DF-5727 — DDB watch addr,size (documented syntax) silently drops the size — always watches 4 bytes

Severity: Low (DDB console is root-gated; mis-sized tripwire, compounds the DF-5721 dead-instrument problem with a distinct argument-parsing root cause).

What breaks

ddb(4) documents watch addr[,size] ("The size argument defaults to 4"), but db_command() (db_command.c:386-396) parses ,size into the command's count parameter, and db_watchpoint_cmd() (db_watch.c:198-201) ignores count entirely and instead re-parses the token stream — which is already at end-of-line, so db_expression() returns FALSE and the size silently defaults to 4. (Only the undocumented space form watch addr size reaches the size.)

db_set_watchpoint() then arms loaddr..loaddr+4 instead of the requested region — an operator watching an 8-byte field with the documented syntax watches half of it, with no error.

Live proof (stock kernel)

baseline-up.serial.log / session1-smp.serial.log:

db> watch ticks,8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  4      <-- requested 8, got 4
db> dwatch ticks
db> watch ticks 8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  8      <-- undocumented syntax works

Fix

Honor the parser-provided count (db_watch.c), keep the legacy space form — see fix.diff. Validated on the patched kernel: watch ticks,8 now shows Size 8; watch ticks still defaults to 4.

Reproduce

./serial_vm1.sh up && ./enter_ddb.sh
DF5725_SOCK=/tmp/opencode/df-5725-ser-up.sock ./drive_ddb.py \
   "watch ticks,8" 2 "show watches" 3 "dwatch ticks" 2 \
   "watch ticks 8" 2 "show watches" 3 "dwatch ticks" 2 "c" 8

DF-5727 — VERDICT

reproduced — impact: none (mis-sized tripwire correctness defect; no memory unsafety). The man-page-documented watch addr[,size] syntax silently drops the size and always watches 4 bytes.

Environment

Same rig as DF-5725 (stock X86_64_GENERIC, UP + SMP instances).

Observation (exact)

db> watch ticks,8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  4      <- requested 8, got 4
db> dwatch ticks
db> watch ticks 8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  8      <- undocumented space form works

Root cause (line-accurate)

share/man/man4/ddb.4 (~line 495) documents watch addr[,size] ("The size argument defaults to 4"). db_command() (sys/ddb/db_command.c:385-396) parses ,size into the command callback's count parameter; db_watchpoint_cmd() (sys/ddb/db_watch.c:192-205) ignores count and calls db_expression(&value) again — the token stream is at end-of-line, db_term() returns FALSE (sys/ddb/db_expr.c), so size = 4 unconditionally. Only the undocumented space-separated form reaches a size. db_set_watchpoint() (db_watch.c:101-138) then arms [addr, addr+4) instead of the requested region, with no error.

Given DF-5721 (software watchpoints are inert on x86_64), this compounds the dead-instrument problem with a distinct argument-handling root cause; it also applies to any future arch where software watchpoints work.

Fix validation

fix.diff (db_watch.c): honor the parser-provided count first, keep the legacy space form, keep the 4 default. On the combined-fix kernel (fix_run.log):

db> watch ticks,8
db> show watches
 ... 8          <- comma syntax now honored
db> dwatch ticks
db> watch ticks
 ... 4          <- default preserved

Baseline reproduced / patched behavior corrected → fixed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.