DF-0251
PC_TO_INDEX u_quad_t overflow on 64-bit (correctness only, bounds check prevents OOB)
Summary
PC_TO_INDEX(:86-88) (pc-pr_off)*pr_scale>>16 in u_quad_t. pr_scale up to 0x10000(:59 allows exactly). 64-bit pc -> product can overflow u_quad_t. Cast to int implementation-defined. Profiling samples wrong buckets. BUT i>=pr_size check(:110,:136) prevents any OOB write. Correctness only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0251 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 384 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_prof.c:86: PC_TO_INDEX u_quad_t overflow on 64-bit (correctness, bounds check prevents OOB)
Verified recommended fix
Source-confirmed at sys/kern/subr_prof.c:86: PC_TO_INDEX u_quad_t overflow on 64-bit (correctness, bounds check prevents OOB)
Verdict
Source-confirmed at sys/kern/subr_prof.c:86: PC_TO_INDEX u_quad_t overflow on 64-bit (correctness, bounds check prevents OOB)
No comments yet.