β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0115

sys_ptrace discards copyout error returning PT_IO descriptor

Summary

PT_IO post-processing copyout(&r.piod,...)(:114) explicitly discards error via (void)cast. If user unmaps uap->addr between copyin(:99) and copyout, transfer completes, syscall returns 0, but updated piod_len never delivered. Tracer desync. No memory safety impact.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0115 Β· 1 files
FileTypeDescriptionSize
fix.diff suggested-fix sys_ptrace discards copyout error returning PT_IO descriptor 351 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor

Verified recommended fix

Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor

Verdict

Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor