DF-5686 — udev_getdevs_ioctl() leaks the cdevs prop_array (and pins every device dict) per UDEVPROP ioctl

What

udev_getdevs_ioctl() (sys/kern/kern_udev.c:961-1015), the consumer of prop_dictionary_copyout_ioctl() from sys/libprop/prop_kern.c:

kern_udev.c:985 ctx.cdevs = prop_array_create(); / refcnt 1 / kern_udev.c:992 devfs_scan_callback(..., &ctx); / fills array / kern_udev.c:1004 prop_dictionary_set(odict, "array", ctx.cdevs); / retain -> 2 / kern_udev.c:1013 prop_object_release(odict); / -> 1 /

prop_dictionary_set() does NOT transfer ownership — the caller's own reference is never released, so every UDEVPROP "getdevs" ioctl leaks the whole cdevs array plus one reference on every cdev's si_dict (device dicts can then never be freed, even on device destruction).

Reachability: /dev/udev is 0600 root:wheel (kern_udev.c:1039-1041), so the direct trigger is privileged — but devd(8) performs the same getdevs ioctl during normal operation on default systems (observed: proparay/prop_array counts creeping up from devd during an otherwise idle session).

Reproduce

$ cc -O2 -o udev_getdevs_leak udev_getdevs_leak.c $ vmstat -m | grep -i prop > b $ ./udev_getdevs_leak /dev/udev 500 $ vmstat -m | grep -i prop > a # proparay/prop_array InUse grew by ~490

Expected (vulnerable): proparay +490, prop_array +490 InUse / +625KB per 500 ioctls.

Expected (patched, fix.diff): prop_array InUse stays 0, proparay flat.

DF-5686 VERDICT

Status: REPRODUCED (kernel heap leak per UDEVPROP getdevs ioctl; root-gated direct trigger, devd-triggered on default systems) — FIXED by fix.diff (validated on rebuilt kernel)

Reproduction (baseline kernel #0, as root — /dev/udev is 0600)

500 × ioctl(/dev/udev, UDEVPROP, {"command":"getdevs"}):

before: proparay 1.97K InUse / 378K prop_array 1.96K InUse / 251K after: proparay 2.46K InUse / 472K prop_array 2.45K InUse / 876K

Delta for 500 ioctls: +490 proparay, +490 prop_array InUse, +625 KB — one leaked array-of-all-cdevs (~1.3 KB) per call, plus one permanent reference on every cdev's si_dict per call (unobservable in vmstat but strictly implied by the missing release: refcounts grow without bound, so device dicts outlive device destruction).

Idle-session observation (no PoC running): proparay/prop_array InUse crept 1→9 over ~10 minutes — devd(8)'s own getdevs polling leaking on a default install.

Fix validation (patched kernel #1, prop_object_release(ctx.cdevs) added at kern_udev.c:1013)

500 ioctls as root: before: proparay 2 / 384B prop_array 0 InUse after: proparay 2 / 384B prop_array 0 InUse FLAT — leak eliminated.

kernel_refs

sys/kern/kern_udev.c:985, 992, 1004-1008, 1011-1014 sys/libprop/prop_kern.c:585-590 (prop_dictionary_copyout_ioctl consumer contract)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.