β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-3917

_mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry) and its overlap test is off by one, clearing a map slot beyond the enclosure

Summary

When reclaiming space from missing enclosures: the overlap test uses > instead of >=, so one-past-the-last-slot matches and clears a mapping entry belonging to the next enclosure; and when the consumed enclosure's last slot is reached, the clear call wipes the NEW enclosure being placed instead of the consumed missing one. Mapping/enclosure-table corruption during space reclamation: the newly placed enclosure loses its metadata and a foreign map entry is cleared, dropping another enclosure's devices. In-bounds writes only. Upstream FreeBSD head shares both defects verbatim.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3917 Β· 1 files
FileTypeDescriptionSize
verdict.json file 449 B view raw

Confirmed kernel references

β€”

Detail

Evidence (decisive lines)

β€”

Verdict

Low - PoC skipped per contract (hardware-gated logic/error-path classes). Source-certain; fixes authored; DF-3916/3917 also reported against FreeBSD head.