DF-0861 — Hand-crafted HPFS image triggering the hpfs_cpinit heap OOB write

Finding: sys/vfs/hpfs/hpfs_subr.c:274,276,282,292,297 (+ bcopy at :230) — hpfs_cpinit() at mount time sizes its hpm_cpdblk array with the on-disk sp_cpinum (unvalidated u32) but bounds its inner fill loop with the per-sector cpisp->s_cpicnt (a separate on-disk u32). A crafted HPFS image whose SpareBlock carries sp_cpinum=1 and whose single code-page-info sector carries s_cpicnt=0x1F (31) causes the inner loop to run 31 times against a 1-entry array, writing 30 × 136 = 4080 bytes of attacker-controlled disk data past the 136-byte kmalloc — a kernel heap OOB write.

This evidence pack contains:

How to reproduce

# 1. deterministic OOB-proof harness (proves byte-exact 4080-byte overflow)
./build.sh && ./run.sh

# 2. live trigger on a DragonFly guest (root for mount)
ssh dfbsd 'cc -O2 -I/usr/src/sys -o /root/mount_hpfs_simple /path/to/mount_hpfs_simple.c'
ssh dfbsd 'kldload hpfs; vnconfig -c vn1 /path/to/df861.img; /root/mount_hpfs_simple /dev/vn1 /mnt'
# mount returns 0 (cpinit completes) -> 4080-B heap OOB write -> slab corruption
# -> probabilistic panic (e.g. Fatal trap 9 in kqueue_register); see panic.txt

Expected vs fixed behaviour

DF-0861 — hpfs_cpinit unbounded code-page inner loop → heap OOB write

Verdict

REPRODUCED. The heap OOB write in hpfs_cpinit is real and confirmed both by a deterministic userspace harness (4080 bytes, attacker-controlled) and by live mounting of a crafted HPFS image on the DragonFly #0 GENERIC kernel (slab corruption → Fatal trap 9 panic in kqueue_register). The authored fix.diff is VALIDATED by hot-swapping a rebuilt hpfs.ko: the crafted image mounts cleanly (1 in-bounds write, no OOB, guest survives 3 cycles) and a forged sp_cpinum=1000 is now rejected at the validation gate with EINVAL.

Root cause (confirmed path:line)

hpfs_cpinit() runs at mount time (hpfs_vfsops.c:305) and loads code-page data into a kernel heap array:

The outer while decrements cpicnt (the total), but the inner for is bounded by cpisp->s_cpicnt (a per-sector count) and runs to completion even after cpicnt has reached 0 (it goes negative; cpicnt is int). cpdbp is advanced on every inner iteration, so a single code-page-info sector that advertises s_cpicnt > sp_cpinum writes sizeof(struct cpdblk) (= 136 B) through cpdbp for s_cpicnt iterations, overshooting the cpicnt-sized hpm_cpdblk array.

Trigger values & primitive

• iteration 0: cpdbp = &hpm_cpdblk[0] — in-bounds (136 B)
• iterations 1..30: cpdbp = &hpm_cpdblk[1..30] — 30 OOB writes × 136 B = 4080 B

Each write is a bcopy of a struct cpdblk (136 B) from a crafted code-page-data sector, of which b_upcase[0x80] (128 B) is freely forgeable → the OOB content is fully attacker-controlled.

Reproduction

1. Deterministic harness (harness.c)

A faithful userspace transcription of the loop + bcopy against the exact on-disk struct layouts from sys/vfs/hpfs/hpfs.h, with a poisoned allocator modelling the slab neighbourhood. Output (decisive):

--- BUG MODE (unpatched hpfs_cpinit) ---
  sp_cpinum=1 -> cpicnt=1 -> kmalloc(hpm_cpdblk)=136 bytes
  cpisec.s_cpicnt=31 -> inner for() runs 31 times
  result: in-bounds writes=1  OOB writes=30  OOB bytes=4080
  first-OOB cpdblk b_upcase[0..1] = 0x41 0x42 (marker) -> ATTACKER-CONTROLLED
  DF_0861_BUG_CONFIRMED=1
  DF_0861_BUG_OOB_WRITE_BYTES=4080

2. Live trigger on #0 GENERIC (INVARIANTS ON)

Crafted df861.img (SpareBlock sp_cpinum=1, cpisec s_cpicnt=0x1F), vnconfig'd and mounted read-only. hpfs_cpinit runs unconditionally at mount time (hpfs_vfsops.c:305) regardless of mount flags, so an RO mount suffices. The mount returns success (cpinit completes), then the 4080-byte OOB write has corrupted a neighbouring slab object; a subsequent kernel operation panics:

Fatal trap 9: general protection fault while in kernel mode
instruction pointer = 0x8:0xffffffff8063b1c6
current process     = 996
Stopped at      kqueue_register+0x526:  movq    (%r15),%rdx
db>

(The cascade timing is probabilistic, as is normal for slab corruption: run 1 panicked in kqueue_register; runs 2 & 3 silently corrupted and the guest survived until reset. The deterministic harness proves the 4080-byte OOB write happens on every mount; the live runs confirm the code path is exercised and the corruption is real.)

Impact / exploitability

• Primitive: 4080-byte, attacker-controlled heap OOB write at mount time, into the slab neighbourhood of a 136-byte kmalloc(…, M_HPFSMNT).
• Trigger: mount-time only. Mounting requires root by default; the realistic unprivileged path requires vfs.usermount=1 plus a root-created
• chowned image (an acceptable precondition per the threat model, but not the default config).
• GENERIC (INVARIANTS ON): the write itself does not trip INVARIANTS (slab checks fire on alloc/free, not per-bcopy); the corruption silently damages neighbours and probabilistically panics (DoS) when a victim object is next touched. A clean uid=0 on GENERIC would require slab grooming that evades INVARIANTS — the demonstrated, realistic impact on the default kernel is heap corruption → panic (DoS).
• Non-default (noinv, INVARIANTS OFF): the corruption is silent and the primitive is a strong candidate for slab grooming → function-pointer / ucred overwrite. That is a non-default-kernel characterization, not a default-GENERIC uid0.

Realistic impact ceiling: local DoS / heap corruption from a mount operation (root, or usermount precondition); a credible privesc primitive only under the usermount precondition on a non-INVARIANTS kernel.

Fix

fix.diff (git-apply-able, validated): 1. Bound the inner loop — for (i=0; i<cpisp->s_cpicnt && cpicnt > 0; …) so cpdbp can never advance past the allocated array (sys/vfs/hpfs/hpfs_subr.c:307). 2. Cap s_cpicnt per sector to CPIS_NCPI (0x1F, the s_cpi[] array bound) so cpibp reads stay in-bounds (:305-306). 3. Validate sp_cpinum against HPFS_SP_CPINUM_MAX (256), returning EINVAL for forged superblocks (:283-287) — also prevents the cpicnt * sizeof(struct cpdblk) kmalloc from wrapping/huge on a hostile sp_cpinum.

The constants are added to sys/vfs/hpfs/hpfs.h.

Fix validation (Phase 8 — module hot-swap)

Applied fix.diff to in-guest /usr/src, rebuilt only the hpfs.ko KLD module (make in /usr/src/sys/vfs/hpfs, ~25 s), installed to /boot/kernel/hpfs.ko (sha256 01434d8ffb77c5963649a3236f117e79535ccb39369e76d566987875c892cb65), kldunload/kldload to hot-swap on the running #0 kernel, then:

Fix closes the bug: the inner loop can no longer overshoot the array, and forged superblocks are rejected before any allocation/loop runs. No full kernel rebuild was required (KLD module hot-swap).

PoC changes

The runner created the entire evidence pack from scratch (the finding folder did not exist). Files authored:

• craft_img.py — HPFS image crafter (forged SpareBlock sp_cpinum=1 + cpisec s_cpicnt=0x1F + a cpdsec sector with attacker marker content)
• harness.c — deterministic OOB-write proof (faithful loop+bcopy transcription + poisoned allocator + fixed-mode control)
• df861.img / df861-huge.img — crafted 64 KB HPFS images (binary)
• mount_hpfs_simple.c — mount(2) helper (RO mount is enough; cpinit runs regardless of mount flags)
• build.sh / run.sh — exact repro scripts
• fix.diff — git-apply-able fix (bound inner loop + cap s_cpicnt + validate sp_cpinum)
• panic.txt, dmesg.txt, env.txt, build.log, run.log, fix_build.log, fix_run.log, manifest.json, this VERDICT.md