Summary

nvme_admin_state_identify_ns loop up to 1024 nsids: 624 req=nvme_get_admin_request(NVME_OP_IDENTIFY); 630 status=nvme_wait_request(req); 631-634 if(status!=0){kprintf(NS FAILED); continue;} NO nvme_put_request(req) on failure path. Success path at 671 does put. Each failure permanently removes one admin request from free list. After maxqe<=256 failures next nvme_get_admin_request->nvme_get_request first_avail==NULL -> KKASSERT(queue->qid!=0) at nvme.c:449 admin queue qid==0 -> panic. Controller with NSMANAGE returns 1024 nsids each failing IDENTIFY NAMESPACE. Fix: nvme_put_request(req) before continue on failure path.

PoC verification

Evidence pack

findings/poc/DF-1813 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.1 KB	↓ raw
fix.diff	suggested-fix	Fix: Add nvme_put_request(req) before continue on failure path.	318 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1813 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/disk/nvme/nvme_admin.c:631-634

Mechanism: nvme_admin_state_identify_ns failure path (status!=0) does continue without nvme_put_request(req), permanently leaking admin requests. After maxqe failures → KKASSERT panic.

Hardware dependency: Requires NVMe controller with failing IDENTIFY NAMESPACE.

Fix: Add nvme_put_request(req) before continue on failure path.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/disk/nvme/nvme_admin.c:631-634 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/disk/nvme/nvme_admin.c:631-634. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: Failure path continues without nvme_put_request → admin request leak → KKASSERT. Add put before continue.

Verified recommended fix

See fix.diff. Failure path continues without nvme_put_request → admin request leak → KKASSERT. Add put before continue.

Verdict

REPRODUCED (source-only). sys/dev/disk/nvme/nvme_admin.c:631-634: Failure path continues without nvme_put_request → admin request leak → KKASSERT. Add put before continue.

nvme_admin: admin request leak on IDENTIFY NAMESPACE failure leads to KKASSERT panic via admin-queue exhaustion