DF-2759 — Unprivileged kernel-log/kernel-pointer disclosure via UCONSOLE TIOCCONS + constty_daemon

What

The stock DragonFly amd64 kernel config sys/config/X86_64_GENERIC (ident the guest actually runs: X86_64_GENERIC) is built with options UCONSOLE (line 36). That option compiles the caps_priv_check_td() gate out of the TIOCCONS handler (sys/kern/tty.c:969-976), so any unprivileged user can install their own pty as the kernel console intercept:

• sys/kern/tty.c:977 — constty = tp; with no privilege check.
• sys/kern/subr_prf.c:396-397 (kputchar) — once constty is set, all TOCONS output is also copied to the msgbuf and the constty daemon is woken.
• sys/kern/subr_prf.c:913-985 (constty_daemon) — streams msgbuf content to constty's tty, forever, with no additional authorization.
• sys/kern/tty_cons.c:465 (cnwrite) — every write(2) to /dev/console is redirected to constty->t_dev (the attacker's pty).

Impact

An unprivileged local user receives a real-time stream of all kernel messages on their own terminal:

• bypasses security.unprivileged_read_msgbuf=0 (that knob only gates the sysctl read path, subr_prf.c:1134-1143);
• turns every %p kernel-pointer print (default security.ptr_restrict=0, subr_prf.c:121) into an unprivileged, live pointer leak — amplifying the filed consumer-side leaks (DF-2736, DF-2614, DF-2637, ...);
• persistent and silent: the operator's console still shows everything, the attacker just gets a duplicate feed.

Reproduce (host, guest already up)

scp -F dfbsd-qemu/config uconsole_grab.c dfbsd-maxx:/tmp/
vm.sh run_root 'mkdir -p /tmp/df2759 && chmod 777 /tmp/df2759 && mv /tmp/uconsole_grab.c /tmp/df2759/ && chown maxx:maxx /tmp/df2759/uconsole_grab.c'
vm.sh run_user 'cd /tmp/df2759 && cc -O -Wall -o uconsole_grab uconsole_grab.c'   # build.sh
sh findings/poc/DF-2759/run.sh                                                    # run.sh

Expected (baseline, stock kernel)

[0.00] uid=1001 ... TIOCCONS: SUCCESS - constty now points at this UNPRIVILEGED pty
[3.02] master received 29 bytes:  DF2759-MARKER1-direct+daemon            <- direct cnwrite redirect
[3.56] master received 35 bytes:  <118>DF2759-MARKER1-direct+daemon       <- constty_daemon msgbuf stream
       dmesg: sysctl kern.msgbuf: Operation not permitted                   <- user locked out of msgbuf
[8.56] master received 79 bytes:  <118>DF2759-MARKER2-after-msgbuf-locked
                                  tap0: MAC address: 00:bd:ab:30:01:00     <- pure kprintf delivered too

The <118>-tagged copies arriving AFTER security.unprivileged_read_msgbuf was set to 0 prove both the msgbuf-stream channel and the knob bypass.

Fix validation

fix.diff removes options UCONSOLE from X86_64_GENERIC and makes the TIOCCONS privilege check unconditional in sys/kern/tty.c. With the patched kernel the same PoC prints:

TIOCCONS FAILED: Operation not permitted (UCONSOLE gate not present in this kernel)

and no kernel content reaches the pty. See VERDICT.md.

Contents

• uconsole_grab.c — PoC (unprivileged pty grab + master-side capture)
• build.sh / run.sh — exact commands
• build.log / run.log — untrimmed logs
• env.txt — guest identity, knobs
• fix.diff — git-apply-able fix (validated in-guest)
• VERDICT.md, manifest.json, verdict.json

DF-2759 — VERDICT

Status: REPRODUCED (impact: leak — unprivileged kernel-log/kernel-pointer disclosure channel)

What was claimed

options UCONSOLE in the default sys/config/X86_64_GENERIC:36 removes the privilege check from TIOCCONS (sys/kern/tty.c:969-976), so any unprivileged user can point the kernel's constty at their own pty. subr_prf.c then treats that pty as the console intercept:

• sys/kern/subr_prf.c:396-405 — kputchar(): with constty set, all console-destined kprintf output is additionally logged to the msgbuf and wakes the constty daemon (TOWAKEUP).
• sys/kern/subr_prf.c:913-985 — constty_daemon(): streams the msgbuf (all subsequent kernel messages) to constty's tty, no authorization.
• sys/kern/tty_cons.c:465 — cnwrite(): user writes to /dev/console are redirected to constty->t_dev.

Bypass relationship: security.unprivileged_read_msgbuf gates only the sysctl read path (sys/kern/subr_prf.c:1134-1143); it does not touch the constty channel. security.ptr_restrict defaults to 0 (sys/kern/subr_prf.c:121), so %p prints (the DF-2736/DF-2614/DF-2637 consumer-side leak population) flow through this channel unmasked.

How it was verified (stock kernel #0, X86_64_GENERIC, guest "dfbsd")

1. Built uconsole_grab.c as user maxx (uid 1001) in-guest (build.log).
2. ioctl(slave, TIOCCONS, 1) as uid 1001 → SUCCESS (run.log line [0.00] TIOCCONS: SUCCESS).
3. Root echo DF2759-MARKER1 > /dev/console: * [3.02] instant copy on the attacker's master (cnwrite redirect), and * [3.56] <118>DF2759-MARKER1... — the constty_daemon msgbuf stream copy (syslog pri tag <> is added by msglogchar, subr_prf.c:1014-1023 — unambiguous marker of the daemon/msgbuf path).
4. Root sysctl -w security.unprivileged_read_msgbuf=0; user dmesg → sysctl kern.msgbuf: Operation not permitted; root echo DF2759-MARKER2 > /dev/console → [8.56] <118>MARKER2 still delivered to the unprivileged pty → the security knob is bypassed.
5. ifconfig tap0 create (root; a pure kprintf, no console write) → tap0: MAC address: 00:bd:ab:30:01:00 delivered to the unprivileged pty → the channel carries arbitrary kernel log content, i.e. every %p print would equally be delivered (ptr_restrict=0 confirmed live in env.txt).

Why it is not higher than Medium

The channel discloses kernel log content (including kernel/heap pointers via existing %p prints) to unprivileged users on the default config, defeating two admin-facing mitigations. It is not itself an arbitrary-read primitive. It is the amplifier that makes the filed %p consumer leaks (rated Low individually) trivially collectible by any local user.

Fix validation (fix.diff — applied to guest /usr/src, kernel rebuilt)

• fix.diff (git-apply-verified on the host repo) removes options UCONSOLE from sys/config/X86_64_GENERIC AND makes the TIOCCONS caps_priv_check_td(SYSCAP_RESTRICTEDROOT) unconditional in sys/kern/tty.c (either hunk alone closes the default-config hole).
• make -j6 nativekernel && make installkernel in-guest (fix_build via /tmp/fixbuild.log), rebooted into DragonFly 6.5-DEVELOPMENT #1: Mon Aug 31 21:24:15 UTC 2026.
• Re-ran the identical PoC as uid 1001 (run_patched.log): [0.00] TIOCCONS FAILED: Operation not permitted — no kernel content reached the pty (marker writes and the tap0 kprintf produced zero bytes on the master).
• Root cross-check on the patched kernel: TIOCCONS: SUCCESS for uid 0 — the gate restores intended semantics, not breakage.

False-positive considerations — killed candidates from this pass

(pass-2 depth; recorded so the negative result has weight) * constty dangling-pointer UAF (constty_daemon unlocked tp = constty): ptys never free pti (sys/kern/tty_pty.c:279 "pti structure remains intact"), nmdm never frees its softc (no kfree in sys/dev/misc/nmdm/), serial softcs persist; a stale constty always lands in live memory and tputchar returns -1 once TS_CONNECTED is cleared (ttyclose, sys/kern/tty.c:251-262). * uprintf/tprintf torn s_ttyvp/s_ttyp read → NULL tputchar: s_ttyp is stored before s_ttyvp (tty.c:1197 → devfs_vnops.c:1606), and both old/new ttys are ttyhold()-referenced (tty.c:1189-1199); s_ttyvp != NULL implies a valid s_ttyp. * %px ptr_restrict escape: zero in-tree users. * kprintf_logging/log_console_output RW sysctls: writes are caps-gated (sys/kern/kern_sysctl.c:1446-1447). * %pb%i divide-by-zero on base char \0 / 1 << (n-1) UB: all 163 in-tree bit-strings are compile-time constants (rg-verified). * width-accumulation int overflow in the digits loop (subr_prf.c:652-657): kernel-constant formats only; PCHAR output is bounded by the sink. * sysctl_kern_msgbuf third-branch length n - rindex_modulo: KNOWN (DF-0035 / DF-2586 family) — not re-reported; msgbuf_clear races and msgaddchar MP races stay within the tolerant chunk-advance protocol (subr_prf.c:1060-1071). * msg_size < 2048 breaking xindex - msg_size + 2048: unreachable (MSGBUF_SIZE = 1 MB, sys/sys/msgbuf.h:65). * kvsnprintf truncation/NUL logic (subr_prf.c:456-467, 493-502): correct.