hammer2 bulkfree scan uses kmem_alloc_swapbacked() result unchecked — NULL bitmap reaches bzero(NULL, size) panic in cbinfo_bmap_init; path is unprivileged via the ungated HAMMER2IOC_BULKFREE_SCAN/ASYNC ioctls

Summary

kmem_alloc_swapbacked() prints an error, deallocates the object, and returns NULL when vm_map_find fails (vm_kern.c:127-133). Its only in-tree caller, hammer2_bulkfree_scan (hammer2_bulkfree.c:569), assigns cbinfo.bmap with no NULL check; the scan loop calls cbinfo_bmap_init(&cbinfo, size) (:607) whose first action is bzero(cbinfo->bmap, size) (:766) — kernel NULL-page deref panic. The ioctl path is reachable without privilege because HAMMER2IOC_BULKFREE_SCAN/ASYNC dispatch without the caps_priv_check gate (hammer2_ioctl.c:145-148; gate bypass already catalogued as DF-0815 — context, not re-reported), and bfi->size is caller-supplied (floored 1MB, capped 1/4 RAM at :534-553, no size==0 path). Trigger additionally requires kernel_map KVA exhaustion for a ≤1/4-RAM allocation — not honestly constructible on x86_64. Ceiling: panic (local DoS); no write primitive.

Recommended fix

NULL-check cbinfo.bmap after :569 → kfree dedup + return ENOMEM.

Timeline

• 2026-09-02 Discovered during pass-2 audit of vm_kern.c (GLM 5.3); caller-discipline defect, consequence verified by code trace.