DF-2360

Unbounded f_reg()/f_rm() indexing crashes DDB: NULL-deref in Grp7 dispatch and wild-pointer deref via REX.R into 8-element tables

Summary

f_reg() and f_rm() macros (:908-909) add 8 when REX_R/REX_B set yielding 0-15 yet used to index lookup tables holding only 8 entries (db_seg_reg db_Grp1..9 db_Esc* db_Grp7_11_*) with no bounds check. Independently of REX Grp7 dispatch indexes db_Grp7_11[] which contains literal NULL pointers (lines 208-209). Disassembling 0f 01 db dereferences NULL+offset faults DDB. Disassembling 44 8c c0 (REX.R + mov sreg) reads db_seg_reg[8] (adjacent int reinterpreted as pointer) and dereferences it also faulting DDB. Requires DDB access (console/serial debugger). Impact: DDB itself takes page fault debugger hangs or machine reboots. Debugger correctness/reliability defect can turn recoverable debug session into forced reboot. [VERIFIED pass2: reproduced on REAL db_disasm - 0f 01 db faults at 0x18 NULL table entry, REX prefix reads past db_Grp7_11 6-entry and db_seg_reg 8-entry tables with corrupt output; bounds plus REX-mask fix-validated]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — bus / platform / cpu
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-129 Improper Validation of Array Index
File: sys/cpu/x86_64/misc/db_disasm.c
Lines: 908-1275
Area: hw
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: certain
Tested: 2026-10-21 22:01:10
Attempts: 3
Runtime: 420s
Code hash: 7163604684cc2ac9
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC
Build cmd: kernel-compiled rig (DFBATCH)
Run cmd: sysctl debug.dfbatch.cmd="dism <grp7null|rexgrp7|rexseg|control>"

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-21 22:01:10
Runtime: —
Kernel: per-fix-DF-2360
fix.diff: findings/poc/DF-2360/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2360 · 8 files

File	Type	Size
env.txt	—	412 B	view raw
fix.diff	—	821 B	view raw
panic.txt	—	1.1 KB	view raw
rig	—	4.0 KB	↓ download
run_fixed_kernel.log	—	2.8 KB	view raw
run_kernel_baseline.log	—	172 B	view raw
verdict.json	—	2.1 KB	view raw
fix.diff	—	821 B	view raw

Fix verification

not_testable

↓ fix.diffper-fix-DF-2360

Confirmed kernel references

Detail

Evidence (decisive lines)

panic.txt (fault 0x18 at db_disasm+0x1049; strlen fault; silent mov %al,%ax), run_fixed_kernel.log (??? + no faults + correct %es), rig/dfbatch_dism.c, fix.diff

PoC changes

db_disasm takes a third regs argument on this tree (ddb.h); NULL works for these paths

Verified recommended fix

bounds/NULL-check the Grp7_11 dispatch and mask REX out of the segment table index

Verdict

The REAL in-kernel db_disasm on crafted bytes: 0f 01 db dispatches through db_Grp7_11[f_reg()] where db_Grp7_11 has literal NULLs at [3]/[4] - the NULL[3] load faults at address 0x18 (db_disasm+0x1049); 44 0f 01 c0 (REX.R) reads db_Grp7_11[8] past the 6-entry table and db_printf strlen()s the garbage pointer (fault in strlen); 44 8c c0 (REX.R + mov sreg) reads db_seg_reg[8] past the 8-entry table at :1381 - on this kernel layout it returned a mapped pointer and printed corrupt output (mov %al,%ax) instead of faulting, the silent-corruption face of the same bug. With the bounds/NULL guard and the &7 sreg mask all three disassemble or reject without faulting and the control is unchanged. DDB is reached by the console holder or after any panic, so this is a debugger-reliability defect that converts recoverable debug sessions into reboots.