Double-free containment in _kfree_obj is INVARIANTS-only: the compiled-in KMALLOC_CHECK_DOUBLE_FREE bitmap and all ring-sanity checks are no-ops in production kernels, so a double free silently duplicates or drops free-ring pointers
| Field | Value |
|---|---|
| ID | DF-2820 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L |
| CWE | CWE-691 (non-enforced safety check) |
| File | sys/kern/kern_kmalloc.c |
| Lines | 959-967 (KKASSERT-gated checks at :632/:646/:942/:966) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
sys/_malloc.h:58 compiles KMALLOC_CHECK_DOUBLE_FREE in by default "for safety", but every enforcement point is a KKASSERT (compiled out without INVARIANTS). In production builds: (a) the common double-free case (destination ring slot empty) is fully SILENT — the duplicate pointer is stored, putting the same kernel address into the free ring twice so two subsequent kmalloc_obj callers receive the same object (cross-subsystem aliasing → UAF-class corruption); (b) when the destination slot is occupied, the code prints and then unconditionally overwrites the slot anyway, silently dropping a live free-object pointer. The guard exists precisely to catch caller bugs — and catches them only on INVARIANTS/debug kernels. Amplifier only (requires a pre-existing kernel double-free; none known in-tree).
Recommended fix
Make detection unconditional and fail-safe: on finding the bit already clear (or the slot occupied), do NOT store into the ring — panic unconditionally or refuse the free + rate-limited kprintf (row diff).
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_kmalloc.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2820 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 695 B | ↓ raw | |
| VERDICT.md | — | 1.2 KB | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 1.1 KB | view raw | |
| manifest.json | — | 515 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 815 B | view raw | |
| verdict.json | — | 2.4 KB | view raw |
DF-2820 — kmalloc double-free containment INVARIANTS-only (Info-tier hardening verification)
What
kmalloc double-free containment INVARIANTS-only
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2820 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Code-certain confirmation (runtime demo deliberately not run: on the INVARIANTS guest the existing KKASSERT would just panic - the designed behavior - while the finding is about production builds): KMALLOC_CHECK_DOUBLE_FREE is defined by default (sys/_malloc.h:58) and bmap_set/bmap_clr maintain the bitmap unconditionally, but EVERY enforcement point in _kfree_obj is a KKASSERT (kern_kmalloc.c:968) which compiles to a no-op without INVARIANTS; the store at :969 is unconditional. Production consequences: common double free (destination slot empty) is fully silent - the same pointer enters the free ring twice and two subsequent kmalloc_obj callers receive the same object (cross-subsystem aliasing); occupied-slot case kprintf's (:964) but still overwrites, dropping a live free-object pointer. Amplifier for caller bugs only; no in-tree trigger. The shipped fix adds an unconditional bmap_test() refusal (rate-limited kprintf, ring left sane) compiled into the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testablefix.diff (bmap_test + unconditional refusal) compiled and booted in the combined fix kernel; no behavior change for legal frees.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: line-accurate map of the enforcement points; fix.diff adds unconditional bmap_test refusal
PoC changes
none (deliberate; INVARIANTS guest would only show the designed panic)
Verified recommended fix
Unconditional bmap_test refusal before storing to the free ring
Verdict
Code-certain confirmation (runtime demo deliberately not run: on the INVARIANTS guest the existing KKASSERT would just panic - the designed behavior - while the finding is about production builds): KMALLOC_CHECK_DOUBLE_FREE is defined by default (sys/_malloc.h:58) and bmap_set/bmap_clr maintain the bitmap unconditionally, but EVERY enforcement point in _kfree_obj is a KKASSERT (kern_kmalloc.c:968) which compiles to a no-op without INVARIANTS; the store at :969 is unconditional. Production consequences: common double free (destination slot empty) is fully silent - the same pointer enters the free ring twice and two subsequent kmalloc_obj callers receive the same object (cross-subsystem aliasing); occupied-slot case kprintfs (:964) but still overwrites, dropping a live free-object pointer. Amplifier for caller bugs only; no in-tree trigger. The shipped fix adds an unconditional bmap_test() refusal (rate-limited kprintf, ring left sane) compiled into the fix kernel.
No comments yet.