β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5211

arch_io_reserve_memtype_wc() persists 4 uninitialized stack bytes into the global memrange descriptor array (mr_owner[4..7] leak into MEMRANGE_GET)

Summary

Partial init + strlcpy('drm') leaves mr_owner[4..7] stale stack bytes that amd64_mrsetlow/variable bcopies into the persistent descriptor array - handed back via /dev/mem MEMRANGE_GET. Privileged-only disclosure (Info). memset-before-fill fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5211 Β· 1 files
FileTypeDescriptionSize
verdict.json file 904 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5211

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (hardware-/root-gated; Low/Info per contract)