DF-5630 VERDICT

Status: reproduced (OOB read proven by value differential) — fix validated

Guest: DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC), cc 8.3. Trigger runs as unprivileged maxx (uid 1001); observability via a root-loaded KLD sysctl harness (df_osrel.ko, in this pack) that exposes struct proc::p_osrel — the exact field the OOB read fills.

Chain

execve(crafted ELF, uid 1001) → exec_elf64_imgact (imgact_elf.c:602) → get_brandinfo loop 1 (imgact_elf.c:550-561) — DragonFly brand has BI_BRAND_NOTE (elf_machdep.c:66) with brandnote {10,4,1,"DragonFly"} (imgact_elf.c:129-136) → check_note → check_PT_NOTE (imgact_elf.c:1721) → note_overflow (imgact_elf.c:1700) bounds ONLY n_namesz → 22 bytes proven; note fields {10,4,1} + vendor "DragonFly\0" all within those 22 bytes → match (imgact_elf.c:1786-1790) → BN_TRANSLATE_OSREL set (imgact_elf.c:134) → bsd_trans_osrel called (imgact_elf.c:1792-1794) → *osrel = *(const int32_t *)(note + 1 + roundup2(10,4)) = (int32_t)(note+24) (imgact_elf.c:1870-1872) — reads 4 bytes at offsets 24..27 of a 22-byte-proven region → with the note at file offsets [4072, 4094): read lands at image_header[4096..4099] — past the first mapped page into the adjacent physical page via the DMAP (kern_exec.c:838-839 → cpu/x86_64/misc/lwbuf.c:95 PHYS_TO_DMAP) → imgp->proc->p_osrel = (imgact_elf.c:867).

Proof (vulnerable kernel #0)

• control binary (full 28-byte note, descriptor 0x44332211 inside the segment): execs; KLD harness reads p_osrel = 1144201745 (0x44332211) — the harness and note plumbing work exactly.
• bug binary (22-byte note, declared descriptor beyond segment/page): execs; p_osrel = 537537071 (0x200a2a2f) = bytes "/*\n " — present nowhere in the 4095-byte crafted file. 3/3 runs. Only possible source: memory past the mapped first page (DMAP neighbor physical page), i.e. the OOB read.
• nonote binary: ENOEXEC (the note was the only branding path).

Impact ceiling on this guest: the 4 bytes land in p_osrel which has no userspace-visible reader (checked: only writes at kern_exec.c:298, imgact_elf.c:867, init_main.c:385) and the read hits DMAP/kmalloc-adjacent memory that stays mapped — no panic, no disclosure today. It is a genuine CWE-125 whose impact is one future p_osrel consumer away (e.g. procstat/sysctl exposure would turn it into a repeatable 4-byte kernel memory oracle), and it can read past a kmalloc chunk in the heap path (imgact_elf.c:1757-1769).

Fix validation (kernel #1, patched, built 23:30 UTC)

• bug binary → "Exec format error" (ENOEXEC): the truncated note is now rejected by the strengthened note_overflow (whole declared note must fit), so no brand, no trans_osrel call.
• control binary → still execs, p_osrel = 0x44332211 — legitimate ABI notes (every real DragonFly binary) are unaffected.
• nonote binary → ENOEXEC as before.

Root cause lines: sys/kern/imgact_elf.c:1700-1707 (note_overflow) + 1866-1875 (bsd_trans_osrel), enabled by elf_machdep.c:66-67 brandnote wiring.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.