β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5114

dragon_saver(): set_video_mode() return value ignored β€” on failure vid would alias the wrong (32KB text) video window and 64000-byte writes would overrun it

Summary

vid is captured unconditionally after the unchecked mode switch; every write trusts hardcoded 320x200. On failure va_window would describe the text window (32KB) and the 64000-byte writes run ~31KB past into the VGA BIOS shadow (MMIO, not kernel RAM - gpset still bounds pixel coords). Provably unreachable on this tree (same static mode table + flag validated by dragon_init; vga.c the only vidsw provider) - hardening for the generic vidsw contract. Check-and-fail-blank fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5114 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1006 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5114

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

check set_video_mode return; fail the blank (SC_SAVER_FAILED restore path)

Verdict

untested (precondition provably absent on this tree: same mode table+flag validated at init)