journal_status_vfs_journal index filter over-returns: requesting status for index k returns journals 0..k instead of only k
| Field | Value |
|---|---|
| ID | DF-2767 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-841 Improper Behavioral Consistency |
| File | sys/kern/vfs_jops.c |
| Lines | 476-478 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The numeric-index filter is if (info->index < index) continue; — it
skips only journals positioned ABOVE the requested index, so a request
for journal #k returns records 0..k (the intent was clearly
info->index != index → continue). Pure logic bug in a root-only
status path; no memory-safety impact.
Recommended fix
Change the predicate to if (info->index != index) continue;
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_jops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2767 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 681 B | ↓ raw | |
| VERDICT.md | — | 981 B | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 389 B | view raw | |
| manifest.json | — | 481 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 527 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2767 — journal_status index filter over-returns (Info-tier hardening verification)
What
journal_status index filter over-returns
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2767 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation on the stock INVARIANTS guest: sys/kern/vfs_jops.c:477-478 implements the per-index journal-status filter as 'if (info->index < index) continue', which skips only journals positioned ABOVE the requested index, so a mountctl status request for index k returns records for journals 0..k instead of only k (the intent is an exact match; every other branch in the loop compares for equality). Root-only path, each record is buflen-guarded (vfs_jops.c:482-501), so the defect is an over-return/parse ambiguity, not memory corruption. Mechanical runtime demo skipped as disproportionate for the Info tier: it requires configuring a live mount journal via mountctl(8). Fix (exact-match predicate) compiled in the combined fix kernel (build RC=0).
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testablefix.diff changes the predicate to exact match (info->index != index); included in the combined 41-fix kernel build (RC=0, 0 errors) which booted and passed the full A/B suite.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt (line-accurate analysis); fix.diff
PoC changes
no PoC required beyond source confirmation
Verified recommended fix
Exact-match filter: if (info->index != index) continue
Verdict
Line-accurate confirmation on the stock INVARIANTS guest: sys/kern/vfs_jops.c:477-478 implements the per-index journal-status filter as if (info->index < index) continue, which skips only journals positioned ABOVE the requested index, so a mountctl status request for index k returns records for journals 0..k instead of only k (the intent is an exact match; every other branch in the loop compares for equality). Root-only path, each record is buflen-guarded (vfs_jops.c:482-501), so the defect is an over-return/parse ambiguity, not memory corruption. Mechanical runtime demo skipped as disproportionate for the Info tier: it requires configuring a live mount journal via mountctl(8). Fix (exact-match predicate) compiled in the combined fix kernel (build RC=0).
No comments yet.