Fully reversible non-cryptographic MINSTD PRNG is sole source of randomness for security-sensitive kernel values

Summary

krandom() implements Park-Miller MINSTD LCG (random.c:55-66) whose entire internal state IS the output: given one output value v next is deterministically computable state only 31 bits. Seeded once at boot with low-entropy tv_sec^tv_nsec (init_main.c:497 carries XXX comment). Despite being documented for randomizing profiling clock numerous security-sensitive consumers use as sole entropy source making values predictable to any observer who can see one output. MINSTD is x[n+1]=16807*x[n] mod (2^31-1) output==state trivially invertible (16807 has modular inverse mod 2^31-1 = 1407677000). Security-sensitive consumers: if_spppsubr.c:4265-4268 (CHAP authentication challenge = seed^krandom() over 4 consecutive fully-correlated outputs) ffs_alloc.c:642/ffs_vfsops.c:1175/ext2_vfsops.c:1421 (inode generation number i_gen for NFS filehandle unguessability) frag6.c:107 (IPv6 fragment ID ip6_id) nfsm_subs.c:159 (NFS RPC XID) if_spppsubr.c:1251/2527/2709 (PPP LCP magic/loop detection) ip_fw3_nat.c:439 (NAT alias port) ip6_input.c:184/186+in6_ifattach.c:145/189 (IPv6 privacy-address/flow). Remote unauthenticated where consumer network-facing: CHAP active attacker observes one challenge word recovers MINSTD state predicts all future challenges defeating auth-response. IPv6 fragment ID prediction enables fragment-injection/packet-assembly attacks. NFS filehandle prediction i_gen guessable filehandles feasible breaking export security boundary. NAT port prediction aids connection-hijacking.