⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1872

Divide-by-zero panic via sysctl kern.dcons.poll_hz=0

Summary

SYSCTL_INT L114 _kern_dcons poll_hz CTLFLAG_RW NULL handler so generic sysctl_handle_int accepts any value including 0 (only SYSCAP_NOSYSCTL_WR enforced kern_sysctl.c:1446). dcons_timeout L353 and dcons_attach L512 both compute polltime=hz/poll_hz BEFORE the intended clamp if(polltime<1)polltime=1. Division evaluated before guard so poll_hz==0 -> integer divide-by-zero #DE on x86 -> kernel panic on next callout tick (within 10ms at default DCONS_POLL_HZ=100). Root trigger sysctlbyname(kern.dcons.poll_hz,&zero,...). Deterministic full-system DoS. No info leak no privilege gain. dcons need only be loaded kldload dcons or compiled in; dcons_crom FireWire attach not required dcons_attach unconditionally arms callout at MOD_LOAD. Fix: guard divisor before dividing if(poll_hz<1)poll_hz=1; or SYSCTL_PROC handler clamp writes to [1,hz].

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1872 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 308 B view raw
VERDICT.md verdict source-confirmation analysis 709 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1872 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: SYSCTL_INT L114 _kern_dcons poll_hz CTLFLAG_RW NULL handler so generic sysctl_handle_int accepts any value including 0 (only SYSCAP_NOSYSCTL_WR enforced kern_sysctl.c:1446). dcons_timeout L353 and dco

Citation: sys/dev/misc/dcons/dcons_os.c:353-512

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: hz/poll_hz div-by-zero when sysctl poll_hz=0 (dcons_os.c:353,512)

Verified recommended fix

Source-confirmed: hz/poll_hz div-by-zero when sysctl poll_hz=0 (dcons_os.c:353,512)

Verdict

Source-confirmed: hz/poll_hz div-by-zero when sysctl poll_hz=0 (dcons_os.c:353,512)