DF-2829 — Uninitialized vm_zone->znalloc heap data disclosed to unprivileged users via sysctl vm.zone

What

zinit() (sys/vm/vm_zone.c:453) allocates struct vm_zone with kmalloc(..., M_ZONE, M_NOWAIT) — no M_ZERO — and zinitna() (sys/vm/vm_zone.c:347-436) initializes every stats field except z->znalloc. That field is only ever incremented (vm_zone.c:773,786). sysctl_vm_zone() reads it (vm_zone.c:848) and prints the sum in the REQUESTS column (vm_zone.c:854-858). vm.zone is a stock, world-readable sysctl (CTLFLAG_RD, no privilege gate) — confirmed readable as nobody.

Result: 8 bytes of stale kernel heap memory (at the fixed offset of znalloc inside a 16640-byte block) cross to unprivileged userspace, as a decimal long, for every zone created through zinit(): SWAPMETA (swap_pager.c:441 — every stock kernel) and the three netbt pools (bt_proto.c:139-149 on device bluetooth kernels). A secondary window: the zone is LIST_INSERT_HEAD'd onto zlist (vm_zone.c:359) before bzero(z->zpcpu,...) (vm_zone.c:362), so a racing reader can also sum uninitialized per-CPU slots during the init window.

Reproduce

Guest (stock X86_64_GENERIC INVARIANTS kernel #0, DragonFly 6.5-DEVELOPMENT):

1. build.sh — build the KLD harness df2829.ko (in-guest, needs /usr/src).
2. run.sh as root: kldload /root/df2829/df2829.ko - the harness grooms the heap: 16 × kmalloc(sizeof(struct vm_zone)) filled with 0x41, freed; then zinit("leakmark_zone", 64, 1, ...).
3. Read as an unprivileged user: sysctl vm.zone | grep leakmark

Expected (vulnerable kernel)

leakmark_zon 000064, 00000000, 000000, 000000, 4702111234474983745

4702111234474983745 = 0x4141414141414141 — exactly the groomed marker, proving the uninitialized heap field reached userspace. On the patched kernel the same run prints REQUESTS 00000000.

Files

• df2829_harness.c — KLD groom + zone source
• build.sh / run.sh
• build.log / run.log — decisive run (root + nobody reads)
• fix_validation.log — patched-kernel rerun (marker gone)
• fix.diff — git-apply-able fix (znalloc init + M_ZERO + bzero reorder)
• manifest.json, verdict.json

DF-2829 VERDICT — REPRODUCED (leak)

Bottom line

zinit() kmallocs struct vm_zone (16640 bytes) without M_ZERO (sys/vm/vm_zone.c:453) and zinitna() never initializes z->znalloc (sys/vm/vm_zone.c:347-436 — every other stats field is set; znalloc is only ever incremented at vm_zone.c:773/786). The world-readable sysctl vm.zone prints that field (vm_zone.c:848,854-858) to any local user (verified: identical output as root and via unprivileged run_user).

How it was reproduced

Stock guest kernel (#0, X86_64_GENERIC, INVARIANTS):

1. KLD harness groomed the heap: 16 allocations of sizeof(struct vm_zone) memset to 0x41, freed (same size class as zinit's kmalloc).
2. zinit("leakmark_zone", 64, 1, ZONE_DESTROYABLE) — zone struct reused a marker block (zone=0xfffff80118628000, kprintf in run.log).
3. Unprivileged sysctl vm.zone printed:

leakmark_zon 000064, 00000000, 000000, 000000, 4702111234474983745

4702111234474983745 == 0x4141414141414141 — the groomed heap marker, verbatim, in the REQUESTS column. USED/FREE/LIMIT are 0, so REQUESTS is pure uninitialized field content. Marker crossed to userspace on the first attempt (attempts=1) and identically for root and nobody.

Reachability on a stock system (no KLD)

swap_zone is created with zinit() on every boot (sys/vm/swap_pager.c:441), and the three netbt pools on device bluetooth kernels (sys/netbt/bt_proto.c:139-149). On the fresh stock guest the SWAPMETA REQUESTS column read 00000001 — i.e. the stale qword happened to be 0 on that boot (early-boot heap largely fresh pages), which is why the harness groom is used for a deterministic demonstration. The disclosure window is structural: whatever occupies that 16 KB heap block before zinit() (boot-time kernel allocations, or — for any future runtime zinit() caller, e.g. a KLD — groomable content) is printed to unprivileged userspace.

Secondary window (same finding/fix): LIST_INSERT_HEAD(&zlist, z) at vm_zone.c:359 happens before bzero(z->zpcpu) at vm_zone.c:362, so a racing sysctl vm.zone reader can sum uninitialized per-CPU zfreecnt/znalloc slots in the init window (same unprivileged reader surface as DF-0951).

Exploit chain

Not a corruption chain — a read primitive: unprivileged user reads sysctl vm.zone; REQUESTS column of the first row discloses 8 bytes of stale kernel heap per zinit()-created zone (decimal-encoded). Value is bounded by heap residue at zone-creation time; on default kernels zone creation is boot-time only, so the realistic yield is early-boot heap residue (may contain kernel pointers → KASLR-relevant on hardened systems; guest has no KASLR). Impact ceiling: limited kernel heap info leak (CWE-457). No write primitive, no escalation path.

Fix validation

Authored fix.diff (znalloc init in zinitna + M_NOWAIT|M_ZERO in zinit + bzero-before-insert reorder). Applied to the guest's /usr/src copy, make nativekernel KERNCONF=X86_64_GENERIC (vm_zone.o rebuilt 20:55, kernel.stripped relinked), make installkernel, reboot into kernel #1 (DragonFly 6.5-DEVELOPMENT #1: Tue Sep 1 20:57:06 UTC 2026).

Re-ran the exact PoC on the patched kernel (same groom, same module): leakmark_zon: ... REQUESTS 00000000 — the 0x4141414141414141 marker is GONE (fix_validation.log). Baseline reproduced / patched not reproduced ⇒ fix_status=fixed.

Kernel references

• sys/vm/vm_zone.c:453 (kmalloc without M_ZERO)
• sys/vm/vm_zone.c:347-363 (zinitna init block — no znalloc; bzero after insert)
• sys/vm/vm_zone.c:773,786 (only-ever-increment)
• sys/vm/vm_zone.c:848,854-858 (unprivileged read + print)
• sys/vm/swap_pager.c:441, sys/netbt/bt_proto.c:139-149 (stock zinit callers)