β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5214

Dead dal_hw_factory_destroy() kfrees a struct hw_factory that only ever exists embedded in gpio_service β€” latent interior-pointer kfree (heap corruption) one future caller away

Summary

The destroy API implies a standalone heap allocation, but every hw_factory in the tree is an embedded gpio_service member freed with the whole service - the header-signature-inviting teardown call would kfree an interior pointer. Zero callers (dead). Delete-the-function fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5214 Β· 1 files
FileTypeDescriptionSize
verdict.json file 927 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5214

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (dead code / hardware-gated; Info/Low per contract)