β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5312

DA_CCB_TRIM completion decrements outstanding_cmds_rd that the TRIM start path never increments: permanent queue-accounting underflow disables read throttling and tps balancing

Summary

dadone handles BUFFER_IO and TRIM in one shared block whose epilogue decrements the rd/wr counters, but the TRIM issuance path breaks out BEFORE the increment - every completed TRIM permanently decrements outstanding_cmds_rd: read throttle permanently satisfied (queued-read depth unbounded), tps_rd normalization can never fire again, write starvation under mixed load after the FIRST trim. Reachable unpriv via filesystem trims (ffs_blkfree_trim/spec_freeblks) on trim-enabled da disks. Skip-decrement-for-TRIM fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5312 Β· 1 files
FileTypeDescriptionSize
verdict.json file 970 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5312

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (Low; sketch PoCs documented, root-gated / perf-accounting / evil-disk classes)