Summary

kmalloc at line 297 is called without M_ZERO, so ke_area contains stale heap data. The copyin at line 304 ignores its return code; if it fails part-way (attacker supplies a partially-invalid lpInBuffer) the buffer remains partially uninitialized yet is still passed as the input to Kernel_DeviceIoControl and, on success, indirectly to copyout at line 315. With a cooperative ioctl code this leaks stale kernel heap to userspace.

Root cause

hptproc.c:297:

ke_area = kmalloc(piop->nInBufferSize+piop->nOutBufferSize, M_DEVBUF, M_NOWAIT);

DragonFlyBSD's kmalloc does not zero memory unless M_ZERO is supplied (kern_slaballoc.c).

hptproc.c:303-304:

if (piop->nInBufferSize)
    copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize);

Return value of copyin is discarded. hptproc.c:309 then unconditionally calls Kernel_DeviceIoControl(... ke_area, piop->nInBufferSize, ...). hptproc.c:315: on err==0 the function copyouts from ke_area + piop->nInBufferSize.

A crafted lpInBuffer that is valid for the first N bytes then invalid will leave ke_area[N..nInBufferSize-1] holding whatever was last in that slab (other kernel allocations, possibly containing pointers/credentials).

Threat model & preconditions

• Attacker position: local root (sysctl write requires SYSCAP_NOSYSCTL_WR).
• Privileges gained or impact: stale kernel heap info leak. Practical impact depends on finding an ioctl code that (a) succeeds without inspecting every byte of lpInBuffer, or (b) copies input-derived data into lpOutBuffer.
• Required config or capabilities: device hptmv loaded.
• Reachability: sysctl hptmv.status write with a crafted lpInBuffer spanning a valid page then an unmapped page, so copyin faults partway.

Proof of concept

1. mmap a single page at a known address with PROT_READ.
2. Compute HPT_IOCTL_PARAM so that nInBufferSize spans past the mapped page into an unmapped page; copyin will fault partway and return EFAULT (ignored).
3. Choose dwIoControlCode that accepts nInBufferSize > 0 and writes to lpOutBuffer.
4. Read out_buf after the sysctl returns 0; bytes beyond what the handler actually wrote will be stale kernel heap.

Impact

Low-severity info leak of stale kernel heap. Standing alone this is a defense-in-depth hardening issue; combined with DF-1851 it also supplies an additional write gadget.

Recommended fix

Add M_ZERO to the kmalloc and abort on copyin != 0:

ke_area = kmalloc(piop->nInBufferSize+piop->nOutBufferSize, M_DEVBUF,
                  M_ZERO | M_NOWAIT);
...
if (piop->nInBufferSize) {
    if (copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area,
        piop->nInBufferSize) != 0) {
        kfree(ke_area, M_DEVBUF);
        return -EINVAL;
    }
}

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).