β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-3916

_mapping_get_dpm_idx_from_id reads PhysicalIdentifier once from entry 0 and compares every DPM entry against it - DPM lookups only ever match entry 0

Summary

PhysicalIdentifier is loaded from entry 0 BEFORE the loop; the loop advances dpm_entry but keeps comparing id against the frozen entry-0 value. Any enclosure whose persistent entry is not entry 0 is never found, so add_new_device allocates a DUPLICATE DPM entry for an already-persisted enclosure. On the following boot process_dpm_pg0 hits the conflict check and disables DPM entirely - device target IDs stop persisting across reboots. Upstream FreeBSD head shares the identical bug (verified). Move-the-read-inside-the-loop fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3916 Β· 1 files
FileTypeDescriptionSize
verdict.json file 449 B view raw

Confirmed kernel references

β€”

Detail

Evidence (decisive lines)

β€”

Verdict

Low - PoC skipped per contract (hardware-gated logic/error-path classes). Source-certain; fixes authored; DF-3916/3917 also reported against FreeBSD head.