Summary

/dev/sndstat is mode 0444 (world-readable). sndstat_read computes the remaining bytes as min(uio_resid, sndstat_buflen - uio_offset) but the global min in DFly is u_int min(u_int, u_int) (libkern.h:76), so the signed off_t subtraction is silently truncated to unsigned 32-bit. An attacker-supplied uio_offset that is negative or past sndstat_buflen makes the subtraction negative; after truncation to u_int it becomes a huge positive value. min returns the (small) uio_resid, l > 0 passes, and uiomove copies kernel heap from sbuf_data + uio_offset to userspace.

Root cause

sndstat.c:206:

l = min(buf->uio_resid, sndstat_buflen - buf->uio_offset);

• min is u_int min(u_int, u_int) (libkern.h:76)
• uio_resid is size_t (64-bit), uio_offset is off_t (signed 64-bit)
• sndstat_buflen is int
• The subtraction evaluates as off_t (signed 64-bit); narrowing to u_int takes the low 32 bits and discards the sign

Examples: - uio_offset = sndstat_buflen + 1: subtraction = -1 → 0xFFFFFFFF → min returns uio_resid → reads past sbuf allocation - uio_offset = -4096: subtraction = sndstat_buflen + 4096 → positive → min returns uio_resid → reads 4096 bytes before sbuf allocation

No validation of uio_offset exists: vn_seek only rejects negative offsets for VREG/VDIR, not character devices.

Threat model & preconditions

• Attacker position: any local unprivileged user (/dev/sndstat mode 0444).
• Privileges gained or impact: kernel heap info leak — up to 4096 bytes per read at attacker-chosen offset relative to the sbuf allocation. Useful for KASLR bypass, credential disclosure, or seeding a separate exploit chain.
• Required config or capabilities: /dev/sndstat present (default).
• Reachability: open /dev/sndstat, prime with one read, then lseek to negative or past-EOF offset, then read.

Proof of concept

int fd = open("/dev/sndstat", O_RDONLY);
read(fd, buf, sizeof(buf));     // prime sndstat_prepare
lseek(fd, -4096, SEEK_SET);    // negative offset accepted for char dev
read(fd, buf, 4096);           // reads 4096 bytes of kernel heap BEFORE sbuf

Expected output

4096 bytes returned, non-zero kernel heap data (pointers, creds, crypto state)

Impact

Medium-severity kernel heap info leak from any local user. The leaked bytes are whatever kernel objects happen to be allocated adjacent to the sbuf buffer — potentially including kernel text/data pointers (KASLR bypass), credential structures, network buffers, or crypto state. Repeatable and deterministic.

Recommended fix

Validate uio_offset before the length math, and compute remaining length in signed type.

--- a/sys/dev/sound/pcm/sndstat.c
+++ b/sys/dev/sound/pcm/sndstat.c
@@ -200,11 +200,18 @@
    }

-   l = min(buf->uio_resid, sndstat_buflen - buf->uio_offset);
+   if (buf->uio_offset < 0 || buf->uio_offset >= sndstat_buflen) {
+       lockmgr(&sndstat_lock, LK_RELEASE);
+       return 0;
+   }
+   l = (int)((off_t)sndstat_buflen - buf->uio_offset);
+   if (l > (int)buf->uio_resid)
+       l = (int)buf->uio_resid;
    err = (l > 0)? uiomove(sbuf_data(&sndstat_sbuf) + buf->uio_offset, l, buf) : 0;

References

• min is u_int min(u_int,u_int): libkern.h:76.
• vn_seek only rejects negative offsets for VREG/VDIR: vfs_vnops.c:1341-1343.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).