vcnt()/vcnt_intr() accumulate u_int per-CPU counters into signed int, wrapping vm.stats.* exports negative after 2^31 aggregate events
| Field | Value |
|---|---|
| ID | DF-2888 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-192 Integer Coercion Error |
| File | sys/vm/vm_meter.c |
| Lines | 245-253, 259-272 |
| Area | vm |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Every vm.stats.sys. and vm.stats.vm. counter is exported by vcnt(),
which declares int count and sums u_int per-CPU fields across all
CPUs; vcnt_intr() likewise. Once the cross-CPU sum exceeds 2^31 (or any
single CPU's counter passes 2^31 — reachable in days on a busy box at
~10k ctx switches/s/CPU), the exported value wraps negative/incorrect.
Correctness/hardening in exported accounting only — the int goes
straight to userland stat consumers (systat, top) with no in-kernel
reader; no security impact. Fix: accumulate u64, export u_int (row
diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of vm_meter.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2888 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 657 B | ↓ raw | |
| VERDICT.md | — | 782 B | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 987 B | view raw | |
| manifest.json | — | 477 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 526 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-2888 — vcnt signed accumulate wraps (Info-tier hardening verification)
What
vcnt signed accumulate wraps
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2888 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation (the wrap needs 2^31 aggregate events - days of sustained load, not demonstrable within a verification session): vcnt (vm_meter.c:245-253) accumulates the u_int per-CPU vmmeter fields into an 'int count' and exports it; vcnt_intr (:259-272) same. Once a per-CPU counter (or the cross-CPU sum) passes 2^31 - reachable in days at ~10k ctx switches/s/CPU - vm.stats.sys. / vm.stats.vm. wrap negative/incorrect for systat/top; no in-kernel reader. Correctness/hardening only. Fix (int64_t accumulate, u_int export) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableWidened accumulators compiled and booted; sysctl vm.stats output identical for small values in A/B.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: signed-accumulate analysis; fix.diff widens the accumulator
PoC changes
none
Verified recommended fix
Accumulate into int64_t and export u_int
Verdict
Line-accurate confirmation (the wrap needs 2^31 aggregate events - days of sustained load, not demonstrable within a verification session): vcnt (vm_meter.c:245-253) accumulates the u_int per-CPU vmmeter fields into an int count and exports it; vcnt_intr (:259-272) same. Once a per-CPU counter (or the cross-CPU sum) passes 2^31 - reachable in days at ~10k ctx switches/s/CPU - vm.stats.sys. / vm.stats.vm. wrap negative/incorrect for systat/top; no in-kernel reader. Correctness/hardening only. Fix (int64_t accumulate, u_int export) compiled in the fix kernel.
No comments yet.