β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5221

framebuffer_alloc() ignores its size argument and never sets info->par β€” silent API-contract divergence, latent NULL-deref for any caller passing size > 0

Summary

LinuxKPI shim kzallocs only sizeof(struct fb_info), ignoring size and never setting info->par - Linux allocates the tail and points par at it. Sole in-tree caller passes 0 and assigns par itself, so latent only; any future ported caller following the Linux contract gets an attach-time NULL deref. Honor-the-contract fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5221 Β· 1 files
FileTypeDescriptionSize
verdict.json file 898 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5221

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (Low/Info per contract; static trace only)