Latent boot-window OOB: csprng_pcpu aliases the single-element csprng_boot while APs are up, and read_random/add_buffer_randomness_src index it with unclamped gd_cpuid
| Field | Value |
|---|---|
| ID | DF-2822 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-125 (latent; writes follow via spin_lock/IBAA mutation) |
| File | sys/kern/kern_nrandom.c |
| Lines | 495-500 (consumers :659, :697; array at :562) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
rand_initialize() installs csprng_pcpu = &csprng_boot (exactly one
struct) from init_x86_64 while ncpus==1. The per-cpu array only appears
at a later SYSINIT. Between SI_BOOT2_START_APS and that SYSINIT,
ncpus>1 and any execution of read_random()'s state =
&csprng_pcpu[mycpu->gd_cpuid] or add_buffer_randomness_src()'s PCPU
branch on cpu>0 addresses memory past csprng_boot and would
spin_lock/mutate adjacent .bss — silent kernel memory corruption. On
the current tree the window is empty of RNG consumers (verified by
enumerating every call site and its SYSINIT ordering); one new
early-boot RNG consumer away from real corruption.
Recommended fix
Clamp or gate until the array exists (fall back to &csprng_boot when csprng_pcpu == &csprng_boot and gd_cpuid != 0), or allocate the real array before SI_BOOT2_START_APS.
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_nrandom.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2822 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 663 B | ↓ raw | |
| VERDICT.md | — | 1.0 KB | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 785 B | view raw | |
| manifest.json | — | 567 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 897 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2822 — csprng boot-window OOB indexing (Info-tier hardening verification)
What
csprng boot-window OOB indexing
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2822 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation of the latent boot-window (runtime demo impossible without re-ordering SYSINITs - the window is by definition empty of consumers today): rand_initialize() is called directly from init_x86_64 (machdep.c:2777) while ncpus==1, installing csprng_pcpu = &csprng_boot, exactly ONE struct (kern_nrandom.c:496); the real per-cpu array only appears at SYSINIT(rand1, SI_BOOT2_POST_SMP, SI_ORDER_SECOND) (:562). Between SI_BOOT2_START_APS (0x1a60000) and SI_BOOT2_POST_SMP (0x1cc0000) ncpus>1, while read_random (:697) and add_buffer_randomness_src (:659) index csprng_pcpu[gd_cpuid] unclamped - cpu>1 addresses memory past csprng_boot in .bss, spin_locks and mutates adjacent state. One new early-boot RNG consumer away from real silent corruption. Fix (gate to &csprng_boot until the array exists) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableGating compiled and booted; no RNG consumer regression in the A/B suite.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: SYSINIT ordering + unclamped indexing map; fix.diff gating
PoC changes
none (boot window empty of consumers)
Verified recommended fix
Force state=&csprng_boot while csprng_pcpu still aliases the boot state
Verdict
Line-accurate confirmation of the latent boot-window (runtime demo impossible without re-ordering SYSINITs - the window is by definition empty of consumers today): rand_initialize() is called directly from init_x86_64 (machdep.c:2777) while ncpus==1, installing csprng_pcpu = &csprng_boot, exactly ONE struct (kern_nrandom.c:496); the real per-cpu array only appears at SYSINIT(rand1, SI_BOOT2_POST_SMP, SI_ORDER_SECOND) (:562). Between SI_BOOT2_START_APS (0x1a60000) and SI_BOOT2_POST_SMP (0x1cc0000) ncpus>1, while read_random (:697) and add_buffer_randomness_src (:659) index csprng_pcpu[gd_cpuid] unclamped - cpu>1 addresses memory past csprng_boot in .bss, spin_locks and mutates adjacent state. One new early-boot RNG consumer away from real silent corruption. Fix (gate to &csprng_boot until the array exists) compiled in the fix kernel.
No comments yet.