DF-3202 — wildCaseCmp() recurses once per '*' (80B frames); star-heavy rule names exhaust the devfs core thread stack. See VERDICT.md. Build: cc -static -O -o star_rec star_rec.c ; Run as root (double fault).

DF-3202 — wildCaseCmp() unbounded recursion: stack exhaustion from star-heavy rule names

Root cause

wildCaseCmp() (sys/vfs/devfs/devfs_core.c:2875) recurses once per '*' processed — the "less-optimal" branch at :2902-2903:

for (i = 0; s + i < mary[d]; ++i)
    if (wildCaseCmp(mary, d + 1, w + 1, s + i) == 0) ...

The compiled frame is 80 bytes (objdump: push %rbp + 5 regs + sub $0x18 + return address). A DEVFS_RULE_NAME rule whose name is a few hundred '*'s therefore recurses a few hundred frames deep inside devfs_rule_checkname() when DEVFS_RULE_APPLY walks the tree — on the devfs core thread — and exhausts the kernel stack.

Reproduced (minimal PoC, clean boot)

Rule name = 300 '*'s, DEVFS_RULE_PERM (checkname runs for NAME rules regardless of cmd), one DEVFS_RULE_APPLY:

Fatal double fault
rip = 0xffffffff8091c316        <- wildCaseCmp+6 : push %r15
panic: double fault

Incidental reproductions during this audit: 252-star name (DF-3200 control pattern) and ~95-star name (DF-3199 offset-100 pattern) — the threshold on this kernel is between ~60 and ~95 stars.

Fix

fix.diff: reject NAME patterns with more than 32 '*'s at rule-add time (32 x 80 B = 2.5 KB worst case; real devfs.rules patterns use a handful of wildcards). A full iterative rewrite of the matcher would also work but is more invasive.

Files

star_rec.c, build.sh, run.sh, panic.txt, fix.diff, run.fixed.log, verdict.json, manifest.json

Incidental reproductions (earlier in the session)

• 252-star pattern (DF-3200 control rule): first crash of the session (boot.log preserved at DF-3201/panic.doublefault.2.txt).
• ~95-star pattern (DF-3199 offset-100 rule): crashed the leak run at the same rip.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.