DF-2862 VERDICT

Status: reproduced (KLD replica with the kernel's own ksscanf/kmalloc on the live stock kernel #0, plus the real boot path via loader.conf; fix validated on a rebuilt kernel #1). Impact: leak (kernel heap bytes adjacent to an M_MOUNT 96-byte allocation read out-of-bounds and copied into devname; at boot those bytes are printed to the console/serial log). Severity Low — the input channel is the loader environment or the boot console, so this is host-config / physical-console gated, not remotely or runtime reachable.

Root cause (path:line)

1. sys/kern/vfs_conf.c:421 — mf = kmalloc(MFSNAMELEN+MNAMELEN, ...) = 96 bytes (MFSNAMELEN 16, MNAMELEN 80, sys/sys/mount.h:92-93).
2. sys/kern/vfs_conf.c:427 — strncpy(mf, cp, MFSNAMELEN+MNAMELEN) with n == sizeof(mf): a candidate remainder >= 96 bytes fills the buffer completely and leaves it without a NUL terminator (the preceding bzero at :426 is fully overwritten).
3. sys/kern/vfs_conf.c:431 — ksscanf(mf, patt, ...) → sys/kern/subr_scanf.c:123 inr = strlen(inp) — strlen runs past the end of the 96-byte heap allocation.
4. sys/kern/subr_scanf.c:265-272 (leading-whitespace skip for %80s) and :373-383 (copy loop) continue consulting/copying bytes past the allocation; copied bytes land in devname[80].
5. Disclosure sink: sys/kern/vfs_conf.c:645 kprintf("no disk named '%s'\n", name) via setrootbyname (vfs_conf.c:447 → 658-672 → 630-651).

DF-0099 (known) covers the write off-by-one of %16[...]/%80s against vfsname[16]/devname[80]; this finding is the read overrun of mf — different line, different primitive.

How it was proven

• Replica (run.log, run.2.log): KLD embedding a verbatim copy of vfs_conf.c:419-431, run at runtime against the kernel's own ksscanf/kmalloc/M_MOUNT. Seeding the class-96 M_MOUNT chunk pool with 'Q' (chunks of exactly 96 bytes, packed back-to-back — kern_slaballoc.c zoneindex() rounds <128 to 8-byte granularity) makes the byte at mf[96] deterministic. Result: first96_nonzero=1 devname[0]=51 devname='QQQQ…' — bytes from beyond the 96-byte allocation copied into devname. Reproduced on 2/2 module loads (after the correct chunk class was seeded; the first groom attempt seeded class-128 and produced the silent variant, which is itself the same OOB read terminating on an adjacent NUL).
• Real boot path (bootpath-baseline.log): loader.conf vfs.root.mountfrom="ufs:da0s1a;ufs:<92 spaces>E;hammer2:vbd0s1d", stock kernel #0. Candidate 2's parse consumed all 96 non-NUL in-bounds bytes and stopped exactly at mf[96] (read out of bounds; silent because the adjacent byte happened to be NUL — consistent with the replica's unseeded variant). The boot log proves the kenv string of

  = 96 bytes reaches the vulnerable copy at boot.

• Console disclosure sink: exercised at boot by candidate 1 (no disk named 'da0s1a;ufs:' printed) — same kprintf that would print OOB-sourced devname bytes whenever the adjacent heap byte is non-NUL/non-space.

Exploit chain

None (by design): boot-time parse, loader/console-gated. Ceiling is disclosure of adjacent M_MOUNT-zone heap bytes to the boot console / serial log, and parse misbehaviour (device lookups on garbage). No runtime unprivileged reachability: vfs_mountroot_try is static, called only from vfs_mountroot (SYSINIT) and vfs_mountroot_ask; kenv is read-only at runtime (kern_environment.c:503, kern.environment CTLFLAG_RD).

Fix validation

fix.diff: bound the copy at the ;-segment (ep) and force termination — seglen = min(ep - cp, MFSNAMELEN+MNAMELEN - 1); bcopy(cp, mf, seglen) into the pre-bzeroed buffer.

• baseline (kernel #0, stock): contamination + unterminated 96-byte copy (bootpath-baseline.log).
• patched (kernel #1 Wed Sep 2 13:46:57 UTC 2026, same loader.conf): no disk named 'da0s1a' — clean segment; candidate 2 parse bounded at 95 with guaranteed NUL; no out-of-bounds consult; machine boots normally via candidate 3 (bootpath-patched.log).
• Replica A/B (BUGGY vs FIXED parse in the same module) shows devname sourced from OOB bytes vs '' cleanly (run.log B1 vs B2).

The fix also fixes DF-2863 (same hunk). Guest restored with vm.sh reset with-src after validation.