DF-5683 — sys_vquotactl() leaks the entire prop object graph on every call (unprivileged)

What

sys_vquotactl() (sys/kern/vfs_quota.c:328-413) — the consumer of prop_dictionary_copyin() from sys/libprop/prop_kern.c — never releases any of the objects it creates or copyin'd:

• vfs_quota.c:346 dict from prop_dictionary_copyin() — never released
• vfs_quota.c:362 cmd from prop_dictionary_get_cstring() (an allocated copy, prop_dictionary_util.c:183-198) — never freed
• vfs_quota.c:374 pa_out from prop_array_create() (+ every item added by cmd_get_usage_all()) — never released
• vfs_quota.c:405 dict = prop_dictionary_create() (reassigns over the still- un-released copyin'd dict) — never released
• vfs_quota.c:351-356 error paths return without nlookup_done(&nd), leaking nlookup root/namecache references per failing call

Reachability

syscall 530 vquotactl(2), no privilege required (there is no priv check anywhere in the function); gated only on the vfs.quota_enabled boot tunable. Base-system vquota(8) ("show"/"sync"/"limit"/"ulim"/"glim") drives it.

Reproduce (baseline, vulnerable kernel)

1. boot guest with vfs.quota_enabled=1 in /boot/loader.conf
2. cc -O2 -o vq_leak_loop vq_leak_loop.c
3. as an unprivileged user: - vmstat -m | grep -i prop (t0) - ./vq_leak_loop / 1000 ; snapshot t1 ; ./vq_leak_loop / 1000 ; snapshot t2

Expected output (vulnerable kernel)

Linear growth of prop malloc types, ~1.6 KB kernel heap per call: t0: propdict 178 / proparay 9 / prop_string 319 t1: propdict 3100 (+2920) / proparay 1009 (+1000) / prop_string 2260 t2: propdict 6030 (+2930) / proparay 1960 (+950) / prop_string 4220 (≈ +1.9 MB live kernel memory per 1000 unprivileged syscalls, unreclaimable)

Expected output (patched kernel, fix.diff applied)

prop malloc types FLAT across 2000 calls (+2 allocs total).

Files

• vq_leak_loop.c tight in-process driver (raw syscall 530, hand-crafted XML)
• vq_leak.sh shell variant driving /sbin/vquota
• build.sh / run.sh
• build.log / run.log (baseline) / run.patched.log (fix validation)
• fix.diff minimal leak fix (git-applyable, sys/kern/vfs_quota.c)
• fix_combined.diff the combined diff actually built & validated in the guest
• fix_build.log / fix_run.log
• VERDICT.md / manifest.json / verdict.json

DF-5683 VERDICT

Status: REPRODUCED (leak, unprivileged) — and FIXED by fix.diff (validated on a rebuilt kernel)

Environment

• Guest: DragonFly 6.5-DEVELOPMENT x86_64, kernel #0: Thu Jul 2 06:02:54 UTC 2026 (baseline) / #1: Sat Oct 10 00:36:54 UTC 2026 (patched, fix applied).
• vfs.quota_enabled=1 boot tunable (feature is OFF by default; the syscall returns EOPNOTSUPP otherwise — same gate DF-2231 documented).
• Driver runs as unprivileged uid 1001 (maxx).

How it reproduces

vquotactl(2) (syscall 530) with <plist><dict><key>command</key><string>get usage all</string><key>arguments</key><string>x</string></dict></plist> walks exactly the leaking path:

sys_vquotactl (vfs_quota.c:328) -> prop_dictionary_copyin(&pref, &dict) [prop_kern.c:454] -> prop_dictionary_get_cstring -> cmd (kmalloc copy) -> prop_array_create() pa_out; cmd_get_usage_all() fills it -> goto done; dict = prop_dictionary_create() (shadows the copyin'd dict) -> prop_dictionary_copyout(&pref, dict) [prop_kern.c:554] -> return — no prop_object_release anywhere, no nlookup_done on the nlookup error paths (vfs_quota.c:351-356).

Baseline measurements (vmstat -m, three checkpoints t0/t1/t2 = 0/1000/2000 calls)

≈ +1.6-1.9 KB live kernel heap per unprivileged syscall, perfectly linear, zero errors, never freed (InUse never drops). With vm.kmem_size ≈ 390 MB, ~250k calls (minutes) exhaust kernel heap.

An equivalent one-shot demo with base-system tooling (as uid 1001): vquota show / — each invocation performs exactly one vquotactl round trip.

Fix validation (fix.diff / fix_combined.diff)

Applied to the guest's /usr/src (vfs_quota.c leak fixes: prop_object_release of dict/pa_out/odict on every exit, prop_dictionary_get_cstring_nocopy for cmd, nlookup_done on error paths), make nativekernel KERNCONF=X86_64_GENERIC, installkernel, reboot into kernel #1.

Patched kernel, 2000 root-driven calls (root passes the DF-5684 priv gate and exercises the identical leak path): - proparay 1→2, propdict 150→152, propstng 314→315 (+2 objects total, i.e. per-boot transient, not per-call) vs +9,770 objects on baseline. - LEAK ELIMINATED. Unprivileged callers additionally get EPERM from the companion privilege fix (DF-5684) before any allocation.

Why this is a real finding beyond DF-2231

DF-2231 covers the copyin size handling in sys/libprop/prop_kern.c (unbounded pref_len, dead prop_object_copyin_limit). This finding is the consumer lifetime bug: even a perfectly-sized, fully-parsed dictionary is leaked wholesale by sys_vquotactl on every call, on the success path, with no malformed input required.

kernel_refs

sys/kern/vfs_quota.c:345-346, 351-356, 362, 374, 405-408 sys/libprop/prop_kern.c:454-458 (prop_dictionary_copyin), 554-557 (copyout) sys/libprop/prop_dictionary_util.c:183-198 (get_cstring allocates a copy)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.