DF-4434
sln_attach() error path after bus_setup_intr failure leaks the 64KB contigmalloc RX ring and skips ifmedia cleanup
Summary
The bus_setup_intr error branch releases IRQ/BAR and detaches the ether interface but never contigfree()s the RX ring nor ifmedia_removeall()s - 64KB contiguous + media entries leaked per failed attach (IRQ exhaustion, kldload/unload racing). Detach path shows the correct cleanup. Add-the-missing-cleanup fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4434 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 880 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated
fix.diff in finding markdown
per-fix-DF-4434
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Error path omits contigfree + ifmedia_removeall; detach path shows the correct cleanup. Fix in finding markdown.
Verdict
not_run: Info hardening finding; root/env-triggered (IRQ exhaustion at probe)
No comments yet.