β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5804

gsignal() leaks the pgfind() reference β€” permanent pgrp/session leak if ever called

Summary

gsignal calls pgfind(pgid) which returns a held reference that must be released with pgrel (documented kern_proc.c:694-698; every other caller pairs them) and never pgrel()s, while pgsignal takes and drops its own separate reference β€” each call leaks one pg_refs and the pgrp plus its session reference can never be reclaimed. No in-tree callers today (dead exported symbol): latent leak filed so the symbol is fixed before someone wires it up. pgrel-after-pgsignal fix proposed.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5804 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1000 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5804

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace vs pgfind/pgrel contract kern_proc.c:637-720

Verified recommended fix

pgrel after pgsignal

Verdict

untested (inspection-only finding; dead kernel symbol / hardening item - Phase V not applicable per contract)