mtx_notlocked_ex() returns the exact opposite of its documented contract (inverted exclusive-lock test in shipped header)
| Field | Value |
|---|---|
| ID | DF-2787 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-628 Functionally Incorrect Contract Implementation |
| File | sys/kern/kern_mutex.c |
| Lines | mutex2.h:436-442 (header consumer of this file's locking) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The comment says "Return TRUE (non-zero) if the mutex is not locked
exclusively" but the implementation returns ((mtx->mtx_lock &
MTX_EXCLUSIVE) != 0) — TRUE when the mutex IS exclusively locked.
Zero in-tree callers (only the correct sibling mtx_notlocked() is
used), so a latent API trap, not a live defect.
Recommended fix
Invert the test to == 0 (matches the contract and the mtx_notlocked()
naming convention).
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_mutex.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2787 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 744 B | ↓ raw | |
| VERDICT.md | — | 775 B | ↓ raw | |
| build.sh | — | 50 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 297 B | view raw | |
| h41.c | — | 14.9 KB | view raw | |
| harness.log | — | 2.0 KB | view raw | |
| manifest.json | — | 495 B | view raw | |
| run.sh | — | 105 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-2787 — mtx_notlocked_ex inverted contract (Info-tier hardening verification)
What
mtx_notlocked_ex inverted contract
Build
cd /root/h41 && make
Run
kldload ./h41.ko; sysctl -w debug.h41.cmd=13
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
A/B one-liner: baseline: 1 then 0 (inverted) | fix: 0 then 1
Files
README.md VERDICT.md build.sh env.txt fix.diff h41.c harness.log manifest.json run.sh verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2787 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Confirmed both by reading and mechanically: mtx_notlocked_ex (sys/sys/mutex2.h:436-442) documents 'Return TRUE (non-zero) if the mutex is not locked exclusively' but returns (mtx_lock & MTX_EXCLUSIVE) != 0 - TRUE when it IS exclusively locked. Harness T13 on the stock guest: while exclusively locked the function returned 1 (doc says 0); after unlock it returned 0 (doc says 1) - the exact inversion. Zero in-tree callers (rg: only the definition), so latent API trap only. On the fix kernel T13 returns 0 then 1 per the documented contract.
Baseline vs fix kernel
baseline: baseline: 1 then 0 (inverted) | fix: 0 then 1 fix: behavior changed as designed (see verdict)
Fix verification
fixedA/B: baseline T13 while-ex-locked=1/after-unlock=0 (inverted); fix kernel 0/1 (doc-correct).
Confirmed kernel references
Detail
Evidence (decisive lines)
harness.log T13 lines; fix.diff (== 0 inversion)
PoC changes
none
Verified recommended fix
Return ((mtx->mtx_lock & MTX_EXCLUSIVE) == 0)
Verdict
Confirmed both by reading and mechanically: mtx_notlocked_ex (sys/sys/mutex2.h:436-442) documents Return TRUE (non-zero) if the mutex is not locked exclusively but returns (mtx_lock & MTX_EXCLUSIVE) != 0 - TRUE when it IS exclusively locked. Harness T13 on the stock guest: while exclusively locked the function returned 1 (doc says 0); after unlock it returned 0 (doc says 1) - the exact inversion. Zero in-tree callers (rg: only the definition), so latent API trap only. On the fix kernel T13 returns 0 then 1 per the documented contract.
No comments yet.