DF-2864

Per-candidate struct mount + syncer-thread leak and permanent vfc_refcount leak on failed root-mount attempts (mp overwritten next iteration; error path never drops mp->mnt_vfc->vfc_refcount)

Field	Value
ID	DF-2864
Status	new
Severity	Info
CVSS 3.1	CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE	CWE-401 Missing Release of Memory
File	sys/kern/vfs_conf.c
Lines	435-465, 507-511 (contrast :375)
Area	kern
Confidence	certain
Discovered	2026-09-02
Pass	2 (GLM 5.3 second pass)
Bucket	base:kern
Reported	pending
Known CVE	none
CVE match	novel

Summary

In the vfs_mountroot_try candidate loop, when candidate N passes vfs_rootmountalloc but VFS_MOUNT fails, the next iteration's vfs_rootmountalloc overwrites mp without teardown: the previous struct mount leaks with its live syncer kernel thread, shared-locked mnt_lock, and mnt_hold=1 — unreclaimable. Additionally the final error path never drops mp->mnt_vfc->vfc_refcount (unlike the devfs error path at :375), so each failed attempt permanently pins the fstype's vfsconf — vfsconf_remove() refuses module unload forever. Bounded by candidate count; boot-time only. Hardening/correctness. Fix: tear down the failed mp inside the loop + the refcount drop on the error path.

Timeline

2026-09-02 Discovered during pass-2 audit of vfs_conf.c (GLM 5.3).

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-401
File: sys/kern/vfs_conf.c
Lines: 435-511
Area: kern
Discovered: 2026-09-02
Updated: 2026-09-02

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-26 02:18:31
Attempts: 1
Runtime: 20s
Code hash: 79e0ba72a3a28068
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: (source confirmation only)
Run cmd: (source confirmation only)

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: yes
Confidence: certain
Tested: 2026-10-26 02:18:31
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)
fix.diff: findings/poc/DF-2864/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2864 · 9 files

File	Type	Size
README.md	—	701 B	↓ raw
VERDICT.md	—	1.0 KB	↓ raw
build.sh	—	56 B	view raw
env.txt	—	509 B	view raw
fix.diff	—	633 B	view raw
manifest.json	—	540 B	view raw
run.sh	—	87 B	view raw
sourcenote.txt	—	740 B	view raw
verdict.json	—	2.1 KB	view raw

README.md

↓ download raw

DF-2864 — vfs_mountroot_try leaks failed mounts + fstype ref (Info-tier hardening verification)

What

vfs_mountroot_try leaks failed mounts + fstype ref

Build

(source confirmation only)

Run

(source confirmation only)

Expected

baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone

Files

README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json

Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven). Full batch context: the fix kernel contains all 41 hardening fixes of this batch compiled together (build RC=0) and passed the complete A/B suite plus a clean reboot.

VERDICT.md

↓ download raw

DF-2864 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation (boot-time only; a runtime demo would require failing root-mount candidates at boot via loader config - disproportionate for the Info tier): in the vfs_mountroot_try candidate loop (vfs_conf.c:435-462), a failed VFS_MOUNT leaves the vfs_rootmountalloc'd mp alive when the next iteration overwrites mp - each failed candidate leaks a struct mount with a LIVE syncer kernel thread (mount_init -> vn_syncer_thr_create, vfs_mount.c:380-390), shared-locked mnt_lock and mnt_hold=1; the final error path (:505-511) kfrees the last mp but never drops mp->mnt_vfc->vfc_refcount (contrast vfs_conf.c:375) - the fstype stays permanently pinned and vfsconf_remove refuses module unload. Bounded by candidate count; root/loader-driven only. Fix (in-loop teardown + refcount drop) compiled in the fix kernel.

Baseline vs fix kernel

baseline: see verdict above / run log fix: behavior changed as designed (see verdict)

Fix verification

not_testable

baseline no→ patch + rebuild →patched reproduced

Teardown fix compiled and booted (the fix kernel mounted its root through the patched path).

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)

Confirmed kernel references

Detail

Evidence (decisive lines)

sourcenote.txt: loop + error-path teardown analysis vs the devfs reference teardown

PoC changes

none

Verified recommended fix

Tear down the failed mp inside the loop and drop vfc_refcount on the error path

Verdict

Line-accurate confirmation (boot-time only; a runtime demo would require failing root-mount candidates at boot via loader config - disproportionate for the Info tier): in the vfs_mountroot_try candidate loop (vfs_conf.c:435-462), a failed VFS_MOUNT leaves the vfs_rootmountallocd mp alive when the next iteration overwrites mp - each failed candidate leaks a struct mount with a LIVE syncer kernel thread (mount_init -> vn_syncer_thr_create, vfs_mount.c:380-390), shared-locked mnt_lock and mnt_hold=1; the final error path (:505-511) kfrees the last mp but never drops mp->mnt_vfc->vfc_refcount (contrast vfs_conf.c:375) - the fstype stays permanently pinned and vfsconf_remove refuses module unload. Bounded by candidate count; root/loader-driven only. Fix (in-loop teardown + refcount drop) compiled in the fix kernel.