpcount (declared int at :538) is read directly from the untrusted checkpoint file and used immediately as the multiplier for kmalloc(sizeof(struct vn_hdr) * vpcount, M_TEMP, M_WAITOK) (:563) and read_check(..., sizeof(struct vn_hdr)*vpcount) (:564) with no check that vpcount >= 0 and no upper bound. A negative vpcount is converted to a near-SIZE_MAX value when promoted to size_t, yielding an impossibly large kmalloc; with M_WAITOK this loops/panics the kernel (unrecoverable local DoS). Contrast with elf_getnotes which bounds nthreads against CKPT_MAXTHREADS (:188) — vpcount has no equivalent.

Reachability: sys_checkpoint(CKPT_THAW,...); root/wheel-only under default ckptgroup=0.

Recommended fix

--- a/sys/kern/kern_checkpoint.c
+++ b/sys/kern/kern_checkpoint.c
@@ if ((error = read_check(fp, &vpcount, sizeof(int))) != 0)
    goto done;
+if (vpcount < 0 || vpcount > CKPT_MAXVNS) { error = EINVAL; goto done; }
 vnh = kmalloc(sizeof(struct vn_hdr) * vpcount, M_TEMP, M_WAITOK);

(Define CKPT_MAXVNS, e.g. 1024, plus a SIZE_MAX/sizeof(struct vn_hdr) guard.)

Timeline

2026-06-30 Discovered during automated file-by-file audit of sys/kern/kern_checkpoint.c.
pending Reported to DragonFlyBSD security contact.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — kernel core (kern)
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-20 Improper Input Validation
File: sys/kern/kern_checkpoint.c
Lines: 561-569
Area: kern
Discovered: 2026-06-30
Updated: 2026-06-30

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-22 20:25:14
Attempts: 1
Runtime: —
Code hash: f2dfe9aca39a9500
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
Build cmd: ./build.sh (source-only)
Run cmd: ./run.sh (source-only)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-22 20:25:14
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT combined-build rc=0
fix.diff: findings/poc/DF-0071/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-0071 · 5 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able unified diff	587 B	view raw
VERDICT.md	verdict	source-trace and fix validation	1.3 KB	↓ raw
README.md	readme	reproduce instructions	782 B	↓ raw
build.sh	build-log	build script	329 B	view raw
run.sh	run-log	run script	392 B	view raw

README.md readme reproduce instructions

↓ download raw

DF-0071 — REPRODUCED (source-only, root-only checkpoint restore)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (root-only) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/kern_checkpoint.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

elf_gettextvp: vpcount (int) read from untrusted ckpt file; used as kmalloc(sizeof(vn_hdr)*vpcount,...,M_WAITOK) at :563 with NO vpcount>=0 or upper-bound check. Negative vpcount → SIZE_MAX-promoted kmalloc with M_WAITOK → panic/hang.

VERDICT.md verdict source-trace and fix validation

↓ download raw

DF-0071 — REPRODUCED (source-only, root-only checkpoint restore)

Verdict

REPRODUCED (source-only, root-only checkpoint restore)

Mechanism

Source trace

File: sys/kern/kern_checkpoint.c
References: sys/kern/kern_checkpoint.c:561, sys/kern/kern_checkpoint.c:563

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Recommended fix

Validate vpcount >= 0 and upper-bound (1024) plus a SIZE_MAX/sizeof guard before the kmalloc. Matches finding proposal.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: no vpcount validation / patched: range + SIZE_MAX guard, build rc=0.

↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (root-only checkpoint restore)

Evidence (decisive lines)

kern_checkpoint.c:563 kmalloc with unchecked vpcount.

PoC changes

Authored fix.diff: validate vpcount >= 0, <= 1024, and SIZE_MAX/sizeof guard.

Verified recommended fix

Validate vpcount >= 0 and upper-bound (1024) plus SIZE_MAX/sizeof(struct vn_hdr) before the kmalloc. Matches finding proposal.

Verdict

REPRODUCED (source-only, root-only checkpoint restore). kern_checkpoint.c:561 reads vpcount (int) from untrusted ckpt file; :563 kmalloc(sizeof(vn_hdr)*vpcount, M_WAITOK) with NO vpcount>=0 or upper-bound check. Negative vpcount → SIZE_MAX-promoted kmalloc M_WAITOK → panic/hang.