DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2943

Dead sysref machinery retained and exported: sysref_init (no callers) can produce objects whose final put objcache_puts non-objcache memory on production builds; allocsysid, SRC_MANAGEDINIT and SRF_SYSIDUSED are entirely unused

Field Value
ID DF-2943
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE CWE-561 (latent CWE-761/arbitrary-free hazard)
File sys/kern/kern_sysref.c
Lines 105-125, 170, 350-353, 362-373
Area kern
Confidence likely
Discovered 2026-09-02
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

Exhaustive rg over sys/ certifies: sysref_init has zero callers (only its prototype); allocsysid has zero callers; no class sets SRC_MANAGEDINIT; SRF_SYSIDUSED is never set by anyone, making the objcache_dtor branch at :350-351 unreachable and sysref_dtor's RB_REMOVE reachable only via objcache reclaim (per-cpu RB trees are insert-only in-tree). sysref_init is the sharp edge: it initializes neither SRF_ALLOCATED nor any objcache backing, yet a future caller that sysref_puts such an object walks to the final-release branch where the only protections are the debug-only KKASSERT at :347 and a production-build objcache_put of a pointer that never came from the cache — an arbitrary-free-shaped footgun behind an unused export. None today (dead code); latent hazard for future/KLD callers. Fix: retire the dead surface or convert the KKASSERTs into always-on guards.

Timeline

  • 2026-09-02 Discovered during pass-2 audit of kern_sysref.c (GLM 5.3).

Discussion (0)

No comments yet.