β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-3918

Allocation-failure path in mpr_mapping_allocate_memory kfrees NULL (panic on DragonFly) / stale pointers; mpr_mapping_initialize return ignored by both callers

Summary

The free_resources path kfrees ALL six table pointers after any partial allocation failure. On the first (attach) call the un-allocated pointers are NULL and DragonFly's kfree(NULL) PANICS - this code was ported from FreeBSD where free(NULL) is a no-op. The free helper does not NULL the pointers, so a reinit retry double-frees stale pointers. Additionally both callers ignore the error return, so after a failure the driver continues with NULL/dangling mapping_table and every event handler walks it. Any M_NOWAIT failure among the firmware-sized arrays turns into a panic instead of a graceful attach failure. Guard+NULL+propagate fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3918 Β· 1 files
FileTypeDescriptionSize
verdict.json file 449 B view raw

Confirmed kernel references

β€”

Detail

Evidence (decisive lines)

β€”

Verdict

Low - PoC skipped per contract (hardware-gated logic/error-path classes). Source-certain; fixes authored; DF-3916/3917 also reported against FreeBSD head.