DF-4716

b_cmd=READ guard tests m.flags for XFR_BAD_SUBDISK (never set there) - condition always true, intended bad-subdisk exclusion dead

Summary

XFR_BAD_SUBDISK is only ever set on rqe->flags, so the guard on m.flags is always true and the bad subdisk's rqe also gets READ - against the comment's intent. No current runtime effect (bad rqes never launched) but a latent hazard exactly on the launch-path machinery where DF-4721 lives. Test-rqe->flags one-token fix.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-697
File: sys/dev/raid/vinum/vinumraid5.c
Lines: 536-537
Area: dev
Discovered: 2026-09-23
Updated: 2026-09-23

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-09-23 01:52:35
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-09-23 01:52:35
Runtime: —
Kernel: per-fix-DF-4716
fix.diff: findings/poc/DF-4716/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4716 · 3 files

File	Type	Size
README.md	—	963 B	↓ raw
fix.diff	—	552 B	view raw
verdict.json	—	1.1 KB	view raw

README.md

↓ download raw

DF-4716 — vinumraid5: b_cmd=READ condition tests m.flags for XFR_BAD_SUBDISK (never set there) — always true, intended "not the bad subdisk" check dead

sys/dev/raid/vinum/vinumraid5.c:536-538:

if ((m.flags & XFR_PARITYOP)            /* parity operation, */
&&((m.flags & XFR_BAD_SUBDISK) == 0))       /* and not the bad subdisk, */
    rqe->b.b_cmd = BUF_CMD_READ;        /* we must read first */

XFR_BAD_SUBDISK is only ever set on rqe->flags (line 523), never on m.flags, so the second clause is always true and the bad subdisk's rqe also gets b_cmd = BUF_CMD_READ. The comment makes the intent unambiguous: the check should test rqe->flags.

Current effect: none — XFR_BAD_SUBDISK rqes are never launched (vinumrequest.c:410) and completion filters re-check the flags — so this is filed as Info (latent correctness hazard guarding the DF-4721-class launch paths). fix.diff corrects the operand. Not PoC-verified (no runtime observable).

Fix verification

not_testable

↓ fix.diffper-fix-DF-4716

Confirmed kernel references

sys/dev/raid/vinum/vinumraid5.c:536

Detail

Evidence (decisive lines)

source trace only: request.h:48 (XFR_BAD_SUBDISK set only via rqe->flags at vinumraid5.c:523), vinumrequest.c:410 (launch skip)

PoC changes

n/a (no seeded PoC; static finding)

Verified recommended fix

test rqe->flags instead of m.flags (fix.diff)

Verdict

wrong-operand condition (m.flags instead of rqe->flags) makes the 'not the bad subdisk' guard at vinumraid5.c:536-538 always true; dead-effect today because XFR_BAD_SUBDISK rqes are never launched, but it is the exact kind of stale guard that hides launch-path lifetime bugs (cf. DF-4721). Info-level hardening; fix.diff corrects the operand. Not PoC-verified: no runtime-observable effect.