DF-5211
arch_io_reserve_memtype_wc() persists 4 uninitialized stack bytes into the global memrange descriptor array (mr_owner[4..7] leak into MEMRANGE_GET)
Summary
Partial init + strlcpy('drm') leaves mr_owner[4..7] stale stack bytes that amd64_mrsetlow/variable bcopies into the persistent descriptor array - handed back via /dev/mem MEMRANGE_GET. Privileged-only disclosure (Info). memset-before-fill fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5211 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 904 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5211
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (hardware-/root-gated; Low/Info per contract)
No comments yet.