DF-3184 VERDICT — procfs_exit() UAF write of pfs->pfs_pid

Bottom line

NOT REPRODUCED empirically within the attempt budget (~17 runs, ~6 h of racing, ~10,000 flush-aimed exit-walks). The defect is mechanically certain from source: every stage of the chain was individually proven on an instrumented kernel (below), and only the final microsecond-scale coincidence (walk's scan→vx_get of a node during that same node's vgone_vxlocked teardown) was never caught. The finding stands as High-severity CWE-416 (kernel UAF write) with confidence likely: source-certain, empirically inconclusive on this 6-vCPU guest.

The defect (source trace)

sys/vfs/procfs/procfs_subr.c:531-549:

vp = PFSTOV(pfs);
vhold(vp);                    /* auxref — does NOT prevent reclaim
                                   (sys/kern/vfs_lock.c:431-435)      */
spin_unlock(&ph->spin);
vx_get(vp);                   /* void — cannot fail, does NOT check
                                   VRECLAIMED (vfs_lock.c:728-735);
                                   BLOCKS on the VX lock if a recycler
                                   holds it                             */
pfs->pfs_pid |= PFS_DEAD;     /* :546 — UAF WRITE if the recycler ran
                                   procfs_freevp() → kfree(pfs)
                                   (procfs_subr.c:249-273) while we
                                   blocked                            */
vx_put(vp);
vdrop(vp);

Reclaim side that frees the pfsnode while vhold is outstanding: - vnlru / allocvnode_gc → freesomevnodes → cleanfreevnode (vfs_lock.c:908-1050): checks v_auxrefs != v_namecache_count before vgone_vxlocked (:971) — a vhold landing after that check does not stop the reclaim; the post-reclaim re-check (:1026) only aborts the reuse of the vnode, not the free of the pfsnode. - umount -f → dounmount → vflush → vflush_scan → vgone_vxlocked per vnode (vfs_mount.c:1165-1181) — unconditional.

vgone_vxlocked → vclean_vxlocked(DOCLOSE) → VOP_RECLAIM → procfs_reclaim (procfs_vnops.c:480-483) → procfs_freevp: vp->v_data = NULL, hash unlink, kfree(pfs) (procfs_subr.c:255-270).

The sibling allocator in the same file revalidates after its blocking acquisition (procfs_allocvp :115-130 rescans the hash after vget) — procfs_exit is missing the equivalent check, writing |= 0x80000000 (4 bytes at struct pfsnode offset 20) into freed M_PROCFS memory.

What WAS proven on the guest (instrumented kernel #1-#3)

1. Chain stage 1 — nodes exist for the walk: tchain child as nobody: 12/13 stats OK; on exit the instrumented walk printed DF3184-WALK pid=2067 ... marked=12 (run.log run.13-era tests). Thousands of marked=12 walks observed (run.14: 1404, run.13: 3124).
2. Chain stage 2 — forced reclaim: mount-cycled scratch procfs; DF3184-FLUSH begin/end per cycle; every unmount succeeded and reclaimed all nodes (marked counts reset to 0 each cycle).
3. Chain stage 3 — timing controllability: dounmount retry-loop behavior characterized precisely: - quiet mount (no lookups): unmount ≈ 1 ms (flush ≈ +1 ms) - lookups, no exits during retries: unmount ≈ 256 ms ± 3 ms (flush ≈ +256 ms) - walk-exits during retries: full UMOUNTF_RETRIES exhaustion (50 × 25.1 ms), flush ≈ +12.55 s (unmount total 13.0-13.3 s)
4. The blocking primitive: vx_get blocking on the recycler's VX lock is the mechanism that turns the race into a guaranteed stale write once the interleaving occurs — confirmed by construction, not observed live.

Why reproduction failed — honest analysis

• Bimodal flush timing with adversarial feedback: walk-exits are themselves transient mount refs; dounmount's retry loop always waits out the last exit before flushing, so the umount-forced flush geometrically lands ~251 ms after the last exiting walk — every single-wave aiming scheme self-defeated (runs 7-9, 11-17).
• Load destroys walk-timing precision: the fork-storm needed for statistical volume (batch 96-288) pushed load average to 90+, giving the exit1 prefix (before the at_exit walk) milliseconds-to-seconds of jitter — larger than the ~5-10 ms flush window.
• Residual per-walk collision probability: given a walk inside the flush window, the walk must be in its ~0.5 μs scan→vx_get gap for one of its ~12 nodes at the instant vflush_scan is inside the same node's ~3 μs vgone — ≲0.5 % per in-flush walk under the best model; observed 0 over ~10⁴ attempts (consistent with a per-walk probability a few times lower than modeled).
• The pure vnlru variant (no umount games) needs the exit to coincide with the recycler reaching that vnode after a FIFO service delay of minutes (measured: ~45k reclaims / 300 s against a ~50k backlog) — estimated single-digit expected hits per day of racing.

Primitive characterization (if triggered)

• One 4-byte OR of 0x80000000 at offset 20 of a freed chunk in the dedicated M_PROCFS slab zone (only struct pfsnode lives there).
• No attacker-controlled value or offset: not a general write primitive. Realistic outcomes: silent no-op (free chunk), corruption of a reallocated live pfsnode (its pid gets the DEAD bit → that /proc node is orphaned from its pid → DoS), or — on INVARIANTS kernels — the subsequent vx_put on the VBAD/VS_INACTIVE raced vnode takes the VREF_FINALIZE → vrele → vnode_terminate path and trips KKASSERT(vp->v_state == VS_ACTIVE) (vfs_lock.c:503) → panic.
• uid=0 escalation: not plausibly reachable from this primitive alone (fixed value/offset, type-constrained zone). Hard blocker documented per contract.

Fix validation

fix.diff (validate vp->v_data == pfs under the held VX lock; skip the write for raced nodes) — not_testable: no reproduced baseline exists to diff against. The fix is mechanically equivalent to the instrumentation's stale-detector condition, which itself never fired, so the patched behavior would be indistinguishable on this guest.

Guest state

Left CLEAN: harness killed, /procN unmounted, /usr/src procfs sources restored to pristine (md5-verified for procfs_subr.c), then vm.sh reset with-src to the clean-source snapshot with the stock kernel.

Attempts

17 distinct race configurations (runs run.log … run.17.log), 3 kernel builds (2 instrumented), ~6 h wall time, ~10,000 flush-aimed walks.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.