DF-4472 PoC — uninitialized type pointer in dm_table_load_ioctl

Build (guest, after vm.sh reset with-src + kldload dm):

cc -o dm_uninit_type dm_uninit_type.c -lprop -lpthread

Run:

./dm_uninit_type            # groom mode: 200 rounds of [valid reload, typeless reload]
./dm_uninit_type --flood 8 800   # 8 threads x 800 malformed reloads (panic variant)

Expected (unpatched) — any of:

• groom: destroy-proof=N == rounds — every typeless reload returns ENOENT (rv2=2) and wipes the inactive table loaded by the paired valid reload, proving dm_target_lookup(garbage) executed (dm_ioctl.c:741 is the only ENOENT return after the destroy at :722-723);
• flood: kernel panic — Fatal trap 12, Stopped at strcmp+0xc (wild read of the uninitialized pointer), guest down;
• possibly dm: could not autoload module for target <garbage> on console.

Expected (patched with fix.diff): groom prints last rv2=22 (EINVAL) with destroy-proof=0; flood completes without panic.

Requires root (or operator group): /dev/mapper/control is 0640 root:operator.

DF-4472 — dm_table_load_ioctl: uninitialized stack pointer type dereferenced as a C string

REPRODUCED (panic / local DoS) + FIX VALIDATED.

The bug

dm_table_load_ioctl() (sys/dev/disk/dm/dm_ioctl.c:673) declares const char *name, *uuid, *type; at :684 and initializes name/uuid/dmv/str — but never type (:690-695). Inside the table-entry loop it does:

730  while ((target_dict = prop_object_iterator_next(iter)) != NULL) {
731      prop_dictionary_get_cstring_nocopy(target_dict, DM_TABLE_TYPE, &type);
...
737      if (((target = dm_target_lookup(type)) == NULL) &&
738          ((target = dm_target_autoload(type)) == NULL)) {

prop_dictionary_get_cstring_nocopy() (sys/libprop/prop_dictionary_util.c:185) returns false without touching the out-param when the key is absent, the element is not a dictionary, or the value is not a string. On the first loop iteration type therefore holds stale kernel-stack data, which is then dereferenced as a NUL-terminated string by:

• dm_target_lookup_name() → strcmp(dm_target_name, dmv->name) (sys/dev/disk/dm/dm_target.c:127) — wild read;
• on lookup failure, dm_target_autoload() → ksnprintf(mod_name, sizeof, "dm_target_%s", dm_target_name) (dm_target.c:74) — second wild read of the same garbage.

Reproduction (baseline, unpatched)

Three independent confirmations on the QEMU guest (DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC, dm.ko kldload-ed):

1. Wild read executes on 100% of rounds (250/250). Groom mode: reload #1 (valid, type:"zero") loads a 1-entry inactive table; reload #2 omits the "type" key entirely → returns ENOENT and the inactive table is now empty. dm_ioctl.c has exactly one ENOENT return after the dm_table_destroy(INACTIVE) at :722-723 — the lookup failure at :741 — so dm_target_lookup(garbage) demonstrably executed with the stale value (run.log: 50/50 and 200/200 rounds).
2. Autoload prints the garbage. Serial console during flood: dm: could not autoload module for target <binary garbage> — the ksnprintf at dm_target.c:74 reading uninitialized memory.
3. PANIC. Flood mode (8 threads × 800 malformed reloads) — the garbage landed on an unmapped value (fault VA 0x8) and the kernel took a fatal page fault in strcmp+0xc called from the lookup path; guest down (panic.txt: Fatal trap 12 … Stopped at strcmp+0xc: movzbl (%rdi,%rax,1),%edx).

Why no uid=0

The primitive is a wild read of a stack-derived pointer used as a string. There is no write primitive; the value at the stack slot cannot be aimed at an attacker-chosen address by construction (it is kernel-stack residue from the proplib internalize machinery of the same ioctl). Best case for an attacker is the observed reliable local DoS (panic) — the same ceiling as the known DF-2448 NULL-deref on this surface. Valid hard blocker for escalation.

Privilege precondition

/dev/mapper/control is created 0640 root:operator (sys/dev/disk/dm/device-mapper.c:181) and dm must be kldload-ed by root — threat model is operator-group member (or root) → kernel, consistent with the known DF-1639/1638xx family on this file.

Fix validation

fix.diff (shared with DF-4473/DF-4474; this file's relevant hunk): initialize type = NULL before the loop, re-initialize per iteration, and check the prop_dictionary_get_cstring_nocopy return value → EINVAL.

• Baseline: groom 50/50 wild-read proofs; flood → fatal trap 12, guest down.
• Patched (dm.ko rebuilt with fix.diff, -Werror clean): groom returns EINVAL (22) on every round (missing type rejected before any lookup); flood 8×800 completes with no panic, guest healthy (run.log §fix).

Files

• dm_uninit_type.c — PoC (groom + flood modes)
• run.log — baseline groom (250/250), baseline panic, patched groom + flood
• panic.txt — full serial-console panic excerpt (strcmp+0xc, trap 12)
• fix.diff — combined dm_ioctl.c fix (validated)
• env.txt, build.sh, run.sh

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.