DF-2827 — ckpt_thaw_proc: e_phnum == 0 ⇒ kmalloc(0) = ZERO_LENGTH_PTR deref (kernel page fault)

• File: sys/kern/kern_checkpoint.c
• Bug lines: kern_checkpoint.c:232-240 — nbyte = sizeof(Elf_Phdr) * ehdr->e_phnum with e_phnum == 0 ⇒ kmalloc(0, M_TEMP, M_WAITOK) returns ZERO_LENGTH_PTR = (void *)-8 (sys/kern/kern_slaballoc.c:888-891); elf_getphdrs(fp, phdr, 0) reads nothing, then phdr->p_filesz (kern_checkpoint.c:240) loads from (void*)-8 + 0x20 = kernel VA 0x18 ⇒ supervisor page fault ⇒ fatal trap / panic on any kernel config.
• Gate: same as DF-2826 (kern.ckptgroup, wheel by default; no fhandle or further image content needed — the header alone is enough).

Build / Run (guest, root)

sh /root/df2826/build.sh                  # builds gen + triggers + images
cd /root/df2826
./gen df2827.ckpt stage2.bin zero         # e_phnum = 0 variant
./trigger_fd3 df2827.ckpt

Expected

Fatal user address access from kernel mode from trigger_fd3 at ...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x18
fault code = supervisor read data, page not present
Stopped at sys_sys_checkpoint+0x2f0: movq 0x20(%rax),%rax
Debugger("panic")

(0x18 = ZERO_LENGTH_PTR(-8) + offsetof(Elf64_Phdr, p_filesz)(0x20); the instruction is exactly the phdr->p_filesz load feeding elf_getnotes.)

Fix

Rejected in ../DF-2826/fix.diff (e_phnum == 0 → EINVAL before the kmalloc); validated on the patched kernel (no trap, clean EINVAL).

DF-2827 VERDICT — ZERO_LENGTH_PTR dereference on e_phnum == 0

REPRODUCED (certain). ckpt_thaw_proc() validates e_ehsize, e_phentsize and e_ident in elf_gethdr() (kern_checkpoint.c:117-143) but never e_phnum. With e_phnum == 0:

• nbyte = sizeof(Elf_Phdr) * e_phnum = 0 (kern_checkpoint.c:232);
• kmalloc(0, M_TEMP, M_WAITOK) hits the degenerate-size case and returns ZERO_LENGTH_PTR = (void *)-8 (kern_slaballoc.c:882-891 — "Return a special pointer");
• elf_getphdrs() reads 0 bytes (harmless);
• elf_getnotes(lp, fp, phdr->p_filesz) (kern_checkpoint.c:240) evaluates phdr->p_filesz ⇒ load from 0xFFFFFFFFFFFFFFF8 + 0x20 = 0x18.

Observed on the stock guest (fresh with-src boot):

Fatal user address access from kernel mode from trigger_fd3 at ffffffff8061e1f0
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x18
fault code = supervisor read data, page not present
Stopped at sys_sys_checkpoint+0x2f0: movq 0x20(%rax),%rax

The movq 0x20(%rax),%rax with rax = 0xfffffffffffffff8 is precisely the phdr->p_filesz read. This is an unconditional kernel-mode fault on a canonical-low address — panic on any config (no INVARIANTS needed).

Impact: local kernel panic / DoS of the checkpoint path, gated by kern.ckptgroup (default wheel-only; verified EPERM for a non-wheel user). No info leak (the loaded value only feeds the nthreads sanity check in elf_getnotes, kern_checkpoint.c:185-189, which rejects it).

Fix: reject e_phnum == 0 in ckpt_thaw_proc() before the kmalloc — included and validated with DF-2826's fix.diff (patched kernel returns EINVAL, no trap; see ../DF-2826/fix_run.log).