DF-2216 — dmi_match() leaks the kgetenv() buffer on every code path

Status: REPRODUCED (verbatim-code, kernel-compiled rig) — impact class: unbounded kernel-heap (M_KENV) exhaustion = availability only. Fix: A/B-validated in the same harness kernel (fix.diff, kfreeenv(s) on every arm).

Part of the DF-22X batch (DF-2216 / DF-2220 / DF-2223 / DF-2224) verified in ONE harness kernel; this pack documents the DF-2216 section.

What this pack contains

How to reproduce

On the DragonFly audit guest (root, /usr/src = clean-source snapshot):

# push this directory to the guest as /root/poc/df22x (all batch files)
sh build.sh      # builds harness kernel DFV22X (nativekernel, ~20 min cold)
cp /usr/obj/usr/src/sys/DFV22X/kernel.stripped /boot/kernel/kernel
cp /usr/obj/usr/src/sys/DFV22X/kernel.debug   /boot/kernel/kernel.debug
shutdown -r now
sh run.sh        # sysctl kern.df22x_run=1; extracts the DF22X dmesg section

Provenance (checked at build time, build aborts otherwise)

1. guest tree linux_dmi.c sha256 c0f7f7a5... == audited sys/ tree file.
2. the rig #includes the tree file verbatim — dmi_match in the kernel is the production function, unmodified.
3. dmi_match_fixed = the same bytes + fix.diff, def renamed only (fixed_dmi.c sha256 76433ec6...).
4. assembled rig df_22x_rig.c sha256 c646506a... (recorded in env.txt).

Expected output (baseline = unmodified production code)

DF2216 CONTROL  paired kgetenv+kfreeenv x16384: memuse delta=0 calls delta=16384
DF2216 BASELINE dmi_match x16384 (matchret=1 mismatchret=0): memuse delta=1703936 ... leaked-bytes-per-call=104
DF2216 BASELINE arm smbios.system.maker   single call: memuse delta=104   (x4 arms)
DF2216 FIXED    dmi_match_fixed x16384 (...): memuse delta=0 calls delta=16384
DF2216 VERDICT: baseline leaked 1703936 bytes in 16384 calls (control 0, fixed 0) -> LEAK CONFIRMED, FIX VALID

The meter is the kernels own per-type accounting (malloc_type.ks_use[].memuse, aggregated exactly as kern_slaballoc.c:451 does).

Attacker input / reachability

dmi_match() has exactly one in-tree caller: radeon_atom_pick_dig_encoder() (sys/dev/drm/radeon/atombios_encoders.c:2251), gated by ASIC_IS_DCE32 (radeon HD4000-class). It runs during encoder assignment — display init, DP/HDMI hotplug, mode sets — reachable by a user holding the DRI device node. Each call leaks one kmalloc(strlen(value)+1, M_KENV) buffer (~104 B slab-quantized); there is no bound. No corruption primitive, no info disclosure → no privesc route; ceiling is kernel-heap exhaustion (DoS).

DF-2216 — VERDICT

REPRODUCED — verbatim-code, kernel-compiled rig; leak quantified with the kernel's own malloc accounting; fix A/B-validated in the same kernel. Impact: unbounded kernel-heap (M_KENV) exhaustion — availability only. No privesc route (see below).

Rig class and why

Runtime kldload of drm GPFs on this audit guest, so the established kernel-compile rig class was used (same as the DF-2212 ttm harness kernel): one custom KERNCONF DFV22X (= stock X86_64_GENERIC + device dfverify) compiles dev/dfverify/df_22x_rig.c, which #includes the production sys/dev/drm/linux_dmi.c verbatim (build.sh aborts unless the guest tree file sha256 equals the audited-tree hash c0f7f7a5...). The function under test in the kernel is byte-for-byte the production dmi_match().

Line-accurate confirmation

sys/dev/drm/linux_dmi.c:35-67: each of the four switch arms (DMI_SYS_VENDOR :44, DMI_BOARD_VENDOR :49, DMI_PRODUCT_NAME :54, DMI_BOARD_NAME :59) does s = kgetenv(...) and return true or falls through — no kfreeenv() anywhere. kgetenv() (kern_environment.c:229) kmalloc(len, M_KENV, M_WAITOK)s a fresh copy of the value (:242) whenever the dynamic kernel environment is active (production default; active on the guest — kenv smbios.system.maker = QEMU). Every in-tree consumer pairs the two (kgetenv_string() kern_environment.c:369 does kfreeenv(tmp)); dmi_match() is the sole defector. Sibling DMI helper dmi_found() (drm_drv.c:1329-1336) frees all four fields — the idiom this function forgot.

Mechanical reproduction (decisive run, run.log)

The rig fabricates the kenv boundary (100-char values for all four smbios.* keys via ksetenv), then measures Σ malloc_type.ks_use[cpu].memuse for M_KENV — the exact aggregation the kernel itself uses (kern_slaballoc.c:451):

104 = slab-chunk-quantized 101-byte request (strlen(value)+1). The finding is confirmed line-accurately: per-call, per-arm, both return paths, unbounded.

Meter engineering note (recorded for reproducibility)

The first iteration double-counted ks_loosememuse — an up-only fold counter that kfree() never decrements (kern_slaballoc.c:1136-1140). The telltale artifact (init:+131104 = one 131072-byte fold + 32) identified it; the corrected meter sums only ks_use[].memuse and the control/fixed loops went to exactly 0. First-iteration log kept as run.first_meterbug.log.

Fix validation (A/B, same kernel)

fix.diff frees s with kfreeenv() on every path of all four arms (and widens s to char *). The fixed function was extracted from a fix.diff-applied scratch copy of the same tree bytes (sha chain in build.sh/env.txt) and compiled into the same kernel as dmi_match_fixed. Result: identical call counts, identical return values (matchret=1 mismatchret=0 in both), memuse delta 0 → leak eliminated, behavior otherwise unchanged. fix_status: fixed.

Reachability (who can actually trigger this)

Sole in-tree caller: radeon_atom_pick_dig_encoder() (atombios_encoders.c:2251), gated by ASIC_IS_DCE32(rdev) — radeon DCE3.2 (HD4000-class) hardware. Invoked during encoder assignment (display init, DP/HDMI hotplug, mode sets) — reachable by a user holding the DRI device node (/dev/dri/cardN). On such a system each event leaks ~104 B of M_KENV with no bound. On the audit guest: no GPU → no runtime trigger; the defect is proven through the verbatim code path (dynamic kenv real, values fabricated). Quantified ceiling: 104 B × events — kenv-heap exhaustion after ~10^7 events (GBs) — a sustained-abuse DoS, matching Low severity.

Privesc assessment (standing directive)

None. The bug is a pure allocation leak: no overread, no overwrite, no use-after-free, no double-free, nothing copied to userspace. The leaked memory is never re-referenced. There is no primitive from which to build an escalation chain; impact is availability only.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.