DF-1027

inittodr reads daysinmonth[12] OOB via unvalidated RTC month -> system clock corruption

Summary

inittodr at clock.c:1112 month=readrtc(RTC_MONTH) returns int [0..99] BCD or larger binary/corrupt. :1113-1114 for(m=1;m<month;m++) days+=daysinmonth[m-1]; daysinmonth has 12 entries (valid 0..11). month>=14 -> reads daysinmonth[12..month-2] OOB from adjacent .rodata. Each OOB byte adds up to 255 days to system time -> set_timetimeofday commits wrong wall clock. Reached at boot (vfs_conf.c:478) AND on every ACPI/APM resume (pmtimer.c:70,86). Attacker: root via /dev/nvram CMOS write at offset 0x08, or VM host, or physical BIOS access. Impact: skewed timestamps, TLS cert validity, Kerberos tickets, cron schedules, audit logs. Fix: if(month<1||month>12) goto wrong_time.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:L/A:L
CWE: CWE-129; CWE-125
File: sys/platform/pc64/isa/clock.c
Lines: 1112-1117
Area: hw
Discovered: 2026-07-06
Updated: 2026-07-06

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-23 11:36:23
Attempts: 1
Runtime: —
Code hash: 4e9378d5c607fab8
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (with-src, INVARIANTS ON, gcc 8.3)
Build cmd: (combined) make -j6 nativekernel KERNCONF=X86_64_GENERIC
Run cmd: source-only; inspect sys/platform/pc64/isa/clock.c:1112

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-23 11:36:23
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT combined 70-finding fix kernel (built rc=0 -Werror 2026-07-23; not booted - source-only)
fix.diff: findings/poc/DF-1027/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1027 · 3 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited path	370 B	view raw
VERDICT.md	verdict	source-confirmation narrative	920 B	↓ raw
env.txt	environment	guest uname + toolchain	247 B	view raw

VERDICT.md verdict source-confirmation narrative

↓ download raw

DF-1027 source-confirmation

Verdict: REPRODUCED (source-confirmed) Impact: none Confidence: likely

Kernel ref: sys/platform/pc64/isa/clock.c:1112

Mechanism

inittodr daysinmonth[] OOB via bad RTC month: month=readrtc(RTC_MONTH) unvalidated; for(m=1;m12 -> wrong system clock. confirmed.

Confirmation method

source-only Low-severity; confirmation by code inspection. Runtime PoC not exercised for this Low-severity item; confirmation is by code inspection against sys/.

Recommended fix

See fix.diff in this folder (git-apply-able unified diff).

Phase 8 (combined build)

This fix is part of the batched 70-finding combined patch (../_batch70/combined_70.patch) applied to in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC build is validated rc=0 with 0 errors under -Werror (../_batch70/fix_build.log).

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined build: fix in combined_70.patch; single make -j6 nativekernel built rc=0, 0 errors under -Werror (../_batch70/fix_build.log). Cited line corrected. Source-only -> validation = clean -Werror compile.

'>>> Kernel build for X86_64_GENERIC completed' + 'NK_DONE rc=0'; grep -cE 'error:|undefined reference' fix_build.log = 0

↓ fix.diffDragonFly 6.5-DEVELOPMENT combined 70-finding fix kernel (built rc=0 -Werror 2026-07-23; not booted - source-only)

Confirmed kernel references

Detail

Exploit chain

none (source-only Low finding, not memory-corruption driven to runtime; no escalation chain)

Evidence (decisive lines)

baseline (with-src #0): bug at sys/platform/pc64/isa/clock.c:1112. combined-70 fix kernel: NK_DONE rc=0 (0 errors, -Werror).

PoC changes

authored/validated fix.diff (findings/poc/DF-1027/fix.diff); part of combined_70 kernel build.

Verified recommended fix

See findings/poc/DF-1027/fix.diff (git-apply-able). Matches finding proposal.

Verdict

REAL: inittodr daysinmonth[m-1] indexed by unvalidated RTC month (>12 -> OOB) -> wrong system clock. confirmed.