β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5281

Vendor-database parsing: ksscanf("%80[^\n]") writes up to 81 bytes into kmalloc(80); pci_load_vendor_data() writes one byte past the preloaded blob

Summary

Maximal 80-char line writes NUL at desc[80] (lands in slab slack - benign in practice); load_vendor_data deliberately writes vendordata[size]='\n' one byte past the loaded module. Boot-time, loader-supplied blob. Width-79 + in-blob-sentinel fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5281 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1007 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5281

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace (DF-5279 also run.t2.log stage 2a in findings/poc/DF-5276/)

Verified recommended fix

see finding markdown

Verdict

untested (Low functional / Low legacy-HW race / Info boot-time; demonstrated in DF-5276 harness where applicable)