DF-2720 — load_section file-size check bypassed by 64-bit wrap ((off_t)filsz + offset)

• File: sys/kern/imgact_elf.c:274
• Severity: Low (check bypass; no memory-unsafety demonstrated)
• Confidence: certain (bypass reproduced; impact assessed none)
• Class: CWE-190 integer overflow / hardening

Root cause

if ((off_t)filsz + offset > vp->v_filesize || filsz > memsz)   /* imgact_elf.c:274 */

offset is vm_offset_t (unsigned 64-bit), so the addition is computed modulo 2^64 regardless of the (off_t) cast. With p_offset = 0xFFFFFFFFFFFFF000 and p_filesz = 0x2000 the sum wraps to 0x1000, which is ≤ file size → the "truncated ELF file" check passes and the segment is mapped file-backed with object pindex 0xFFFFFFFFFFFFF000 >> 12 (~2^52 pages past EOF).

Reproduce

python3 make_wrapseg2.py  # t2_wrapfile / t2_wrapanon + controls
# guest: /tmp/t2_wrapfile ; echo $?   -> 139 (SIGSEGV)
#        /tmp/t2_wrapanon ; echo $?   -> 65   (anon tail reads zero)
# controls: t2_readfile -> 66, t2_readanon -> 65, t2_readtext -> 66

Exec succeeds (no "elf_load_section: truncated ELF file" uprintf — contrast with a genuinely-too-large p_filesz, which prints it), the wrapped file-backed range is present in the map (visible in the process core: vaddr=0x600000 filesz=0x2000), and touching it SIGSEGVs (vm_fault on a vnode page far beyond EOF fails instead of zero-filling). The anon tail maps and reads as zero.

Impact

None demonstrated beyond a self-inflicted SIGSEGV: the pager handles the beyond-EOF pindex gracefully on this guest (no INVARIATS panic, no leak, no corruption). The check exists precisely to prevent walking "off the end of the file object" — the wrap defeats it, so this is defense-in-depth.

Fix

Detect the wrap:

-   if ((off_t)filsz + offset > vp->v_filesize || filsz > memsz) {
+   if (offset + filsz < offset || offset + filsz > vp->v_filesize ||
+       filsz > memsz) {

DF-2720 VERDICT

Status: reproduced (check bypass confirmed) — impact: none (no memory unsafety) — confidence: certain.

What was run

t2_* family of crafted ELF64 binaries on the INVARIANTS guest, uid 1001:

• t2_exit77 → rc=77 (harness sanity: entry/exit path correct, DF SYS_exit=1)
• t2_readtext → rc=66 (read own text, nonzero)
• t2_readfile → rc=66 (valid file-backed PT_LOAD part reads real bytes)
• t2_readanon → rc=65 (valid anon bss tail reads zero)
• t2_wrapfile → rc=139 — PT_LOAD with p_offset=0xFFFFFFFFFFFFF000, p_filesz=0x2000: exec succeeded (check bypassed — no "truncated ELF file"), the range [0x600000,0x602000) IS mapped file-backed (seen in the core: type=1 flags=6 vaddr=0x600000 filesz=0x2000), and reading it SIGSEGVs.
• t2_wrapanon → rc=65 — the wrapped segment's anon tail maps and reads zero, proving load_section processed the segment fully.

Impact assessment

No kernel panic (checked serial log), no leak, no corruption. The beyond-EOF vnode pindex faults cleanly through vm_fault → SIGSEGV. The finding stands as a hardening/robustness issue: the truncated-file check is bypassable and the documented invariant ("fail so vm_map doesn't walk off the end of the file object", imgact_elf.c:265-270) is violated.

No exploit chain; no fix-validation build performed (impact none).