DF-3007 — devfs_uninit passes NULL to devfs_msg_send -> guaranteed NULL-pointer write (latent)

• File: sys/vfs/devfs/devfs_core.c:2751 (devfs_msg_send(DEVFS_TERMINATE_CORE, NULL))
• sys/vfs/devfs/devfs_core.c:1112-1119 (unconditional deref)
• sys/sys/msgport2.h:33-38 (lwkt_initmsg stores through msg)
• Class: CWE-476 NULL pointer dereference (write)
• Severity: Info — latent: unreachable on a stock system (see VERDICT)

Build / Run

No build. As root on the guest:

shutdown -r now     # then inspect the serial console / boot log

Expected (had the path executed)

devfs_msg_send immediately executes lwkt_initmsg(&devfs_msg->hdr, ...) with devfs_msg == NULL — hdr is the first member of struct devfs_msg (sys/sys/devfs.h:165-166), so this is a write to address 0 -> kernel panic.

Observed

Two clean reboots, no panic, guest returns to login: — the SYSUNINIT entry never executes on this configuration (static-kernel sysuninit_set has no consumer on DragonFly; SYSUNINITs run only for KLD modules via linker_file_sysuninit, sys/kern/kern_linker.c:535). Details and the dead-path trace are in VERDICT.md. run.log holds the reboot attempt log.

Fix

fix.diff — allocate a real message (devfs_msg_get()); it is auto-freed via devfs_dispose_port's devfs_msg_autofree_reply. Compile-validated in the fix build.

DF-3007 VERDICT

Status: not_reproduced — the NULL-deref is real by construction but the code path is dead on a stock DragonFly system. Severity Info (latent).

The bug (certain, by code reading)

sys/vfs/devfs/devfs_core.c:2751:

    devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);

devfs_msg_send (devfs_core.c:1112-1119) unconditionally does:

    lwkt_initmsg(&devfs_msg->hdr, &devfs_dispose_port, 0);
    devfs_msg->hdr.u.ms_result = cmd;

struct devfs_msg begins with struct lwkt_msg hdr (sys/sys/devfs.h:165), so &NULL->hdr == NULL, and lwkt_initmsg (sys/sys/msgport2.h:33-38) writes msg->ms_flags and msg->ms_reply_port — i.e. two stores to address 0, followed by lwkt_sendmsg(port, NULL). Any execution panics.

Runtime reachability — traced dead on this guest

1. devfs_uninit is registered by SYSUNINIT(vfs_devfs_register, SI_SUB_DEVFS_CORE, SI_ORDER_ANY, ...) at devfs_core.c:2805-2806.
2. DragonFly's boot code (sys/kern/init_main.c:200-270, mi_startup) walks only sysinit_set; the static sysuninit_set has no consumer anywhere in the kernel — grep of sys/kern finds sysuninit executed only in linker_file_sysuninit (sys/kern/kern_linker.c:188-198,535), which is called from linker_file_unload for KLD modules only.
3. devfs is compiled into the stock kernel (vfs.root uses it; the devfs module cannot be unloaded — it owns /dev). Therefore devfs_uninit never runs on this system.
4. Empirical: two shutdown -r now cycles on the guest — no panic, clean reboot to login: both times (run.log).

Classification per the honest table: "expected marker absent, run exits 0, guest stays up" -> not_reproduced, impact none. The finding is kept because the code is objectively broken and would fire instantly if anyone ever makes devfs unloadable or adds a sysuninit walker (FreeBSD-style shutdown runs SYSUNINITs; DF ports of that machinery would trip this).

Fix validation

Not applicable beyond compilation: the path cannot be executed on this system (that is the finding itself). fix.diff was applied in the guest /usr/src and compiled in the patched kernel build (build log /tmp/kbuild.log in guest) — it compiles and changes no runtime behavior on stock configs.

Fix

-   devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);
+   msg = devfs_msg_get();
+   devfs_msg_send(DEVFS_TERMINATE_CORE, msg);
+   /* msg is auto-freed through the devfs_dispose_port reply */