DF-2753 VERDICT — SIDL child published to pid hash before p_pgrp/p_ucred initialization

Status: reproduced (impact=panic, confidence=certain) — verified live on the audit QEMU guest as an unprivileged user, then fix-validated by in-guest kernel rebuild.

1. Root cause (line-accurate)

fork1() allocates the child zeroed (kmalloc(..., M_ZERO), kern_fork.c:444), marks it SIDL (:458), takes p2->p_token exclusively (:474), and then publishes it to the allproc list + pid hash at :491 (proc_add_allproc(p2)). Only afterwards does it:

• :496-497 bcopy(&p1->p_startcopy, ...) — the only place p2->p_pgrp gets set (p_pgrp is inside the startcopy..endcopy region, sys/sys/proc.h:289-309);
• :509 p2->p_ucred = crhold(lp1->lwp_thread->td_ucred) — the only place the child's credential pointer is set.

The exclusive p2->p_token (held :474→:726) protects consumers that take the token before dereferencing — and indeed kern_kill(pid)'s direct path (kern_sig.c:800-804) is safe. But the lookup/scan layer does not filter SIDL: pfind() (kern_proc.c:502-527) and allproc_scan() (kern_proc.c:1401-1447) skip only SZOMB. Consumers that dereference *p_ucred/p_pgrp before taking p_token therefore race the fork:

1. kill(-1, sig) — kern_sig.c:711 allproc_scan(killpg_all_callback) → callback CANSIGNAL(p, sig, 0) (kern_sig.c:721) → p_trespass(cr1, p->p_ucred) (kern_prot.c:1023). With p->p_ucred == NULL: unjailed cr1 passes PRISON_CHECK (cr_prison == NULL short-circuit, proc.h:462-463) and faults at caps_get(cr2=NULL, SYSCAP_RESTRICTEDROOT) (kern_prot.c:1038) — NULL + 0xa0 read. Jailed cr1 faults inside PRISON_CHECK itself.
2. sched_getscheduler/sched_getparam/sched_setparam/ sched_rr_get_interval(pid) — kern_p1003_1b.c:151 evaluates CAN_AFFECT(p, cr, other_proc) before lwkt_gettoken(&other_proc->p_token); the macro (kern_p1003_1b.c:73-78) unconditionally derefs (q)->p_ucred->cr_ruid.
3. getsid(pid) — kern_prot.c:153 derefs pt->p_session->s_sid with no token at all; p_session is p_pgrp->pg_session (proc.h:344), NULL until the :496 bcopy.
4. (jailed only) ptrace(PT_ATTACH, pid) — sys_process.c:153 pre-token PRISON_CHECK(curp->p_ucred, p->p_ucred).
5. (jailed only) sysctl kern.proc.pid.<pid> — kern_proc.c:1687-1691: the only kern.proc branch that neither skips SIDL (the main loop does, kern_proc.c:1725-1728) nor NULL-checks the pcredcache() result (the KERN_PROC_ALL loop does, kern_proc.c:1717-1718).

Sibling-sink asymmetries prove the authors knew embryonic procs are visible (pcredcache() is NULL-safe; kern_descrip.c:2017/3462 check SIDL) — the protection is simply incomplete.

2. Reproduction

PoC sidl_race.c: one thread forks in a tight loop (children _exit(0) immediately, reaped in-loop), four threads spray kill(-1, SIGWINCH) (default-ignore signal; the fault happens inside the permission check before any delivery). Run as unprivileged maxx on the guest (DragonFly 6.5-DEVELOPMENT #0, 6 cpus, stock INVARIANTS kernel).

Result (< 90 s wall clock; ssh died mid-run, guest at db>):

Fatal user address access from kernel mode from sidl_race at ffffffff806504ff
Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address   = 0xa0
fault code      = supervisor read data, page not present
Stopped at      p_trespass+0x3f:        movl    0xa0(%r12),%eax

p_trespass+0x3f = the caps_get(cr2, ...) inline at kern_prot.c:1038; VA 0xa0 = NULL + caps-field offset in struct ucred. Exactly the predicted sink, from the predicted caller (kill(-1) scan), with the predicted NULL-field origin (kern_fork.c:491→:509 window). See panic.txt, run.log, panic_full.log.

3. Primitive characterization (why panic, not uid0)

This is a fixed-VA NULL read, not a controlled-pointer corruption: the faulting pointer is the zeroed p2->p_ucred of a fresh M_ZERO allocation — the attacker controls when it is NULL, not what it contains, and the deref address (NULL+0xa0) is constant. DragonFly's trap handler additionally treats kernel-mode access to user VA 0 ("Fatal user address access from kernel mode") as fatal regardless of any mapping, so mapping page 0 from userland cannot convert this into a data read. There is no write primitive, no UAF window (p2 is never freed mid-fork — it cannot exit before start_forked_proc), and no length/type confusion. Ceiling = reliable local unprivileged kernel panic (DoS). This is a read-only bug: the reproduced+panic result is the complete characterization for the class, not an incomplete exploit run.

4. Fix validation

fix.diff (authored after the reproduction): 1. kern_fork.c: move the bcopy startcopy block (sets p_pgrp), the startprofclock inheritance, p2->p_ucred = crhold(...), the jailed()/P_JAILED check, and the p_args refcount before proc_add_allproc(p2) publishes the child. All moved code depends only on p1 (p1 token held since :324) and writes only to the still-private p2 — the reorder is race-free by construction. 2. kern_proc.c (defense-in-depth): pfind() and allproc_scan()/ alllwp_scan() skip SIDL alongside SZOMB (matching FreeBSD's PRS_NEW skip and the existing SIDL skip in the kern.proc sysctl loop).

In-guest validation: vm.sh reset with-src → git apply fix.diff in /usr/src → make -j6 nativekernel (build log: fix_build.log) → reboot into patched kernel → re-run the exact same PoC for 120 s: forks≈2.0M, kills≈2.9M, no panic, guest healthy (baseline panicked within 90 s with the same load). fix_baseline_reproduced=1, fix_patched_reproduced=0, fix_status=fixed.