_systimer_init_periodic(): SYSTF_100KHZSYNC phase-sync branch is dead code (missing else-if)
| Field | Value |
|---|---|
| ID | DF-2930 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-670 |
| File | sys/kern/kern_systimer.c |
| Lines | 268-273 |
| Area | kern/timer |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The SYSTF_100KHZSYNC computation at :268-269 is unconditionally overwritten by the following if/else — the second condition at :270 lacks 'else', so any flags combination with SYSTF_100KHZSYNC (and not MSSYNC) falls into the else (plain fromhz(freq)). systimer_init_periodic_nq100khz() therefore never delivers the documented 100kHz-ganged periods or the coincident-event ordering guarantees its API comment promises. No in-tree caller of nq100khz exists today — latent: the first future caller relying on the documented ordering semantics gets silently wrong timer phasing. Fix: make the second condition an 'else if'.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_systimer.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2930 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 777 B | ↓ raw | |
| VERDICT.md | — | 857 B | ↓ raw | |
| build.sh | — | 50 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 513 B | view raw | |
| h41.c | — | 14.9 KB | view raw | |
| harness.log | — | 2.0 KB | view raw | |
| manifest.json | — | 510 B | view raw | |
| run.sh | — | 104 B | view raw | |
| verdict.json | — | 1.8 KB | view raw |
DF-2930 — SYSTF_100KHZSYNC dead branch (missing else) (Info-tier hardening verification)
What
SYSTF_100KHZSYNC dead branch (missing else)
Build
cd /root/h41 && make
Run
kldload ./h41.ko; sysctl -w debug.h41.cmd=9
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
A/B one-liner: baseline: periodic==plain 10001 | fix: periodic==ganged 10010
Files
README.md VERDICT.md build.sh env.txt fix.diff h41.c harness.log manifest.json run.sh verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2930 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Mechanically reproduced via the harness on the stock guest: systimer_init_periodic_nq100khz(&st, cb, NULL, 10000) produced st.periodic = 10001 = fromhz(10000), NOT the ganged fromhz(100000)*10 = 10010 the SYSTF_100KHZSYNC flag promises - the 100KHZSYNC assignment at kern_systimer.c:268-269 is unconditionally overwritten because the MSSYNC condition at :270 lacks 'else' (dead branch), so the documented 100kHz-ganged periods and coincident-event ordering of the nq100khz API never materialize. Zero in-tree callers today (latent). On the fix kernel the same call yields periodic = 10010 = the ganged value.
Baseline vs fix kernel
baseline: baseline: periodic==plain 10001 | fix: periodic==ganged 10010 fix: behavior changed as designed (see verdict)
Fix verification
fixedA/B: baseline plain period; fix kernel ganged period (else-if).
Confirmed kernel references
Detail
Evidence (decisive lines)
harness.log T9: periodic=10001 (== plain fromhz); fix kernel: periodic=10010 (== ganged)
PoC changes
none
Verified recommended fix
Make the MSSYNC branch else if
Verdict
Mechanically reproduced via the harness on the stock guest: systimer_init_periodic_nq100khz(&st, cb, NULL, 10000) produced st.periodic = 10001 = fromhz(10000), NOT the ganged fromhz(100000)*10 = 10010 the SYSTF_100KHZSYNC flag promises - the 100KHZSYNC assignment at kern_systimer.c:268-269 is unconditionally overwritten because the MSSYNC condition at :270 lacks else (dead branch), so the documented 100kHz-ganged periods and coincident-event ordering of the nq100khz API never materialize. Zero in-tree callers today (latent). On the fix kernel the same call yields periodic = 10010 = the ganged value.
No comments yet.