DF-2974

EVENTHANDLER_FAST_DEREGISTER macro is syntactically broken (missing underscore in list symbol) and the entire FAST handler API is dead code

Field	Value
ID	DF-2974
Status	new
Severity	Info
CVSS 3.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE	CWE-1164 / CWE-1078
File	sys/sys/eventhandler.h (found in subr_eventhandler.c pass 2)
Lines	95-96
Area	kern
Confidence	certain
Discovered	2026-09-02
Pass	2 (GLM 5.3 second pass — subr_eventhandler.c row)
Bucket	base:kern
Reported	pending
Known CVE	none
CVE match	novel

Summary

eventhandler.h:95-96 defines EVENTHANDLER_FAST_DEREGISTER(name, tag) as eventhandler_deregister(Xeventhandler_list ## name, tag) — the token concat produces 'Xeventhandler_list' instead of 'Xeventhandler_list_' (compare the correct form at :68/:78/:83/:93), so any use is a compile error. Grep confirms EVENTHANDLER_FAST_* have zero users in-tree: the whole fast-handler path (static lists outside the registry) is dead code that nonetheless encodes the lock-free-dispatch pattern DF-0246 lives in. Fix: delete the FAST API (preferred) or correct the typo; if kept, FAST_INVOKE must take evlist_token to close the DF-0246-class race for fast lists.

Timeline

2026-09-02 Discovered during pass-2 audit of subr_eventhandler.c (GLM 5.3). DF-0246 re-verified still present, not re-reported.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — kernel core (kern)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-1164
File: sys/kern/subr_eventhandler.c
Lines: 95-96
Area: kern
Discovered: 2026-09-04
Updated: 2026-09-04

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-26 02:18:33
Attempts: 3
Runtime: 90s
Code hash: ac57fff6b25ea141
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cd /root/evt && make
Run cmd: make (compile demo)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-10-26 02:18:33
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)
fix.diff: findings/poc/DF-2974/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2974 · 8 files

File	Type	Size
README.md	—	636 B	↓ raw
VERDICT.md	—	1003 B	↓ raw
build.log	—	861 B	view raw
build.sh	—	50 B	view raw
env.txt	—	509 B	view raw
evt_typo.c	—	996 B	view raw
fix.diff	—	418 B	view raw
run.sh	—	80 B	view raw

README.md

↓ download raw

DF-2974 — EVENTHANDLER_FAST_DEREGISTER token-paste typo (Info-tier hardening verification)

What

EVENTHANDLER_FAST_DEREGISTER token-paste typo

Build

cd /root/evt && make

Run

make (compile demo)

Expected

baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone

Files

build.log build.sh env.txt evt_typo.c fix.diff run.sh

Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven). Full batch context: the fix kernel contains all 41 hardening fixes of this batch compiled together (build RC=0) and passed the complete A/B suite plus a clean reboot.

VERDICT.md

↓ download raw

DF-2974 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Mechanically reproduced as a compile demo on the stock guest: a kernel module using the EVENTHANDLER_FAST_DECLARE/DEFINE/REGISTER API compiles cleanly, but ANY use of EVENTHANDLER_FAST_DEREGISTER (sys/sys/eventhandler.h:95-96) expands to eventhandler_deregister(Xeventhandler_list ## name, tag) - the token paste lacks the trailing underscore, producing the undeclared identifier 'Xeventhandler_listfoofam' while gcc itself suggests the real symbol 'Xeventhandler_list_foofam' - i.e. the macro is syntactically broken and the entire FAST handler API (zero in-tree users) is dead code. Control: with only the underscore fixed in the header, the identifier resolves and the paste error disappears. Fix compiled in the fix kernel (preferred alternative - deleting the dead FAST API - noted).

Baseline vs fix kernel

baseline: see verdict above / run log fix: behavior changed as designed (see verdict)

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

A/B compile: baseline fails on the pasted symbol; underscore-fixed header resolves it.

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)

Confirmed kernel references

Detail

Evidence (decisive lines)

build.log: Xeventhandler_listfoofam undeclared; did you mean Xeventhandler_list_foofam + zero-error control with the one-character fix

PoC changes

module-based compile demo (plain cc cannot resolve kernel headers); FAST_DECLARE needs a function-pointer typedef

Verified recommended fix

Fix the paste to Xeventhandler_list_ ## name (or delete the dead FAST API)

Verdict

Mechanically reproduced as a compile demo on the stock guest: a kernel module using the EVENTHANDLER_FAST_DECLARE/DEFINE/REGISTER API compiles cleanly, but ANY use of EVENTHANDLER_FAST_DEREGISTER (sys/sys/eventhandler.h:95-96) expands to eventhandler_deregister(Xeventhandler_list ## name, tag) - the token paste lacks the trailing underscore, producing the undeclared identifier Xeventhandler_listfoofam while gcc itself suggests the real symbol Xeventhandler_list_foofam - i.e. the macro is syntactically broken and the entire FAST handler API (zero in-tree users) is dead code. Control: with only the underscore fixed in the header, the identifier resolves and the paste error disappears. Fix compiled in the fix kernel (preferred alternative - deleting the dead FAST API - noted).