DF-5338
kern_trap() broken fall-through for unhandled kernel-mode traps (T_PROTFLT/T_SEGNPFLT/T_BPTFLT/T_TRCTRAP): NULL p/lp deref for kernel threads, trapsignal(lp, i=0) sig-0 OOB read/call, and handler-returns-to-faulting-instruction livelock β pc64 ends these cases in trap_fatal
Summary
The vkernel copy breaks out of its switch where pc64 ends in trap_fatal: kernel threads (td_proc==NULL) deref NULL p inside the SA_NODEFER SIGSEGV handler -> recursive fault to stack exhaustion; emulated threads call trapsignal(sig=0) whose _SIG_WORD(0)=-1 reads one word below the sigset and a set bit 31 indexes ps_sigact[-1] and CALLS it; or silent 100%-CPU refault livelock instead of a diagnosable panic. Requires a partner vkernel kernel-mode #GP bug to reach. Match-pc64-trap_fatal fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5338 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5338
Confirmed kernel references
Detail
Evidence (decisive lines)
differential proof vs pc64 trap.c kernel-branch (trap_fatal) in finding markdown
Verified recommended fix
terminate unhandled kernel-mode cases in trap_fatal as pc64 does
Verdict
untested (Low crash-path robustness; needs a partner kernel-mode #GP bug to reach)
No comments yet.