β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5373

bus_dmamap_create() leaks the freshly kmalloc'd map when the initial bounce-page allocation partially fails (vkernel never got pc64's kfree(*mapp) error-path fix)

Summary

*mapp kmalloc'd before the bounce top-up; ENOMEM returns with map_count not incremented and the map never freed - callers treat failed create as no-map, leaking 72B M_DEVBUF per call, exhaustible to vkernel DoS under lowaddr pressure + NOWAIT creates. pc64 fixed exactly this; the fork predates it. kfree-and-NULL-on-error fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5373 Β· 1 files
FileTypeDescriptionSize
verdict.json file 976 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5373

Confirmed kernel references

Detail

Evidence (decisive lines)

code-certain divergence vs pc64's fixes in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (Medium race / Low leak; needs a bus_dma driver inside a vkernel to exercise)