DF-0231
Buffer-size safety depends solely on KKASSERT debug assertions
Summary
Only guards that bp1/bp2 buffers fit I/O are KKASSERT(:93,:150). Production kernels: no-op. If table_blocks*blksize > b_bufsize -> oversized read into undersized buffer. Currently unreachable given constraints but security boundary shouldnt be debug assert.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0231 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 387 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_diskgpt.c:93: buffer-size safety depends solely on KKASSERT debug assertions
Verified recommended fix
Source-confirmed at sys/kern/subr_diskgpt.c:93: buffer-size safety depends solely on KKASSERT debug assertions
Verdict
Source-confirmed at sys/kern/subr_diskgpt.c:93: buffer-size safety depends solely on KKASSERT debug assertions
No comments yet.