DF-2809 — "Unreadable program headers" check is warning-only → unbounded OOB read via e_phoff/e_phnum + first-page parsing never bounded by bytes actually read

Build

python3 gen_exec_ko.py phdr-wild.ko  phdr-wild    # 64-byte file, e_phoff = 0x300000000000
python3 gen_exec_ko.py phdr-short.ko phdr-short    # 64-byte file, e_phoff=0x40, e_phnum=2 (phdrs live past EOF)

Run

scp -F dfbsd-qemu/config phdr-wild.ko phdr-short.ko dfbsd:/tmp/
dfbsd-qemu/vm.sh run_root 'kldload /tmp/phdr-wild.ko; echo RC=$?'
dfbsd-qemu/vm.sh log 45

Expected (stock kernel, verified 2026-09-01)

kldload: Unreadable program headers        <-- the check FIRES...
Fatal user address access from kernel mode from kldload at ffffffff80627802
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0x2801170e3000
Stopped at      link_elf_load_file+0x242:  movl (%rax),%edx   <-- ...and is ignored

phdr-short: kldload: Unreadable program headers then a decision made from UNINITIALIZED heap ("Object is not dynamically-linked" on the observed run — the phdr entries past the 64 file bytes came from stale M_LINKER heap).

Expected (patched kernel)

kldload: Unreadable program headers, RC=1 (ENOEXEC), guest stays up

Why (root cause, sys/kern/link_elf.c)

449:  firstpage = kmalloc(PAGE_SIZE, M_LINKER, M_WAITOK);     /* NOT M_ZERO */
451:  vn_rdwr(UIO_READ, vp, firstpage, PAGE_SIZE, 0, ..., &resid);
453:  nbytes = PAGE_SIZE - resid;                             /* bytes actually read */
...
489:  if (!((hdr->e_phentsize == sizeof(Elf_Phdr)) &&
490:        (hdr->e_phoff + hdr->e_phnum*sizeof(Elf_Phdr) <= PAGE_SIZE) &&
491:        (hdr->e_phoff + hdr->e_phnum*sizeof(Elf_Phdr) <= nbytes)))
492:      link_elf_error("Unreadable program headers");        /* NO error=, NO goto */
...
500:  phdr = (Elf_Phdr *) (firstpage + hdr->e_phoff);          /* unbounded */
505:      switch (phdr->p_type) {                               /* wild read */

The if-body at 492 contains ONLY the kprintf — the missing error = ENOEXEC; goto out; (present in FreeBSD's link_elf.c) makes both the <= PAGE_SIZE and the <= nbytes conditions decorative: - e_phoff (64-bit, file-controlled) is added to the firstpage pointer and dereferenced with no bound → arbitrary-offset kernel read (the phdr-wild panic). - For short files, everything past nbytes in the kmalloc'd page is uninitialized heap (no M_ZERO) and is parsed as Ehdr/phdr content (phdr-short), so load decisions are driven by stale kernel heap.

DF-2809 VERDICT — reproduced (wild kernel read panic; nbytes never enforced)

Status: reproduced. Stock guest kernel DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC, fresh vm.sh reset with-src before the run.

Evidence

phdr-wild (deterministic panic)

login: kldload: Unreadable program headers
Fatal user address access from kernel mode from kldload at ffffffff80627802
Fatal trap 12: page fault while in kernel mode
cpuid = 4
fault virtual address  = 0x2801170e3000
fault code             = supervisor read data, page not present
Stopped at      link_elf_load_file+0x242:       movl    (%rax),%edx

(run.log, panic.txt). The 64-byte module sets e_phoff = 0x300000000000. The message ordering on the serial console is the smoking gun: the loader printed "Unreadable program headers" (the check condition is TRUE: 0x300000000000 + 1*56 > PAGE_SIZE) and then walked straight into phdr = firstpage + 0x300000000000 and dereferenced it. firstpage (0xfffffe1170e3000) + 0x300000000000 wrapped to the user-range address 0x2801170e3000 → "Fatal user address access from kernel mode".

link_elf_load_file+0x242 is switch (phdr->p_type) at sys/kern/link_elf.c:505.

phdr-short (uninitialized heap parsed as phdrs)

64-byte file with e_phoff=0x40, e_phnum=2: the check fires again (0x40 + 2*56 = 0xb0 > nbytes = 0x40) and loading continues, parsing both phdr entries out of the kmalloc'd-but-never-written tail of firstpage (allocated WITHOUT M_ZERO at sys/kern/link_elf.c:449). Observed outcome: kldload: Object is not dynamically-linked — a decision derived purely from stale heap contents (nondeterministic across heap states; on a groomed heap the stale bytes can equally produce PT_LOAD/PT_DYNAMIC entries feeding the segs[] machinery). nbytes (sys/kern/link_elf.c:453) is computed and used in the dead check only — it never bounds any parsing.

Root cause

sys/kern/link_elf.c:489-492 — the if body is only link_elf_error(...). FreeBSD's link_elf.c has error = ENOEXEC; goto out; in this block; DragonFly is missing them, disabling BOTH protections the condition expresses (in-page bounds and short-file/bytes-read bounds).

Impact

Root-gated (kldload) crafted-module kernel read at an attacker-chosen 64-bit offset → panic (DoS). The uninit-heap parse additionally makes module acceptance depend on stale kernel memory (non-deterministic loads). Low severity per the project's root-supplied-input rubric (cf. DF-0060 Low).

Fix validation

fix.diff adds the missing { error = ENOEXEC; goto out; }. Patched kernel: kldload /tmp/phdr-wild.ko → "kldload: Unreadable program headers", RC=1, guest stays up. phdr-short likewise rejected. See run_fix.log.