sysctl kern.stackgap_random accepts unbounded negative values: ALIGN(-gap) up to 2GB silently places every exec's stack contents outside the stack mapping — system-wide exec SIGSEGV from a single root sysctl (validation gap)

Summary

sysctl_kern_stackgap() validates only positive values. Negative values are a documented feature ("static gap if negative") consumed unbounded in exec_copyout_strings(): sgap = ALIGN(-gap), subtracted from destp. A root-set value such as −1073741824 passes validation, yields sgap=1GB, and pushes destp/stack_base ~1GB below USRSTACK — outside the maxssiz=512MB stack mapping. copyout/suword return values are ignored, so execve() reports success while the new image enters userland with an unmapped stack pointer and every program faults at entry. INT_MIN additionally makes −gap signed-overflow UB. Root-only misconfiguration → hardening/validation gap.

Recommended fix

Validate the magnitude of negative values symmetrically (unsigned negation avoiding INT_MIN UB), keeping the static-gap feature — diff above.

Timeline

• 2026-08-30 Discovered during pass-2 audit of kern_exec.c (GLM 5.3).