brk/sbrk mappings are created RWX (VM_PROT_ALL as both prot and max_protection) — executable heap defeats future W^X policy

Summary

Both sys_sbrk and sys_obreak pass VM_PROT_ALL (RWX) as both the protection and max_protection arguments to vm_map_find, so every page of the malloc/brk heap is mapped read-write-execute. On amd64 the pmap honors VM_PROT_EXECUTE via the NX bit, so heap memory is genuinely executable. This is historical BSD behavior (FreeBSD's obreak does the same) and adds no exposure beyond what an unprivileged process already gets from mmap(PROT_READ|PROT_WRITE|PROT_EXEC); filed as defense-in-depth so the heap is not an implicit W^X escape hatch the day W^X enforcement lands — and so shellcode stashed by a memory-corruption bug can run directly from the heap without a second mprotect step. Fix: VM_PROT_RW (optionally keep max_protection=ALL as a compat escape hatch).

Timeline

• 2026-09-02 Discovered during pass-2 audit of vm_unix.c (GLM 5.3). DF-0961/0962 re-verified still present, not re-reported.