dev_dmmap/dev_dpsize don't preset a_result; dead dev_dclone never initializes a_name/a_namelen/a_cred/a_mode — uninitialized kernel stack passed to drivers by the dispatch shim
| Field | Value |
|---|---|
| ID | DF-2852 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-457 (latent API-contract hazard) |
| File | sys/kern/kern_device.c |
| Lines | 261-283, 448-467, 310-326 (contrast :471-473) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The shim builds each driver args struct on the kernel stack but leaves
result/output fields uninitialized in three wrappers: dev_dmmap never
presets a_result before d_mmap, dev_dpsize never presets a_result, and
dev_dclone fills only a_head (a_name/namelen/cred/mode = stack garbage).
dev_dkqfilter demonstrates the intended contract by explicitly presetting
a_result=0 with a comment. Today every in-tree d_mmap/d_psize sets
a_result on success and dev_dclone has zero callers (devfs_clone invokes
clone handlers directly with fully-initialized structs) — no current
trigger; latent defense-in-depth gap. Fix: zero the whole args struct
(= { 0 }) in every wrapper (or delete the dead dev_dclone).
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_device.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2852 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 693 B | ↓ raw | |
| VERDICT.md | — | 1.1 KB | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 692 B | view raw | |
| manifest.json | — | 551 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 768 B | view raw | |
| verdict.json | — | 2.2 KB | view raw |
DF-2852 — dev dispatch wrappers leave args uninitialized (Info-tier hardening verification)
What
dev dispatch wrappers leave args uninitialized
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2852 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation: the dev dispatch shim builds driver args structs on the kernel stack but leaves output fields uninitialized in three wrappers - dev_dmmap (kern_device.c:261-283) never presets a_result yet returns it on success; dev_dpsize (:448-467) same; dev_dclone (:310-326) fills only a_head so a_name/a_namelen/a_cred/a_mode are stack garbage. dev_dkqfilter (:471-473) documents the intended contract by explicitly presetting a_result=0. dev_dclone has zero callers (rg: prototype only; devfs_clone invokes handlers directly with initialized structs) and every in-tree d_mmap/d_psize sets a_result on success, so no current trigger - a future non-conforming d_mmap would hand an unpriv user an attacker-influenced physical page from leaked stack; a future dev_dclone caller would pass garbage cred pointers into privilege checks. Fix (preset a_result / bzero dclone args) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testablePresets compiled and booted; identical dispatch behavior for conforming drivers.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: wrapper-by-wrapper analysis + dkqfilter contract
PoC changes
none
Verified recommended fix
Preset a_result in dev_dmmap/dev_dpsize; bzero the args in dev_dclone (or delete it)
Verdict
Line-accurate confirmation: the dev dispatch shim builds driver args structs on the kernel stack but leaves output fields uninitialized in three wrappers - dev_dmmap (kern_device.c:261-283) never presets a_result yet returns it on success; dev_dpsize (:448-467) same; dev_dclone (:310-326) fills only a_head so a_name/a_namelen/a_cred/a_mode are stack garbage. dev_dkqfilter (:471-473) documents the intended contract by explicitly presetting a_result=0. dev_dclone has zero callers (rg: prototype only; devfs_clone invokes handlers directly with initialized structs) and every in-tree d_mmap/d_psize sets a_result on success, so no current trigger - a future non-conforming d_mmap would hand an unpriv user an attacker-influenced physical page from leaked stack; a future dev_dclone caller would pass garbage cred pointers into privilege checks. Fix (preset a_result / bzero dclone args) compiled in the fix kernel.
No comments yet.