kern_ptrace permission checks dereference tracer (and pre-token target) ucred pointers with no crhold and no token — freed-cred read racing cratom_proc (DF-2868 analog in sys_process.c)

Summary

kern_ptrace() gates PT_ATTACH (and every op re-gated via CHECKIO/ p_trespass in procfs_domem/doregs/dofpregs/dodbregs) by reading bare p_ucred pointers with no reference taken. The tracer-side curp->p_ucred is never protected at all, and the target-side pointer is unprotected at the pre-token PRISON_CHECK. A sibling thread of the tracer executing any set*uid path replaces p_ucred under p_spin and immediately crfree()s the old credential, so the racing kern_ptrace thread dereferences freed M_CRED memory inside a privilege decision. Honest ceiling: the churner can only materialize creds carrying its own ruid, so a fully-unauthorized attach of a foreign-uid target is not constructible even when the race is won — the defect is the UAF read itself (garbage compares/panic risk) plus stale-cred TOCTOU. Same class as DF-2868 (ktrcanset) — this is the ptrace-path instance. Fix: crhold both creds around the whole permission switch (and the procfs siblings).

Timeline

• 2026-09-02 Discovered during pass-2 audit of sys_process.c (GLM 5.3).