sysent[] entry swaps are unsynchronized against unlocked syscall dispatch: non-atomic 24-byte struct assignment (register/deregister) races trap.c's separate sy_narg/sy_call loads (torn dispatch), and deregister has no in-flight quiesce — kldunload frees module text while a victim thread executes inside sy_call (UAF execution)

Summary

syscall_register/deregister mutate the global dispatch table by plain struct assignment (24 bytes over 4 fields: multiple stores, no lock, no atomics), while every CPU dispatches syscalls by reading the same entry unlocked (trap.c reads sy_narg at :1235 and calls sy_call at :1285 — 50 instructions apart). kld_lock serializes loaders against each other but nothing serializes them against dispatch. (a) Torn interleaving during the load/unload window dispatches the new sy_call with the old sy_narg — the module function runs with the caller's stale registers as unpassed arguments (arg-count confusion; args are user data, no kernel-memory leak — that escalation was killed). (b) No refcount/quiesce protects in-flight callers: kldunload restores lkmnosys and frees the module image while a thread is inside the module's sy_call → execution continues into freed kernel memory. Same registry-swap-discipline family as DF-2971/DF-2918/DF-2975; root-timed race with an unprivileged victim thread (realistic mainly for long-blocking syscalls). Not run (Low per contract). Fix: atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister before module text is freed.

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_syscalls.c (GLM 5.3).