DF-4175
iir_init: bus_dmamap_create failure returns with sc_init_level one step low — iir_free skips kfree(sc_gccbs) and every created gc_dmamap (permanent leak on failed attach)
Summary
The gccb init loop returns 1 immediately when bus_dmamap_create fails, but sc_init_level is only bumped to 5 after the whole loop. iir_free's switch enters at case 4 and never executes the case-5 block that destroys the gc_dmamaps and kfrees the ~46KB sc_gccbs array - all leaked on a failed attach with dangling dma maps. Move-the-increment fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4175 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | ↓ raw | |
| verdict.json | file | 752 B | view raw |
README.md
file
↓ download raw
DF-4175
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
see pass-2 result block fix
source-only
per-fix-DF-4175
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; hardware-gated (no iir controller / no Qlogic HBA on audit guest)
No comments yet.