DF-2856

Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors

Field	Value
ID	DF-2856
Status	new
Severity	Info
CVSS 3.1	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CWE	CWE-908 / CWE-459
File	sys/kern/subr_rman.c
Lines	257-263, 347, 594
Area	kern
Confidence	likely
Discovered	2026-09-02
Pass	2 (GLM 5.3 second pass)
Bucket	base:kern
Reported	pending
Known CVE	none
CVE match	novel

Summary

int_rman_release_resource only clears RF_ALLOCATED, and the whole-chunk takeover path ORs flags and sets r_dev without resetting r_virtual, r_bustag, r_bushandle or r_rid — a re-allocated chunk carries the PREVIOUS owner's mapping pointer and bus handle, readable by the new owner via rman_get_virtual()/rman_get_bushandle() if the driver reads before writing. The stale RF_SHAREABLE bit also persists on free fragments, so a later RF_SHAREABLE request can share a region whose current owner did not request sharing. Kernel-internal caller-contract weakness; hardening. Fix: clear the fields on release/takeover.

Timeline

2026-09-02 Discovered during pass-2 audit of subr_rman.c (GLM 5.3).

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: likely
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CWE: CWE-908
File: sys/kern/subr_rman.c
Lines: 257-594
Area: kern
Discovered: 2026-09-02
Updated: 2026-09-02

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: leak
Confidence: certain
Tested: 2026-10-26 02:18:30
Attempts: 2
Runtime: 45s
Code hash: 85d6e241caa2a7fb
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cd /root/h41 && make
Run cmd: kldload ./h41.ko; sysctl -w debug.h41.cmd=6

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-10-26 02:18:30
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)
fix.diff: findings/poc/DF-2856/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2856 · 10 files

File	Type	Size
README.md	—	764 B	↓ raw
VERDICT.md	—	959 B	↓ raw
build.sh	—	50 B	view raw
env.txt	—	509 B	view raw
fix.diff	—	598 B	view raw
h41.c	—	14.9 KB	view raw
harness.log	—	2.0 KB	view raw
manifest.json	—	532 B	view raw
run.sh	—	104 B	view raw
verdict.json	—	2.3 KB	view raw

README.md

↓ download raw

DF-2856 — rman whole-chunk reuse leaks previous owner data (Info-tier hardening verification)

What

rman whole-chunk reuse leaks previous owner data

Build

cd /root/h41 && make

Run

kldload ./h41.ko; sysctl -w debug.h41.cmd=6

Expected

baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone

A/B one-liner: baseline: stale 0xdeadbeef | fix: NULL

Files

README.md VERDICT.md build.sh env.txt fix.diff h41.c harness.log manifest.json run.sh verdict.json

Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven). Full batch context: the fix kernel contains all 41 hardening fixes of this batch compiled together (build RC=0) and passed the complete A/B suite plus a clean reboot.

VERDICT.md

↓ download raw

DF-2856 — VERDICT

status: reproduced | reproduced: 1 | impact: leak | confidence: certain

Mechanically reproduced via the harness on the stock guest with a private rman: reserve a whole chunk (0..63) for owner A, rman_set_virtual(r1, 0xdeadbeef), release; reserve the SAME whole chunk for owner B - rman_get_virtual(res2) returns 0xdeadbeef: the takeover path (subr_rman.c:257-263) ORs flags and sets r_dev without resetting r_virtual/r_bustag/r_bushandle/r_rid, so the new owner reads the PREVIOUS owner's mapping pointer/bus handle through the public accessors (cross-driver data hygiene leak of kernel pointers). int_rman_release also only clears RF_ALLOCATED (:592 region) so a stale RF_SHAREABLE persists on free fragments. On the fix kernel the takeover clears all four fields and rman_get_virtual(res2) returns NULL.

Baseline vs fix kernel

baseline: baseline: stale 0xdeadbeef | fix: NULL fix: behavior changed as designed (see verdict)

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

A/B: baseline 0xdeadbeef stale pointer; fix kernel NULL (fields cleared at takeover; RF_SHAREABLE cleared at release).

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)

Confirmed kernel references

Detail

Exploit chain

whole-chunk reuse -> previous owner r_virtual/r_bushandle readable by new driver (kernel pointer disclosure)

Evidence (decisive lines)

harness.log T6: res2 virtual=0xdeadbeef; fix kernel T6: NULL

PoC changes

rman_reserve_resource(rm, start, end, count, flags, dev) argument order; rman_manage_region required after rman_init

Verified recommended fix

Clear r_virtual/r_bustag/r_bushandle/r_rid at whole-chunk takeover and drop RF_SHAREABLE at release

Verdict

Mechanically reproduced via the harness on the stock guest with a private rman: reserve a whole chunk (0..63) for owner A, rman_set_virtual(r1, 0xdeadbeef), release; reserve the SAME whole chunk for owner B - rman_get_virtual(res2) returns 0xdeadbeef: the takeover path (subr_rman.c:257-263) ORs flags and sets r_dev without resetting r_virtual/r_bustag/r_bushandle/r_rid, so the new owner reads the PREVIOUS owners mapping pointer/bus handle through the public accessors (cross-driver data hygiene leak of kernel pointers). int_rman_release also only clears RF_ALLOCATED (:592 region) so a stale RF_SHAREABLE persists on free fragments. On the fix kernel the takeover clears all four fields and rman_get_virtual(res2) returns NULL.