l64_makevirginlabel unsigned underflow on tiny slices: d_abase = d_total_size - ressize (and derived d_pstop) wrap to ~2^64 when the slice is smaller than the reserved area
| Field | Value |
|---|---|
| ID | DF-2912 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-191 Integer Underflow |
| File | sys/kern/subr_disklabel64.c |
| Lines | 474-491 (esp. :482), 465-467 |
| Area | kern/disk |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In l64_makevirginlabel, ressize is at least 4096. For a slice smaller than that (craftable via a 1-sector MBR slice, cf. DF-2904 family), lp->d_abase = lp->d_total_size - ressize underflows to ~2^64 and d_pstop becomes similarly huge; d_pbase also exceeds d_total_size. DIOCGDVIRGIN64 then returns this bogus label, and because l64_setdisklabel accepts the misaligned-only-checked d_abase while rejecting every partition, disklabel64(8) cannot label such tiny slices — functional self-DoS with no kernel memory impact (no in-kernel consumer of d_abase; only userland/boot code reads it). Fix: clamp or refuse when d_total_size < ressize.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_disklabel64.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2912 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 709 B | ↓ raw | |
| VERDICT.md | — | 941 B | ↓ raw | |
| build.sh | — | 67 B | view raw | |
| dl64_tiny.c | — | 2.1 KB | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 1.1 KB | view raw | |
| manifest.json | — | 567 B | view raw | |
| run.log | — | 282 B | view raw | |
| run.sh | — | 99 B | view raw | |
| verdict.json | — | 2.2 KB | view raw |
DF-2912 — disklabel64 tiny-slice d_abase underflow (Info-tier hardening verification)
What
disklabel64 tiny-slice d_abase underflow
Build
cc -Wall -O2 -o dl64_tiny dl64_tiny.c
Run
./dl64_tiny (as root; vnconfig inside)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh dl64_tiny.c env.txt fix.diff manifest.json run.log run.sh verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2912 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Mechanically reproduced as root on the stock guest: a vn disk carrying a 1-sector MBR slice yields d_total_size=512 < ressize=4096, and DIOCGDVIRGIN64 on /dev/vn0s1 returned d_abase = 0xfffffffffffff200 (= 512-4096 two's complement, exactly the predicted unsigned underflow at subr_disklabel64.c:482) and d_pstop = 0xffffffffffffe000 (derived wrap at :491) - a bogus virgin label that makes disklabel64(8) unable to label tiny slices (every partition rejected); no kernel memory impact (no in-kernel consumer of d_abase). On the fix kernel the same ioctl returns d_abase = 0x9000 (clamped, no wrap) and d_pstop clamped to d_pbase. Fix iterated twice: v1 clamped only d_abase (A/B still showed wrapped d_pstop), v2 clamps both.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
fixedA/B: baseline underflowed d_abase/d_pstop; fix kernel returns clamped sane values.
Confirmed kernel references
Detail
Evidence (decisive lines)
run.log baseline: d_abase=0xfffffffffffff200; fix kernel: d_abase=0x9000, d_pstop clamped (0xffffffff... gone)
PoC changes
vn slice created via a hand-built MBR image (1 sector at LBA 16, type 0xA5); DIOCGDVIRGIN64 on the slice device
Verified recommended fix
Clamp d_abase (and derived d_pstop) when d_total_size < ressize
Verdict
Mechanically reproduced as root on the stock guest: a vn disk carrying a 1-sector MBR slice yields d_total_size=512 < ressize=4096, and DIOCGDVIRGIN64 on /dev/vn0s1 returned d_abase = 0xfffffffffffff200 (= 512-4096 twos complement, exactly the predicted unsigned underflow at subr_disklabel64.c:482) and d_pstop = 0xffffffffffffe000 (derived wrap at :491) - a bogus virgin label that makes disklabel64(8) unable to label tiny slices (every partition rejected); no kernel memory impact (no in-kernel consumer of d_abase). On the fix kernel the same ioctl returns d_abase = 0x9000 (clamped, no wrap) and d_pstop clamped to d_pbase. Fix iterated twice: v1 clamped only d_abase (A/B still showed wrapped d_pstop), v2 clamps both.
No comments yet.