β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4394

hpt_shutdown_vbus frees LDM memory and adapter handles before terminating the vbus timer callout - pending timer callback runs on freed memory (shutdown-window UAF)

Summary

In the shutdown path the vbus lock is dropped, LDM command pools are freed and adapter handles kfree'd, but the periodic vbus timer (callout_init_lk'd to the vbus lock, armed for background RAID/rebuild tasks) is only terminated AFTERWARDS. A timer callback firing in the window executes LDM code over freed command structures. Shutdown-time crash when a rebuild/verify has the timer armed. Terminate-before-free fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4394 Β· 2 files
FileTypeDescriptionSize
README.md file 141 B ↓ raw
verdict.json file 845 B view raw
README.md file
↓ download raw

DF-4394

Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.

Fix: see pass-2 result block fix

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

see pass-2 result block fix

source-only
per-fix-DF-4394

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

source-only; path:line citations in pass-2 result block

Verdict

source-verified; hardware-gated