⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-4061

Linux-compat ioctl 0xc0046d00 re-reads a 110-byte struct amr_linux_ioctl from the 4-byte IOC buffer: 106 bytes of uninitialized kernel stack become ali.inlen/outlen, opcode, mailbox and passthrough pointers that steer the whole management ioctl

Summary

amr_ioctl accepts 0xc0046d00 and 0xc06e6d00 identically, then copyin()s 110 bytes; but the syscall layer stages only IOCPARM_LEN(cmd)=4 bytes for 0xc0046d00, so bytes 4..109 are stale kernel stack - selecting opcode dispatch, the PASS branch, and the copyin/copyout pointers. Root-only 0600 node; correctness/defense-in-depth (non-deterministic dispatch off prior syscall residue); no data crosses back out. Reject-undersized-cmd fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4061 · 2 files
FileTypeDescriptionSize
README.md file 225 B ↓ raw
verdict.json file 913 B view raw
README.md file
↓ download raw

DF-4061

Hardware-gated finding - PoC skipped (no device on audit guest). Source citations in the pass-2 result block.

Fix: reject 0xc0046d00 (or check IOCPARM_LEN(cmd) == sizeof(struct amr_linux_ioctl)) before the copyin

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

reject 0xc0046d00 (or check IOCPARM_LEN(cmd) == sizeof(struct amr_linux_ioctl)) before the copyin

source-only
per-fix-DF-4061

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

source-only; path:line citations in pass-2 result block

Verdict

source-verified; hardware-gated (no device on audit guest); no guest run per allocation