DF-5774 — -n : / -n '' makes strtok() return NULL and strtol(NULL) kills the vkernel before boot

File: sys/platform/vkernel64/platform/init.c Lines: 394-395 Severity: Low (operator-input NULL-deref DoS of the vkernel process at option parsing) Status: reproduced (stock) / fix validated.

Reproduce (guest, root, VKERNEL64 built)

cd /usr/obj/usr/src/sys/VKERNEL64
ktrace -i -f /tmp/vk5774.ktrace ./kernel.debug -m 512m -n : ; echo monitor rc=$?
kdump -f /tmp/vk5774.ktrace | grep PSIG

Expected output

Vulnerable (baseline_run.log / baseline.kdump.txt):

monitor rc=0
kernel.debug PSIG  SIGSEGV SIG_DFL      <- vkernel child dies in strtol(NULL)
(no boot output at all)

Control -n 2 parses fine and the boot proceeds (Using anonymous memory (512 MB)).

Fixed (fixed_run.log, rebuilt kernel with fix.diff hunk 2):

-- kdump signals:
kernel.debug CALL  exit(0x40)           <- EX_USAGE, no signal
-- output was:
Bad -n option

Root cause

init.c:394 tok = strtok(optarg, ":"); returns NULL when the whole -n argument is delimiters or empty (-n :, -n '', -n ::), and init.c:395 passes it straight to strtol(tok, NULL, 0) — a NULL nptr dereference in libc. The child segfaults during getopt, the monitor sees a signaled child (WEXITSTATUS of the wait status is 0) and exits 0 with zero diagnostics.

Fix

fix.diff hunk 2: NULL-check tok and usage_err("Bad -n option").

DF-5774 — VERDICT

Status: reproduced (stock kernel, deterministic). Fix validated on a rebuilt kernel. Impact: none beyond process death (DoS of the vkernel at startup); classified Low. Confidence: certain.

-n : (or an empty -n argument): strtok(optarg, ":") at init.c:394 consumes the whole delimiter string and returns NULL; init.c:395 optcpus = strtol(tok, NULL, 0) dereferences NULL inside libc → SIGSEGV of the vkernel child during option parsing, before writepid()/boot output. The monitor's WEXITSTATUS(status) (init.c:228) on a signaled child yields 0, so the whole vkernel exits 0 silently — no diagnostic, no core by default.

Live: ktrace/kdump on the guest shows kernel.debug PSIG SIGSEGV SIG_DFL (baseline.kdump.txt) with an empty boot log; control -n 2 boots (Using anonymous memory (512 MB)). This is the same operator-input crash class as the known DF-1031 (init_disk NULL deref on -c) but a distinct defect at a different site (option parsing, not device setup).

Fix (fix.diff hunk 2: if (tok == NULL) usage_err("Bad -n option");) validated on the rebuilt kernel: kdump now shows CALL exit(0x40) (EX_USAGE) and the message Bad -n option — no signal, no crash (fixed_run.log).

Not uid0-relevant: no memory-corruption primitive (NULL read).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.