DF-5724 — unvalidated $tabstops DDB variable: divide-by-zero trap cascade / infinite-loop hard hang

File: sys/ddb/db_output.c (db_force_whitespace), sys/ddb/db_variables.c Severity: Medium (whole-host unrecoverable freeze from the DDB console; DDB entry is reachable by jailed root via sysctl debug.enter_debugger per DF-2246) Status: reproduced live (both variants), fix validated on a rebuilt kernel.

The bug

set $tabstops=N stores N into db_tab_stop_width with no validation (sys/ddb/db_variables.c:52 registration, db_write_variable sys/ddb/db_variables.c:120-128 does a raw store). The output layer then computes

/* sys/ddb/db_output.c:65 */
#define NEXT_TAB(i) rounddown((i) + db_tab_stop_width, db_tab_stop_width)
/* sys/sys/param.h:400 */
#define rounddown(x, y) (((x)/(y))*(y))     /* no zero guard */

inside db_force_whitespace() (sys/ddb/db_output.c:74-93), which runs on every printing character of every DDB prompt/output line — and, critically, at the top of every db_readline() (sys/ddb/db_input.c:306).

• tabstops=0 -> rounddown(x,0) = integer division by zero -> #DE (x86 trap 18) inside the stopped-machine debugger. The trap handler's own output re-triggers the division: cascading fatal traps, each ~0x370 of kernel stack consumed, until the machine is a silent brick.
• tabstops=-8 -> next_tab computes <= 0, next_tab <= db_output_position holds, the inner while (last_print < next_tab) never advances and the outer while (last_print < db_output_position) spins forever — hard hang with all CPUs stopped, no trap, no output, ssh dead. (The pending trailing space of the very next "db> " prompt is enough — db_readline's synch call fires it before any command is even typed.)

Same class for huge tabstops (0x7fffffffffffffff): signed overflow in (i) + db_tab_stop_width wraps negative -> same non-advancing loop.

Build / run

./serial_vm.sh up
ssh -F ../../../dfbsd-qemu/config dfbsd 'sysctl debug.enter_debugger=ddb'   # root vehicle
python3 drive.py A    # set $tabstops=0  -> fatal trap 18 cascade
# reboot, then
python3 drive.py B    # set $tabstops=-8 -> silent hard hang

Expected output

Variant A (stock, serial.variantA.log, 31 traps):

db> set $tabstops=0
db>
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer     = 0x8:0xffffffff802cba26      <- db_force_whitespace+0x26
...
Fatal trap 18: ... (31x, stack pointer descending 0xfffff801183f7458 -> 0xfffff8004f0686d8)
[then silence; ssh dead; only a hard QEMU reset recovers]

Variant B (stock, serial.variantB.log):

db> set $tabstops=-8
db>                                      <- last output ever; no echo, no trap
[ssh dead; CPU spinning in db_force_whitespace; hard reset required]

Fixed kernel (serial.fixedkernel.log, built from fix.diff):

db> set $tabstops=0
tabstops must be >= 1
db> x/x db_active
db_active:      1
db> set $tabstops=-8
tabstops must be >= 1
db> print/d 5
          5
db> x/x db_active
db_active:      1
db>                                    <- session fully alive

Fix

fix.diff — validating db_varfcn_t setters for $tabstops/$maxwidth (reject < 1 via db_error, which longjmps before the store, sys/ddb/db_command.c:481-488) plus a defensive db_tab_stop_width > 0 ternary in NEXT_TAB so no future writer can #DE/hang the debugger. Validated: baseline (trap cascade + hang) vs patched (clean rejection, debugger alive) on the same guest, same rig.

DF-5724 VERDICT — reproduced (panic-class trap cascade + hard hang), fix validated

Narrative

$tabstops is a raw-settable DDB variable (sys/ddb/db_variables.c:52, :120-128). db_force_whitespace() (sys/ddb/db_output.c:74-93) evaluates NEXT_TAB(i) = rounddown(i + db_tab_stop_width, db_tab_stop_width) and DragonFly's rounddown (sys/sys/param.h:400) has no zero guard.

Variant A — set $tabstops=0 (stock kernel, live): accepted silently. The next "db> " prompt leaves a pending trailing space (pos=4, last_non=3); db_readline()'s output-position sync (sys/ddb/db_input.c:306) calls db_force_whitespace(), which executes rounddown(3+0, 0) -> fatal trap 18 (integer divide fault) in kernel mode, RIP 0xffffffff802cba26 = db_force_whitespace+0x26 (symbolized via nm, env.txt). Because the trap handler itself prints through the same path, the machine enters a cascade of 31 identical fatal traps (serial.variantA.log), the kernel stack descending from 0xfffff801183f7458 to 0xfffff8004f0686d8 (~0x370/trap) before going silent. ssh dead; only a hard reset recovers. Fatal trap 18 count: 31.

Variant B — set $tabstops=-8 (stock kernel, live): accepted silently; the same prompt-sync enters the whitespace loop with next_tab = 0 <= pos and an inner while (last_print < next_tab) that never advances -> silent infinite loop with all CPUs stopped (serial.variantB.log: transcript ends at the prompt; zero traps; ssh dead). The exact print/d 5 trigger (db_printf("%11ld") leading spaces at column 0) was never even needed — the prompt's own pending space suffices.

Controls in-session: before each set, x/x db_active prints normally (tabstops still 8).

Fix validation (same guest, rebuilt kernel): fix.diff applied to the guest's /usr/src (md5-verified source parity with the audited tree), kernel rebuilt (nativekernel, BUILD_RC=0, installed #1: Sat Oct 10 17:53:17 UTC 2026), guest rebooted, identical driver rerun: both variants now print tabstops must be >= 1 (db_error longjmp aborts the set before the store), and the previously-fatal commands (x/x db_active, print/d 5) work; the DDB session stays fully alive and c continues. Zero fatal traps (serial.fixedkernel.log). Baseline vs patched captured in the same pack.

Impact

Whole-host unrecoverable freeze/trap-cascade from the DDB console. DDB entry itself needs root — including jailed root via sysctl debug.enter_debugger=ddb (reachability established by DF-2246), so the realistic ceiling is "jailed root freezes the entire host, survives nothing less than a hard reset". No memory corruption, no info leak: pure DoS/panic class. Severity Medium (matches DF-2246's bar), confidence certain.

Exploit chain

(none — denial of service only) jailed root -> sysctl debug.enter_debugger=ddb -> set $tabstops=0 -> cascade of fatal trap 18 (db_force_whitespace+0x26) eating the kernel stack -> brick; or set $tabstops=-8 -> infinite loop in db_force_whitespace with all CPUs stopped -> silent brick.

Kernel references

• sys/ddb/db_output.c:65 (NEXT_TAB), :74-93 (db_force_whitespace loop/div)
• sys/ddb/db_variables.c:48-53 (raw variable table), :120-128 (unvalidated store)
• sys/ddb/db_input.c:306 (db_readline sync call that fires it)
• sys/sys/param.h:400 (rounddown without zero guard)
• sys/ddb/db_command.c:481-488 (db_error longjmp used by the fix)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.