DF-2882 VERDICT — REPRODUCED (impact: leak)

Root cause (path:line)

sys/kern/subr_scanf.c:289-306, CT_CHAR suppress branch:

if (flags & SUPPRESS) {
    size_t sum = 0;
    for (;;) {
        if ((n = inr) < width) {      /* :292  short input */
            sum += n;
            width -= n;
            inp += n;                 /* :295  inp -> NUL terminator */
                                       /*       inr NOT zeroed! */
            if (sum == 0)
                goto input_failure;
            break;
        } ...

inp advances by n = inr (to the terminator) while inr keeps its old value. Every consumer of the invariant "inr > 0 ⇒ *inp is a valid unread char" then operates on phantom input:

• guard at :258 (if (inr <= 0) goto input_failure) passes;
• %s loop at :375-382 accepts the NUL (!isspace('\0')), copies it, advances inp past the terminator and keeps copying until whitespace or inr/width exhausts — up to inr-1 bytes past the string end;
• %c at :308 bcopys width bytes starting at the terminator;
• negated %[^...] at :324 matches the NUL (tab[0]=1) and walks.

The alternative branch (inr -= width; inp += width) is balanced; CCL/STRING/INT loops all decrement inr in lockstep with inp++. Only this branch loses the count — and only when width > inr (positive control E6, width == inr, is clean).

How it was proven

1. Verbatim userland replica (guest libc as control): %*16c%s on an 8-char string → engine ret=1, out = 00 'C' 'A' 'N' 'A' 'R' 'Y' '!' 00; libc ret=0.
2. In-kernel, kernel's own ksscanf (stock INVARIANTS kernel #0, KLD harness, run.log): - E1: canary bytes after the NUL copied into caller buffer. - E2: kmalloc(32) exact-size input, groomed neighbor at in+32 (delta199=32): out = 00 51×15 — 'Q' bytes from beyond the allocation, i.e. out of the adjacent live heap object. Cross-object kernel heap disclosure. - E3: the walk crossed slab metadata: out = 00 80 16 94 8d 00 f8 ff ff 51 ... — a live kernel pointer (0xfffff8008d941680) plus heap bytes copied into the caller buffer. Second load leaked 0xfffff8004f102660 (run.2.log) — two distinct pointers, consistent with slab freelist/metadata adjacency. - E6 negative control (%*8c, N == strlen): clean.
3. Fix validation (kernel #1 built in-guest with fix.diff hunk 2): E1/E2/E3 → ret=0, out untouched (sentinel 0xee intact) — the walk is gone; behavior now equals libc.

Impact ceiling

• Kernel memory disclosure: bytes past the end of the input string (same allocation = semantic break; end of allocation = adjacent kernel heap objects, slab metadata, kernel pointers) copied into the caller's destination buffer — buffers that callers overwhelmingly copy back to userland or embed in further output.
• Potential panic/DoS if the walk crosses into an unmapped page (walk length ≤ phantom inr ≤ strlen).
• Return-value/nassigned corruption (conversion "succeeds" on exhausted input).

Why Medium (not High)

No in-tree caller currently emits %*Nc with N>1 (21 call sites surveyed: radeon_vce.c:107,122; ttm_page_alloc.c:167; ttm_memory.c:122; amdgpu_gfx.c:126; vinumio.c:711 [uses %d/%[a-z]/%[s] — different, balanced paths]; if_ath.c:576 [%c width 1 — balanced]; if_mxge.c:625; smc_sysctl.c:589; channel.c:1078; feeder_eq.c:512; if_ethersubr.c:1690; pci.c:3657,3661; autoconf.c:239,263,287; kern_uuid.c:394; vfs_conf.c:431; vkernel64 autoconf.c:316,340,364). The format string is kernel-supplied, so an unprivileged user cannot trigger it through any shipping code path. It is a live defect of the exported KPI that any KLD or future caller invokes at its peril — filed Medium in the kernleak bucket so the one-line fix lands.

Exploit chain

None in-tree (no %*Nc caller). For a hypothetical caller with user-controlled input: %*Nc + %s on an exact-size heap string → adjacent-object kernel heap bytes (incl. pointers) copied into the caller buffer → returned to user. No write primitive: all writes stay inside caller-supplied destination buffers.

verdict.json summary

status=reproduced, reproduced=1, impact=leak, confidence=certain, fix_status=fixed (kernel #1, in-guest nativekernel, baseline reproduced / patched clean).