DragonFlyBSD kernel security audit — maintainer briefing
A file-by-file adversarial audit of the DragonFlyBSD kernel
tree (all of sys/, ~2,800 files, two full model passes), run under
coordinated disclosure. Every finding below was machine-verified on the
stock kernel of a QEMU/KVM guest (DragonFly 6.5-DEVELOPMENT, INVARIANTS
build): a working proof-of-concept was executed, the cited
path:line was confirmed in the shipped binary, and — for
5576 of them — the proposed patch was built into a single-fix kernel and
the PoC re-run to prove the bug is gone. Nothing on this page is speculative:
3431 findings reproduced live, 799 were honestly refuted or
gated by missing hardware, and every verdict carries a full evidence pack
(sources, untrimmed logs, panic transcripts, fix.diff) you can re-run
yourself.
SMAP and SMEP do not neutralize the headline chains. We re-ran the weapons on a guest with CR4.SMAP and CR4.SMEP both enabled (rcr4()=0x340630, stock kernel): DF-5845 reached uid=0 on the first attempt (every forged object and its stub live in kernel heap, which this kernel maps RWX — pmap_kenter never sets PG_NX); the DF-3017 devfs chain was re-targeted to uid=0 with both protections on (kernel-heap fake ops table + kernel-text jmp *%rbx gadget + credential-zeroing stub; unprivileged lstat only); DF-2769 is pure logic and immune by construction. Data-only and heap-resident chains are protection-independent — the durable fixes are the small kernel patches, not the CPU flags. Full matrix with logs: findings/SMAP-SMEP-REVIEW.md. Boot note: identcpu.c masks SMEP under CPUID2_VMM by default, so virtualized DragonFly currently runs with SMEP off on capable hardware unless hw.cpu_stdext_disable=0.
1 · Read these first — demonstrated unprivileged → root
These chains were driven to uid=0 on the stock
kernel (film-ready logs in each evidence pack). They are ordered by how easy
they are to trigger. Each is independently fixed by a small patch; the two
halves of the DF-3017 chain are both needed to close the composite.
| ID | Severity | What it is (plain language) | Preconditions | Fix |
|---|---|---|---|---|
| DF-3017 | Critical reproduced | devfs device-node lifetime hole (raced cdev becomes attacker-authored) chained with the DF-2694 socket bug for information recon | none — any local user, no groups/mounts/interaction | ~55-line locking fix in devfs; DF-2694 is a separate 24-line fix |
| DF-5845 | Critical reproduced | firewire FW_ASYREQ copies ioctl data to the ADDRESS of a pointer field, forging an adjacent transfer object | operator group on a FireWire-equipped host (i915-era laptops, add-in cards) | one-character fix (drop the &) + a length bound |
| DF-3156 | Critical reproduced | cd9660 Rock Ridge name parsing overflows a stack buffer on a crafted ISO | attacker-supplied ISO mounted (physical media, downloaded image, or vfs.usermount); constant-injection friendly | 2-line fix (rewind the output pointer) |
| DF-2769 | High reproduced | a killed root terminal session leaves a stale world-writable pty master that a user re-opens and injects into the NEXT root session | none beyond a root shell having existed on the box | 11-line admission check in ptcopen |
| DF-1326 | Critical reproduced | mpr SAS driver PASS_THRU ioctl stack smash (legacy path, needs the HBA) | operator group + LSI SAS2008-class controller | bounded copy in the ioctl path |
| DF-1359 | Critical reproduced | mps SAS driver sibling of DF-1326 | operator group + LSI MPS controller | bounded copy in the ioctl path |
Testing DF-5845 on real hardware? There is a step-by-step field guide for two DragonFly boxes and a FireWire cable here: DF-5845 field test.
2 · Quick wins — small patches, real impact
A hand-picked list of verified fixes that are tiny and self-contained: ideal first commits. All are A/B-validated on rebuilt kernels unless marked otherwise on their finding page.
| ID | Severity | What it fixes | Patch size |
|---|---|---|---|
| DF-0165 | High | caps: jail policy bypass — argument corrupted before the check | 4 lines |
| DF-3156 | Critical | cd9660: stack overflow → root shell from a crafted ISO | 2 lines |
| DF-5845 | Critical | firewire: kernel heap overwrite → root (operator) | 1 char + bound |
| DF-2769 | High | pty: stale master re-open hijacks next root session | 11 lines |
| DF-2244 | Info | iconv: sysctl strcpy into 31-byte stack field | strlcpy + length check |
| DF-2261 | Low | gdbstub: register index OOB write (console holder) | bounds fix |
| DF-2384 | Low | acpi_hp: unprivileged sysctl leaks heap past short BIOS reply | length check |
| DF-3084 | Low | ext2fs: negative directory size → unpriv kernel panic via touch(1) | sign check |
| DF-3359 | Low | rtsock: unpriv route-socket heap-pointer leak (needs one poisoned ifaddr) | clamp sa_len |
| DF-3389 | Medium | IPv6: deferred-transport UAF read of freed ifaddr under churn | snapshot flags |
| DF-2715 | Info | recvmsg leaks kernel-internal flag bit to userspace | strip force bits |
| DF-5848 | Low | nfsd: unauthenticated remote TCP panic via misaligned RPC records | accept MT_HEADER |
| DF-5846 | Medium | nlookup: unprivileged reliable panic via rmdir-of-cwd race | NULL-parent guard |
| DF-2533 | Medium | xdisk: leaked global lock wedges subsystem; wrong-lock release panics | unlock pattern |
| DF-2454 | Low | device-mapper striped table: heap OOB write of table text | clamp advances |
3 · How to work the rest
Triage board: triage.html lists every
finding grouped in your requested priority order (hammer2 → memory corruption
→ privilege escalation → kernel leaks → base system → legacy → contrib), with
per-finding state, priority, owner and comments — the team can edit states
through the collaboration API built into this site.
Finding pages: every finding has a page with the full write-up, CVSS,
CVE cross-reference, the verification verdict, the validated
fix.diff, and a browsable copy of the cited source lines.
Evidence packs: each verified finding ships its pack at
findings/poc/DF-NNNN/ — build.sh / run.sh reproduce the exact
result; VERDICT.md is the narrative. Everything is deterministic
on the stock 6.5-DEVELOPMENT INVARIANTS kernel the audit shipped with.
Severity honesty: findings marked not reproduced were chased
to ground and closed with the reason (hardware-gated, structurally
unreachable, or refuted outright). We do not inflate; a quiet negative result
is recorded with the same care as a hit.
4 · Disclosure
Coordinated disclosure: findings stay private to the audit contributors and the DragonFly project until fixes are confirmed or the 90-day embargo lapses. PoC material is not published before then. The one publicly disclosed item so far is CVE-2026-110912 (DF-0494). Contact and embargo dates are tracked per-finding in the triage board.