Dead sysref machinery retained and exported: sysref_init (no callers) can produce objects whose final put objcache_puts non-objcache memory on production builds; allocsysid, SRC_MANAGEDINIT and SRF_SYSIDUSED are entirely unused
| Field | Value |
|---|---|
| ID | DF-2943 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-561 (latent CWE-761/arbitrary-free hazard) |
| File | sys/kern/kern_sysref.c |
| Lines | 105-125, 170, 350-353, 362-373 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Exhaustive rg over sys/ certifies: sysref_init has zero callers (only its prototype); allocsysid has zero callers; no class sets SRC_MANAGEDINIT; SRF_SYSIDUSED is never set by anyone, making the objcache_dtor branch at :350-351 unreachable and sysref_dtor's RB_REMOVE reachable only via objcache reclaim (per-cpu RB trees are insert-only in-tree). sysref_init is the sharp edge: it initializes neither SRF_ALLOCATED nor any objcache backing, yet a future caller that sysref_puts such an object walks to the final-release branch where the only protections are the debug-only KKASSERT at :347 and a production-build objcache_put of a pointer that never came from the cache — an arbitrary-free-shaped footgun behind an unused export. None today (dead code); latent hazard for future/KLD callers. Fix: retire the dead surface or convert the KKASSERTs into always-on guards.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_sysref.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2943 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 689 B | ↓ raw | |
| VERDICT.md | — | 929 B | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 2.1 KB | view raw | |
| manifest.json | — | 546 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 604 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2943 — dead sysref surface (sysref_init/allocsysid) (Info-tier hardening verification)
What
dead sysref surface (sysref_init/allocsysid)
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2943 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation re-verified by rg this session: sysref_init (kern_sysref.c:105-125) has ZERO callers (prototype only, sysref2.h:122) and initializes neither SRF_ALLOCATED nor objcache backing - a future caller that sysref_puts such an object walks to final release where the only guards are the INVARIANTS KKASSERT (:347) and a production-build objcache_put of a pointer that never came from the cache (:349-353) - an arbitrary-free-shaped footgun behind an unused export. allocsysid (:362-373) also has zero callers; no class sets SRC_MANAGEDINIT; SRF_SYSIDUSED is never set (objcache_dtor branch :350-351 unreachable). Fix retires sysref_init and allocsysid (+ prototypes); compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableDeletions compiled and booted; no in-tree reference to either symbol.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: dead-symbol map; fix.diff deletions
PoC changes
none
Verified recommended fix
Remove sysref_init/allocsysid and their prototypes (or add always-on guards)
Verdict
Line-accurate confirmation re-verified by rg this session: sysref_init (kern_sysref.c:105-125) has ZERO callers (prototype only, sysref2.h:122) and initializes neither SRF_ALLOCATED nor objcache backing - a future caller that sysref_puts such an object walks to final release where the only guards are the INVARIANTS KKASSERT (:347) and a production-build objcache_put of a pointer that never came from the cache (:349-353) - an arbitrary-free-shaped footgun behind an unused export. allocsysid (:362-373) also has zero callers; no class sets SRC_MANAGEDINIT; SRF_SYSIDUSED is never set (objcache_dtor branch :350-351 unreachable). Fix retires sysref_init and allocsysid (+ prototypes); compiled in the fix kernel.
No comments yet.