β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5202

rain_saver(): set_video_mode() return value ignored β€” on blank-time failure vid aliases the stale 32KB text window and the 64000-byte bzero + drop-fill overrun it into 0xC0000+, while blanked/vid state commits as if the saver were active (DF-5114/DF-5197/DF-5198 family twin, last saver)

Summary

The last family twin: on failure the 64000-byte bzero + drop-fill march ~30KB past the text window into 0xC0000+ (DMAP-mapped so no fault), plus blanked/vid commit so syscons keeps ticking against a text-mode DAC. Latent (root kldload + VGA console + blank-time divergence). Check-and-bail fix (mirror of the dragon/warp/fire twins).

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5202 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.1 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5202

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace: set_video_mode discard at :77, consumers at :83-90

Verified recommended fix

check set_video_mode return; bail before touching vid

Verdict

untested (latent: root kldload + VGA console + blank-time mode-switch failure; guest is serial-console)