β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5095

MFI_DEBUG timeout helpers print kernel heap pointer (cm) and the pmap_kextract() physical address of command data buffers to the world-readable kernel message buffer

Summary

In MFI_DEBUG builds the timeout path prints cm=%p and pmap_kextract(cm->cm_data) into msgbuf (world-readable via dmesg; no %p hashing on DF). Double-gated (option off by default + LSI hardware). Note: mfi.c:3476/3519 print the same cm %p unconditionally even in non-debug builds. Print-index-not-pointer fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5095 Β· 1 files
FileTypeDescriptionSize
verdict.json file 928 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5095

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

print cm_index instead of cm pointer; drop pmap_kextract

Verdict

untested (double-gated: MFI_DEBUG off + no MegaRAID on guest)