_sglist_append_buf() ignores pmap_extract() failure — unmapped user addresses become physical-page-0 DMA segments instead of EFAULT (dead paths; upstream parity)
| Field | Value |
|---|---|
| ID | DF-2861 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-755 Improper Handling of Exceptional Conditions |
| File | sys/kern/subr_sglist.c |
| Lines | 125-130, 153-156 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
For user address ranges (pmap != NULL), paddr comes from pmap_extract(),
which returns 0 for unmapped addresses. The value is never checked: an
invalid user buffer appends a segment with ss_paddr=0, so a DMA
consumer would transfer to/from physical page 0 rather than fail with
EFAULT. Only reachable via sglist_append_user/append_uio/consume_uio —
all with zero in-tree callers; FreeBSD HEAD likewise does not check.
Fix: if (paddr == 0) { pmap_extract_done(handle); return (EFAULT); }
after each extract (callers already roll back on error).
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_sglist.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2861 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 779 B | ↓ raw | |
| VERDICT.md | — | 816 B | ↓ raw | |
| build.sh | — | 50 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 698 B | view raw | |
| h41.c | — | 14.9 KB | view raw | |
| harness.log | — | 2.0 KB | view raw | |
| manifest.json | — | 506 B | view raw | |
| run.sh | — | 104 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2861 — _sglist_append_buf ignores pmap_extract failure (Info-tier hardening verification)
What
_sglist_append_buf ignores pmap_extract failure
Build
cd /root/h41 && make
Run
kldload ./h41.ko; sysctl -w debug.h41.cmd=7
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
A/B one-liner: baseline: ret 0 seg paddr=0 | fix: ret 14 EFAULT nseg 0
Files
README.md VERDICT.md build.sh env.txt fix.diff h41.c harness.log manifest.json run.sh verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2861 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Mechanically confirmed via the harness on the stock guest: sglist_consume_uio over an unmapped user VA appended the segment {ss_paddr=0x0, len=16} and returned success - _sglist_append_buf never checks pmap_extract() failure (subr_sglist.c:125-156): an invalid user buffer becomes a physical-page-0 DMA segment instead of EFAULT; a consumer would transfer to/from physical page 0. Only reachable via append_user/append_uio/consume_uio which have zero in-tree callers (dead paths; FreeBSD HEAD likewise unchecked). On the fix kernel the same call returns EFAULT with nseg=0.
Baseline vs fix kernel
baseline: baseline: ret 0 seg paddr=0 | fix: ret 14 EFAULT nseg 0 fix: behavior changed as designed (see verdict)
Fix verification
fixedA/B: baseline paddr=0 segment appended; fix kernel EFAULT before any append (both extract sites).
Confirmed kernel references
Detail
Exploit chain
unmapped user buffer -> pmap_extract returns 0 -> DMA segment pinned at physical page 0
Evidence (decisive lines)
harness.log T7: seg0.paddr=0x0 len=16 ret=0; fix kernel: ret=14 nseg=0
PoC changes
none
Verified recommended fix
if (paddr == 0) { pmap_extract_done(handle); return (EFAULT); } at both extract sites
Verdict
Mechanically confirmed via the harness on the stock guest: sglist_consume_uio over an unmapped user VA appended the segment {ss_paddr=0x0, len=16} and returned success - _sglist_append_buf never checks pmap_extract() failure (subr_sglist.c:125-156): an invalid user buffer becomes a physical-page-0 DMA segment instead of EFAULT; a consumer would transfer to/from physical page 0. Only reachable via append_user/append_uio/consume_uio which have zero in-tree callers (dead paths; FreeBSD HEAD likewise unchecked). On the fix kernel the same call returns EFAULT with nseg=0.
No comments yet.