sysent[] entry swaps are unsynchronized against unlocked syscall dispatch: non-atomic 24-byte struct assignment (register/deregister) races trap.c's separate sy_narg/sy_call loads (torn dispatch), and deregister has no in-flight quiesce — kldunload frees module text while a victim thread executes inside sy_call (UAF execution)
| Field | Value |
|---|---|
| ID | DF-2985 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H |
| CWE | CWE-362 / CWE-367 |
| File | sys/kern/kern_syscalls.c |
| Lines | 67-68, 76 (readers: trap.c:1235 vs :1285) |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
syscall_register/deregister mutate the global dispatch table by plain struct assignment (24 bytes over 4 fields: multiple stores, no lock, no atomics), while every CPU dispatches syscalls by reading the same entry unlocked (trap.c reads sy_narg at :1235 and calls sy_call at :1285 — 50 instructions apart). kld_lock serializes loaders against each other but nothing serializes them against dispatch. (a) Torn interleaving during the load/unload window dispatches the new sy_call with the old sy_narg — the module function runs with the caller's stale registers as unpassed arguments (arg-count confusion; args are user data, no kernel-memory leak — that escalation was killed). (b) No refcount/quiesce protects in-flight callers: kldunload restores lkmnosys and frees the module image while a thread is inside the module's sy_call → execution continues into freed kernel memory. Same registry-swap-discipline family as DF-2971/DF-2918/DF-2975; root-timed race with an unprivileged victim thread (realistic mainly for long-blocking syscalls). Not run (Low per contract). Fix: atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister before module text is freed.
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_syscalls.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2985 · 11 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 806 B | ↓ raw | |
| VERDICT.md | — | 2.5 KB | ↓ raw | |
| build.sh | — | 69 B | view raw | |
| calibration.log | — | 366 B | view raw | |
| df2985_panic.txt | — | 2.0 KB | view raw | |
| dfv_safe.c | — | 21.8 KB | view raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 1.3 KB | view raw | |
| manifest.json | — | 792 B | view raw | |
| run.sh | — | 207 B | view raw | |
| verdict.json | — | 2.9 KB | view raw |
DF-2985 PoC evidence pack
What
sysent[] swaps are unsynchronized against unlocked syscall dispatch: torn dispatch / wild kernel execution.
Build
make (KMOD dfv_safe); cc dfv5call.c
Run
kldload dfv_safe.ko; sysctl -w dfv.s2985=3; ./dfv5call 5 (calibration); sysctl -w dfv.s2985=2; sysctl -w dfv.s2985=1; ./dfv5call 15 -> kernel panics
Expected
calibration clean; every unsynchronized flip run: Fatal trap 1 privileged instruction fault (garbage execution)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2985 - verification verdict
Status: reproduced | reproduced: 1 | impact: panic | confidence: likely
Torn/unsynchronized sysent swaps crash the stock kernel 3/3, while coherent entries never do. Calibration: a statically registered probe syscall (variant A: sy_narg=1, returns args[1]) sustained 340,510+ unpriv calls with ZERO anomalies. Enabling the flipper thread (nothing but syscall_register/syscall_deregister alternating two safe constant entries - the stock kern_syscalls.c:67-68/:76 plain 24-byte struct assignments, no locks) crashed the kernel EVERY run, identically, with wild kernel execution: Fatal trap 1 privileged instruction fault, RIP inside module-adjacent text, ddb showing a non-symbolic PC executing garbage (push %cs) - i.e. control flow left every defined entry point. The only difference between the crash-free calibration and the crashes is the unsynchronized sysent[] mutation; no harness fault can redirect a coherent entry (all sy_call values are valid function entry points). The crash machine-reproduces the finding: non-atomic multi-field swaps dispatched unlocked. Caller-side torn-argument counter never printed (kernel died first); one earlier run additionally exhibited the reading form before this harness was hardened (discarded as tainted - see notes).
Evidence pointers
df2985_panic.txt: Fatal trap 1 privileged instruction fault / Stopped at push %cs; calibration line: calls=340510 torn=0
Kernel references
PoC changes vs the filing sketch
first flipper attempt crashed with a harness cleanup bug (uninitialized old-entry restore) - discarded; fixed harness (coherent register/deregister pairs only) still crashes 3/3 with constant-safe entries
Fix
recommendation: atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister
fix status: not_testable
ordered-publish hardening compiled in fix-all kernel (full quiesce needs a dispatch epoch; partial fix documented)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableordered-publish hardening compiled in fix-all kernel (full quiesce needs a dispatch epoch; partial fix documented)
Confirmed kernel references
Detail
Exploit chain
module flipper swaps sysent entry unsynchronized -> userland syscall dispatch interleaves fields -> kernel executes garbage text -> panic (privileged-instruction fault)
Evidence (decisive lines)
df2985_panic.txt: Fatal trap 1 privileged instruction fault / Stopped at push %cs; calibration line: calls=340510 torn=0
PoC changes
first flipper attempt crashed with a harness cleanup bug (uninitialized old-entry restore) - discarded; fixed harness (coherent register/deregister pairs only) still crashes 3/3 with constant-safe entries
Verified recommended fix
atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister
Verdict
Torn/unsynchronized sysent swaps crash the stock kernel 3/3, while coherent entries never do. Calibration: a statically registered probe syscall (variant A: sy_narg=1, returns args[1]) sustained 340,510+ unpriv calls with ZERO anomalies. Enabling the flipper thread (nothing but syscall_register/syscall_deregister alternating two safe constant entries - the stock kern_syscalls.c:67-68/:76 plain 24-byte struct assignments, no locks) crashed the kernel EVERY run, identically, with wild kernel execution: Fatal trap 1 privileged instruction fault, RIP inside module-adjacent text, ddb showing a non-symbolic PC executing garbage (push %cs) - i.e. control flow left every defined entry point. The only difference between the crash-free calibration and the crashes is the unsynchronized sysent[] mutation; no harness fault can redirect a coherent entry (all sy_call values are valid function entry points). The crash machine-reproduces the finding: non-atomic multi-field swaps dispatched unlocked. Caller-side torn-argument counter never printed (kernel died first); one earlier run additionally exhibited the reading form before this harness was hardened (discarded as tainted - see notes).
No comments yet.