DF-5538 VERDICT — vkernel64 fuwordadd32()/swapu32() over-strict page-tail straddle guard

Status: REPRODUCED (vkernel uaccess semantic divergence, userland-visible) — fix validated

The bug

sys/platform/vkernel64/platform/copyio.c:

• swapu32() — guard at copyio.c:165: if (PAGE_SIZE - ((vm_offset_t)p & PAGE_MASK) < sizeof(uint64_t)) return -1;
• fuwordadd32() — guard at copyio.c:229: same, sizeof(uint64_t)

Both are 32-bit operations. A 32-bit word at page offset 0xFFC has PAGE_SIZE - 0xFFC == 4 bytes of room — it fits entirely in-page — but 4 < 8 aborts with the fault sentinel -1 even though the page is mapped and writable. Compare the correct siblings in the same file: casu32 uses sizeof(u_int) (copyio.c:96); swapu64/fuwordadd64/casu64 use sizeof(uint64_t) for real 64-bit ops (copyio.c:58/133/197).

Why it matters (live caller)

umtx_sleep(2) reads the user word with fuwordadd32(uptr, 0) (sys/kern/kern_umtx.c:146, also :172, :224). Consequences inside a vkernel for a 32-bit-aligned word in the last 4 bytes of a page (any mapping, unprivileged, only requires the 4-byte alignment check at kern_umtx.c:127):

1. umtx_sleep(w, v, t) with *w == v → instant EBUSY instead of sleeping: the futex never sleeps on a matching word.
2. umtx_sleep(w, -1, t) with *w != -1 → sleeps the full timeout on the phantom -1 and returns (EAGAIN): lost wakeups, hangs.

On native pc64 the same word is read by a real lock xaddl + onfault and works at offset 0xFFC (verified: native reference run, all probes OK). The vkernel twin breaks the MI uaccess contract for page-tail 32-bit words. No memory-unsafety: the guard is over-strict, never under-strict (verified for all six guards in the file). swapu32 is latent (no in-tree caller); fuwordadd64/swapu64/casu64/casu32 also have no in-tree callers — only fuwordadd32 is live, via umtx.

How it was verified

Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC). df5538.c — one static binary, run in two environments:

• Native reference (guest host kernel, pc64): A off0x000 → OK(slept 1.491s), B off0xFFC → OK(slept 1.500s), C off0xFFC → OK(instant EBUSY) — RESULT: OK (mask=0).
• vkernel baseline (/usr/obj/usr/src/sys/VKERNEL64/kernel.debug -m 512m -r /vkroot.img -n 2, unprivileged root shell inside, binary from /root/df5538): A off0x000 → OK(slept 1.460s) — plumbing fine at page offset 0; B off0xFFC → EBUSY elapsed 0.000 — kernel never saw the word; C off0xFFC → slept 0.300s, EAGAIN — slept on a value that isn't there; RESULT: BROKEN (mask=3).

The 0.000s-vs-1.5s / 0.300s-vs-0.000s splits are three orders of magnitude apart — deterministic, not timing noise. Full console in run.log (baseline) and run.fixed.log (post-fix).

Fix validation

fix.diff (authored after verification, applied only to the guest's /usr/src copy; the audit tree's sys/ is untouched — git apply --check only on the host):

-copyio.c:165  if (PAGE_SIZE - ((vm_offset_t)p & PAGE_MASK) < sizeof(uint64_t))
+copyio.c:165  if (PAGE_SIZE - ((vm_offset_t)p & PAGE_MASK) < sizeof(uint32_t))
-copyio.c:229  if (PAGE_SIZE - ((vm_offset_t)p & PAGE_MASK) < sizeof(uint64_t))
+copyio.c:229  if (PAGE_SIZE - ((vm_offset_t)p & PAGE_MASK) < sizeof(uint32_t))

Incremental make nativekernel KERNCONF=VKERNEL64 (fix-build.log, NK_RC=0), exact same PoC re-run inside the patched vkernel:

A → OK(slept 1.470s), B off0xFFC → OK(slept 1.510s) (word now read correctly), C off0xFFC → OK(instant EBUSY) (phantom gone) — RESULT: OK (mask=0), VKPROBE_RC=0.

Baseline-bad behavior is GONE after the one-line-per-function fix.

Negative results (classes hunted and killed in this pass-2)

• exec/exit vs curproc->p_vmspace UAF (copyio.c:49,87,125,157,189,221,313,353 deref with no hold): killed — exec_new_vmspace() calls killalllwps(1) before replacing p_vmspace (kern_exec.c:922-926), and killlwps() blocks until p_nthreads == 1 (kern_exit.c:280-281); exit1() likewise tears down only after every LWP is gone. A thread mid-copyin() must finish its syscall and exit first. No window.
• fault-recovery/onfault chains: vkernel64 has no onfault trampoline here; vm_fault_page() error paths return NULL+error → EFAULT/-1 correctly at every call site (copyio.c:65-66,103-104,139-140,171-172, 204-205,236-237,326-327,367-368).
• busy-vs-hold page release contract: matches vm_fault.c:1100-1107 / 1498-1510 exactly — copyin passes busyp=NULL and always vm_page_unhold (copyio.c:325,338); copyout/casu/swap/fuwordadd* pass &busy and do busy ? vm_page_wakeup : vm_page_unhold (copyio.c:76-79,114-117,146-149, 178-181,210-213,242-245,379-382). pmap_fault_page_quick() is a NULL stub in vkernel64 (pmap.c:703-708), so the formal path (and its COW handling incl. the vkernel-specific pmap_enter at vm_fault.c:1455-1466) is always taken.
• subword/cross-page copies: copyin/copyout page-loop math is exact (n = min(page-remainder, len)); suword*/fuword* inherit it and work cross-page. Only the cas/swap/fetchadd family over-rejects (this finding). No under-strict guard exists → no OOB.
• under-strict guards: none — all six guards reject ≥ the access size required.
• lwbuf failure path: lwbuf on x86-64/vkernel64 is a pure inline DMAP arithmetic wrapper (sys/cpu/x86_64/include/lwbuf.h:77-92) — cannot fail, cannot sleep; lwbuf_free is a no-op.
• -1 sentinel ambiguity (fuword/casu/fubyte returning -1 for a real -1 word): inherited BSD-wide MI contract semantics, same on pc64 — not a finding.
• kernel-address confusion: vm_fault_page on the user map cannot reach vkernel kernel KVA (no entries); growstack side effects match native fault semantics.
• copystr on user pointers: kernel-only MI contract (same as pc64); caller misuse is the DF-3222 class, already filed against dirfs.

Impact ceiling

Application-level malfunction inside a vkernel: futexes at page tail never block correctly (busy-spin / lost sleep / phantom sleep). No kernel memory corruption, no privilege boundary crossed (vkernel user → vkernel user). Severity Low. Guest kernel unaffected (pc64 path correct — verified natively).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.