⬢ DragonFlyBSD Kernel Audit
← full dashboard

Triage — Dillon priority

Every finding grouped in the order the project asked to sift them: Hammer2 first, then kernel memory corruption (UAF-style), privilege escalations on general-use paths, and kernel leaks; ancient subsystems (PPP, iSCSI, NTFS, SMB) are grouped last and deferred. Triage state, owner and comments are shared with the team via the collaboration API.

5801
findings
3212
pass 2 · new
5797
untriaged
4
touched

Hammer2 94

Dillon's first ask: anything in sys/vfs/hammer2.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5799 High 8.8 hammer2_cleanup_devvp() unconditionally clears dev->si_mountpoint, stripping the kernel's raw-device write gate and double-mount protection from live hammer2 devices and from other filesystems' devices
sys/vfs/hammer2/hammer2_vfsops.c:1096
 dos reproduced fixed untriaged — —
DF-5836 Medium 5.7 hammer2_inode_create_normal stomps a live inode when the media-seeded inum allocator collides — only a compiled-out KKASSERT guards it (panic on INVARIANTS; meta clobber + duplicate on-media chain insertion on production kernels)
sys/vfs/hammer2/hammer2_inode.c:1156
 panic reproduced fixed untriaged — —
DF-5784 High 5.5 hammer2_chain_cmp key-range end overflow: crafted bref with key + (1<<keybits) > 2^64 wraps the comparator range, mis-ordering the in-memory rbtree (pruned by RB_SCAN, duplicated by every lookup) and regressing iteration keys — unkillable getdents live-lock, hung umount, and unbounded kernel chain leak from a mounted crafted image
sys/vfs/hammer2/hammer2_chain.c:109
 dos reproduced fixed untriaged — —
DF-5785 Medium 5.5 Unvalidated on-disk blockref type byte: any media array slot with type outside 1..6 selected by lookup reaches hammer2_chain_alloc's raw panic() — deterministic kernel panic (mount + one directory read) on production kernels
sys/vfs/hammer2/hammer2_chain.c:207
 panic reproduced fixed untriaged — —
DF-5843 Medium 4.4 hammer2_xop_inode_chain_sync: KKASSERT(0) kernel panic on INODE/DIRENT-typed child during file truncation — crafted/corrupted-image local DoS
sys/vfs/hammer2/hammer2_xops.c:1570
 panic reproduced fixed untriaged — —
DF-5820 Low 3.6 hammer2_vop_nrename masks backend ENOENT as success and commits rename bookkeeping (tip nlink--/DELETING, iparent/name_key rewrite, cache_rename) against an unrenamed media topology
sys/vfs/hammer2/hammer2_vnops.c:2165
 none not_reproduced not_testable untriaged — —
DF-5818 Medium 3.3 hammer2_write_file never enforces the append-only chflag (uappnd/sappnd): writable descriptors can overwrite arbitrary offsets of append-only files
sys/vfs/hammer2/hammer2_vnops.c:997
 dos reproduced fixed untriaged — —
DF-5817 Low 3.3 hammer2_vop_write checks RLIMIT_FSIZE against the pre-append offset, so O_APPEND writes bypass the file-size rlimit entirely (no EFBIG, no SIGXFSZ)
sys/vfs/hammer2/hammer2_vnops.c:869
 dos reproduced fixed untriaged — —
DF-5819 Low 2.5 hammer2_vop_nsymlink unconditionally discards the symlink-data write error ('/* XXX handle error */ error = 0;')
sys/vfs/hammer2/hammer2_vnops.c:1847
 none not_reproduced not_testable untriaged — —
DF-5786 Info 2.5 Kernel heap/buffer pointer disclosure to unprivileged dmesg readers via unconditional %p kprintf in hammer2 reptrack debug and check-failure paths
sys/vfs/hammer2/hammer2_chain.c:2266
 kernel address disclosure to non-root dmesg readers untested not_testable untriaged — —
DF-5821 Info 2.5 hammer2_vop_reclaim kprintf discloses vp/ip kernel pointers to the console/msgbuf
sys/vfs/hammer2/hammer2_vnops.c:183
 none not_reproduced not_testable untriaged — —
DF-2647 High 8.2 hammer2_ioctl_pfs_get trusts on-media uint16 name_len past a KKASSERT — production kernels get a controlled kernel heap OOB write up to ~64KB
sys/vfs/hammer2/hammer2_ioctl.c:494 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2616 High 7.8 No radix-alignment/64KB-window validation of on-disk data_off — chain->data + chain->bytes overruns the DIO buffer (OOB read/write)
sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2620 High 7.8 Crafted on-disk pfs_nmasters drives OOB thread-array access and arbitrary kfree in hammer2 unmount (xop_helper_cleanup)
sys/vfs/hammer2/hammer2_vfsops.c:527 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2619 High 7.1 Dirent namlen unbounded by chain->bytes: OOB read past 64KB DIO buffer in dirent_test AND 127-byte kernel-memory disclosure to userspace via getdents
sys/vfs/hammer2/hammer2_chain.c:5781 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2618 Medium 6.6 Overlapping key ranges in on-disk blockref arrays unvalidated — chain-insert collision panic or RB_REMOVE wipes the parent's rbtree root
sys/vfs/hammer2/hammer2_chain.c:313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2621 High 6.3 hammer2_xop_helper_create() re-kmallocs pmp->xop_groups unconditionally — leaked thread array and orphaned threads that use-after-free the pmp
sys/vfs/hammer2/hammer2_admin.c:431 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2645 Medium 6.3 Flush-driven indirect collapse contradicts its own skip guard: concurrent child COW-modify during hammer2_chain_indirect_maintenance leaves a live child, tripping the unconditional repchange emptiness KKASSERT (panic) or orphaning the subtree (silent data loss)
sys/vfs/hammer2/hammer2_flush.c:1039 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2658 Medium 6.0 hammer2_sync_replace() resize is a guaranteed no-op (radix of chain->bytes instead of focus->bytes): heap OOB read persisted to media / silent truncation / NULL-source bcopy for embedded dirents
sys/vfs/hammer2/hammer2_synchro.c:939 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2617 Medium 5.5 Zero-offset data_off on data-requiring bref types silently yields chain->data==NULL with error==0 — NULL panic or unkillable while(1) tsleep hang
sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2626 Medium 5.5 hammer2_read_file ignores uiomovebp() error: user-triggered unkillable in-kernel infinite loop (read/readlink EFAULT livelock)
sys/vfs/hammer2/hammer2_vnops.c:983 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2630 Medium 5.5 hammer2 VFS_ROOT quorum wedge: pfs_nmasters > nchains pins mount forever and holds the namecache lock
sys/vfs/hammer2/hammer2_vfsops.c:1966 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2633 Medium 5.5 hammer2 write() silently succeeds while backend allocation fails on full PFS (ENOSPC never reaches the writer)
sys/vfs/hammer2/hammer2_strategy.c:1310 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2640 Medium 5.5 Unguarded hammer2_chain_dirent_test() calls in the xop backend lookup loops are the first dereference of a NULL-data chain — unprivileged post-mount kernel panic (survives DF-2617's fix)
sys/vfs/hammer2/hammer2_xops.c:282 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2651 Medium 5.5 NULL-pointer dereference in hammer2_freemap_adjust() when the freemap leaf is absent — mount-time panic from crafted image
sys/vfs/hammer2/hammer2_freemap.c:1013 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2655 Medium 5.5 hammer2 ZLIB decompression failure returns zero-filled SUCCESS (b_error never set) — silent data substitution on malformed compressed blocks
sys/vfs/hammer2/hammer2_strategy.c:258 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2657 Medium 5.5 Sync-thread xop quorum counts the excluded node: hammer2_xop_collect() can never reach quorum, permanently parking every sync thread (h2coll) — precise fixable root cause of the DF-2631 umount -f wedge family
sys/vfs/hammer2/hammer2_synchro.c:411 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2662 Medium 5.5 hammer2_update_spans() dereferences chain->data of an EIO-failed inode chain (NULL deref panic, unmasked by DF-2661's fix)
sys/vfs/hammer2/hammer2_iocom.c:313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2652 High 5.3 Wrong bitmap-pair index (& 15 instead of 5-bit mask) in hammer2_freemap_adjust() DORECOVER — live blocks left marked free, overlapping allocations and silent cross-file data corruption
sys/vfs/hammer2/hammer2_freemap.c:1073 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2624 Medium 5.1 hammer2_pfsalloc kstrdup(ripdata->filename) with no NUL bound overreads the 64KB DIO buffer (mount-time panic / silent adjacent-heap overread)
sys/vfs/hammer2/hammer2_vfsops.c:495 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2635 Medium 5.1 iroot meta.inum overwritten from media after inum-hash insertion — hammer2_inode_drop walks off the wrong bucket (NULL-deref panic at unmount plus in-memory inode aliasing)
sys/vfs/hammer2/hammer2_inode.c:617 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2627 Medium 4.7 hammer2_vop_readdir reads uninitialized stack (bref) on first-xop-error and discloses it to userspace via the directory cookie/offset
sys/vfs/hammer2/hammer2_vnops.c:745 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2632 Medium 4.7 hammer2 flusher panics on dense dirent packing: 'insert base overlapping elements' (unprivileged local DoS)
sys/vfs/hammer2/hammer2_chain.c:5308 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2642 Medium 4.7 zero_write() drops hammer2_chain_delete() failure: all-zero block overwrite silently succeeds while the old data chain survives the topology — reads resurrect pre-overwrite content after buffer-cache eviction
sys/vfs/hammer2/hammer2_strategy.c:1298 · pass 2 · new
 none reproduced inconclusive untriaged — —
DF-2644 Medium 4.7 hammer2_xop_inode_flush NULL-derefs the PFS-root chain during sync when its media re-read fails (kernel panics on a recoverable I/O error)
sys/vfs/hammer2/hammer2_flush.c:1334 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2646 Medium 4.7 hammer2_flush_core LOST CHILD3 panics on the NULL->non-NULL parent transition (unconditional KKASSERT / hammer2_chain_unlock(NULL))
sys/vfs/hammer2/hammer2_flush.c:681 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2649 Medium 4.7 NULL parent->data dereference in hammer2_bulkfree_scan's PFSROOT kprintfs when a PFS-root chain fails to load with a non-CHECK error
sys/vfs/hammer2/hammer2_bulkfree.c:143 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2660 Medium 4.7 hammer2_sync_insert() TOCTOU re-lookup races concurrent same-key creates on mounted rw clusters: KKASSERT(chain == NULL) panics INVARIANTS kernels (duplicate-key chain_create on production)
sys/vfs/hammer2/hammer2_synchro.c:741 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2661 Medium 4.7 hammer2 DIO error path leaves stale dio->bp with DIO_GOOD cleared; concurrent accessor trips KKASSERT(dio->bp == NULL) and panics
sys/vfs/hammer2/hammer2_io.c:350 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2663 Medium 4.7 hammer2 mount-time volume-size containment check silently skipped when DIOCGPART fails; forged volu_size beyond backing media accepted, short-read media-EOF semantics then serve uninitialized kernel memory as file data
sys/vfs/hammer2/hammer2_ondisk.c:283 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2638 Low 4.7 hammer2_inode_chain_sync clears RESIZED/MODIFIED before the backend sync and never restores them on error — silent metadata loss
sys/vfs/hammer2/hammer2_inode.c:1718 · pass 2 · new
 none untested not_testable untriaged — —
DF-2641 Low 4.7 Latent unguarded chain->data derefs in xop_nrename/xop_unlink/chain_sync (539 lacks even the error check its siblings have; 670-678/1618 are NULL-offset WRITE variants after modify-succeeds-with-NULL)
sys/vfs/hammer2/hammer2_xops.c:539 · pass 2 · new
 none untested not_testable untriaged — —
DF-2643 Low 4.7 hammer2_xop_strategy_write dereferences the inode chain without the NULL check the read xop performs — NULL-deref panic if the inode's cluster chain is concurrently gone
sys/vfs/hammer2/hammer2_strategy.c:623 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2901 Low 4.7 hammer2 bulkfree scan uses kmem_alloc_swapbacked() result unchecked — NULL bitmap reaches bzero(NULL, size) panic in cbinfo_bmap_init; path is unprivileged via the ungated HAMMER2IOC_BULKFREE_SCAN/ASYNC ioctls
sys/vfs/hammer2/hammer2_bulkfree.c:569 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-5849 Low 4.7 hammer2_xop_start_except NULL deref under unpriv nlookup storm mode 0xd - candidate new finding
sys/vfs/hammer2/hammer2_xops.c · pass 2 · new
 — — — untriaged — —
DF-2636 Medium 4.4 hammer2_igetv panics on unhandled on-media objtype (0,3,8,10,11..255) — crafted-image kernel DoS at mount/first access
sys/vfs/hammer2/hammer2_inode.c:791 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2653 Medium 4.4 sub_key-derived bitmap index overflows the 64-bit element in hammer2_bmap_alloc() for non-radix-aligned crafted DATA bref keys — KKASSERT panic (INVARIANTS) / truncated mask with overlapping 64K allocations (noinv)
sys/vfs/hammer2/hammer2_freemap.c:663 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2631 Medium 4.1 umount -f of a same-clid multi-device hammer2 cluster hangs in hammer2_thr_wait (h2twait) on unmodified images
sys/vfs/hammer2/hammer2_admin.c:461 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-2659 Low 4.1 NULL column chain during sync: hammer2_inode_chain_and_parent() cannot return NULL (panics at chain->parent first) and synchro.c evaluates chain->bref.modify_tid BEFORE its own if (chain) guard
sys/vfs/hammer2/hammer2_synchro.c:417 · pass 2 · new
 none untested not_testable untriaged — —
DF-2648 Low 3.8 HAMMER2IOC_VERSION_GET and HAMMER2IOC_INODE_GET ignore the caps_priv_check result (privilege gate bypass)
sys/vfs/hammer2/hammer2_ioctl.c:86 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2614 Low 3.6 Debug kprintf's in hammer2 cluster message path leak kernel heap pointer to msgbuf and allow peer-driven console flooding
sys/vfs/hammer2/hammer2_iocom.c:135 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2622 Low 3.3 One-byte stack out-of-bounds read in hammer2_vfs_mount label parsing for empty or '@'-only device strings
sys/vfs/hammer2/hammer2_vfsops.c:1012 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2629 Low 3.3 hammer2_vop_setattr applies va_mtime with no owner/VA_UTIMES_NULL privilege check (divergence from the VFS contract UFS enforces)
sys/vfs/hammer2/hammer2_vnops.c:561 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2637 Low 3.3 Kernel heap-pointer (%p) kprintf disclosures on four hammer2 inode error paths
sys/vfs/hammer2/hammer2_inode.c:711 · pass 2 · new
 none untested not_testable untriaged — —
DF-2628 Low 2.5 hammer2_vop_nlink increments meta.nlinks even when hammer2_dirent_create fails — permanent link-count inflation and unfreeable inodes
sys/vfs/hammer2/hammer2_vnops.c:1599 · pass 2 · new
 none inconclusive — untriaged — —
DF-2639 Low 2.3 hammer2_inode_create_pfs never sets *errorp on its done2 error paths — snapshot ioctl silently succeeds without creating anything
sys/vfs/hammer2/hammer2_inode.c:1042 · pass 2 · new
 none untested not_testable untriaged — —
DF-2623 Low 1.9 hammer2_fixup_pfses kprintf uses ripdata captured before hammer2_chain_modify COW'd and released the buffer
sys/vfs/hammer2/hammer2_vfsops.c:2399 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2664 Low 1.9 Vendored LZ4 r97: LZ4_decompress_safe() reads one byte past the source buffer when inputSize==0 (upstream r96/v1.9.4 guard missing)
sys/vfs/hammer2/hammer2_lz4.c:407 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2666 Low 1.9 HAMMER2IOC_RECLUSTER leaks the holdfp() file reference on both error returns in hammer2_ioctl_recluster() — permanent struct-file pin per failing call
sys/vfs/hammer2/hammer2_ioctl.c:212 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2656 Info 1.1 hammer2 zlib port drops zcalloc's zero-initialization: deflate window/state kmalloc'd unzeroed, leaving stale-heap reads whose output-independence rests on subtle invariants
sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:239 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2665 Info 1.1 Vendored LZ4 is upstream r97 (2013) — 13 years of upstream hardening absent (cross-reference; upstream-owned history)
sys/vfs/hammer2/hammer2_lz4.c:372 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2650 Medium — KKASSERT(radix != 0) in h2_bulkfree_callback — deterministic unprivileged kernel panic from a radix-0 on-disk data_off
sys/vfs/hammer2/hammer2_bulkfree.c:847 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-0763 High 7.8 Missing on-disk radix validation in chain allocation — malicious filesystem image radix 17-31 causes heap OOB read/write via bcopy/hash/CRC/array iteration
sys/vfs/hammer2/hammer2_chain.c:189 · 📝
 panic reproduced fixed triaged P0 dillon 1
DF-0821 High 7.8 OOB kernel heap read/write via crafted signed bmap->linear from filesystem image
sys/vfs/hammer2/hammer2_freemap.c:616
 panic reproduced fixed untriaged — —
DF-2583 High 7.8 Unvalidated parent->bytes yields OOB blockref array access during flush
sys/vfs/hammer2/hammer2_flush.c:1094
 panic reproduced fixed untriaged — —
DF-2605 High 7.8 Missing radix validation in hammer2_chain_alloc causes OOB read/write from crafted filesystem image
sys/vfs/hammer2/hammer2_chain.c:189
 panic reproduced fixed untriaged — —
DF-2562 High 7.1 readdir trusts on-media name length as bcopy length -> kernel heap OOB read (info leak + panic)
sys/vfs/hammer2/hammer2_vnops.c:702
 leak:65535 reproduced fixed untriaged — —
DF-2585 Medium 7.0 Cluster array chain pointer read without cluster_spin UAF in volume dedup check
sys/vfs/hammer2/hammer2_flush.c:1377
 none not_reproduced not_testable untriaged — —
DF-0823 High 6.7 hammer2_xop_helper_cleanup stops only MASTER-indexed threads — leaks survivors into freed heap UAF on unmount of multi-chain PFS
sys/vfs/hammer2/hammer2_admin.c:437
 panic reproduced fixed untriaged — —
DF-0805 Low 6.3 LZ4 read path compressed_size bounds checked only by KKASSERT — heap OOB read on non-INVARIANTS kernels
sys/vfs/hammer2/hammer2_strategy.c:197
 panic reproduced fixed untriaged — —
DF-0815 Medium 6.1 Missing privilege check on BULKFREE_SCAN/ASYNC and DEBUG_DUMP ioctls — unprivileged DoS + kernel address leak via msgbuf
sys/vfs/hammer2/hammer2_ioctl.c:83
 leak:kernel_ptrs reproduced fixed untriaged — —
DF-0777 Medium 5.5 hammer2_vop_readdir leaks kernel heap via unvalidated on-disk name_len/namlen — OOB read past inode/data buffer into heap
sys/vfs/hammer2/hammer2_vnops.c:706
 leak:65535 reproduced fixed untriaged — —
DF-0796 Medium 5.5 NULL deref in hammer2_inode_chain_and_parent when cluster has NULL chain slot — sibling hammer2_inode_chain handles correctly this does not
sys/vfs/hammer2/hammer2_inode.c:436
 panic reproduced fixed untriaged — —
DF-0804 Medium 5.5 Panic / NULL deref via crafted HAMMER2 image in strategy_read_completion — unknown bref.type/methods from media
sys/vfs/hammer2/hammer2_strategy.c:441
 panic reproduced fixed untriaged — —
DF-0817 Medium 5.5 NULL deref in h2_bulkfree_sync freemap lookup error path — live_chain->error deref when live_chain is NULL
sys/vfs/hammer2/hammer2_bulkfree.c:1046
 panic reproduced fixed untriaged — —
DF-0822 Medium 5.5 Sustained CPU-burn DoS via unchecked radix in hammer2_freemap_adjust count calculation
sys/vfs/hammer2/hammer2_freemap.c:977
 panic reproduced fixed untriaged — —
DF-0842 Medium 5.5 Missing sliding-window allocation in inflate updatewindow() — NULL-pointer-write panic on malformed HAMMER2 zlib block
sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c:373
 panic reproduced fixed untriaged — —
DF-0875 Medium 5.5 hammer2_get_volume unconditional panic on out-of-range data_off from crafted filesystem image
sys/vfs/hammer2/hammer2_ondisk.c:731
 panic reproduced fixed untriaged — —
DF-0904 Medium 5.5 Infinite kernel-thread loop in hammer2_update_spans when non-inode chain under super-root
sys/vfs/hammer2/hammer2_iocom.c:313
 dos reproduced fixed untriaged — —
DF-2568 Medium 5.5 NULL-deref panic in hammer2_flush retry loop when chain loses parent during flush
sys/vfs/hammer2/hammer2_flush.c:404
 panic not_reproduced not_testable untriaged — —
DF-2584 Medium 5.5 Flush depth limit panics instead of deferring DoS via deeply nested crafted image
sys/vfs/hammer2/hammer2_flush.c:56
 panic reproduced fixed untriaged — —
DF-0762 Medium 4.7 NULL deref in hammer2_chain_lastdrop no-parent retry path — parent->core.spin released when parent is NULL
sys/vfs/hammer2/hammer2_chain.c:646
 dos reproduced fixed untriaged — —
DF-0813 Medium 4.7 NULL deref in hammer2_flush() retry loop when chain->parent becomes NULL during concurrent flush — missing NULL guards present in setup/teardown
sys/vfs/hammer2/hammer2_flush.c:397
 none not_reproduced not_testable untriaged — —
DF-0800 Low 4.7 Missing NULL check on hammer2_inode_chain in truncation reset path — panic + %s OOB read on crafted image filename
sys/vfs/hammer2/hammer2_xops.c:1600
 none not_reproduced fixed untriaged — —
DF-0818 Low 4.7 Integer divide-by-zero in bulkfree_pass progress computation for total_size<10000 (crafted image volu_size=0)
sys/vfs/hammer2/hammer2_bulkfree.c:727
 none not_reproduced fixed untriaged — —
DF-0772 Medium 4.4 Infinite loop in hammer2_fixup_pfses on non-INODE blockref under super-root — system-wide HAMMER2 mount/unmount hang
sys/vfs/hammer2/hammer2_vfsops.c:2389
 dos reproduced fixed untriaged — —
DF-2606 Medium 4.4 Unvalidated bref->keybits from disk causes undefined behavior in shift operations throughout chain lookups
sys/vfs/hammer2/hammer2_chain.c:109
 dos reproduced not_testable untriaged — —
DF-2569 Low 4.4 Unconditional kernel panic on flush recursion depth limit instead of documented deferral
sys/vfs/hammer2/hammer2_flush.c:580
 panic reproduced not_testable untriaged — —
DF-0801 Info 4.1 Missing NULL check on hammer2_inode_chain in xop_inode_connect — latent dead-code NULL deref
sys/vfs/hammer2/hammer2_xops.c:1488
 none reproduced not_testable untriaged — —
DF-0826 Info 3.0 deflate() emits zlib header and resets adler unconditionally — stream corruption for any non-single-shot caller
sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391
 none reproduced not_testable untriaged — —
DF-0905 Low 2.5 iroot inode lock leaked on early-exit path in hammer2_update_spans
sys/vfs/hammer2/hammer2_iocom.c:303
 dos reproduced not_testable untriaged — —
DF-0906 Low 2.5 TOCTOU on iocom conn_state in hammer2_volconf_update (XXX comment flags missing interlock)
sys/vfs/hammer2/hammer2_iocom.c:375
 panic reproduced not_testable untriaged — —
DF-0816 Low 2.3 Heap over-read in volume_list bcopy of kstrdup strings — leaks kernel heap via copyout
sys/vfs/hammer2/hammer2_ioctl.c:1439
 leak reproduced not_testable untriaged — —
DF-0936 Info 0.5 NUL-termination write underflows when aux_size==0 (latent OOB write, dead code today; live twin at hammer2_iocom.c:149)
sys/vfs/hammer2/hammer2_msgops.c:72
 none reproduced fixed untriaged — —

Kernel memory corruption (UAF / OOB write) 1755

Use-after-free, double-free, OOB/heap/stack writes, integer overflow into a write, type confusion — the corruption bugs that become user→root escalations.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5825 High 8.8 kdmsg_state_msgrx() rxcmd REPLY-direction injection unlinks transaction state from the wrong red-black tree — peer-triggered UAF with fully controlled kernel pointer dereference
sys/kern/kern_dmsg.c:810
 panic reproduced fixed untriaged — —
DF-5833 High 7.8 generic_elf_coredump note-size precompute race: LWP insertions between the DRYRUN and WRITE passes overflow the header reservation, the swallowed elf_putallnotes error leaves target->off past off_max, elf_puttextvp computes vnh_max from a size_t-underflowed (off_max - off), and cb_put_fp writes attacker-sized vn_hdr records past the kmalloc'd core-header buffer
sys/kern/imgact_elf.c:1012
 none inconclusive not_testable untriaged — —
DF-5844 Medium 5.8 sysctl_sysctl_next_ls(): unbounded recursion level writes past newoid[CTL_MAXNAME] — value-controlled kernel stack smash from an unprivileged MIB walk
sys/kern/kern_sysctl.c:727
 panic reproduced fixed untriaged — —
DF-5809 Medium 5.5 vfs_export_lookup() returns an unref'd netcred after dropping NE_LOCK; consumers keep it across the NFS request while DELEXPORT frees it (use-after-free of the authorization credential)
sys/kern/vfs_subr.c:2297
 dos reproduced not_testable untriaged — —
DF-5792 High 5.3 closef() filedesc_to_leader chain walk vs fdfree() unlink+kfree: cross-lock use-after-free (unprivileged kernel fatal trap at closef+0x80)
sys/kern/kern_descrip.c:3071
 panic reproduced fixed untriaged — —
DF-5812 Medium 5.3 swaponvp() rounds swap size UP to the stripe boundary, publishing up to 63 pages of phantom swap per device: OOB swap I/O past device EOF and an unkillable pageout retry livelock under swap pressure
sys/vm/swap_pager.c:537
 dos reproduced fixed untriaged — —
DF-5791 Low 5.2 Async-attach thread races driver deregistration/device deletion: device_t has no refcount and device_detach() short-circuits DS_INPROGRESS to success, allowing device_set_driver() to free the softc/kobj while device_attach_thread() is inside DEVICE_ATTACH()
sys/kern/subr_bus.c:2005
 latent UAF write into freed softc/device untested not_testable untriaged — —
DF-5807 Medium 5.1 vop_write_dirent() performs an unbounded source bcopy; UFS OFSFMT readdir passes an unvalidated namlen — crafted old-format FFS image reads up to 255 bytes past the buffer-cache buffer
sys/kern/vfs_subr.c:2566
 panic reproduced fixed untriaged — —
DF-5822 Medium 4.7 sysctl_kern_proc() uses an unreferenced curproc->p_ucred (cr1) across blocking copyouts — ucred UAF read defeats ps_showallprocs=0 visibility filtering (unprivileged info disclosure)
sys/kern/kern_proc.c:1669
 leak reproduced fixed untriaged — —
DF-5798 Low 4.7 unmount_allproc_cb() mutates p->p_textnch without p->p_token, racing exec's drop/copy — namecache reference underflow to UAF potential
sys/kern/vfs_syscalls.c:777
 none not_reproduced not_testable untriaged — —
DF-5788 Low 3.6 kern_getcwd() reads fd_ncdir completely unlocked and walks the mount topology holding no mount reference — latent use-after-free racing chdir() and umount -f
sys/kern/vfs_cache.c:5076
 none not_reproduced not_testable untriaged — —
DF-5826 Info 3.1 Reader never validates DMSGF_SIZE against the base command — undersized extended headers reach command dispatch (latent type confusion)
sys/kern/kern_dmsg.c:348
 latent type confusion untested not_testable untriaged — —
DF-5803 Medium 2.5 expand_name() logs an unterminated, uninitialized kmalloc buffer via %s — recycled kernel-heap bytes disclosed into the user-readable kernel log
sys/kern/kern_sig.c:2453
 leak reproduced not_testable untriaged — —
DF-5810 Low 2.5 vtruncbuf() caches the separately-allocated nc_name pointer across unlocked blocking work, then prints it (narrow UAF read)
sys/kern/vfs_subr.c:531
 none untested not_testable untriaged — —
DF-5814 Low 2.5 vm_pageout_page(): object->flags use-after-free READ on the failed-vget error path — page hold parks the page on PQ_HOLD but pins neither the vm_object nor (on vget failure) the vnode
sys/vm/vm_pageout.c:1254
 none untested not_testable untriaged — —
DF-5823 Low 2.5 KERN_PROC_PGRP/KERN_PROC_TTY sysctl filters dereference the p_pgrp->pg_session->s_ttyp->t_dev chain with no p_token/pgref — TOCTOU use-after-free read against pgrp teardown (dead p_session NULL guard)
sys/kern/kern_proc.c:1736
 none not_reproduced not_testable untriaged — —
DF-3157 High 10.0 msdosfs_fhtovp feeds fully attacker-controlled NFS file-handle fields into deget/readep/deupdat: 31-byte kernel heap OOB read+write, arbitrary in-volume device-offset read/write via stat()/SETATTR, deterministic fatal kernel panic (3/3) and nfsd wedge — remotely reachable on any NFS-exported msdosfs, no crafted image needed
sys/vfs/msdosfs/msdosfs_denode.c:363 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2748 High 9.1 Full-duplex journal ack-path loss permanently wedges all writers in uninterruptible, SIGKILL-immune kernel sleep — and mountctl -d frees the journal out from under the sleepers (demonstrated wake-through-reuse UAF)
sys/kern/vfs_journal.c:330 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3423 High 9.1 gre_mobile_input(): neither M_HASH nor M_LENCHECKED cleared, inner ip_len double-counts the outer IP header (ANY valid mobile-GRE packet panics INVARIANTS kernels), and a truncated datagram yields a negative-length bcopy — reproduced as an unbounded kernel-heap overwrite (mbuf-metadata smash, secondary panic in m_free)
sys/net/gre/if_gre.c:237 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3398 High 9.0 Outbound-ICMP NAT heap OOB write: byte-swapped alias_port used as icmp_in[] index (distinct generator from DF-0569/0570)
sys/net/ipfw3_nat/ip_fw3_nat.c:310 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2675 Critical 8.8 allocbuf() maps 17 pages into the 16-page MAXBSIZE per-header KVA slot when (loffset & PAGE_MASK)+size > MAXBSIZE — PTE written into the next buffer header's slot, aliasing one page between two live kernel buffers (cross-buffer R/W, info leak, panic)
sys/kern/vfs_bio.c:3039 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3156 Critical 8.8 Dangling RRIP NM-CONTINUE chain: cd9660_rrip_defname fallback writes the ISO name at the un-reset advanced ana->outbuf — OOB write past altname[NAME_MAX] (kernel stack, lookup) and past the isoreaddir d_name area (kernel heap, readdir); verified unprivileged uid=0
sys/vfs/isofs/cd9660/cd9660_rrip.c:276 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-3879 Critical 8.8 dsp_mmap_single 64-bit offset-overflow bounds bypass + 32-bit truncation in sndbuf_getbufofs maps arbitrary kernel memory (b->buf + attacker-chosen ofs) read/write into user PTEs
sys/dev/sound/pcm/dsp.c:2342 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5845 Critical 8.8 FW_ASYREQ bcopy writes to address-of-pointer xfer->send.payload - user-controlled kernel heap overwrite
sys/bus/firewire/fwdev.c:560 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-2707 High 8.8 Duplicate transmitted DELETE re-runs the state close sequence: double RB_REMOVE on a stale node plus phantom rbtree refcount drop — state-tree corruption and premature kdmsg_state_free (UAF), peer-driven on production kernels
sys/kern/kern_dmsg.c:1667 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2755 High 8.8 TIOCSCTTY reassignment performs unsynchronized read-modify-write of session->s_ttyvp in vn_ioctl/devfs_fo_ioctl: racing twins double-vrele() the old controlling-tty vnode → v_refcnt underflow → premature vnode destruction → use-after-free
sys/kern/vfs_vnops.c:1049 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2922 High 8.8 proplib type confusion: unvalidated "arguments" object mtx_lock()ed as an array before type check → unprivileged kernel corruption / panic / livelock
sys/kern/vfs_quota.c:242 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3015 High 8.8 ufs_symlink controlled kernel heap overflow via unvalidated on-disk fs_maxsymlinklen — bcopy of up to 1023 attacker bytes into the 60-byte i_shortlink, ~919 bytes past the struct inode slab chunk
sys/vfs/ufs/ufs_vnops.c:1562 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3137 High 8.8 Unvalidated on-disk ab_freeoff used as insertion offset: controlled 12-byte kernel-heap OOB write at attacker-chosen offset (hpfs_addextent:452 / hpfs_addextentr:643 / hpfs_concatalsec:278)
sys/vfs/hpfs/hpfs_alsubr.c:278 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3138 High 8.8 AE_SPLIT parent-fixup bcopy(ranp, AB_LASTANP(rabp), 16) writes one alnode past the entry array; split source bcopy reads past the buffer (hpfs_addextent:410 / hpfs_addextentr:599 / hpfs_splitalsec:229)
sys/vfs/hpfs/hpfs_alsubr.c:229 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4036 High 8.8 Unclamped VBIOS SCLK/MCLK DPM counts overflow polaris10 SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table entries[8][4]
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1000 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4475 High 8.8 IOCATAREQUEST unclamped timeout: 1-tick completion-wait fallback completes and frees a channel-owned ata_request (UAF -> Fatal trap 12 in ata_start)
sys/dev/disk/nata/ata-all.c:486 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4515 High 8.8 drm_prime fd_to_handle: port's dma_buf_get() drops its file reference before returning, making drm_prime.c's trailing dma_buf_put() an unbalanced fdrop — refcount underflow, premature free of dma_buf+GEM object while the prime fd and rb-tree handle are still live, and an unreference'd dma_buf* used across the whole ioctl (racing-close UAF)
sys/dev/drm/drm_prime.c:802 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4569 High 8.8 drm_ioctl() dispatches on cmd&0xff only — never validates the user ioctl command (size/dir/group) against the canonical table entry; port dropped upstream's cmd=ioctl->cmd + canonical-size guard: kernel stack OOB write via DRM_IOCTL_GET_STATS and kernel-stack disclosure oracle via any 0-returning unauthenticated ioctl
sys/dev/drm/drm_ioctl.c:801 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4587 High 8.8 ttm_bo_release_mmap drops an unowned OBJT_MGTDEVICE object reference on every BO revocation — premature vm_object termination under live mappings plus early ttm_bo_unref (kernel UAF)
sys/dev/drm/ttm/ttm_bo_vm.c:821 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5308 High 8.8 usb_filter_detach() error path leaves the destroyed knote linked in the live usb_fifo klist — KNOTE() then walks freed memory and dispatches kn->kn_fop->f_event through attacker-reclaimed heap (unprivileged kernel UAF with controlled indirect call)
sys/bus/u4b/usb_dev.c:1239 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5320 High 8.8 ucom unplug lifecycle UAF: driver softc kfree'd while the never-freed tty keeps dangling t_sc/t_oproc/t_param/t_stop and in-flight cdev dispatch follows si_drv1 into freed memory (multi-port adapters leave orphaned openable device nodes)
sys/bus/u4b/serial/usb_serial.c:543 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5752 High 8.8 netbt hands rx mbufs to netisr_queue() (embedded netmsg) and frees them while still port-queued: the lwkt netisr port queue is operated through freed mbuf memory and corrupts (deterministic panic; same-node double-link on chunk reuse)
sys/netbt/hci_unit.c:437 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3597 High 8.7 gfx_v8_0_parse_ind_reg_list: trailing-entry heap OOB read/write past the RLC register-list copy plus post-write BUG_ON panic
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:4001 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3748 High 8.3 STA-mode AID→WCID truncation: rt2860_newassoc writes node pointer past wcid2ni[254] into txq[0] (remote OOB write via rogue AP)
sys/dev/netif/ral/rt2860.c:885 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3003 High 8.2 hammer_update_itimes() in-place atime/mtime update writes past the inode record's 16KB block on crafted HAMMER1 images — no data_len validation at extraction and hammer_crc_test_leaf() accepts any wrong-length INODE record via the 0-return CRC bypass
sys/vfs/hammer/hammer_inode.c:1446 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3078 High 8.2 ffs_reload (MNT_RELOAD) adopts the re-read superblock's geometry without validating it against the mount-time allocations — heap OOB write with attacker-controlled length and content, divide-by-zero, and heap OOB read disclosed to the media
sys/vfs/ufs/ffs_vfsops.c:484 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3106 High 8.2 ufs_direnter compaction loop heap OOB write via crafted d_namlen (DIRSIZ >> d_reclen) with debug.dircheck=0 — attacker-controlled kernel heap corruption past directory fragment buffers
sys/vfs/ufs/ufs_lookup.c:808 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3164 High 8.2 Failed MNT_UPDATE remount leaves mp->mnt_data dangling: use-after-free of struct udf_mnt on the live mount (double free at unmount)
sys/vfs/udf/udf_vfsops.c:153 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3167 High 8.2 hammer_reblock_data() bcopy OOB kernel write/read: unvalidated on-disk leaf data_len/data_offset plus >16KB allocations that are not buffer-contained
sys/vfs/hammer/hammer_reblock.c:464 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3168 High 8.2 rebalance_node trusts unvalidated on-disk B-Tree node counts: avg_elms pack loop writes past the 63-element elms[] array of the kmalloc'd 4096-byte node copies — attacker-controlled heap overflow (observed slab-metadata smash), OOB reads, and count>63 persisted to disk
sys/vfs/hammer/hammer_rebalance.c:330 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3321 High 8.2 gif(4) decapsulation keeps the outer packet's M_LENCHECKED — inner IPv4 header never length-validated on requeue into ip_input(): one-packet unauthenticated panic on default INVARIANTS kernels, lying-length corruption on production kernels (mpls label-0 and ip_mroute X_ipip_input decaps clear neither flag)
sys/netinet/ip_input.c:489 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3381 High 8.2 catchpacket() bh_caplen unsigned underflow: BPF_MINBUFSIZE(32) < bif_hdrlen(34/36) on x86-64 gives a ~4GiB copy into kmalloc(32) (heap overflow, deterministic panic)
sys/net/bpf.c:794 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3382 High 8.2 Stale undersized store buffers: BIOCSBLEN after bpfdetach (bd_bif==NULL, bd_sbuf allocated) desynchronizes bd_bufsize from the kmalloc'd buffers -> ~512KiB controlled overflow past kmalloc(4096)
sys/net/bpf.c:795 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3439 High 8.2 ipfw3 skipto stale next_rule cache: rule deletion leaves a dangling cached target; packet matching executes the freed rule (deny-all blackhole, wild filter_funcs dispatch, deterministic panic)
sys/net/ipfw3_basic/ip_fw3_basic.c:181 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3444 High 8.2 bpf_filter() executes unvalidated BPF programs via ipfw3_layer4 check_bpf: BPF_LD|BPF_MEM/BPF_ST/BPF_STX with unchecked pc->k give arbitrary-offset kernel stack read/write and full RIP control
sys/net/bpf_filter.c:365 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4132 High 8.2 tokenize() writes one pointer per token into the fixed 64-entry static token[] with no bound: kernel static-data overflow → control-flow hijack (kernel executes attacker bytes)
sys/dev/raid/vinum/vinumconfig.c:78 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4133 High 8.2 vinum_scandisk() copies on-disk config lines into config_line[2048] with no length bound: ~129 KB kernel heap overflow from crafted media, before any validation
sys/dev/raid/vinum/vinumconfig.c:1621 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4140 High 8.2 Drive free list grows without bound: OOB write past the 16-entry (256-byte) drive->freelist heap array with attacker-chosen u64 pairs from ordinary config
sys/dev/raid/vinum/vinumconfig.c:436 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4147 High 8.2 Arbitrary kernel read/write from the CUSE server: proc_rwmem_dfly uses the server-controlled peer_ptr as the raw kernel side of copyin()/copyout()
sys/dev/misc/cuse/cuse.c:881 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-4466 High 8.2 dm-crypt: use-after-free of target config - async completions race table destroy (suspend/reload/resume and remove paths have no in-flight drain)
sys/dev/disk/dm/crypt/dm_target_crypt.c:698 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4842 High 8.2 kthread_stop() sleeps a fixed 1 second then lwkt_free_thread()s a struct thread DragonFly kthreads reclaim themselves — free of a live TDF_RUNNING thread (panic) or thread_cache double-entry (same struct thread handed to two owners) on every drm_sched_fini
sys/dev/drm/linux_kthread.c:89 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2739 Medium 8.2 linker_file_unload() veto path drops the caller's reference on a failed unload — refcount underflow on a live linker_file → premature teardown under a live dependent → use-after-free
sys/kern/kern_linker.c:514 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3255 Medium 8.2 nfs_clientd() use-after-free and double-free of the nfsmount on non-KERB NFS mounts: nfs_unmount() frees nmp (and the EINTR path's own dounmount frees both nmp and mp) while the clientd loop keeps executing against the freed memory — reproduced kernel double-free panic 2/2
sys/vfs/nfs/nfs_kerb.c:106 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4063 Medium 8.2 fdformat() 20 s timeout double-completes its bio and recycles the pbuf under the fdc driver -> double-linked bio in fdc->bio_queue -> kernel panic (queue corruption / UAF)
sys/dev/disk/fd/fd.c:2276 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4623 Medium 8.2 virtqueue: used-ring completion ownership never validated at runtime — duplicate/foreign (in-bounds) id underflows ndescs, cycles the descriptor free list, aliases in-flight descriptors and mis-attributes driver completion cookies
sys/dev/virtual/virtio/virtio/virtqueue.c:544 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4654 Medium 8.2 twa: unchecked CAM cdb_len overflows the 16-byte firmware CDB field (heap/DMA-pool overflow)
sys/dev/raid/twa/tw_osl_cam.c:276 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4741 Medium 8.2 drm_sched_fini returns without cancelling the armed work_tdr or draining ring_mirror_list → delayed-work/callout executes on the freed scheduler after driver teardown (softclock panic)
sys/dev/drm/scheduler/sched_main.c:652 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5443 Medium 8.2 pnp_read_bytes() error path abandons the grown buffer — caller frees the stale pre-growth pointer: kernel heap double free + leak of the replacement
sys/bus/isa/pnp.c:506 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3035 High 8.1 FFS allocator uses unvalidated on-disk cylinder-group header fields as kernel-memory offsets/indexes — crafted image gives attacker-offset OOB read/write on first allocation
sys/vfs/ufs/ffs_alloc.c:1010 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3192 High 8.1 fuse_mount() never cross-checks args.fd with the looked-up /dev/fuse name: devfs_get_cdevpriv() returns ANY driver's per-fd private data, so a foreign fd (cuse/netmap/evdev/ipmi/nvmm) is type-confused with struct fuse_mount and a fuse_mount layout is written into the foreign live object
sys/vfs/fuse/fuse_vfsops.c:140 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3264 High 8.1 pf_state use-after-free: pf_send_tcp() drops pf_token mid-state-operation, letting the purge thread free the in-flight state
sys/net/pf/pf.c:2254 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3272 High 8.1 Remote peer heap out-of-bounds write via IPCP VJ Max-Slot-Id: sl_compress_init(sp->pp_comp, p[4]) unclamped, tstate[16] loop runs to peer-chosen 255
sys/net/sppp/if_spppsubr.c:2976 · pass 2 · new
 memcorrupt reproduced fixed untriaged — —
DF-4634 High 8.1 snd_clone_gc()/snd_clone_destroy() free pending-INVOKE clone entries under stalled openers: UAF write/read in snd_clone_acquire/ref plus a persistent unprivileged cdev+devfs-node leak that pins sound.ko unloadable
sys/dev/sound/clone.c:381 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2875 High 8.0 Pipelined BLK_WRITE in one transaction: single-slot iost->data aux tracking frees the most-recent aux while its bio is still in flight (deterministic UAF on bp->b_data) and leaks all earlier aux
sys/kern/subr_diskiocom.c:440 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4106 High 8.0 vge_rxeof SOF branch ignores vge_newbuf() failure: the mbuf is left referenced by BOTH the head chain and vge_rx_mbuf[]/descriptor -> double-free in vge_stop, use-after-free via if_input, NIC DMA into live/freed cluster, and RX-ring wedge -> serializer-held vge_intr livelock
sys/dev/netif/vge/if_vge.c:1294 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5737 Medium 8.0 Event-context link teardown races the syscall transmit path with no shared locking -> use-after-free write in hci_acl_send (forged RESET completion / CREATE_CON status / discon_compl frees links a send(2) is still touching)
sys/netbt/hci_event.c:271 · pass 2 · new
 none untested not_testable untriaged — —
DF-2687 High 7.9 TIOCSCTTY reassignment orphans the old tty's t_session, yielding an unprivileged use-after-free of struct session (deterministic panic; ctty hijack of recycled sessions)
sys/kern/tty.c:1190 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2857 High 7.9 shm_deallocate_segment keeps the segment findable during its own blocking teardown: racing IPC_RMID double-deallocates the vm_object (guaranteed panic; kfree double-free door)
sys/kern/sysv_shm.c:180 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3514 High 7.9 ng_ID_rehash/ng_name_rehash migrate hash entries only under #ifdef INVARIANTS (double-insert on production/module builds) and ng_ID_rehash destroys the old table with the WRONG mask -> 'hashdestroy: hash not empty' kernel panic (list-corruption UAF) — root cause of DF-3271's fix_failed mystery
sys/netgraph7/netgraph/ng_base.c:953 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5688 High 7.9 idr_remove()/idr_get_node() conflate per-leaf state with the cumulative Fenwick counter: phantom decrement yields duplicate-id issuance with silent kernel-object pointer overwrite and a deterministic KKASSERT panic
sys/libkern/linux_idr.c:187 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3672 Medium 7.9 MPT_TAG_2_REQ production macro indexes tgt_cmd_ptrs[tag_id>>18] with no bounds check — user-controlled XPT_CONT_TARGET_IO tag_id gives heap OOB read + wild request_t* dereference
sys/dev/disk/mpt/mpt_cam.c:4355 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3017 Critical 7.8 devfs node/cdev lifetime hole: nresolve→devfs_allocv drops devfs_lock on a raw devfs_node; concurrent unpriv pty teardown frees node+cdev → UAF write + sysref_get on freed cdev (proven panic 2/2)
sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new
 uid0 → root reproduced not_testable untriaged — —
DF-3996 Critical 7.8 Unclamped phase offset in the envy24 DMA emulators: second-channel start writes/reads up to ~2x past the shared play/record DMA buffers — controlled 32-bit kernel heap write (S32_LE) and kernel heap disclosure to userspace
sys/dev/sound/pci/envy24.c:1414 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4012 Critical 7.8 mps MPTIOCTL_REG_ACCESS: unvalidated u32 RegOffset gives operator-group users arbitrary kernel read/write in the 4 GiB window above the register BAR
sys/dev/raid/mps/mps_user.c:1958 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4020 Critical 7.8 mpr MPTIOCTL_REG_ACCESS: unvalidated u32 RegOffset gives operator-group users arbitrary kernel read/write in the 4 GiB window above the register BAR (twin of DF-4012)
sys/dev/raid/mpr/mpr_user.c:2194 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2691 High 7.8 EVFILT_SIGNAL knote use-after-free: knote stays linked into struct proc after the target is reaped; kqueue teardown runs SLIST_REMOVE on freed kernel memory
sys/kern/kern_sig.c:2667 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2778 High 7.8 mq_notify_proc is an unreferenced struct proc *: registrant exit with an inherited descriptor leaves a dangling pointer consumed by mq_send1 (PHOLD + ksignal on freed kernel heap) — deterministic UAF with cross-process signal injection
sys/kern/sys_mqueue.c:988 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2826 High 7.8 elf_getfiles() drops an unowned reference on the checkpoint file when fdalloc() fails: struct file refcount underflow, premature fo_close/vrele/ffree, UAF, success-masking, tempfp leak
sys/kern/kern_checkpoint.c:664 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2869 High 7.8 tq_running single-slot with unlocked clear breaks taskqueue_cancel/drain under concurrent runners → premature-free UAF
sys/kern/subr_taskqueue.c:407 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2996 High 7.8 nfs_sillyrename consumes nfs_lookitup() result with no error check, uninitialized np, and no identity/type validation — wild-pointer write and VDIR n_cookies type confusion; deterministic kernel panic from unprivileged unlink() against a mounted share
sys/vfs/nfs/nfs_vnops.c:3036 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3216 High 7.8 ext2 MNT_RELOAD adopts a new block size without re-deriving um_nindir/um_bptrtodb/um_seqinc/f_iosize — mis-mapped I/O (deterministic panic), OOB read, and 4-byte-granular OOB heap write in the indirect-block walks of ext2_bmaparray/ext2_getlbns/ext2_balloc
sys/vfs/ext2fs/ext2_bmap.c:126 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3232 High 7.8 Unvalidated fs_fragshift scales ffs_subr.c block-bitmap byte indexes up to 8x past the cylinder-group bitmap — OOB read plus single-byte 0x00/0xff OOB write at attacker-chosen offset, from one unprivileged ftruncate() on a crafted mount (silent write persisted to media)
sys/vfs/ufs/ffs_subr.c:195 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3233 High 7.8 ffs_blkatoff hands directory code an out-of-bounds *res pointer on crafted-geometry mounts (blkoff via unvalidated fs_qbmask vs blksize-derived buffer) — unprivileged creat/touch reads and writes directory-entry data tens of KB past the buffer; deterministic fatal supervisor-write trap
sys/vfs/ufs/ffs_subr.c:80 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3250 High 7.8 ext2_alloc_vnode EBUSY-collision handler double-frees the inode (kernel heap double-free/UAF, deterministic panic) — v_data published before ext2_ihashins, synchronous reclaim frees the handler's inode first; plus permanent lost-wakeup D-state hang in the same hand-rolled ext2fs_inode_hash_lock
sys/vfs/ext2fs/ext2_ihash.c:1313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3368 High 7.8 nm_bdg_preflush: unbounded NS_MOREFRAG fragment chains overrun the nkr_ft forwarding table — linear heap OOB write with attacker-chosen pointer values, u_int-wrap wild write ~4GiB above the object, and uint8 ft_frags truncation livelock
sys/net/netmap/netmap_vale.c:984 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3619 High 7.8 Heap OOB write in ci_get_svi2_voltage_table: VBIOS dependency-table count (u8, up to 255) copied into fixed entries[32] before any trim
sys/dev/drm/amd/amdgpu/ci_dpm.c:2264 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3683 High 7.8 Heap OOB write in phm_get_svi2_voltage_table_v0: VBIOS V0 dependency count (u8, up to 255) copied into fixed entries[32] before any trim
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:219 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3684 High 7.8 Kernel stack overflow: smu7_get_sclks/smu7_get_mclks copy up to 255 VBIOS entries into amd_pp_clocks.clock[16]/latency[16] held in the caller's stack frame
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4613 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3701 High 7.8 vega10 clock getters overflow the caller's 16-entry stack array: unbounded VBIOS dep-table counts (DF-3684 twin)
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4115 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3703 High 7.8 vega10 ODN tables are fixed entries[8] but filled/iterated with unbounded VBIOS dep-table counts — heap overflow of struct vega10_hwmgr
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:310 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3705 High 7.8 vega10 SMC PPTable populate loops write 8-entry SMC arrays (CksEnable/CksVidOffset, StaticVoltageOffsetVid, UvdDpmVoltageIndex, SocVid) with unbounded dep-table counts
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1700 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3783 High 7.8 BT848SCLIP / capture geometry → unbounded RISC program emission overflows the fixed 8-page dma_prog/odd_dma_prog buffers (up to 37×; also clip-less via 2046-row odd-only YUV4:2:2)
sys/dev/video/bktr/bktr_core.c:1219 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3787 High 7.8 METEORSSIGNAL stores td->td_proc without a reference and video_close() never clears it → frame-completion interrupt ksignal()s a freed struct proc (UAF from interrupt context)
sys/dev/video/bktr/bktr_core.c:1485 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3789 High 7.8 METEORSETGEO accepts frames=0 → bigbuf resize block skipped entirely → oversized rows/cols stored → 626,696-byte OOB RISC-DMA write and OOB read() heap disclosure with the default RGB16 format (no SACTPIXFMT; distinct trigger from DF-1216)
sys/dev/video/bktr/bktr_core.c:1642 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3790 High 7.8 bktr_filter_detach() calls knote_insert() instead of knote_remove() → destroyed knote left on (or self-looped into) the VBI klist → KNOTE() from the frame interrupt dereferences freed memory / hard hang (root cause bktr_os.c, sink bktr_core.c:705)
sys/dev/video/bktr/bktr_core.c:705 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3796 High 7.8 ena_down tears down IO queues and frees RX buffers without draining the deferred RX cleanup task (mbuf UAF / double free)
sys/dev/virtual/amazon/ena/ena.c:2611 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3797 High 7.8 Device-supplied register offsets from CREATE_SQ/CREATE_CQ replies cached unvalidated — every doorbell/unmask becomes an arbitrary-offset kernel write by the guest CPU
sys/dev/virtual/amazon/ena/ena.c:1049 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3838 High 7.8 32-bit wraparound family in evergreen CS surface-size validation ((slice+1)*64 wrap → nby=0/layer_size=0; layer_size*mslice u32 product wrap; <<8 base-offset truncation vs 40-bit GPU addresses; htile nbx*nby*4 wrap; streamout <<8 and *4 wrapped before the u64 check) → CS validator bypass → GPU OOB read/write past BO, cross-process GPU memory corruption
sys/dev/drm/radeon/evergreen_cs.c:404 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3914 High 7.8 Unbounded firmware NumSlots heap OOB write in the direct-attached enclosure reservation path (_mapping_get_dev_info/_mapping_get_pcie_dev_info)
sys/dev/raid/mpr/mpr_mapping.c:1243 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4009 High 7.8 NVMe-encapsulated pass-thru: unvalidated u32 DataSize drives PRP walk past the 8MiB arena (deterministic OOB write); kmalloc result unchecked
sys/dev/raid/mpr/mpr_user.c:904 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4013 High 7.8 mps FW-diag state machine: shared DMA trio + stale per-type size yields OOB kernel disclosure, cross-type free, UAF read, and double free (DF-4008 mpr twin, worse)
sys/dev/raid/mps/mps_user.c:1376 · pass 2 · new
 panic inconclusive fixed untriaged — —
DF-4028 High 7.8 CS validator rewrites ib[0] after validation: cb_color_size_idx defaults to 0 (full r600 CS validator bypass)
sys/dev/drm/radeon/r600_cs.c:309 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4031 High 7.8 Tracked offsets wrap in u32 while the GPU addresses 40 bits: streamout size raw*4 and base<<8 truncation validate the WRONG offset
sys/dev/drm/radeon/r600_cs.c:721 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4085 High 7.8 Unvalidated IOC-pg8 MaxNumPhysicalMappedIDs used as num_slots: heap OOB write in _mapping_process_dpm_pg0 reservation loop
sys/dev/raid/mps/mps_mapping.c:1512 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4092 High 7.8 Unvalidated IOC-pg8 MaxNumPhysicalMappedIDs used as num_slots: heap OOB write in mpr _mapping_process_dpm_pg0 reservation loop (twin of DF-4085)
sys/dev/raid/mpr/mpr_mapping.c:2216 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4231 High 7.8 txp(4) trusts NIC-fed rxd->rx_len: unbounded m_copydata heap OOB read+write past mbuf clusters
sys/dev/netif/txp/if_txp.c:676 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4233 High 7.8 txp_init() ignores txp_rxring_fill() failure and enables RX over a stale buffer ring: firmware DMA into freed clusters + NULL deref
sys/dev/netif/txp/if_txp.c:1127 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4329 High 7.8 i915 request-object RCU lifetime protocol is a no-op on DragonFly: empty synchronize_rcu()/cond_synchronize_rcu(), ignored SLAB_TYPESAFE_BY_RCU, unconditional dma_fence_get_rcu — lockless readers (GEM_BUSY) race freed-and-reused request memory and chase attacker-influenced pointers
sys/dev/drm/i915/i915_request.c:732 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4363 High 7.8 mps_config_get_man_pg10 allocates a fixed 0x5C-byte buffer but DMAs firmware PageLength*4 bytes into it - kernel heap overflow (the file's only fixed-size page allocation)
sys/dev/raid/mps/mps_config.c:249 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4412 High 7.8 radeon_vm_get_bos() TOCTOU on vm->max_pde_used — kernel heap out-of-bounds write via racing GEM_VA/CS
sys/dev/drm/radeon/radeon_vm.c:135 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4451 High 7.8 Heap out-of-bounds write (4 sites) from temporal divergence of _CRS/_PRS evaluations — pl_links sized by one evaluation, indexed by a later one
sys/dev/acpica/acpi_pci_link.c:235 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4506 High 7.8 i915_gem_context unlocked handle lookups race idr_grow's synchronous kfree of the IDR node array (DragonFly shim has no RCU) -> use-after-free read returns attacker-groomed contents as struct i915_gem_context *
sys/dev/drm/i915/i915_gem_context.c:831 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4510 High 7.8 drm_syncobj: lockless drm_syncobj_fence_get() races drm_syncobj_replace_fence()'s outside-the-lock dma_fence_put() of the old fence — rcu_read_lock() is only preempt_disable() on DragonFly and the last put kfree()s synchronously, so a cross-CPU waiter kref_get()s freed memory and then dispatches through the freed fence's ops: unprivileged kernel heap UAF (read+write) via render-node syncobj ioctls on i915/amdgpu
sys/dev/drm/drm_syncobj.c:182 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4531 High 7.8 drm_clients_info() walks dev->filelist under the wrong lock with a sleeping kmalloc between a count pass and an unbounded copy pass: concurrent open()/close() yields a kernel heap OOB write (or UAF read)
sys/dev/drm/drm_file.c:268 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4559 High 7.8 sassc->targets[] sized facts->MaxTargets but IR volume mapping IDs run to MaxTargets+MaxVolumes-1: mpssas_volume_add and the IR-config REMOVED branch write out of bounds (fw-controlled u64 at fixed offset)
sys/dev/raid/mps/mps_sas_lsi.c:847 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4604 High 7.8 radeon_gem_va_ioctl: bo_va use-after-free — set_addr() drops the BO reservation internally, then radeon_gem_va_update_vm() dereferences bo_va unprotected while a racing GEM_CLOSE on the same DRM fd frees it
sys/dev/drm/radeon/radeon_gem.c:693 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4631 High 7.8 radeon MST destroy_connector frees a kref-counted drm_connector raw (drm_connector_cleanup+kfree from the topology worker): UAF for in-flight ioctls, double kfree via the kref release path, and an unbounded per-flap fake-encoder leak
sys/dev/drm/radeon/radeon_dp_mst.c:288 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4635 High 7.8 radeon_audio: enc_priv type confusion — radeon_encoder_lvds* consumed as radeon_encoder_atom_dig* on LCD-carrying digital encoders (eDP) → dig->pin/dig->afmt OOB read/write into the ADJACENT 288-byte slab chunk + wild MMIO deref
sys/dev/drm/radeon/radeon_audio.c:262 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4646 High 7.8 nvme(4) device teardown vs in-flight data-path I/O: use-after-free of the namespace softc and I/O queues -> kernel divide-by-zero panic (Fatal trap 18 in nvme_get_request)
sys/dev/disk/nvme/nvme_disk.c:115 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4665 High 7.8 smu_get_voltage_dependency_table_ppt_v1 copies VBIOS-controlled count records into callers' fixed entries[8] ODN tables — heap OOB write of struct smu7_hwmgr (up to 6916 attacker-controlled bytes)
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:675 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4740 High 7.8 drm_sched_job_recovery re-runs completed jobs across its unlocked run_job() window racing drm_sched_job_finish → UAF (job + drm_sched_fence freed, parent write and cb armed inside freed heap, panic on signal)
sys/dev/drm/scheduler/sched_main.c:368 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4748 High 7.8 Use-after-free of amdgpu_dm_connector via stale dc_sink->priv in the dm MST payload/DPCD helpers (connector kfree'd while an enabled stream's dc_sink keeps the back-pointer alive)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:197 · pass 2 · new
 memcorrupt reproduced fixed untriaged — —
DF-4853 High 7.8 evergreen_hdmi_enable / evergreen_dp_enable consume lvds-typed enc_priv as radeon_encoder_atom_dig on the eDP dpms path: dig->afmt OOB read at +288 into the adjacent slab chunk → guard falls through → wild deref feeding six WREG32 MMIO sites + dig->afmt->enabled write-through (DF-4635/DF-4828 family, new sinks; corrects DF-4828's dpms-route dismissal)
sys/dev/drm/radeon/evergreen_hdmi.c:429 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4864 High 7.8 amdgpu_vm_clear_bo() 64-byte IB overrun: the ATS root-PD clear emits two 10-dword set_pte_pde packets + SDMA pad (24 dwords) into a 16-dword (64-byte) SA sub-allocation — deterministic 32-byte kernel heap OOB write per GPU-VM create on every AMD Raven APU
sys/dev/drm/amd/amdgpu/amdgpu_ring.c:107 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5008 High 7.8 amdgpu_vram_mgr_new: non-power-of-two pages_per_node breaks the num_nodes bound — one-struct heap OOB write past the kvmalloc_array node array, unprivileged via GEM_CREATE in.alignment
sys/dev/drm/amd/amdgpu/amdgpu_vram_mgr.c:183 · pass 2 · new
 heap-oob-write (kernel-space primitive reproduced: verbatim amdgpu_vram_mgr_new loop + real in-kernel drm_mm wrote a live drm_mm_node 184 bytes past a 1-element kvmalloc_array and clobbered a neighboring heap object; full unpriv-ioctl entry point hardware-gated - amdgpu binds only on AMD ASICs, QEMU guest has none, amdgpu.ko confirmed buildable+loadable module on DF) reproduced fixed untriaged — —
DF-5169 High 7.8 i915_clflush_work() self-frees its container inside the work callback; DFly LinuxKPI process_all_work() then UAF-reads/writes the freed struct (work->worker=NULL 8-byte NULL write, work->running=false 1-byte zero write, wakeup on dangling channel)
sys/dev/drm/i915/i915_gem_clflush.c:89 · pass 2 · new
 kernel heap UAF write (memory corruption): 8-byte NULL write at freed-object +16 (work->worker) and 1-byte zero at +25 (work->running) into attacker-reclaimable M_DRM-class memory, plus wakeup() on a dangling wait channel; deterministic primitive proof without panic; reliable uid=0 chain not developed (trigger needs pre-LLC Intel GPU, not emulatable in QEMU) reproduced fixed untriaged — —
DF-5200 High 7.8 kthread_park() provides no quiescence: returns without waiting for the target to park while kthread_parkme() never deschedules - the park/unpark contract drm_sched_entity_fini() and amdgpu GPU-reset rely on is void, giving a deterministic use-after-free on entity teardown
sys/dev/drm/linux_kthread.c:103 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5271 High 7.8 cdgetpage/find_mode_page_* trust device-controlled mode-header blk_desc_len: heap OOB read+write in all CD audio ioctls
sys/bus/cam/scsi/scsi_cd.c:3437 · pass 2 · new
 device-directed kernel heap OOB write + OOB read (4 fully user-chosen bytes per ioctl at any offset up to ~64KB past a 32-byte kmalloc chunk, device-chosen offset via 16-bit blk_desc_len, unlimited repetitions; OOB read returns 4 heap bytes per ioctl to userland). Root-gated entry (caps_priv_check_self SYSCAP_RESTRICTEDROOT at cdopen) with attacker-controlled SCSI/USB 'CD-ROM' hardware - same threat model as known DF-0987/DF-2268. reproduced fixed untriaged — —
DF-5292 High 7.8 Beacon mbuf write-after-free across disjoint lock domains: rum_update_beacon's unlocked ieee80211_beacon_update window vs m_freem in rum_newstate/rum_vap_delete
sys/bus/u4b/wlan/if_rum.c:2825 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5413 High 7.8 FW_SSTBUF -> 32-bit nchunk*npacket wrap in fwdev_allocbuf -> 0-segment fwdma buffer -> fwdma_v_addr() OOB seg[0] -> controlled kernel write (and read) via production fw_write/fw_read
sys/bus/firewire/fwdev.c:504 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-5434 High 7.8 REQBUFS-while-streaming frees bq->mem without draining product/consumer queues or resetting descriptors: USB completion engine writes frame data into freed kernel memory (UAF write) and, after a frame-size shrink, stale vbuf.bytesused underflows the bulk maxlen giving a controlled-offset heap OOB write
sys/bus/u4b/uvc/uvc_buf.c:517 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5740 High 7.8 hci_socket.c mutates socket buffers from the NETISR thread with no synchronization (hci_mtap sbappendaddr vs soreceive, hci_drop sbdroprecord vs sbappendrecord) and hands the TX-completion callback a reference-free socket pointer that survives teardown (cmdwait ctx TOCTOU → post-detach hci_drop UAF)
sys/netbt/hci_socket.c:1004 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5780 High 7.8 hci_memo_find/hci_memo_new/hci_memo_free operate on unit->hci_memos with zero synchronization while concurrently reachable from unprivileged user context, netisr-0 and softclock — double-free and write-after-free of 48-byte hci_memo records
sys/netbt/hci_misc.c:124 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2949 Medium 7.8 cttyclose() takes its tty-vnode reference with vref() racing the terminal vrele() of concurrent ctty teardowns — vref: bad refcnt panic (INVARIANTS) / freelist vnode resurrection (stock)
sys/kern/tty_tty.c:153 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3481 Medium 7.8 ng_ppp mutates its entire private state (frag TAILQ, qlen, mseq/xseq, activeLinks, conf) with zero synchronization across concurrent v1 execution contexts — double TAILQ_REMOVE/kfree/m_freem (UAF-class) if raced; empirically contained on stock socket-fed topologies but one feeder refactor away
sys/netgraph/ppp/ng_ppp.c:1144 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3845 Medium 7.8 OCR return-to-CAM flush races the lock-free ISR completion path: only a 1-second DELAY heuristic separates two unsynchronized mrsas_cmd_done callers (double xpt_done / duplicated free-list entry); timeout callout re-arms 600 s on recycled commands
sys/dev/raid/mrsas/mrsas.c:2324 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4054 Medium 7.8 SMU-firmware-fed DPM level count stored unclamped: vega12_setup_single_dpm_table fill loop writes past dpm_levels[16] — firmware-controlled linear heap overflow of the kzalloc'd vega12_hwmgr backend
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:481 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4148 Medium 7.8 UAF/double-free race: in-flight cuse_client_open vs final cuse_server_unref (async destroy_dev, refs++ after the final decrement)
sys/dev/misc/cuse/cuse.c:1509 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4255 Medium 7.8 agp_i915_write_gtt programs GTT PTEs into the MMADR register BAR (sc_res[0]) instead of GTTADR (sc_res[1]): GPU-register corruption incl. PGTBL_CTL hijack at PTE index 0x808, and OOB writes past the mapped MMADR resource for PTE indices >= 32768
sys/dev/agp/intel-gtt.c:998 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4325 Medium 7.8 sf_txeof() trusts DMA-written 15-bit TX completion index: OOB descriptor read feeds arbitrary pointer to m_freem(), OOB NULL write, and sf_tx_cnt underflow
sys/dev/netif/sf/if_sf.c:998 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4326 Medium 7.8 sf_rxeof() trusts DMA-written 11-bit endidx: sf_newbuf() OOB-writes mbuf pointer + DMA address up to 12KB past the entire contigmalloc'd descriptor block
sys/dev/netif/sf/if_sf.c:940 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4439 Medium 7.8 drm_atomic_state holds no drm_device reference while nonblocking commits outlive the ioctl on system_unbound_wq — missing backport of Linux 4e076c73e4f6 (stable-fix use-after-free)
sys/dev/drm/drm_atomic.c:77 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4469 Medium 7.8 drm_crtc_helper_set_config() sizes save_connector_encoders with the racy num_connector while iterating the live list — concurrent DP-MST connector registration (spinlock-only) writes one pointer past the kcalloc'd array, and the fail path reads the OOB slot back into connector->encoder (heap OOB write + forged-pointer injection)
sys/dev/drm/drm_crtc_helper.c:571 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4497 Medium 7.8 sbsh: deactivate() drops xq/rq mbufs but leaves stale pointers - TXS/RXS/UFL processing after carrier loss (or after ifconfig down) double-frees / uses freed mbufs
sys/dev/netif/sbsh/if_sbsh.c:726 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5033 Medium 7.8 UAF/OOB-read race in amdgpu_bo_list_get(): DragonFly's idr_find() is lockless while idr_grow() kfree()s the node array synchronously (Linux RCU-safe-idr assumption does not hold)
sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:167 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5186 Medium 7.8 DRM_UNLOCKED dumb-buffer MAP_DUMB races the unsynchronized legacy GEM offset-hash publication: live-key free_unr double-free, same-node dual-bucket hlist link, and wrong-object resolution in the mmap path (cross-object / UAF-class mapping ceiling)
sys/dev/drm/drm_dumb_buffers.c:115 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5337 Medium 7.8 userenter() ucred cache race — vkernel twin missing pc64's p_spin interlock: unlocked crhold races cratom_proc's swap+crfree, giving crhold-on-freed (M_CRED UAF) from unprivileged in-vkernel userland
sys/platform/vkernel64/x86_64/trap.c:167 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5370 Medium 7.8 bus_dmamap_destroy() frees a map still queued for a deferred load (EINPROGRESS) -> write-after-free with attacker-followed map->dmat pointer and permanent zone wedge (vkernel twin of pc64 DF-5347)
sys/platform/vkernel64/platform/busdma_machdep.c:383 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5420 Medium 7.8 pmap_inval_smp()/pmap_inval_smp_cmpset() shortcut samples pmap->pm_active outside the CPULOCK_EXCL interlock (and takes none for non-PMAP_MULTI pmaps); originator also returns before target done-bits drain
sys/platform/pc64/x86_64/pmap_inval.c:282 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4629 Low 7.8 mpt_user: DMA page buffer freed on ioctl timeout while the deliberately-abandoned request still points at it — late IOC completion DMAs into freed kernel heap
sys/dev/disk/mpt/mpt_user.c:259 · pass 2 · new
 Kernel heap corruption by device DMA: late IOC completion writes up to len bytes into freed (reallocatable) heap untested not_testable untriaged — —
DF-2902 High 7.6 mbrinit/mbr_extended trust device-reported d_media_blksize — up to 2 GiB synchronous read into a MAXPHYS (128 KB) pbuf: assertion-cast bypass (all kernels) or INVARIANTS panic; proven OOB write with attacker-controlled content/length
sys/kern/subr_diskmbr.c:127 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3881 High 7.6 Unbounded MST topology depth (LCT) -> OOB stack/heap writes and unbounded kernel recursion from malicious hub
sys/dev/drm/drm_dp_mst_topology.c:1052 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5276 High 7.6 pci_read_vpd(): zero-length VPD identifier string causes unbounded sequential kernel heap overflow (device-controlled content and length)
sys/bus/pci/pci.c:1108 · pass 2 · new
 memcorrupt reproduced fixed untriaged — —
DF-5392 High 7.6 PnP isa_config count fields trusted unvalidated at the ISA_ADD_CONFIG boundary; pnp_check_quirks' unbounded ic_nport++ defeats pnpparse's == clamps → attacker-indexed OOB kernel-heap writes at boot (persisted by isa_add_config, panic via count consumer)
sys/bus/isa/isa_common.c:938 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5396 High 7.6 urndis(4) bulk RX: device-controlled rm_datalen up to MCLBYTES copied after m_adj(ETHER_ALIGN) — 2-byte kernel heap overflow past a 2048-byte slab chunk (fixed upstream in FreeBSD 11 years ago, never synced)
sys/bus/u4b/net/if_urndis.c:859 · pass 2 · new
 memcorrupt reproduced fixed untriaged — —
DF-5406 High 7.6 HID report-descriptor Push/Pop items drive the parser's pushlevel out of range; hid_get_item() re-derives c = &s->cur[pushlevel] out of bounds on the next call → kernel heap read/write with device-chosen offset and content
sys/bus/u4b/usb_hid.c:248 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2998 High 7.5 Server attributes freely retype live vnodes in nfs_loadattrcache (VREG→VDIR observed live; VCHR/VBLK with server-chosen rdev via addaliasu + v_ops switch) — device-node injection and buffer-cache type confusion through every attribute load in this file
sys/vfs/nfs/nfs_vnops.c:2903 · pass 2 · new
 kernel type confusion -> deterministic panics (two new independent memory-corruption sinks) + server-driven device-node injection into the local namespace reproduced fixed untriaged — —
DF-3061 High 7.5 nfs_namei() retry protocol leaks locked namecache state and nfsrv_rename()'s retry drives double-releases — remote NFS client can panic the kernel
sys/vfs/nfs/nfs_subs.c:1003 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3172 High 7.5 ffs_indirtrunc wild and attacker-aimed kernel bzero via unvalidated on-disk fs_nindir and unclamped lastbn
sys/vfs/ufs/ffs_inode.c:535 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3388 High 7.5 wg peer teardown races in-flight noise consumers: wg_peer freed via uncounted r_arg and r_index re-linked after handshake_clear (use-after-free)
sys/net/wg/wg_noise.c:596 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3843 High 7.5 mrsas_sync_map_info writes firmware-controlled ldCount × 4-byte entries into a fixed 172,200-byte RAID-map DMA buffer — unbounded linear kernel heap overflow (computed bound size_sync_info is dead code)
sys/dev/raid/mrsas/mrsas.c:3207 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3886 High 7.5 drm_dp_sideband_msg_build msg[256] accumulation overrun: up to 61 hub-controlled bytes past msg_rx->msg (distinct sink from DF-1264)
sys/dev/drm/drm_dp_mst_topology.c:371 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3908 High 7.5 Kernel stack OOB write in tonga_program_memory_timing_parameters: VBIOS-controlled SCLK/MCLK DPM counts index fixed stack table arb_regs.entries[8][4]
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1492 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3909 High 7.5 Heap OOB writes into smc_state_table.GraphicsLevel[8]/MemoryLevel[4] via unclamped VBIOS SCLK/MCLK DPM counts (incl. unguarded MemoryLevel[count-1] store)
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:709 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3939 High 7.5 Kernel stack OOB write in ci_program_memory_timing_parameters: VBIOS SCLK/MCLK DPM counts index fixed stack table arb_regs.entries[8][6] (DF-3908 twin)
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1653 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3940 High 7.5 Heap OOB writes into kzalloc'd struct ci_smumgr via unclamped VBIOS MCLK DPM count vs SMU7_MAX_LEVELS_MEMORY=6: MemoryLevel[6..7], unguarded MemoryLevel[count-1], mc_regs->data[6..7], mclk_levels[MemoryDpmLevelCount] (DF-3909 twin)
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1314 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4000 High 7.5 Unclamped VBIOS SCLK/MCLK DPM counts overflow the iceland SMC state tables and the 384-byte stack MC-arb table: GraphicsLevel[8], MemoryLevel[4], arb_regs.entries[8][4] (kernel STACK), mc_regs.data[4] — DF-3908/3909/3939/3940 family with iceland's tighter mclk bound (count 5 suffices)
sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:980 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-5254 High 7.5 Beacon mbuf use-after-free write: urtwn_update_beacon's unlocked ieee80211_beacon_update window races setup_beacon/vap_delete across disjoint lock domains
sys/bus/u4b/wlan/if_urtwn.c:2206 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5288 High 7.5 USB_FS_UNINIT racing USB_FS_START/STOP/COMPLETE on a shared ugen fd: f->fs_xfer array kfree'd/NULLed without priv_lock while consumers snapshot f->fs_xfer[ep_index] unlocked — kernel page-fault/GPF panic (groomable use-after-free)
sys/bus/u4b/usb_transfer.c:972 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5314 High 7.5 USB_FS_CLOSE is unserialized: concurrent closes double-run usbd_transfer_unsetup() on one xfer (kernel panic via setup_refcount assert; refcount_alloc underflow → permanent endpoint lockout on no-assert kernels) and CLOSE×START leaves stale-xfer UAF writes into freed memory
sys/bus/u4b/usb_generic.c:1558 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3180 Medium 7.5 tmpfs_fhtovp passes an unpinned tmpfs_node to tmpfs_alloc_vp; blocking releases the mount token and reclaim frees the node under the caller (window proven by on-guest panic from fhopen race; stock kernels reach a use-after-free at tmpfs_subr.c:382)
sys/vfs/tmpfs/tmpfs_vfsops.c:453 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3547 Medium 7.5 Use-after-free of struct ngd_private in all cdevsw methods: disconnect frees priv immediately after DragonFly's asynchronous destroy_dev()
sys/netgraph7/ng_device.c:299 · pass 2 · new
 none build_failed not_testable untriaged — —
DF-3679 Medium 7.5 igb_rxeof trusts NIC-DMA'd descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len → heap OOB read up to 63,487 bytes past the 2046/2048-byte RX cluster (DF-3604/3639/3663/3667 family)
sys/dev/netif/igb/if_igb.c:2744 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4053 Medium 7.5 Sense-data memcpy has dst/src swapped vs FreeBSD: autosense never delivered (all-zero sense + CAM_AUTOSNS_VALID) and device-controlled copy length overflows struct vtscsi_request when a pass CCB carries sense_len > 96
sys/dev/virtual/virtio/scsi/virtio_scsi.c:1383 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4454 Medium 7.5 evdev driver teardown frees evdev_dev under open clients and in-flight writes: use-after-free with cross-object event injection and kernel wedge
sys/dev/misc/evdev/evdev.c:98 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5165 Medium 7.5 request_irq admits duplicate (irq,dev_id) registration and its failure path releases/NULLs pdev-global IRQ state owned by live registrations — armed handler left on released resource/MSI vectors (interrupt-time UAF), orphaned handler with dangling dev_id, NULL-resource crash on retry, double-release at teardown
sys/dev/drm/linux_irq.c:75 · pass 2 · new
 interrupt-context UAF / orphaned armed handler / cross-device teardown untested not_testable untriaged — —
DF-2740 Low 7.5 Inconsistent locking of linker shared state: sys_kldload userrefs++/id read outside kld_lock (UAF-write window), unlocked refs mutations, and unlocked linker_files/found_modules traversals racing KPI loaders
sys/kern/kern_linker.c:814 · pass 2 · new
 none untested not_testable untriaged — —
DF-5162 Low 7.5 bktr_mem stored-address registry is never invalidated when the METEORSETGEO grow path frees the frame buffer — driver reload reinstalls the freed KVA, bzeros ~3.5 MB and RISC-DMAs video into reallocated kernel memory (write-after-free)
sys/dev/video/bktr/bktr_mem.c:103 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3938 Info 7.5 Latent device-controlled-length memcpy in ena_com_get_hash_function(): keys_num (u32 in device-DMA buffer) << 2 as copy size
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2354 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3344 High 7.4 lagg port-detach handler registered on never-fired ifnet_departure_event: persistent kernel UAF after member interface destroy
sys/net/lagg/if_lagg.c:218 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3520 High 7.4 Negative-length bcopy in ng_pptpgre ack processing: one in-window ack converts the DF-0596 window violation into an unbounded kernel OOB read+write
sys/netgraph/pptpgre/ng_pptpgre.c:641 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3962 High 7.4 mvfrey CCB-timeout callout runs iop_intr without the adapter lock, racing the locked hard-IRQ drain: double srb completion (double free to freelist + double xpt_done → CAM UAF); plus 60s DELAY busy-loop in softclock and the timed-out CCB is never completed
sys/dev/raid/hptiop/hptiop.c:2647 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4066 High 7.4 ti_rxeof indexes the mbuf chain arrays with the NIC-DMA'd uint16_t return-descriptor ti_idx and no bounds check: OOB pointer read used as struct mbuf (wild-pointer stores at :1690 + if_input type confusion) and OOB 8-byte NULL write up to +512KB past the chain arrays inside struct ti_softc
sys/dev/netif/ti/if_ti.c:1638 · pass 2 · new
 none observed (hardware-gated); source-level: kernel OOB write (8-byte NULL store up to +512KB past chain array) + wild-pointer mbuf writes + type confusion into ether_input via NIC-DMA'd uint16_t descriptor index inconclusive not_testable untriaged — —
DF-4797 High 7.4 nata ad(4) teardown race: ad_strategy/ad_done (and the disk-layer close path) vs ad_detach — use-after-free of the ad_softc/struct disk and near-NULL writes; reproduced fatal trap 12
sys/dev/disk/nata/ata-disk.c:167 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5240 High 7.4 xpt_scan_bus() create-path failure branch frees the in-flight XPT_SCAN_LUN CCB and scan_info (kernel UAF, deterministic panic)
sys/bus/cam/cam_xpt.c:5394 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5258 High 7.4 sc_epq[MTW_BULK_RX] is a zero-length array: the 6 TX endpoint queues alias 14 KB of live mtw_softc fields; every ifconfig-up stamps over them and every channel change (sc_chan_group) forges the upper dword of epq[0].tx_data[3].ni, a live ieee80211_node pointer
sys/bus/u4b/wlan/if_mtw.c:4466 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5738 High 7.4 hci_link_free() ignores the SCO->ACL anchor reference: anchored ACL teardown leaves hl_refcnt==1 -> KKASSERT panic on INVARIANTS kernels, silent kfree + dangling SCO->hl_link (fatal UAF demonstrated) on production GENERIC kernels
sys/netbt/hci_link.c:810 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3518 Medium 7.4 ng_pptpgre priv UAF: rmnode kfree(priv) races in-flight rcvdata/rcvmsg dispatched inline without a node reference
sys/netgraph/pptpgre/ng_pptpgre.c:437 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3519 Medium 7.4 Non-atomic node->refs++ / priv->timers++ in ng_pptpgre timer start vs ng_unref — lost update frees live ng_node (UAF)
sys/netgraph/pptpgre/ng_pptpgre.c:768 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3961 Medium 7.4 SG-capacity heap overflow: firmware-fed max_sg_count writes scatter-gather entries past the 34-entry capacity of srb->req[600] into srb->hba/ccb/next/dma_map (itl non-highmem, mv, mvfrey paths)
sys/dev/raid/hptiop/hptiop.c:2471 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5242 Medium 7.4 xpt_release_device() uses non-joining callout_stop before kfree(device) — xpt_release_devq_timeout can already be blocked on CAM_SIM_LOCK(device->sim) and then operate on the freed cam_ed (UAF; upstream defers the free)
sys/bus/cam/cam_xpt.c:4790 · pass 2 · new
 heap OOB comparison oracle / race-gated UAF / accounting drift untested not_testable untriaged — —
DF-4421 Low 7.4 ich_pci_attach() publishes the 0666 /dev/mixerN (mixer_init) before five failure paths whose bad: unwind frees the AC97 codec and softc — dangling mixer cdev UAF on open/ioctl (DF-4156/4193/4299/4334/4344 family, 6th instance, widest window in family)
sys/dev/sound/pci/ich.c:1031 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4726 Low 7.4 aureal: BAR loop stores tags/handles for up to 6 BARs into au->st[3]/au->sh[3] — OOB kernel write over sh[], parent_dmat and lock at attach (crafted-PCI-device threat model)
sys/dev/sound/pci/aureal.c:571 · pass 2 · new
 none untested not_testable untriaged — —
DF-4568 Info 7.4 CT teardown frees the shared CT page while GuC interrupts are still enabled and guc->handler still points at CT code — interrupt-context use-after-free read+write of the released descriptor mapping
sys/dev/drm/i915/intel_guc_ct.c:898 · pass 2 · new
 none untested not_testable untriaged — —
DF-3146 High 7.3 RRIP NM length underflow in cd9660_rrip_altname: u_short wrap rewinds the name output pointer by 65536*N → controlled OOB write at a wild kernel address (heap via readdir, kstack via lookup) or bcopy((size_t)-1) panic
sys/vfs/isofs/cd9660/cd9660_vnops.c:542 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3195 High 7.3 nfs_inactive/nfs_reclaim discriminate the n_un3 union (sillyrename vs dir-cookie list) by the runtime-mutable v_type — a server-side VREG→VDIR retype of a sillyrenamed file makes reclaim walk the struct sillyrename as an nfsdmap list: kfree(M_NFSREQ block as M_NFSDIROFF), then kfree of the live s_cred ucred, then wild-pointer deref — deterministic kernel panic (verified 2/2), fix validated on rebuilt kernel
sys/vfs/nfs/nfs_node.c:392 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3690 High 7.3 Adaptec parser: unbounded 16-bit total_disks zeroing loop — massive deterministic kernel heap OOB write at first metadata parse
sys/dev/disk/nata/ata-raid.c:1685 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3691 High 7.3 No parser validates array width — RAID0/5 strategy indexes disks[] OOB via user-chosen LBA (wild device_t deref); RAID1/01 paths OOB-write disks[width].last_lba and composite->request[]
sys/dev/disk/nata/ata-raid.c:3248 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3785 High 7.3 BT848_REEPROM: signed (offset+count) guard bypassed with negative offset → readEEProm() writes up to 32767 bytes into eeProm.bytes[256] (~32 KiB kernel heap overflow of the 260-byte M_IOCTLOPS ioctl argument, content attacker-controllable via DF-1217's raw I2C write)
sys/dev/video/bktr/bktr_core.c:2086 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3786 High 7.3 BT848_SIGNATURE: signCard() has no bound on count → single-bit OOB read-modify-write up to ~3.8 KiB past the 260-byte ioctl argument (bit-OR heap corruption primitive)
sys/dev/video/bktr/bktr_core.c:2094 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4330 High 7.3 mr_update_span_set writes firmware-indexed strip_offset[count] OOB - linear kernel-heap overflow past sc->log_to_span[] (last softc member)
sys/dev/raid/mrsas/mrsas_fp.c:949 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4846 High 7.3 feed_format_feed sizes its byte window with the inexact generated SND_FXROUND/SND_FXDIV table: misround-up within the claimed [1,65536] domain writes up to oalign-1 bytes past the destination window (or before it via the ialign path) and over-reports the return into sndbuf_acquire (ring overflow)
sys/dev/sound/pcm/feeder_format.c:220 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4847 High 7.3 feed_matrix_feed FXROUND misrounds: entry rounding sizes the matrixing pass past the destination window and the ialign>oalign path computes a source window that starts before the buffer
sys/dev/sound/pcm/feeder_matrix.c:479 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4848 High 7.3 feed_volume_feed divides the USER-PACED source return with inexact SND_FXDIV: frame overcount writes past the window and count -= j*align underflows to ~4GiB, re-arming the loop to pull a directed, user-length-controlled write past the window end
sys/dev/sound/pcm/feeder_volume.c:277 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4849 High 7.3 feed_mixer_feed FXROUND past the caller's free space (persistent sndbuf ring overflow) and mcnt = count - rcnt unsigned underflow arming a ~4GiB memset at b+rcnt when any child feeder over-returns
sys/dev/sound/pcm/feeder_mixer.c:299 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3781 Medium 7.3 update_rxhead path: unchecked 10-bit rxcd->qid produces OOB MMIO write up to 0x29F0 past the 4KB vmxnet3 BAR0 (panic / cross-device MMIO corruption)
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2321 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4321 Medium 7.3 ath_hal_getregdump(): signed/unsigned comparison break + unchecked do-while first write => unbounded attacker-length kernel-heap overflow with attacker-known register values
sys/dev/netif/ath/ath_hal/ah.c:848 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4836 Medium 7.3 Firmware-facing frame->hdr.sge_count never reconciled with the validated user_ioc->sge_count: FW consumes stale SGEs (device DMA to freed ioctl buffers) and can read its SGL past the 1024-byte frame allocation
sys/dev/raid/mrsas/mrsas_ioctl.c:205 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-4854 Low 7.3 vega10_ih: unvalidated device-DMA'd IH wptr (DF-4843 twin) — permanent amdgpu interrupt-thread spin on misaligned wptr, plus 20-byte OOB ring read via RB_OVERFLOW recovery
sys/dev/drm/amd/amdgpu/vega10_ih.c:194 · pass 2 · new
 dos untested not_testable untriaged — —
DF-5297 High 7.2 umass autosense REQUEST SENSE uses user-controlled csio.sense_len (up to 255) as the DMA length into the fixed 32-byte csio.sense_data inside the kernel CCB — malicious USB disk overwrites the rest of ccb_scsiio with device-controlled bytes
sys/bus/u4b/storage/umass.c:2602 · pass 2 · new
 kernel memory corruption (device-controlled intra-object write into live kernel CCB; trigger gated on root-only /dev/pass* for the >32 length, content fully device-controlled) reproduced fixed untriaged — —
DF-3018 Low 7.2 spec VOP dispatch (devfs_spec_read/write/ioctl/kqfilter, D_QUICK close) calls dev_d* on vp->v_rdev with no cdev reference and the vnode unlocked — vfs_timestamp(&node->atime) after teardown is a UAF write if the device dies during the dispatch
sys/vfs/devfs/devfs_vnops.c:1099 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4759 Low 7.2 Module teardown is unsynchronized: vinum_inactive() TOCTOU vs vinumopen(), the state > volume_down gap skips open-but-down volumes, and VF_OPEN/VF_DAEMONOPEN are refcount-free booleans (UAF-class teardown window)
sys/dev/raid/vinum/vinum.c:171 · pass 2 · new
 none untested not_testable untriaged — —
DF-4567 Info 7.2 CTB ring math trusts GuC-firmware-written descriptor fields with only compiled-out GEM_BUG_ON validation — desc->size==0 gives divide-by-zero panic, inflated size/tail gives FW-offset wild write past the 1-page CT object
sys/dev/drm/i915/intel_guc_ct.c:324 · pass 2 · new
 none untested not_testable untriaged — —
DF-2920 High 7.1 Beyond-EOF VM pages retained for the last buffer remain faultable: nvnode_pager_setsize()'s unmap is the only EOF enforcement, so mmap reads/writes past EOF succeed on every filesystem, pre-truncate content (incl. recycled disk-block residue) is served during the truncate zero-fill window, and on tmpfs beyond-EOF writes become file data
sys/kern/vfs_vm.c:42 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2940 High 7.1 mpipe_done() tears down the malloc pipeline with no synchronization against in-flight users — its only teardown caller (dm-crypt) destroys tables while bios still hold mpipe buffers: KKASSERT panic / UAF write on production kernels / reproduced permanent kernel wedge
sys/kern/kern_mpipe.c:122 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3011 High 7.1 btree_remove() unbounded recursion — kernel stack overflow from crafted deep B-trees with all-valid counts/types/CRCs (bypasses DF-0776 hardening)
sys/vfs/hammer/hammer_btree.c:1979 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3141 High 7.1 sizeof(struct fnode)=520 > FNODESIZE=512: unconditional 8-byte out-of-bounds write past the buffer in hpfs_update, mirror OOB read in hpfs_vget — cross-file page-cache corruption with attacker-crafted content, or deterministic kernel page-fault panic
sys/vfs/hpfs/hpfs_subr.c:735 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3190 High 7.1 Unvalidated superblock fragment-mask fields (fs_fmask/fs_qfmask) let fragroundup() round DOWN in ffs_balloc — undersized kernel buffer handed to ffs_write for an attacker-sized/-contented overrun copy, and deterministic unprivileged-triggered kernel panic
sys/vfs/ufs/ffs_balloc.c:119 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3376 High 7.1 Lockless nd6_ra_input tail races nd6_timer expiry-sweep frees: UAF on nd_prefix/nd_defrouter (M_IP6NDP) with fatal route-replication panic; single-site fix empirically falsified
sys/netinet6/nd6_rtr.c:403 · pass 2 · new
 dos reproduced fix_failed untriaged — —
DF-3749 High 7.1 wcid2ni[] never cleared on node free → TX-status drain use-after-free (hostap remote)
sys/dev/netif/ral/rt2860.c:887 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3882 High 7.1 drm_dp_mst_handle_down_rep txmsg use-after-free race vs drm_dp_mst_wait_tx_reply timeout kfree
sys/dev/drm/drm_dp_mst_topology.c:2337 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3686 Medium 7.1 Zero-count DPM tables (ignored setup failures) drive unsigned index 0xFFFFFFFF into dpm_levels[]: wild read/write ~48 GB out plus OOB reads and divide-by-zero across OD paths
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3588 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3712 Medium 7.1 2-byte DMA heap overflow in em(4) RX when MTU in (1500, 2028]: ETHER_ALIGN front-trim coexists with RCTL_LPE long-frame reception on 2048-byte hardware buffers
sys/dev/netif/em/if_em.c:3378 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3930 Medium 7.1 mly_cam_complete() INQUIRY rewrite writes vendor/product/revision at data_ptr[8..36) regardless of dxfer_len — heap OOB write via short pass(4) INQUIRY CCB on a logical device
sys/dev/raid/mly/mly.c:2341 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4008 Medium 7.1 mpr diag-buffer registration: shared DMA trio + stale per-type size yields OOB kernel disclosure, cross-type free, and NULL-deref/UAF
sys/dev/raid/mpr/mpr_user.c:1508 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2853 High 7.0 rman_reserve_resource alignment-roundup unsigned wrap grants resources outside the scanned free fragment — overlapping allocations with live owners and free-fragment inflation across neighbors
sys/kern/subr_rman.c:247 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2938 High 7.0 OBJT_DEVICE pager objects never reference the cdev: device teardown while a mapping persists leaves a dangling object->handle → cdev use-after-free in old_dev_pager_fault (indirect call via freed si_ops) and old_dev_pager_dtor (assert + NULL write)
sys/vm/device_pager.c:124 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2990 High 7.0 newblk hash chains mutated without the softdep lock: lock-free insert/lookup races locked remove+kfree on shared chains (list corruption, UAF write into freed M_NEWBLK, 'lost block' panics)
sys/vfs/ufs/ffs_softdep.c:1003 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3188 High 7.0 Unlocked pfsm RB-tree lookup-vs-final-remove race: hammer_load_pseudofs/hammer_rel_pseudofs lack any serialization — UAF + double free + RB tree corruption, sprayable unprivileged via the ungated HAMMERIOC_GET_PSEUDOFS on a nonexistent PFS
sys/vfs/hammer/hammer_pfs.c:68 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3248 High 7.0 hpfs_genlookupbyname's unvalidated dirent walk drives hpfs_updateparent into a 20-byte OOB heap write past a 2048-byte dirblk chunk — attacker-chosen bytes (utimes mtime/atime u64 + crafted fn_size u32) at attacker-chosen offset (<=64KB of u16 reclen hops), unprivileged trigger on a crafted HPFS mount; silent corruption + livelock-DoS variants (write side of DF-0927's read walk)
sys/vfs/hpfs/hpfs_lookup.c:73 · pass 2 · new
 high reproduced fixed untriaged — —
DF-3728 High 7.0 ciss_notify_complete: fatal-error path leaves ciss_periodic_notify dangling -> double-ownership, double post, xpt_done twice (CAM UAF)
sys/dev/raid/ciss/ciss.c:3619 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-3729 High 7.0 ciss_notify_rescan_logical: unbounded ndrives + unchecked LUN_TO_BUS/TARGET -> OOB heap read and write
sys/dev/raid/ciss/ciss.c:3866 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-3813 High 7.0 mpr_wait_command()/mpr_request_polled() miss the realloc check on the concurrent-reinit wakeup/poll path — use-after-free on struct mpr_command
sys/dev/raid/mpr/mpr.c:3578 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3880 High 7.0 dsp_oss_syncstart use-after-free: lksleep drops the syncgroup lock mid-walk; timeout wake resumes SLIST_FOREACH over sm/sg freed by a concurrent SYNCSTART
sys/dev/sound/pcm/dsp.c:3027 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3995 High 7.0 dc_link_is_dp_sink_present frees a BORROWED struct ddc on DDC-open failure: use-after-free on every later DDC/AUX transaction plus stale-pointer double free at connector teardown
sys/dev/drm/amd/display/dc/core/dc_link.c:348 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4014 High 7.0 mps_user_pass_thru frees the in-flight command and its DMA buffer the instant mps_wait_command() times out (use-after-free with device DMA writeback)
sys/dev/raid/mps/mps_user.c:975 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4026 High 7.0 /dev/dsp mmap vs chn_resizebuf use-after-free: dsp_mmap_single maps bufsoft inside chn_resizebuf's lock-drop windows and the resize then kfrees the mapped buffer — persistent userland RW over freed M_DEVBUF kernel heap
sys/dev/sound/pcm/channel.c:1762 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4165 High 7.0 VBIOS retimer HdmiRegNum/Hdmi6GRegNum (u8, unclamped) drive heap OOB write past kzalloc'd struct integrated_info in get_integrated_info_v11
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1441 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4395 High 7.0 Heap OOB write in get_dcefclk_voltage_dependency_table pioneer path: allocation capped at min(ucNumEntries+1, 8) but copy loop runs raw ucNumEntries — up to 6916 bytes of VBIOS-controlled records past a 228-byte kernel heap object
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:721 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-4834 High 7.0 mrsas_passthru operates on the raw userland ioctl pointer: validation→use TOCTOU on sge_count walks past the 16-entry stack arrays (kernel stack OOB write + OOB stack reads); unmapped arg panics the kernel
sys/dev/raid/mrsas/mrsas_ioctl.c:150 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4840 High 7.0 Use-after-free race on non-refcounted DRM_MODE_OBJECT_MODE objects in drm_mode_obj_set_property_ioctl — freed mode reclaimed with attacker data drives a fully controlled properties/property/dispatch chain ending in a controlled indirect call (plane->funcs->set_property)
sys/dev/drm/drm_mode_object.c:515 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4919 High 7.0 cancel_work_sync()/flush_work() decide 'work is idle' from lockless flag reads — premature return while the work is between dequeue and start (or while an insert is publishing), violating the free-after-cancel contract → UAF/arbitrary-call ceiling
sys/dev/drm/linux_workqueue.c:331 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4927 High 7.0 radeon_sa_bo_next_hole leaves dangling borrowed fence pointers across inner-loop iterations → UAF write, UAF read, and double kfree in radeon_sa_bo_new (missing upstream fix 0381ac3ca2e7)
sys/dev/drm/radeon/radeon_sa.c:267 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-5013 High 7.0 mfi LD lifetime UAF: device_delete_child frees the mfi_disk softc under open descriptors and in-flight bios (AEN offline path has no gate at all)
sys/dev/raid/mfi/mfi_disk.c:178 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5016 High 7.0 syscons history ring UAF: scroll-path appends (syscons_lock) are not serialized against ring realloc/free (vga_token)
sys/dev/misc/syscons/schistory.c:94 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5049 High 7.0 mfi syspd lifetime UAF: AEN PD removal (MR_EVT_PD_REMOVED) deletes the syspd locklessly with no gate and mfi_syspd_detach frees the softc under open descriptors and bios parked on the controller bioq (DF-5013's syspd twin)
sys/dev/raid/mfi/mfi_syspd.c:155 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5059 High 7.0 drm_clients_info walks dev->filelist under struct_mutex instead of filelist_mutex: count/copy TOCTOU heap overflow (write) and close-race UAF (read) via hw.dri.N.clients
sys/dev/drm/drm_sysctl.c:268 · pass 2 · new
 heap-overflow-write + UAF-read (kernel-space primitive reproduced with the verbatim drm_sysctl.c:260-301 walk/copy body, real M_DRM allocator and real struct drm_file[544B]: opens landing between the count walk (:271) and copy walk (:281) made the copy write 544B-elem structs past the exact-size kmalloc; 138 organic hits per 100k unprivileged sysctl reads with no forced interleave; a groomed exact-size allocation clobbered an adjacent kernel heap object (guard[9]) - real cross-object corruption; end-to-end hw.dri path hardware-gated: QEMU guest has no GPU/device, so no real drm clients exist and a uid0 chain on the live path was not exercisable) reproduced fixed untriaged — —
DF-5106 High 7.0 emu_midi_detach() ignores mpu401_uninit() failure: with the 0666 MIDI cdev open, detach reports success while newbus kfrees the softc the still-live cdev/mpu401/callout keep using (UAF + deterministic kldunload panic)
sys/dev/sound/pci/emu10kx-midi.c:229 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5125 High 7.0 synchronize_rcu() expands to zero instructions — zero-length grace period lets drm callers kfree objects under live readers (UAF → kernel RIP control, demonstrated)
sys/dev/drm/linux_rcu.c:94 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5126 High 7.0 rcu_read_lock() is cpu_ccfence() (no exclusion) and reclaim is a fixed 1s delay line — __kfree_rcu/call_rcu free objects while readers are still inside their critical sections (deterministic 3/3 UAF + RIP control, demonstrated)
sys/dev/drm/linux_rcu.c:81 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5177 High 7.0 hrtimer_cancel() is not atomic against concurrent hrtimer_start(): releases timer_token before the delete/drain and start() falsifies running/gd — cancel returns while the callback is still executing, so the caller's kfree turns the __hrtimer_task epilogue into a deterministic use-after-free write
sys/dev/drm/linux_hrtimer.c:112 · pass 2 · new
 kernel use-after-free write (memory corruption), deterministic: hrtimer_cancel() returns while timer->function is still executing (Linux requires exclusion), so the caller's kfree() is followed by __hrtimer_task epilogue writes (lwkt token ops + running/active byte clears) into freed-then-reallocated memory; same interleave with a RESTART-returning callback reaches systimer_init_oneshot() on the freed chunk (bzero + insertion into a live per-cpu systimer queue, ending in a timer->function call from attacker-reclaimed memory); uid=0 chain not completed (drm hrtimer callers are GPU-gated on this guest) reproduced fixed untriaged — —
DF-5259 High 7.0 Beacon mbuf use-after-free write: mtw_update_beacon manipulates rvp->beacon_mbuf with no MTW_LOCK (the port dropped FreeBSD's RUN_LOCK), racing m_freem in mtw_newstate(S_RUN)/mtw_vap_delete under the disjoint sc-lock domain
sys/bus/u4b/wlan/if_mtw.c:3855 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5321 High 7.0 fw_xfer/tlabel use-after-free and double completion: firewire_xfer_timeout() vs fw_rcv() + FW_ASYREQ waiter — no cross-CPU serialization of the completion/tlabel lifetime
sys/bus/firewire/firewire.c:336 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5347 High 7.0 bus_dmamap_destroy() frees a map still queued for deferred load (EINPROGRESS) -> UAF with arbitrary-call/RIP control from freed memory
sys/platform/pc64/x86_64/busdma_machdep.c:440 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5378 High 7.0 Use-after-free of the UVC control graph in uvc_query_v4l2_ctrl()/uvc_query_v4l2_menu(): detach frees sc->ctrl before destroy_dev, giving a racing unprivileged VIDIOC_QUERYCTRL/QUERYMENU a 1-byte write into freed kernel heap plus a 31-byte-per-query kernel-heap disclosure
sys/bus/u4b/uvc/uvc_ctrls.c:1065 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5414 High 7.0 fw_read frees the FWACT_CH xfer while it stays linked in ir->q (dequeue is #if 0) -> use-after-free + double free on every subsequent read
sys/bus/firewire/fwdev.c:304 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5467 High 7.0 vga_pci_unmap_bios() re-evaluates vga_pci_is_boot_display() and tears down a ROM-BAR mapping with the 128K shadow size: kernel page-table teardown + kernel_map VA free beyond the mapping, plus a leaked live ROM resource
sys/bus/pci/vga_pci.c:288 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5548 High 7.0 Unsynchronized si_drv1/refcount lifecycle in fwmem open/close/ioctl/strategy — live-race kernel panic, post-race NULL write, and an 8-byte controlled UAF write over the slab freelist pointer (arbitrary-address allocation / double allocation)
sys/bus/firewire/fwmem.c:266 · pass 2 · new
 unsynchronized si_drv1/refcount lifecycle: live open/close race -> Fatal trap 12 (NULL+offsetof(refcount) deref in production fwmem_close, fwmem.c:292); post-race NULL-si_drv1 state -> supervisor WRITE at 0x0 in fwmem_ioctl (fwmem.c:410); racing ioctl/close -> 8 fully attacker-controlled bytes at offset 0 of a freed 16-byte-zone chunk == DragonFly SLAB freelist next pointer -> kmalloc hands out the attacker-chosen address / silently duplicates a live chunk (on this INVARIANTS kernel: deterministic allocator-assert panics; on production builds: silent double allocation) reproduced fixed untriaged — —
DF-5550 High 7.0 camq_resize() shrink-below-entries: heap OOB write + persistent entries>array_size queue corruption — guard is #ifdef DIAGNOSTIC only (compiled out of stock kernels); in-tree trigger via xpt_remove_periph shrinking a drvq whose periph is still queued
sys/bus/cam/cam_queue.c:116 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5613 High 7.0 Unsynchronized iso-xferq claim (FW_STSTREAM/FW_SRSTREAM) and teardown (fw_close -> fwdma_free_multiseg) → shared queue, bulkxfer heap overflow with chosen ints, and in-flight fw_write/fw_read UAF write/read on freed fwdma buffers
sys/bus/firewire/fwdma.c:100 · pass 2 · new
 memcorrupt: controlled kernel UAF write (attacker iso payload into fwdma segment pages freed by the concurrent teardown) + linear heap overflow past the bulkxfer kmalloc with chosen poffset ints; fatal supervisor-write variant on >=4GB-RAM hosts (panic.txt) reproduced fixed untriaged — —
DF-2692 Medium 7.0 lwpsignal() writes p->p_sigacts->ps_frominfo[] on the token-swapped delivery path holding only the lwp token, racing kern_execve()'s sigacts replacement/free (UAF write)
sys/kern/kern_sig.c:1425 · pass 2 · new
 none untested not_testable untriaged — —
DF-2842 Medium 7.0 vnode_pager_reference() lacks the vp↔object interlock — TOCTOU use-after-free on vm_object ref_count
sys/vm/vnode_pager.c:203 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2872 Medium 7.0 taskqueue_free() ignores the write-only tq_callouts counter: armed timeout callout fires into freed/reallocated queue (UAF)
sys/kern/subr_taskqueue.c:150 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3394 Medium 7.0 vlan SIOCGIFMEDIA uses an unpinned parent ifnet pointer across a serializer drop: UAF (indirect if_ioctl call through freed ifnet) racing privileged parent destroy
sys/net/vlan/if_vlan.c:951 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3755 Medium 7.0 Dangling rdev->pm.dpm.ps after alloc-failure kfree in ni_parse_power_table: ignored-error UAF publication, ps_priv leak, and teardown double free (use-after-free kfree of a live foreign object)
sys/dev/drm/radeon/ni_dpm.c:4020 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3800 Medium 7.0 mprsas_realloc_targets resizes the target array to stale pre-reset IOC facts and never updates sassc->maxtargets while the mapping layer is rebuilt from new facts: heap OOB write past sassc->targets[] (and past mapping_table[] in the opposite direction)
sys/dev/raid/mpr/mpr_sas.c:3911 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3928 Medium 7.0 Unvalidated firmware channel counts overflow mly_cam_sim[6] and mly_btl[6][16] at attach (~4KB pointer writes + ~290KB strided flag writes past the softc)
sys/dev/raid/mly/mly.c:1947 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4007 Medium 7.0 eb_move_to_gpu error path double-unreserves vmas: pin/fence/GEM-object refcount underflow → UAF
sys/dev/drm/i915/i915_gem_execbuffer.c:1864 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4069 Medium 7.0 Unclamped VBIOS SCLK DPM count overflows GraphicsLevel[8] in vegam_populate_all_graphic_levels (heap OOB write past vegam_smumgr)
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:886 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4070 Medium 7.0 Unclamped VBIOS MCLK DPM count overflows MemoryLevel[4] in vegam_populate_all_memory_levels — count=5 already OOB
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1047 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4071 Medium 7.0 Kernel STACK overflow in vegam_program_memory_timing_parameters: unclamped sclk x mclk counts fill a 640B stack SMU75_Discrete_MCArbDramTimingTable (entries[8][4])
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1291 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4157 Medium 7.0 ADC DMA-ring completion feed uses the raw APU CURPTR register as its only bound — desync/power-state race yields unbounded kernel OOB write
sys/dev/sound/pci/maestro.c:1066 · pass 2 · new
 none untested not_testable untriaged — —
DF-4356 Medium 7.0 postclose teardown order reversed: amdgpu_vm_fini before amdgpu_ctx_mgr_fini (DF-port divergence) - VM page tables freed under still-live context jobs (device-side UAF / GPU loss)
sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1073 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5064 Medium 7.0 drm_device_detach never unregisters or releases the drm_device: /dev/dri minors stay live and dispatch into unloaded driver-module memory after kldunload (UAF-class) plus unbounded drm_device leak; i915 never runs any driver teardown
sys/dev/drm/drm_dragonfly.c:251 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5191 Medium 7.0 sio_pccard_detach mutates com->gone/com->tp/com->ibuf and calls ttyclose without tty_token, racing siopen/sioclose/siosetwater into kernel heap UAF and double-free of com->ibuf
sys/dev/serial/sio/sio_pccard.c:117 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5260 Medium 7.0 Deferred mtw_cmdq entries hold raw vap/ni pointers; mtw_vap_delete frees the mtw_vap without draining sc->cmdq_task - mtw_update_beacon_cb/mtw_newassoc_cb/mtw_key_set_cb execute on freed objects
sys/bus/u4b/wlan/if_mtw.c:909 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5262 Medium 7.0 Lockless mtw_cmdq[] ring: producers store .func before the args with no barrier while mtw_cmdq_cb consumes concurrently under MTW_LOCK (which producers never take) - torn publish executes callbacks with stale pointers
sys/bus/u4b/wlan/if_mtw.c:1937 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2959 Low 7.0 ucom_get_data TX path passes unclamped request length to clist_qtob — latent heap OOB write past USB page-cache segment (consumer-side defect found in tty_subr.c pass-2 API sweep)
sys/bus/u4b/serial/usb_serial.c:1898 · pass 2 · new
 none untested not_testable untriaged — —
DF-2961 Low 7.0 kobj_class_free() reclaims the compiled ops table with no grace period while the lock-free dispatch hot path reads it (force multiplier turning any consumer refcount slip into a freed function-pointer table call)
sys/kern/subr_kobj.c:179 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3316 Low 7.0 tcp_pcblist marker-dance walks per-cpu inpcb lists from a preemptible user thread with no synchronization — DF-3315's non-atomic advance race, here with fully unprivileged churn (UAF read/write on struct inpcb)
sys/netinet/tcp_subr.c:1271 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3588 Low 7.0 Double free of adev->pm.dpm.ps on allocation-failure path in si_parse_power_table (plus leak of already-parsed si_ps states)
sys/dev/drm/amd/amdgpu/si_dpm.c:7256 · pass 2 · new
 OOM-gated double free untested not_testable untriaged — —
DF-3811 Low 7.0 intel_ddi_init error path kfrees intel_dig_port while a fully-registered DP connector still references it (OOM-gated UAF)
sys/dev/drm/i915/intel_ddi.c:3863 · pass 2 · new
 none untested not_testable untriaged — —
DF-4156 Low 7.0 agg_attach() error path frees the AC97 codec while the 0666 /dev/mixerN mixer_init() created survives — post-failure mixer ioctl UAF through freed kobj
sys/dev/sound/pci/maestro.c:1894 · pass 2 · new
 none untested not_testable untriaged — —
DF-4334 Low 7.0 via_attach() pcm_register()-failure path destroys the AC97 codec while the 0666 /dev/mixerN mixer_init() created survives — dangling mixer devinfo UAF on open/ioctl
sys/dev/sound/pci/via8233.c:1335 · pass 2 · new
 none untested not_testable untriaged — —
DF-4344 Low 7.0 atiixp_chip_post_init mixer_init/pcm_register error-path asymmetry leaves a live 0666 /dev/mixerN over freed codec+softc — UAF on open/ioctl and NULL-deref suspend (DF-4156 family, 5th instance)
sys/dev/sound/pci/atiixp.c:1085 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4457 Low 7.0 cmi_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc — UAF on open/ioctl (DF-4156 family, 7th instance)
sys/dev/sound/pci/cmi.c:986 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4504 Low 7.0 t4dwave: attach-failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec/tr_info — mixer-UAF family (9th instance)
sys/dev/sound/pci/t4dwave.c:882 · pass 2 · new
 none untested not_testable untriaged — —
DF-4537 Low 7.0 cs4281: attach-failure path after mixer_init() leaves a live 0666 /dev/mixerN over freed codec/softc - mixer-UAF family (10th instance)
sys/dev/sound/pci/cs4281.c:845 · pass 2 · new
 none untested not_testable untriaged — —
DF-4550 Low 7.0 als_pci_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc — dangling mixer devinfo UAF on open/ioctl (DF-4156 family, 11th instance)
sys/dev/sound/pci/als4000.c:842 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4610 Low 7.0 nm_pci_attach failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc — mixer-UAF family, 13th instance (DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537/4550)
sys/dev/sound/pci/neomagic.c:695 · pass 2 · new
 none untested not_testable untriaged — —
DF-4724 Low 7.0 aureal: attach failure after mixer_init() leaves the live 0666 /dev/mixerN over the freed au softc — DF-4156 mixer-UAF family, 15th instance (premise live-verified on the guest)
sys/dev/sound/pci/aureal.c:634 · pass 2 · new
 none untested not_testable untriaged — —
DF-4743 Low 7.0 via_attach(): five failure paths after mixer_init() free the AC97 codec while the 0666 /dev/mixerN survives — dangling mixer devinfo UAF on unprivileged open/ioctl (DF-4156 mixer-UAF family, 16th instance)
sys/dev/sound/pci/via82c686.c:548 · pass 2 · new
 none untested not_testable untriaged — —
DF-3585 High 6.8 Heap OOB write in si_get_svi2_voltage_table (and lowSMIO sink in si_populate_smc_voltage_table): BIOS dependency-table count (u8, up to 255) copied into fixed entries[32]/lowSMIO[32] arrays
sys/dev/drm/amd/amdgpu/si_dpm.c:4410 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3981 High 6.8 login_callout never cancelled when sbp_dev is freed (stale-LUN invalidation, !VALID_LUN loop, post_explore GC) — softclock fires sbp_login_callout on the kfree'd sdev and runs sbp_mgm_orb writes into freed slab + fwdma_free'd ORB pages
sys/dev/disk/sbp/sbp.c:625 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4207 High 6.8 Wild OOB heap write in eepromExpandPower5112(): 0xDEAD sentinel xgainList[0] used as pDataPerXPD[] index when device EEPROM xpdMask has no set bits
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:195 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3887 Medium 6.8 VBIOS usVoltageIndex (USHORT 0..65535) OOB heap write in sumo_construct_vid_mapping_table — up to 5 chosen-offset 16-bit-pair writes into/after the kv_power_info heap object
sys/dev/drm/amd/amdgpu/kv_dpm.c:167 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2904 Low 6.8 mbr_extended()'s signed int slice counter can wrap negative after 2^31 accepted EBR entries, defeating the `slice >= MAX_SLICES` guard → OOB write of attacker-controlled ds_offset/ds_size before dss_slices[]
sys/kern/subr_diskmbr.c:423 · pass 2 · new
 none untested not_testable untriaged — —
DF-3402 Low 6.8 slstart drains sc_fastq/ifsq under tty locks while sloutput fills them under the ifsq serializer — no common lock, concurrent ifqueue corruption
sys/net/sl/if_sl.c:494 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2741 High 6.7 DIOCGSLICEINFO: dsioctl bcopy uses runtime dss_nslices (GPT disks: up to 130) against the 16-record ioctl type — 29,184-byte kernel heap OOB write per ioctl
sys/kern/subr_disk.c:1196 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3229 High 6.7 fuse_ipc_tx() error paths free a still-linked fuse_ipc: fuse_ipc_wait returns ENOTCONN without fuse_ipc_remove at :163-167 (dead-at-entry, fip linked on BOTH queues) and :198-201 (dead-after-blind-reply, fip still on request_head)
sys/vfs/fuse/fuse_ipc.c:163 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3426 High 6.7 Generic netmap TX pool mbufs are dispatched with no retained reference: tx_pool slots alias driver-owned and then freed memory (controlled UAF write + double free)
sys/net/netmap/netmap_generic.c:504 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3644 High 6.7 Heap OOB write in ci_get_svi2_voltage_table: VBIOS dependency-table count (u8, up to 255) copied into fixed entries[32] before any trim
sys/dev/drm/radeon/ci_dpm.c:2159 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3739 High 6.7 BIOS-count-driven OOB pointer write past rdev->i2c_bus[16] in radeon_atombios_i2c_init
sys/dev/drm/radeon/radeon_atombios.c:172 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3740 High 6.7 Stack buffer overflow in radeon_atom_get_mclk_range_table: uncapped (u8) num_entries fill of mclk[16] into a caller stack local
sys/dev/drm/radeon/radeon_atombios.c:3938 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5376 High 6.7 targwrite() forwards raw user abort_ccb pointer when targusermerge() returns ESRCH ('!= EFAULT' check): fake-CCB arbitrary-address kernel write and kernel-global cam_simq corruption → RIP-control chain
sys/bus/cam/scsi/scsi_target.c:626 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2808 Medium 6.7 Cross-segment mapsize under-sizing: mapsize derives only from segs[0]'s start and segs[1]'s end, so segs[0]'s extent is never covered → file-controlled kernel heap overflow (DF-2771 analogue in the EXEC loader)
sys/kern/link_elf.c:541 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2832 Medium 6.7 Syncer-trigger API (trigger_syncer*/speedup_syncer) has no lifetime interlock against vn_syncer_thr_stop — UAF atomic-write on freed syncer ctx (and NULL-ctx / freed-mount reads)
sys/kern/vfs_sync.c:561 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2894 Medium 6.7 kenv_init() ingests unbounded bootloader env strings; kgetenv() strcpy() overflows a 258-byte kernel stack buffer, detonable by any unprivileged user via kenv(2) KENV_GET
sys/kern/kern_environment.c:580 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2984 Medium 6.7 syscall_deregister() writes sysent[*offset] through an unvalidated index with an unvalidated value: MOD_LOAD-failure rollback destroys a live syscall slot (EEXIST) → any unprivileged user's syscall(N) is a kernel NULL function call — deterministic persistent panic; EINVAL variant = arbitrary-index 24-byte kernel zero-write; ENFILE variant = sysent[-1] OOB write
sys/kern/kern_syscalls.c:72 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3260 Medium 6.7 Unvalidated rule act_ofs escalates DF-0261's OOB read to a 4-byte heap OOB write, a deterministic packet-triggered kernel panic, and an F_LEN==0 netisr infinite loop
sys/net/ipfw/ip_fw2.c:4515 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3314 Medium 6.7 Node teardown dereferences the freed ieee80211vap when the last node reference outlives vap destruction: _ieee80211_free_node AID_CLR wild write + node_free ratectl/cleanup UAF
sys/netproto/802_11/wlan/ieee80211_node.c:1786 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3698 Medium 6.7 cu_info walkers index bitmap[4][4]/ao_cu_bitmap[4][4] with unclamped max_shader_engines/max_sh_per_se taken from gpu_info firmware or VBIOS → heap OOB write + read
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:937 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4967 Medium 6.7 radeon_gart_bind/unbind take a 32-bit `unsigned offset`: GTT aperture offsets >= 4 GiB truncate and alias GART entries across buffer objects (cross-process GPU data redirection)
sys/dev/drm/radeon/radeon_gart.c:241 · pass 2 · new
 none untested not_testable untriaged — —
DF-5289 Medium 6.7 pmap_enter/pmap_unwire UKSMAP wire-accounting corruption: mlock() of /dev/upmap wires a transient stack-fictitious page with no vm_page wire, pmap_unwire() then returns the real kmalloc'd slab page which vm_fault_unwire unwires — slab page loses its only wire (silent corruption) and panics deterministically on the second cycle
sys/platform/vkernel64/platform/pmap.c:2429 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5293 Medium 6.7 Deferred rum_cmdq entry holds a raw struct ieee80211vap *; rum_vap_delete() frees the rum_vap without draining sc->cmdq_task - rum_update_beacon_cb/rum_set_beacon execute on freed memory
sys/bus/u4b/wlan/if_rum.c:2830 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3805 Low 6.7 Unbounded csio->cdb_len bcopy into the 32-byte MPI2 CDB field overflows the request frame in the req_frames DMA pool
sys/dev/raid/mpr/mpr_sas.c:2102 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3920 Low 6.7 OsSendCommand bcopy's user-controlled cdb_len (<=255) into UCHAR Cdb[16] - kernel stack overflow
sys/dev/raid/hptmv/entry.c:2771 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2745 High 6.6 exit1() p_peers unlink race: lost unlink leaves leader permanently wedged in uninterruptible exit (pre-fdfree, pinning fds+vmspace) and members freed while still linked — kernel heap UAF read/write
sys/kern/kern_exit.c:384 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3047 High 6.6 MNT_RELOAD adopts new group geometry without resizing the cluster-summary arrays — heap OOB write, bzero()/free() of OOB-read pointers, and per-reload gd leak
sys/vfs/ext2fs/ext2_vfsops.c:620 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3784 High 6.6 vbi_read() truncates the 64-bit read length to int → negative readsize bypasses both guards → uiomove() of (size_t)INT_MIN copies ~2 GiB of kernel memory to userspace
sys/dev/video/bktr/bktr_core.c:1159 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3998 High 6.6 Unclamped phase offset in the envy24ht DMA emulators: second record channel START reads up to ~32 KB past the shared record DMA buffer into the user's /dev/dsp stream (kernel heap disclosure); play-direction twin carries an attacker-controlled 32-bit write ~130 KB past the play DMA buffer but is latent behind the 1-play-channel registration (DF-3996 twin)
sys/dev/sound/pci/envy24ht.c:1324 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4001 High 6.6 Unclamped VBIOS SCLK/MCLK DPM counts overflow fiji SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1026 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4002 High 6.6 Unclamped VBIOS MM-dependency count overflows fiji UvdLevel[8]/VceLevel[8]/AcpLevel[8] SMC arrays
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1433 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-2828 Medium 6.6 Multi-threaded CKPT_THAW violates vmspace_exec()/pmap_replacevm()'s single-thread contract: deterministic INVARIANTS panic; released-vmspace UAF for other LWPs on production kernels
sys/kern/kern_checkpoint.c:556 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3688 Low 6.6 Unbounded sprintf loops in smu7_print_clock_levels overflow the 4096-byte sysfs page buffer once the VBIOS DPM count exceeds ~233
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4428 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2905 High 6.5 md_done() leaks every pending m_nextpkt record of an mdchain — remote mbuf-pool exhaustion DoS by a malicious SMB server
sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3286 High 6.5 mesh_decap stack OOB write: reserved AE=11 mesh control grows the header copy to 56 bytes into the 50-byte stack buffer b[]
sys/netproto/802_11/wlan/ieee80211_mesh.c:1281 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4027 High 6.5 sili deferred timeout hands a port-owned ccb (state ATA_S_ONCHIP) back to poll callers which sili_ata_put_xfer() it — ccb/slot double lifecycle: reissue on an active slot, stale sili_unload_prb of the new command's live dmamap, and double CAM completion
sys/dev/disk/sili/sili.c:1359 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5015 High 6.5 syscons history ring: stale-geometry ring after ignored sc_alloc_history_buffer() failure → negative ring tail → controlled heap OOB write (underflow) + OOB read
sys/dev/misc/syscons/schistory.c:147 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3028 Medium 6.5 Daemon LOOKUP reply with S_IFMT-clear mode yields vtyp=VBAD → fuse_node_vn KKASSERT(0) panic (INVARIANTS force-enabled module-wide)
sys/vfs/fuse/fuse_vnops.c:554 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3360 Medium 6.5 pf scrub max-mss: 2-byte stack OOB read/write past opts[40] in pf_normalize_tcpopt() via malformed MSS option
sys/net/pf/pf_norm.c:1915 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3479 Medium 6.5 ng_btsocket_l2cap_attach() never takes the implied pcb reference (soreference): KKASSERT panic in sonewconn on every inbound L2CAP connection; child socket refcount runs one low on production kernels (latent pcb->so UAF)
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1961 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4188 Medium 6.5 Dangling rdev->pm.dpm.ps after kfree-without-NULL on the ENOMEM path of sumo_parse_power_table + swallowed init error -> double free in sumo_dpm_fini at unload/reboot; ps_priv[0..i-1] leaked — sumo twin of DF-4117/4144/4125/4023/3973/3755/3955
sys/dev/drm/radeon/sumo_dpm.c:1500 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4494 Medium 6.5 rs780_dpm: swallowed-init lifetime bugs — dangling rdev->pm.dpm.ps after kfree-without-NULL and self-radeon_dpm_fini in rs780_dpm_init -> double free in rs780_dpm_fini and UAF read+write in rs780_dpm_enable
sys/dev/drm/radeon/rs780_dpm.c:830 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4607 Medium 6.5 4x-timeout DANGER1 direct completion races the real completion: concurrent ata_completed -> UAF + double objcache_put
sys/dev/disk/nata/ata-queue.c:140 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5108 Medium 6.5 lockrange() commits pos one past plex->lock[PLEX_LOCKS] when the table fills while a conflicted requester sleeps (16-byte heap OOB write + usedlocks overrun defeating the == fullness checks)
sys/dev/raid/vinum/vinumlock.c:139 · pass 2 · new
 memcorrupt not_reproduced not_testable untriaged — —
DF-5223 Medium 6.5 rv770_copy_dma under-reserves the DMA ring for radeon_sync_rings() semaphore waits: with two pending cross-ring fences, 16 dwords are written past the reserved window, overwriting un-executed GPU commands (user-reachable rv770 twin of DF-1943)
sys/dev/drm/radeon/rv770_dma.c:59 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5753 Medium 6.5 hci_intr()'s scodone completion dispatch (membership walk + hci_sco_complete) is unlocked and unreferenced against syscall-context SCO teardown: sco_disconnect NULLs hl_sco then frees the link while still listed -> NULL-pointer kernel write (sp_pending--) / UAF in netisr context
sys/netbt/hci_unit.c:390 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3863 Low 6.5 u32 truncation of nptes in amdgpu_vm_bo_update_mapping undersizes the update IB; amdgpu_vm_update_ptes then emits an unbounded command stream past its end (kernel heap overflow)
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1807 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4488 Low 6.5 vo destruction runs under the 'video' serial only while all vo sysctl handlers run under 'video_output' only — use-after-free race on vo/vo_levels with an unprivileged 'levels' reader
sys/dev/acpica/acpi_video/acpi_video.c:300 · pass 2 · new
 none untested not_testable untriaged — —
DF-5287 High 6.4 Concurrent read()/write() on a shared ugen endpoint fd double-enters ugen_transfer_setup(): orphaned usb_xfer blocks (permanent kernel memory leak + endpoint refcount exhaustion locking the endpoint for all drivers) plus unlocked usb_fifo_free_buffer() UAF window against live callbacks
sys/bus/u4b/usb_transfer.c:145 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5592 High 6.4 cam_sim freed while still pending in the camisr completion softint — UAF write plus function-pointer dispatch from freed object (cam_sim_release has no synchronization against xpt_done/camisr)
sys/bus/cam/cam_sim.c:241 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2845 Medium 6.4 sbuf_drain() does not validate the drain callback's return value — a drain returning 0 yields a silent, unbounded, content-controlled linear kernel-heap overflow on production kernels
sys/kern/subr_sbuf.c:324 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3277 Medium 6.4 bridge_delete_span() TAILQ_REMOVEs span bif from the per-cpu MEMBER list head — list-tail corruption cross-links span and member lists, leading to KASSERT panic / member-bif UAF and double-free
sys/net/bridge/if_bridge.c:1155 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3607 Medium 6.4 ncr(4): timeout daemon completes an nccb still armed in the chip's DSA — later phase-mismatch resumes DMA from stale/reused scatter descriptors (memory corruption) or wedges the HBA
sys/dev/disk/ncr/ncr.c:5148 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3660 Medium 6.4 isp_detach() never terminates or reaps the per-channel FC kthreads nor stops ldt/gdt callouts; isp_pci_detach() then frees the lock, isp_param and bus resources they still use - teardown use-after-free
sys/dev/disk/isp/isp_freebsd.c:159 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3812 Medium 6.4 isp_add_wwn_entry / isp_del_wwn_entry index FCPARAM(isp, chan) with an unchecked firmware-controlled channel (raw in_vpidx) — kernel heap OOB read/write up to ~17.8 MB past isp_param; isp_del_all_wwn_entries off-by-one admits chan == nchan
sys/dev/disk/isp/isp_library.c:2398 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4029 Medium 6.4 SET_RESOURCE VALID_BUFFER relocates with 8-dword stride into 7-dword resource slots (validated/executed desync)
sys/dev/drm/radeon/r600_cs.c:1953 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4178 Medium 6.4 twe_immediate_request timeout releases a request still posted to the controller and linked on twe_busy — late completion double-processes the reused request (TAILQ corruption / biodone of in-flight bio)
sys/dev/raid/twe/twe.c:1003 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4341 Medium 6.4 Unserialized ISR/netgraph concurrency over per-channel descriptor rings: UAF writes, hook write-after-free, descriptor double-free, and device DMA into freed mbufs (ignored channel-zap status)
sys/dev/netif/mn/if_mn.c:1329 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4349 Medium 6.4 adv_run_doneq completes ccb_infos entries without ACCB_ACTIVE validation: in-bounds stale-slot double completion (double xpt_done/LIST_REMOVE/recycled-dmamap unload) and never-allocated-slot write through uninitialized cinfo->ccb
sys/dev/disk/advansys/advansys.c:1106 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4614 Medium 6.4 ips command-queue lifecycle double-free/UAF: unchecked ips_cmdqueue_init at ips.c:414 plus unconditional, non-NULLing kfree in ips_cmdqueue_free (also frees under live commands on detach)
sys/dev/raid/ips/ips.c:116 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4762 Medium 6.4 fwe_stop() frees RX bulkxfer chunks and their mbufs while fwohci_rbuf_update()/fwe_as_input() still manipulate or walk them — teardown race causes UAF write/read and mbuf double-free
sys/dev/netif/fwe/if_fwe.c:258 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4884 Medium 6.4 Double-free of adev->bios when amdgpu_get_bios() fails: every VBIOS read method kfrees without NULLing and amdgpu_device_fini() frees the dangling pointer again on the probe-failure teardown path
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:116 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4910 Medium 6.4 Unsynchronized aconnector->dc_sink teardown: lockless dm_dp_destroy_mst_connector (destroy work) races mode_config.mutex-held dm_dp_mst_get_modes check-then-set — dc_sink leaked with dangling dc_sink->priv, remote-sink slot exhaustion makes the known DF-1966 NULL-deref panic deterministic, plus UAF-read windows
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:232 · pass 2 · new
 none untested not_testable untriaged — —
DF-5247 Medium 6.4 Deferred run_cmdq entries outlive the vap/node they point at: run_vap_delete frees run_vap without draining sc->cmdq_task
sys/bus/u4b/wlan/if_run.c:1030 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3278 Low 6.4 bridge_fragment() re-header loop double-frees the fragment chain and UAF-reads freed mbufs when any M_PREPEND(M_NOWAIT) fails
sys/net/bridge/if_bridge.c:4386 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3283 Low 6.4 ieee80211_fragment: fragment size can exceed MCLBYTES (FRAG_MAX=2346 default) -> m_align() computes negative offset -> packet-controlled heap underflow write before the mbuf cluster (release) / KASSERT panic (INVARIANTS)
sys/netproto/802_11/wlan/ieee80211_output.c:1703 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3732 Low 6.4 ciss_init_pci: unvalidated firmware transport_offset maps ciss_perf outside the BAR window; ciss_init_perf writes through it
sys/dev/raid/ciss/ciss.c:694 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3733 Low 6.4 ciss_periodic re-arms after unlock vs callout_stop in ciss_free -> post-free callout execution (UAF)
sys/dev/raid/ciss/ciss.c:3431 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3756 Low 6.4 tulip_srom_decode() unbounded media-info pointer walk: OOB WRITE past tulip_softc.tulip_mediainfo[10] into the softc tail and kernel heap
sys/dev/netif/de/if_de.c:2080 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3923 Low 6.4 hpt_attach bus_setup_intr failure kfree()s the newbus-owned IAL_ADAPTER_T softc while it stays linked on gIal_Adapter (use-after-free)
sys/dev/raid/hptmv/entry.c:2026 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4076 Low 6.4 Unvalidated chip-reported IOCRequestFrameSize sizes every request slot; all request builders write fixed sizeof(struct) with no minimum check
sys/dev/raid/mps/mps.c:750 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4193 Low 6.4 es_pci_attach error path after mixer_init leaves a live /dev/mixerN pointing at freed codec/es (UAF on open/ioctl)
sys/dev/sound/pci/es137x.c:1810 · pass 2 · new
 es_pci_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed codec/es (UAF on open/ioctl). Attach-failure precondition only (IRQ/dma-tag/pcm_register failure after mixer_init) - not user-triggerable on demand. Same family as DF-4156 (maestro). untested not_testable untriaged — —
DF-4274 Low 6.4 twa(4) deferred-busdma passthru error path returns the request to the free queue twice — queue corruption and cross-thread request reuse (latent UAF/double-free; sibling of twe DF-4178)
sys/dev/raid/twa/tw_osl_freebsd.c:1282 · pass 2 · new
 none untested not_testable untriaged — —
DF-4611 Low 6.4 nm_init() programs ring/coeff buffers from unvalidated card-provided buftop — cbuf/rbuf/pbuf/acbuf wrap to ~4G offsets used by nm_wrbuf() and sndbuf_setup()
sys/dev/sound/pci/neomagic.c:576 · pass 2 · new
 none untested not_testable untriaged — —
DF-4628 Low 6.4 bxt_exec_gpio: function-static bxt_gpio_table caches devm-allocated gpio_descs across device unbind/rebind — use-after-free on gpiod_set_value
sys/dev/drm/i915/intel_dsi_vbt.c:304 · pass 2 · new
 UAF write (gpiod_set_value mutates desc->flags/value) on first panel-enable after rebind; potentially exploitable if the freed chunk is reclaimed untested not_testable untriaged — —
DF-5521 Low 6.4 iicsmb_detach has no quiesce: kldunload during an in-flight SMBus transaction resumes the sleeper in freed module text (UAF) and leaves iicbus_softc->owner dangling
sys/bus/iicbus/iicsmb.c:164 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3427 High 6.3 SET_MBUF_DESTRUCTOR/generic_mbuf_destructor is ABI-incompatible with DragonFly mbufs: ext_free receives the 16-byte mbcluster, not the mbuf (OOB read -> wild ifp deref + permanent cluster leak)
sys/net/netmap/netmap_generic.c:101 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4529 High 6.3 Device teardown vs in-flight NVMEIOCGETLOG/open: use-after-free of the admin queue and softns -> kernel divide-by-zero panic in nvme_get_request (reproduced 2/2)
sys/dev/disk/nvme/nvme.c:273 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4952 High 6.3 feed_mixer_rec: no free-space clamp — one feeder over-return wraps sndbuf_getfree to ~4G and the acquire loop re-arms maxfeed (~64KB) requests into the fixed-size bufsoft->tmpbuf: linear heap OOB write by the real converter (REC-path sink of the FXROUND family, distinct from DF-4849's PLAY path)
sys/dev/sound/pcm/feeder_mixer.c:195 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2775 Medium 6.3 sysctl_intrnames traverses every CPU's interrupt-handler lists unsynchronized → use-after-free read / kernel heap disclosure via hw.intrnames
sys/kern/kern_intr.c:1100 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3118 Medium 6.3 Signed 32-bit flusher sequence ring misorders all completion/mis-sequencing comparisons past 2^31; wrapped state causes permanently stuck flush group and self-sustaining synchronous-finalize storm (system wedge)
sys/vfs/hammer/hammer_flusher.c:114 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3318 Medium 6.3 in6_update_ifa() accepts arbitrary ifra_dstaddr.sin6_len — unprivileged SIOCGLIFADDR kernel-heap pointer leak and privileged SIOCDLIFADDR kernel stack buffer overflow
sys/netinet6/in6.c:901 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3345 Medium 6.3 lagg_lacp_detach drops the lagg WLock mid-detach while sc_* protocol callbacks remain installed: ioctl re-entry into half-torn-down LACP state (incl. unprivileged SIOCGLAGG)
sys/net/lagg/if_lagg.c:1085 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3973 Medium 6.3 Ignored btc_dpm_init failure leaves dangling rdev->pm.dpm.ps and un-NULLed dyn_state pointers: double free in btc_dpm_fini (two paths) plus eg_pi/ps_priv leaks — btc twin of DF-3645/3755/3955
sys/dev/drm/radeon/btc_dpm.c:2574 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4211 Medium 6.3 mpt_refresh_raid_vol frees a request on ETIMEDOUT that is still queued to the IOC and on request_pending_list → request-pool double-link / cross-command use-after-free
sys/dev/disk/mpt/mpt_raid.c:1327 · pass 2 · new
 none untested not_testable untriaged — —
DF-4253 Medium 6.3 SATA-ID timeout recovery frees in-flight commands (SMID reuse confusion), can Target-Reset the wrong target, and overwrites targ->tm without NULL check
sys/dev/raid/mpr/mpr_sas_lsi.c:992 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4364 Medium 6.3 All mps_config.c getters free the mps_command while the IOC still owns it after mps_request_polled timeout - late completion UAF / cross-request completion confusion / reply-queue corruption
sys/dev/raid/mps/mps_config.c:167 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4371 Medium 6.3 Dangling rdev->pm.dpm.dyn_state entries pointers after error-path kfree in r600_parse_extended_power_table — r600_free_extended_power_table at teardown kfrees them again (heap double free; root site shared by all six DPM family callers)
sys/dev/drm/radeon/r600_dpm.c:939 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4398 Medium 6.3 tws_scsi_err_complete touches the ccb after xpt_done (callout_stop on a surrendered ccb) — CAM ccb use-after-free race on every error completion
sys/dev/raid/tws/tws_cam.c:593 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4400 Medium 6.3 tws_intr_resp invokes req->cb with no busy-state/completer validation — firmware replay of an in-range req_id double-completes surrendered ccbs or calls a NULL cb (distinct from DF-1590's index OOB)
sys/dev/raid/tws/tws_cam.c:1161 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4914 Medium 6.3 radeon_fbdev_init() failure leaves rdev->mode_info.rfbdev dangling (published before any fallible step, kfree'd on the error path without clearing) — production teardown radeon_fbdev_fini() then use-after-frees and double-kfrees it
sys/dev/drm/radeon/radeon_fb.c:379 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4925 Medium 6.3 amdgpu_fbdev_init() publishes adev->mode_info.rfbdev before the fallible drm_fb_helper_init() and kfrees it without clearing on error — dangling pointer → deferred double-free/UAF in production teardown (DF-4914 radeon_fb twin)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:365 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5021 Medium 6.3 dp_retrain_link_dp_test walks dc->current_state with no lock and no state reference while concurrent atomic commits release it — use-after-free driven by unauthenticated HPD-RX automated-test input from a malicious DP sink
sys/dev/drm/amd/display/dc/core/dc_link_hwss.c:274 · pass 2 · new
 kernel UAF/NULL-deref per finding untested not_testable untriaged — —
DF-5273 Medium 6.3 cdioctl() drops an unmatched cam_periph_release() when cam_periph_hold(PCATCH) is signal-interrupted: periph refcount underflow -> premature free / UAF window
sys/bus/cam/scsi/scsi_cd.c:1930 · pass 2 · new
 peripheral refcount underflow (demonstrated 1 -> 0 -> -1 on a valid, open cd periph; earlier exploratory runs reached -3 and -5), one burned reference per signal-interrupted ioctl, deterministic; with device invalidation (unplug/kldunload) the CAM_PERIPH_INVALID && refcount==1 branch of cam_periph_release() frees periph+softc while fds remain open -> use-after-free window in cdioctl/cdclose between cam_extend_get() and cam_periph_lock(). Root-gated entry; the full UAF was not chased (racy), the underflow is deterministic. reproduced not_testable untriaged — —
DF-5674 Medium 6.3 Keysym free mutates the global interned-key rb-tree without the tree mutex — unsynchronized rb-tree rebalancing → UAF/heap corruption
sys/libprop/prop_dictionary.c:148 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2725 Low 6.3 cluster_rbuild() under-counts component pages vs the pbuf's embedded xio_pages[]/KVA window — latent OOB pointer write + PTE install past MAXPHYS window for non-page-tiling VFS geometry
sys/kern/vfs_cluster.c:954 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3719 Low 6.3 Firmware load: registration-metadata size drives an unbounded SRAM PIO copy (*limit initialized to sram_size then blindly overwritten) and short-inflate copies uninitialized kernel heap to the NIC
sys/dev/netif/mxge/if_mxge.c:685 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3891 Low 6.3 Double free of adev->pm.dpm.ps (and leak of parsed ps_priv states) on the kzalloc-failure path of kv_parse_power_table
sys/dev/drm/amd/amdgpu/kv_dpm.c:2750 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4129 Low 6.3 seq_sync() kernel stack overflow: sync[16] vs midi_number up to 32 — unprivileged kernel control-flow corruption (RIP=0) via SNDCTL_SEQ_SYNC/close on the 0666 sequencer
sys/dev/sound/midi/sequencer.c:2063 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4725 Low 6.3 aureal: bad: unwind frees au BEFORE bus_teardown_intr (live IRQ handler over freed softc — UAF write in au_intr) and releases NULL reg[] entries after a mid-list BAR failure (NULL-deref panic)
sys/dev/sound/pci/aureal.c:599 · pass 2 · new
 none untested not_testable untriaged — —
DF-4977 Low 6.3 cardbus_detach_card ignores device_detach/device_delete_child failures and pci_freecfg's the child devinfo anyway: surviving child keeps freed ivars (UAF) while its bus resources are ripped out from under the running driver
sys/dev/pccard/cardbus/cardbus.c:236 · pass 2 · new
 none untested not_testable untriaged — —
DF-5051 Low 6.3 dal_vector_insert_at() performs no bounds check on position — kernel heap OOB write at a caller-chosen 32-bit element offset (latent library defect, primitive runtime-demonstrated)
sys/dev/drm/amd/display/dc/basics/vector.c:204 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5052 Low 6.3 dal_vector_destruct() leaves container dangling — second destruct is a double kfree (latent; double-free reproduced at runtime, fix semantics runtime-validated)
sys/dev/drm/amd/display/dc/basics/vector.c:131 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5274 Low 6.3 cdgetccb() stores its result in a function-static 'union ccb *' — concurrent callers on different SIM locks can receive the same ccb (double xpt_release_ccb) or leak one
sys/bus/cam/scsi/scsi_cd.c:1384 · pass 2 · new
 CCB double-release UAF family (DF-5274) / attach-time leak (DF-5275) untested not_testable untriaged — —
DF-4828 High 6.2 r600_hdmi_buffer_status_changed / r600_hdmi_update_audio_settings consume lvds-typed enc_priv as radeon_encoder_atom_dig on the audio-work walk: dig->afmt OOB read at +288 into the adjacent slab chunk → wild deref + last_buffer_filled_status write-through (DF-4635 family, new sinks, interrupt-driven trigger)
sys/dev/drm/radeon/r600_hdmi.c:283 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3902 Low 6.2 sioclose() gone-path double-free of com->ibuf: kfree guarded by '!= NULL' but pointer never NULLed — every further close on the detached unit re-frees the same M_DEVBUF block
sys/dev/serial/sio/sio.c:1475 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3967 Low 6.2 tx_intr STA_CSR4 completion desync: qid 5-15 garbage mapped to the mgt ring, results matched to the driver's stat cursor rather than a device index, unguarded txq->queued-- underflow defeating the ring-full gate, and m leaked on the ni==NULL path
sys/dev/netif/ral/rt2661.c:896 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3103 High 6.1 Embedded-ICB read path trusts unvalidated l_ea/l_ad: udf_vget's wrapping int allocation plus udf_readatoffset's &fentry->data[l_ea] with sign-extended negative *size yields a wild OOB kernel-heap read
sys/vfs/udf/udf_vnops.c:1037 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3373 High 6.1 connect(2)/listen(2) TOCTOU on one TCP socket: handler-side state guards absent, same inpcb linked into both wildcard and connection hash — reliable unprivileged panic (INVARIANTS) / dangling connhash entry + UAF on 4-tuple lookup (production)
sys/netinet/tcp_usrreq.c:481 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4542 High 6.1 syscons CONS_SET mode change (sc_set_text_mode) vs tty output (scstart/sc_puts): no common lock across scp->vtb/history teardown - reproducible kernel panic and heap double-free window
sys/dev/misc/syscons/scvidctl.c:54 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3111 Medium 6.1 hammer_direntry_namekey ALG1 iteration-range overflow: crafted filenames make dirents permanently unfindable and unremovable (durable fs poisoning + unremovable space leak)
sys/vfs/hammer/hammer_subs.c:943 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3592 Medium 6.1 si_ib_parse() lacks packet-fits-in-IB validation -> OOB reads up to 6 dwords past the IB sub-allocation + WRITE_DATA (pkt->count - 2) underflow spin
sys/dev/drm/radeon/si.c:4776 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3915 Medium 6.1 Wild OOB read (and NVRAM garbage write) in _mapping_commit_enc_entry via unvalidated enclosure start_index ingested from DPM pg0 (num_slots==0 bypasses DF-1282)
sys/dev/raid/mpr/mpr_mapping.c:129 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4424 Medium 6.1 Negotiated SEG_MAX smaller than a MAXPHYS transfer overflows the per-queue sglist: KASSERT panic on INVARIANTS kernels, truncated/mislabeled descriptor chain in production
sys/dev/virtual/virtio/block/virtio_blk.c:582 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4686 Medium 6.1 ar2425: FillVpdTable/interpolate span never clamped — descending curve → (uint16_t)(Pmax−Pmin) wrap → ~131 KB sequential OOB write past the function-static VpdTable_* block in kernel static storage; valid curve spanning >63 half-dB → OOB write with no wrap (ar2425 twin of DF-4683, flagged at ar2425.c:311)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:311 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5754 Medium 6.1 hci_detach() frees struct hci_unit with no lifetime protection for in-flight kernel processing: btintr()'s unit-list walk and hci_intr()'s devlock loop (and in-flight driver rx, and hci_unit_lookup's unreferenced pointers) operate on the freed unit -> UAF through hci_devlock
sys/netbt/hci_unit.c:123 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3821 Low 6.1 Unvalidated GETCOMMPREF geometry: aac_max_fib_size of zero divides by zero at attach (boot panic); sizes below the 28-byte FIB header make the unconditional header copyin overflow the undersized FIB slots
sys/dev/raid/aac/aac.c:1802 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4172 Low 6.1 iir_intr: unvalidated controller completion index reads/writes up to 2 gdt_ccb entries past sc_gccbs[124] (OOB dispatch, SLIST corruption, wild gc_ccb/gc_ucmd derefs)
sys/dev/raid/iir/iir.c:1580 · pass 2 · new
 none untested not_testable untriaged — —
DF-4889 Low 6.1 iir_pci_attach drives the i960 MPR register layout at fixed offsets 0x2c-0x3fc0 with no BAR0 size validation — short BAR0 => MMIO reads/writes past the resource mapping (panic or up to ~12KB wild zero-write) before the magic read-back can reject the card
sys/dev/raid/iir/iir_pci.c:186 · pass 2 · new
 Out-of-bounds device-memory (MMIO) access from a short BAR0: kernel page-fault panic or up to ~12KB bulk zero-write past the resource mapping, before the magic read-back check; requires crafted/broken PCIe hardware with the probed Intel/ICP IDs (CWE-125/CWE-787 device-memory variant) untested not_testable untriaged — —
DF-4964 Low 6.1 sili(4): attach maps BAR(2) and carves per-port subregions with no size validation — undersized port-register window on a crafted/malfunctioning SiI 3124/3132 drives OOB MMIO writes/reads past the pmap-mapped window (kernel panic at boot/kldload, or silent corruption of the adjacent mapping)
sys/dev/disk/sili/sili_attach.c:170 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5781 Low 6.1 hci_route_lookup walks hci_unit_list and unit->hci_links with no synchronization against attach/detach (crit_enter-only) and privileged hci_disable teardown — UAF reads and 6-byte freed-heap disclosure via getsockname
sys/netbt/hci_misc.c:65 · pass 2 · new
 none untested not_testable untriaged — —
DF-3169 High 6.0 umount -f frees autofs nodes/mount under in-flight triggers and mkdirs — use-after-free (read+write, dangling requests, armed callout in freed memory) and a guaranteed NULL-deref panic variant
sys/vfs/autofs/autofs_vnops.c:209 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3191 High 6.0 fuse_mount() lacks a double-mount guard: one /dev/fuse fd mounted at two mount points shares one struct fuse_mount — second mount re-initializes the live object (locks/IPC lists/RB tree/rfnp) and the first unmount frees the second mount's root and splices stale nodes into its tree (root-clobber UAF; guaranteed panic)
sys/vfs/fuse/fuse_vfsops.c:168 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3198 High 6.0 Use-after-free in DEVFS_RULE_RESET: devfs_gc() frees nodes under the topology walker's saved cursors
sys/vfs/devfs/devfs_rules.c:222 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3227 High 6.0 FUSE blind reply completes and frees a fuse_ipc still linked on request_head — deterministic stale-queue-head corruption, 'Bad tailq' kernel panic
sys/vfs/fuse/fuse_device.c:192 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2668 Medium 6.0 fhstatfs(2)/fhstatvfs(2) overwrite the vfs_getvfs()-held mount with vp->v_mount: nullfs pass-through FHTOVP causes mnt_hold underflow — KKASSERT panic on INVARIANTS, kfree() of a live struct mount (UAF) on release kernels
sys/kern/vfs_syscalls.c:5074 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3120 Medium 6.0 Unsynchronized UFS quotaon/quotaoff mount-state machine: concurrent Q_QUOTAOFF double-executes the teardown — double vn_close(qvp) (vnode opencount/refcount corruption, UAF), crfree(NOCRED) NULL-deref, and dqsync-against-closed-quota-file panic
sys/vfs/ufs/ufs_quota.c:503 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3319 Medium 6.0 v4 SIOCDLIFADDR kernel stack buffer overflow: in_lifaddr_ioctl bcopy uses unvalidated ia_sockmask/ia_dstaddr sin_len as length into 64-byte on-stack in_aliasreq — deterministic on stock lo0 (::1 /128) via the DF-0490 confusion, and via root-poisoned sin_len once the filter is fixed
sys/netinet/in.c:911 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3383 Medium 6.0 bpfdetach() frees only the FIRST bpf_if of an interface: leftover entries (wlan radiotap) keep bif_ifp/bif_driverp pointing at the freed ifnet -> UAF writes/reads on later close or rebind; bp==NULL branch dereferences NULL instead of reporting
sys/net/bpf.c:1566 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3645 Medium 6.0 UAF + double free of rdev->pm.dpm.{ps,priv}: ci_parse_power_table/ci_dpm_init free and leave dangling pointers, and radeon_pm_init_dpm ignores the dpm.init failure
sys/dev/drm/radeon/ci_dpm.c:5620 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4478 Medium 6.0 State-machine ioctls run without lock_config and race config frees: setstate()/set_sd_state()/update_plex_state() walk SD[]/plex->sdnos that unlocked VINUM_DETACH/ATTACH and locked VINUM_CREATE free/reallocate (UAF-class; guest killed 2/3 runs)
sys/dev/raid/vinum/vinumstate.c:104 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4669 Medium 6.0 snp: SNPSTTY re-attach cleanup is dead code — old target tty left poisoned with dangling t_sc → deterministic snplclose UAF / slab double free
sys/dev/misc/snp/snp.c:557 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4907 Medium 6.0 dm_target_delay _destroy() drains queued bios asynchronously; their completion path writes through stale &dmv->stats into the freed-and-reallocated dm_dev (deterministic write-after-free → cross-object devstat corruption → panic)
sys/dev/disk/dm/delay/dm_target_delay.c:267 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5065 Medium 6.0 dm_target_uninit() tears down the target registry unconditionally: frees still-registered/still-referenced dm_target_t objects and lockuninit's the global lock — deterministic freed-module-text execution (Fatal trap 12), plus heap UAF of busied targets in the DF-4751 race window
sys/dev/disk/dm/dm_target.c:277 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5502 Medium 6.0 ioapic_add() accepts unvalidated firmware GSI base/npin: negative-GSI chain OOB-reads ioc_intsrc[] (ioapic.c:372), forwards negative IRQs to ioapic_set_legacy_irqmap() for silent OOB writes on production kernels, and aliases the int_gsi==-1 sentinel for a deterministic production panic (ioapic.c:520)
sys/platform/pc64/apic/ioapic.c:229 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5662 Medium 6.0 cam_extend_set() has no lower-bound index validation: controlled kernel-pointer OOB write before the ps[] array (incl. cross-object corruption), NULL-page fatal trap on fresh arrays, and signed-overflow panic in the growth size math
sys/bus/cam/cam_extend.c:56 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5663 Medium 6.0 Unsynchronized cam_extend growth frees ea->ps under lockless readers: use-after-free read returned to CAM drivers as struct cam_periph * (root cause of the DF-5462 class; first conclusive reproduction — consumption panics the kernel)
sys/bus/cam/cam_extend.c:64 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2771 Low 6.0 mapsize 64-bit accumulation overflow in link_elf_obj_load_file sizes the KVA mapping below the per-section bzero/read lengths → wild zero-fill past the mapping
sys/kern/link_elf_obj.c:621 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2973 Low 6.0 eventhandler_deregister() performs no tag/list validation — wrong-list or stale tag deterministically corrupts both lists' tail sentinels (write-after-free, cross-list handler aliasing, double free); tag==NULL silently frees an entire shared list
sys/kern/subr_eventhandler.c:123 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3443 Low 6.0 altq_priq: dangling pif_ifq use-after-free - interface destroyed mid-pf-transaction leaves PRIQ_LOCK operating on freed ifnet/altq_subq (slab freelist corruption panic / permanent pf_token wedge)
sys/net/altq/altq_priq.c:114 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3695 Low 6.0 ata_raid_delete frees the ar_softc without draining in-flight I/O — use-after-free in ata_raid_done/strategy
sys/dev/disk/nata/ata-raid.c:1281 · pass 2 · new
 none untested not_testable untriaged — —
DF-3720 Low 6.0 Unvalidated firmware-returned SRAM offsets used as kernel write pointers (lanai TX/RX rings, intr_coal_delay_ptr, irq_claim/irq_deassert, RSS table and key): OOB MMIO writes past the BAR mapping on a hostile device; int16_t ring-mask truncation on device ring sizes
sys/dev/netif/mxge/if_mxge.c:1207 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3824 Low 6.0 ASR_init_message writes the mandatory sense SGL element 8 bytes past asr_action's 512-byte stack buffer when one CCB spans >=58 physical runs; the adapter-derived ha_SgSize limit is computed and never used
sys/dev/raid/asr/asr.c:1812 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4174 Low 6.0 gdtexecuteccb: unbounded physical scatter/gather copy — CAM_SCATTER_VALID|CAM_SG_LIST_PHYS CCBs with sglist_cnt > GDT_MAXSG overflow the 324-byte gccb->gc_cmd (pass(4)-reachable heap overflow)
sys/dev/raid/iir/iir.c:876 · pass 2 · new
 none untested not_testable untriaged — —
DF-4399 Low 6.0 Passthrough SGL written at user-controlled offset: gcmd->size (u8, verbatim from TWS_IOCTL_FIRMWARE_PASS_THROUGH) used as SGL destination offset — lands on neighboring request's header_desc
sys/dev/raid/tws/tws_cam.c:1034 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4704 Low 6.0 get_pixel_size() integer-divides depth by 8 and the blit/fill dispatch falls through to 32-bit ops — 8bpp KMS console gets 4-byte/pixel writes on a 1-byte/pixel stride (OOB writes past the framebuffer mapping)
sys/dev/misc/syscons/sckmsrndr.c:138 · pass 2 · new
 Kernel page faults / adjacent-memory corruption on the first console clear at 8bpp KMS console (4-byte writes on a 1-byte stride); root/boot-config gated untested not_testable untriaged — —
DF-4929 Low 6.0 tpmcrb_detach/tpm20_release tear down the TPM device with no dev_lock and no draining while transmit is in flight: softc/buf use-after-free, discard callout fires into freed memory → deterministic kernel panic
sys/dev/crypto/tpm/tpm_crb.c:230 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5025 Low 6.0 ipsd open/detach TOCTOU: detach can free the ipsdisk softc under an open descriptor — ipsd_close/strategy then write freed memory (DF-5013 pattern in ips)
sys/dev/raid/ips/ips_disk.c:92 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3074 Low 5.9 nfs_mountdiskless() double-frees the dup_sockaddr() on mountnfs() failure (mountnfs's bad: path frees nm_nam via nfs_free_mount, then haderror kfrees it again)
sys/vfs/nfs/nfs_vfsops.c:767 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2679 High 5.8 NEWBUS device teardown races unprivileged sysctl readers: use-after-free read in sysctl_devices()/device_sysctl_handler() (panic + permanent hang from uid!=0)
sys/kern/subr_bus.c:3858 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2694 High 5.8 sorflush() frees the receive sockbuf underneath sleeping sorecvtcp()/soreceive() copiers — UAF race, unprivileged kernel panic on both TCP and AF_UNIX/UDP paths
sys/kern/uipc_socket.c:1953 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3173 High 5.8 autofs request timeout task is armed on the creator CPU's taskqueue but cancelled/drained on the last releaser CPU's queue — foreign-list STAILQ_REMOVE NULL-deref panic and wrong-queue-drain use-after-free (read+write after objcache_put)
sys/vfs/autofs/autofs.c:303 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2786 Medium 5.8 mtx_abort_link stale-state double-unlink: mtx_delete_link leaves MTX_LINK_LINKED_* set on an unlinked link until an unlocked IDLE reset, letting a racing abort write through dangling next/prev (UAF-write / wait-queue poisoning)
sys/kern/kern_mutex.c:914 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-2896 Medium 5.8 cnwrite() constty use-after-free: unsynchronized constty->t_dev captured without a reference and dispatched through dev_doperate() after a sleepable log_console() walk, while an unprivileged user (default UCONSOLE) controls the cdev's lifetime
sys/kern/tty_cons.c:465 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2923 Medium 5.8 vq_vptomp check-then-use race on vp->v_pfsmp → mount use-after-free with indirect call through freed memory
sys/kern/vfs_quota.c:420 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3134 Medium 5.8 dirfs_node_setpassive's check-then-close of dn_fd races dirfs_findfd's ref-then-use and all fd consumers — in-flight operations can use a CLOSED (and host-RECYCLED) descriptor against the wrong host file/directory
sys/vfs/dirfs/dirfs_subr.c:849 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3862 Medium 5.8 amdgpu_device_gpu_recover dereferences the timed-out job across the multi-second GPU reset although the fence-completion path can already have kfree'd it (UAF, concurrent-reinit family)
sys/dev/drm/amd/amdgpu/amdgpu_device.c:3414 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4482 Medium 5.8 Revive-conflict waitlist/relaunch machinery launches and walks freed requests (UAF cluster) — reliable kernel panic under concurrent conflicting I/O during subdisk revive
sys/dev/raid/vinum/vinumrequest.c:327 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4484 Medium 5.8 acpi_video_vo_bind leaves dangling vo->vo_levels when _BCL re-evaluation fails -> UAF read via sysctl and double-free panic in vo_destroy
sys/dev/acpica/acpi_video/acpi_video.c:597 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4525 Medium 5.8 amdgpu_dpm: error-path double/triple free of all dyn_state power-table pointers - amdgpu_free_extended_power_table() frees without NULLing and every caller teardown frees the dangling pointers again
sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:775 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4584 Medium 5.8 radeon_bo_get_surface_reg steals surface registers from other BOs under no lock: NULL-deref panic and 4-byte UAF write into freed radeon_bo slab
sys/dev/drm/radeon/radeon_object.c:609 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4783 Medium 5.8 mmcsd_detach() does not exclude or drain the data path: strategy/open callers race lockuninit() and the newbus softc free (DF-4646 family)
sys/dev/disk/mmcsd/mmcsd.c:209 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5394 Medium 5.8 usb_detach() races the asynchronous usb_bus_attach(): NULL-softc guard bypassed with a wild softc (-8) → supervisor write fault in usb_callout_drain; the teardown-skip variant frees the whole usb_bus under 4 live USB kthreads
sys/bus/u4b/controller/usb_controller.c:191 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5551 Medium 5.8 camq_insert() into a full queue writes a kernel pointer one slot past the array (full-queue guard is DIAGNOSTIC-only)
sys/bus/cam/cam_queue.c:148 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-5689 Medium 5.8 idr_find()/idr_for_each() read the node array without the idr token while idr_grow() kfree()s the old array — use-after-free read returns a stale kernel object pointer (and idr_for_each walks OOB past the freed array)
sys/libkern/linux_idr.c:449 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3315 Low 5.8 in_pcblist_range walks non-shared pcbinfo (ripcbinfo) with no synchronization; non-atomic marker advance vs same-cpu netisr pcb teardown yields UAF read/write and list corruption
sys/netinet/in_pcb.c:2452 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3656 Low 5.8 Error-path UAF: amdgpu_dm init failure paths kfree registered i2c adapters / connectors / encoders / planes that remain in DRM core lists
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4080 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4468 Low 5.8 ess_attach() pcm_register-failure unwind kfrees sc while the 0666 /dev/mixerN that mixer_init() published survives — dangling mixer devinfo UAF on open/ioctl (DF-4156 family, 8th instance)
sys/dev/sound/pci/solo.c:1045 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4486 Low 5.8 REPROBE destroy path leaves the per-output ACPI notify handler registered against freed memory (AcpiRemoveNotifyHandler(NULL) is a no-op)
sys/dev/acpica/acpi_video/acpi_video.c:386 · pass 2 · new
 none untested not_testable untriaged — —
DF-5381 Info 5.8 USB copy engine enforces no bounds: usbd_get_page + usbd_copy_in/out/_user/frame_zero/usb_uiomove memcpy across the loaded extent with no clamp — single chokepoint for ~120 call sites (cross-object heap OOB read/write/zero + wild KVA/UINT32_MAX span + instant panic demonstrated via root KLD; in-tree precedent DF-0998/DF-2357)
sys/bus/u4b/usb_busdma.c:79 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2802 Medium 5.7 jail(2) id >= 100000 shares per-prison sysctl nodes (DF-0054 truncation at scale): silent loss of all per-jail capability controls + sysctl_oid freed-under-reference UAF at teardown
sys/kern/kern_jail.c:992 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3539 Medium 5.7 v1 ng_async: unserialized SET_CONFIG realloc races rcvdata decode/encode - write-after-free cascades into runaway unbounded kernel heap overflow (silent hard lockup)
sys/netgraph/async/ng_async.c:317 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3594 Medium 5.7 bwn_intr_noise missing re-entry guard: 9th noise-sample interrupt writes 4 bytes past noi_samples into mac_phy
sys/dev/netif/bwn/bwn/if_bwn.c:5198 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3931 Medium 5.7 Detach/shutdown lifetime: self-rescheduling mly_periodic can survive callout_stop and in-flight commands are never drained — use-after-free after mly_free()
sys/dev/raid/mly/mly.c:1397 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4023 Medium 5.7 Dangling rdev->pm.dpm.ps after kzalloc-failure kfree in rv7xx_parse_power_table (:2308): ignored rv770_dpm_init error -> double free in rv770_dpm_fini at unload/reboot + leak of parsed ps_priv states — shared root site of DF-3645/3755/3955/3973, rv770-dispatch instance
sys/dev/drm/radeon/rv770_dpm.c:2306 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4117 Medium 5.7 Dangling rdev->pm.dpm.ps after swallowed cypress_dpm_init failure: double free in cypress_dpm_fini at unload/reboot (cypress dispatch of the DF-4023/DF-3973 family)
sys/dev/drm/radeon/cypress_dpm.c:2050 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4144 Medium 5.7 Dangling rdev->pm.dpm.ps after kfree-without-NULL in trinity_parse_power_table (:1781) + swallowed trinity_dpm_init error -> double free in trinity_dpm_fini (:2086-2089) and UAF via boot_ps at enable; ps_priv[0..i-1] leaked — Trinity twin of DF-4023/DF-3973/DF-4117/DF-4125
sys/dev/drm/radeon/trinity_dpm.c:1766 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4162 Medium 5.7 radeon_pm.c:1448 discards radeon_dpm_init() return (and the asic *_init files discard radeon_pm_init's): the root enabler of the six-file NULL-boot_ps / dangling-ps family — central hub fix consolidating DF-4022/3972/4117/4118/4124/4125/4143/4144
sys/dev/drm/radeon/radeon_pm.c:1448 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4240 Medium 5.7 dpt_init/dpt_attach: device-fed MAX_CHAN (up to 8 channels) never clamped to MAX_CHANNELS=3 — OOB writes of sims[3..7]/paths[3..7] over live softc members incl. bus_dma_tag_t/bus_dmamap_t (type confusion)
sys/dev/raid/dpt/dpt_scsi.c:1313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4241 Medium 5.7 dpt_intr never validates the status packet's target CCB is in flight: duplicate/unsolicited device-fed ccb_busaddr -> double free-list insertion of dccb + double xpt_done of stale/recycled ccb (UAF family)
sys/dev/raid/dpt/dpt_scsi.c:1518 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4599 Medium 5.7 VINUM_RESETCONFIG calls free_vinum() without lock_config(): frees all DRIVE/SD/PLEX/VOL arrays racing even the lock-holding VINUM_CREATE writer and every unlocked *CONFIG reader → kernel heap UAF (read proven: panic; write/double-free windows on same interleaving)
sys/dev/raid/vinum/vinumioctl.c:214 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4679 Medium 5.7 Stolen reserved-base above stolen_top u64-wraps g4x/bdw reserved size, bypasses resource_contains and inflates stolen_usable_size up to 96x → OOB physical allocations beyond stolen
sys/dev/drm/i915/i915_gem_stolen.c:472 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4683 Medium 5.7 FillVpdTable/interpolate span never clamped: descending EEPROM curve → (uint16_t)(Pmax-Pmin) wrap → ~131 KB sequential OOB heap WRITE past ar2317State; valid curve spanning >63 half-dB → OOB write past object end with NO wrap (not covered by any family twin)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:289 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5109 Medium 5.7 lockdrive() pid-based recursion admits second same-process thread into drive critical section (double vn_close / double Free → BADFREE2 panic)
sys/dev/raid/vinum/vinumlock.c:59 · pass 2 · new
 panic reproduced inconclusive untriaged — —
DF-5218 Medium 5.7 dc_sink retain/release contract violated by DM forced-connector paths: emulated_link_detect strands references (permanent ~1KB dc_sink leak per forced-detect cycle) and update_connector_after_detect branch A releases a borrowed dc_sink (premature free with dangling link->local_sink, or kref_put UAF write + dc_sink_free double-free on freed slab after EDID-change detect)
sys/dev/drm/amd/display/dc/core/dc_sink.c:68 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5268 Medium 5.7 xhci_init latches unmasked device-controlled register offsets (CAPLENGTH/RTSOFF/DBOFF): every later XREAD/XWRITE is an unbounded OOB MMIO access past the mapped BAR
sys/bus/u4b/controller/xhci.c:626 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3171 Low 5.7 mfsclose() deactivates the MFS I/O server on ANY device close — no finality check (speculative: would destroy_dev/kfree the serving mfsnode under a live mount if a non-final close ever slips through)
sys/vfs/mfs/mfs_vfsops.c:136 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-3405 Low 5.7 tap(4) softc use-after-free: clone-destroy/create paths race open() with no common lock (kfree'd tap_softc used by tapopen/tapwrite/tapclose)
sys/net/tap/if_tap.c:223 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3562 Low 5.7 serpent_set_key() one-sided key-length validation: negative lengths wrap through u_int32_t i/lk into ~16 GiB runaway/wild OOB writes; non-byte lengths read past the key buffer
sys/crypto/serpent/serpent.c:453 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3963 Low 5.7 mv family queue-pointer registers used unmasked: device-fed outbound_tail/inbound_head index inbound_q/outbound_q[512] MMIO — OOB bus-space read and 8-byte OOB MMIO write up to ~32GB past BAR2
sys/dev/raid/hptiop/hptiop.c:229 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4163 Low 5.7 radeon_pm_fini_dpm never cancels pm.dpm.thermal.work nor clears dpm_enabled while the thermal IRQ outlives pm_fini: post-fini UAF in radeon_dpm_thermal_work_handler
sys/dev/drm/radeon/radeon_pm.c:1690 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4173 Low 5.7 iir_shutdown: shared flush ucmd freed (wrong malloc type) while still queued/in flight, and re-queued for the next drive while a gccb owns it — use-after-free at shutdown
sys/dev/raid/iir/iir.c:1493 · pass 2 · new
 none untested not_testable untriaged — —
DF-4223 Low 5.7 Attach error-path asymmetry: double bus_dmamap_destroy (double kfree of M_DEVBUF maps) and callout_drain/bus_dmamap_destroy walked through a NULL hcb array
sys/dev/virtual/vmware/pvscsi/pvscsi.c:615 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4286 Low 5.7 acpi_thinkpad LED async task (AcpiOsExecute) not drained on detach — use-after-free of the softc
sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:391 · pass 2 · new
 use-after-free of acpi_thinkpad softc (read/write + AcpiEvaluateObject with handles loaded from freed memory) racing kldunload/devctl-detach against /dev/led/thinklight toggles; root-only, hardware-gated inconclusive not_testable untriaged — —
DF-4438 Low 5.7 mrsas_cam_attach error paths free sim_0/sim_1 without clearing sc pointers — attach_fail_cam unwind re-frees via mrsas_cam_detach: cam_sim_path() UAF read, second xpt_bus_deregister, cam_sim_free() double-free into M_CAMSIM (plus devq refcount underflow)
sys/dev/raid/mrsas/mrsas_cam.c:150 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4512 Low 5.7 vmbus: selected/registered vmbus cputimer never stopped or deregistered on detach - per-tick reload runs on the freed vmbus_softc and through unloaded module text (UAF write + dangling call target) after kldunload
sys/dev/virtual/hyperv/vmbus/vmbus.c:280 · pass 2 · new
 Per-tick UAF write (8-byte host-influenced value into freed softc) + call through unloaded module text after kldunload untested not_testable untriaged — —
DF-4543 Low 5.7 agp: /dev/agpgart cdev outlives chipset detach - dangling si_drv1 UAF on open fds, plus free_cdev unit-vs-minor mismatch leaves a stale node
sys/dev/agp/agp.c:240 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4719 Low 5.7 Pending AAC_EVENT_CMFREE fires after aac_cam_detach freed the sim -> xpt_release_simq/xpt_done through freed objects (UAF)
sys/dev/raid/aac/aac_cam.c:165 · pass 2 · new
 none untested not_testable untriaged — —
DF-4835 Low 5.7 create_frame_pool failure path frees frames and destroys the tag while leaving every pointer dangling: attach unwind mrsas_free_mem() double-frees all frames and the tag
sys/dev/raid/mrsas/mrsas_ioctl.c:422 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4916 Low 5.7 amdgpu_virt_init_data_exchange: host-controlled pf2vf_size drives a 1 KB memset (and the header reads) past the kmap'ed fw VRAM reservation — no validation that the region contains the 64 KB-offset exchange area
sys/dev/drm/amd/amdgpu/amdgpu_virt.c:402 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5022 Low 5.7 feed_volume_init() publishes f->data before validation completes and frees it on both error branches without clearing it — feeder_create()'s error unwind double-frees the info block
sys/dev/sound/pcm/feeder_volume.c:165 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5141 Low 5.7 mlx_pci_attach() double mlx_free() on mlx_attach() failure — kernel heap double-free/UAF (mlx_enq2 kfree'd twice, DMA tags/s/g/IRQ resources released twice)
sys/dev/raid/mlx/mlx_pci.c:202 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5301 Low 5.7 TOCTOU: uhub_child_location_string()/uhub_child_pnpinfo_string() dereference sc->sc_udev->hub after a device_is_attached() guard that stays true while uhub_detach() frees and NULLs it (NULL-deref panic / UAF read)
sys/bus/u4b/usb_hub.c:1668 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5563 Low 5.7 iicbus_request_bus parks requesters on the softc with timeout-0 tsleep and no detach drain — kldunload under a parked waiter frees the softc and unmaps iicbus.ko text under it: freed-text execution (UAF) on resume, plus sc->owner write into freed memory on colliding wakeup
sys/bus/iicbus/iiconf.c:63 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5582 Low 5.7 smbus_acpi_detach does not quiesce in-flight GSBUS address-space handler dispatches: AcpiRemoveAddressSpaceHandler frees the handler object and its held ContextMutex, and newbus frees the softc/parent device underneath the running handler (UAF, panic/heap corruption)
sys/bus/smbus/smbacpi/smbacpi.c:268 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5643 Low 5.7 smbus_detach never checks sc->owner: the bus detaches (and device_detach frees the softc) underneath the owning client and parked requesters — the owner's release (the smbioctl exit path) takes Fatal trap 12, and a parked SMB_WAIT requester woken on the freed softc performs a post-free read+write and returns success
sys/bus/smbus/smbus.c:105 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5664 Low 5.7 usb_alloc_mbufs() truncates the 64-bit (block_size + sizeof(struct usb_mbuf)) * nblocks product into usb_size_t before kmalloc — undersized heap allocation whose data pointers are constructed fully out of bounds (latent CWE-190-to-CWE-787; no unprivileged in-tree path reaches it today)
sys/bus/u4b/usb_mbuf.c:62 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5765 Low 5.7 Unsynchronized cspair lifetime handoff: iconv_xlat_open/iconv_xlat_close manipulate cp_refcount lockless against under-lock cspair teardown, and iconv_sysctl_add's error path frees referenced pairs unconditionally — UAF writes into freed cspairs, dangling d_table, kernel heap corruption (reproduced panic:BADFREE2)
sys/libiconv/iconv_xlat.c:60 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4829 Info 5.7 md(4) mdstrategy_malloc sector-array growth uses 32-bit sector number and 32-bit size arithmetic: wrapped growth kmalloc(0)/(undersized chunk) -> ZERO_LENGTH_PTR bcopy / heap overflow + wild write (LATENT — unreachable behind dscheck)
sys/dev/disk/md/md.c:253 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4893 Info 5.7 Dead AH_DEBUG_ALQ block: unlocked global `ath_hal_alq` TOCTOU — use-after-free of `struct alq` if ever compiled (latent, triple-unreachable on stock DF)
sys/dev/netif/ath/ath_hal/ah_osdep.c:230 · pass 2 · new
 none untested not_testable untriaged — —
DF-3095 Medium 5.6 Unvalidated vol0_next_tid at mount: deterministic kernel panic on first write (TID exhaustion) and silent TID wraparound that leaks new records into every historical snapshot
sys/vfs/hammer/hammer_vfsops.c:683 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3501 Medium 5.6 ng_fec_addport arpcom type confusion: writes a node pointer at +sizeof(ifnet)+16 and 6 known MAC bytes at +sizeof(ifnet) past ANY non-arpcom ifnet allocation (lo0), reads 6 bytes OOB disclosed as the fec MAC (kernel pointer leak via gif), and corrupts live gif_softc fields -> kernel GPF
sys/netgraph/fec/ng_fec.c:378 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2680 Low 5.6 /dev/devctl FIOASYNC stores unreferenced curproc in devsoftc.async_proc; devclose never clears it -> ksignal() on freed struct proc (UAF write)
sys/kern/subr_bus.c:412 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2921 Medium 5.5 Signed integer overflow in nvtruncbuf()/nvnode_pager_setsize() at file lengths within blksize of 2^63 → ~2^63-iteration unmap loop holding the vnode token and object lock: unprivileged, unkillable, permanent kernel livelock on HAMMER2 (guest becomes unshut-downable)
sys/kern/vfs_vm.c:145 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2999 Medium 5.5 hammer(1) setattr/write have no va_size clamp: DF-2921-class nvtruncbuf/nvnode_pager_setsize signed-overflow → unprivileged permanent kernel livelock on any HAMMER1 mount
sys/vfs/hammer/hammer_vnops.c:670 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3207 Medium 5.5 nullfs_unmount() frees mnt_data while callers without unmount interlock can still reach it: kern_statfs/kern_fstatfs/sys_quotactl dereference a dead nullfs mount — deterministic NULL-deref panic (kernel DoS) triggered by an unprivileged user around umount -f; race-window UAF read of the freed null_mount
sys/vfs/nullfs/null_vfsops.c:262 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3218 Medium 5.5 dirfs_root open-failure teardown: dirfs_free_vp NULL-pointer write (vp->v_data at NULL), latent double-free, and never-cleared dangling dmp->dm_root
sys/vfs/dirfs/dirfs_vfsops.c:246 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3235 Medium 5.5 procfs_docmdline() use-after-free read of freed pargs / lwp_lpmap / p_upmap across a blocking uiomove — cross-process argv disclosure past the CHECKIO gate
sys/vfs/procfs/procfs_status.c:236 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3478 Medium 5.5 listen(2) on an L2CAP SEQPACKET socket recurses solisten()↔so_pru_listen() without bound → kernel stack overflow → CPU double fault (unprivileged, 100% reproducible panic)
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2460 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3614 Medium 5.5 Heap OOB write past SISLANDS_SMC_STATETABLE.lowSMIO[32] via untrimmed SVI2 VDDCI voltage-table count in si_populate_smc_voltage_table — radeon twin of the lowSMIO half of amdgpu DF-3585
sys/dev/drm/radeon/si_dpm.c:4046 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4370 Medium 5.5 amdgpu_bo_placement_from_domain walks up to 6 domain entries into placements[AMDGPU_BO_MAX_PLACEMENTS=3] and BUG_ONs: unprivileged GEM_CREATE with domains=VRAM|GTT|CPU panics the kernel; domains=0x3f writes places[3..5] OOB (over bo->placement/bo->tbo) before the panic
sys/dev/drm/amd/amdgpu/amdgpu_object.c:139 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4721 Medium 5.5 launch_requests() keeps walking the request group after an inline completion freed it (trailing XFR_BAD_SUBDISK rqe) - kernel panic on the ORDINARY degraded RAID-5 write (new, waitlist-independent arm of the DF-4482 UAF cluster)
sys/dev/raid/vinum/vinumrequest.c:395 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5749 Medium 5.5 Unsynchronized softclock l2cap_rtx() vs netisr-port l2cap_detach()/l2cap_close(): double channel/request teardown — kernel page fault (supervisor WRITE), zone double-free, hard freeze (l2cap analog of DF-0724/5748, co-firing DF-0745's sink)
sys/netbt/l2cap_upper.c:267 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-3242 Low 5.5 ufs_check_export hands out &np->netc_anon after dropping NE_LOCK — concurrent export update (mount -u MNT_DELEXPORT) frees the netcred while nfsrv_fhtovp still reads the embedded credential across a window that includes VFS_FHTOVP disk I/O: UAF read feeding garbage uid/groups into the NFS root-squash mapping
sys/vfs/ufs/ufs_vfsops.c:246 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3092 Info 5.5 fillinusemap() tail-marking loop compares a cluster number against a word-index bound (never executes) and chainlength()'s word-relative clamp misses — phantom "free" clusters beyond pm_maxcluster drive usemap_alloc KASSERT panic on INVARIANTS kernels
sys/vfs/msdosfs/msdosfs_fat.c:320 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4018 Info 5.5 amdgpu userptr machinery is dead-but-armed: usertask is never set, so re-enabling GEM_USERPTR instantly NULL-derefs in amdgpu_ttm_tt_get_user_pages; gup shim has an inverted KKASSERT; ttm->sg is freed without NULLing (double-free shape)
sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:834 · pass 2 · new
 amdgpu userptr machinery is dead-but-armed: usertask never set (#if 0) so re-enabling GEM_USERPTR instantly NULL-derefs at amdgpu_ttm.c:834 (guard after deref); gup shim has an inverted KKASSERT; pin failure path kfrees ttm->sg without NULLing (double-free shape); bind-error paths leak pinned pages. untested not_testable untriaged — —
DF-4003 Medium 5.4 fiji_populate_cac_table overflows BapmVddcVid{Lo,Hi}Sidd[16] and OOB-reads vddc_voltage_table.entries[32]
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:772 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4004 Medium 5.4 fiji clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1706 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-5761 Medium 5.4 sco_pcb newconn-matching walk UAF: hci_sco_newconn() (netisr) holds a listening pcb across the sonewconn callback while sco_detach() (syscall) unlinks and kfrees it — deterministic kernel panic, indirect-call primitive through freed memory
sys/netbt/sco_upper.c:240 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3830 Low 5.4 trm_detach frees I/O port, SRB array and DMA tags before bus_teardown_intr and SIM deregistration, with no drain of in-flight CCBs — use-after-free / permanent CAM wedge on kldunload
sys/dev/disk/trm/trm.c:3696 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3832 Low 5.4 trm_eepromBuf[unit] indexed by unbounded adapter unit — 128-byte OOB read+write of adjacent kernel globals at attach with a 5th Tekram card
sys/dev/disk/trm/trm.c:212 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2682 High 5.3 sigio use-after-free: funsetown() kfrees struct sigio still dereferenced by lockless pgsigio() readers (socket/tty/kqueue SIGIO wakeups)
sys/kern/kern_descrip.c:1245 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3184 High 5.3 procfs_exit() writes pfs->pfs_pid through a pfsnode a concurrent vnode reclaim may already have kfree()'d (use-after-free write, 4-byte OR at offset 20 in the M_PROCFS zone)
sys/vfs/procfs/procfs_subr.c:542 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3582 High 5.3 Type-confused FCPARAM() write in RQCS_RESET_OCCURRED handler: on dual-bus SCSI cards a routine bus reset performs a 32-bit RMW ~21 KB past the 408-byte isp_param heap allocation
sys/dev/disk/isp/isp.c:6105 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2719 Medium 5.3 Coredump each_segment traverses the vm_map RB-tree unlocked while a pre-counted-'stopped' sibling LWP can still be mutating it (UAF read race)
sys/kern/imgact_elf.c:1193 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2918 Medium 5.3 Unsynchronized vfsconf registry: sys_mount vs kldunload TOCTOU — UAF write/call through unloaded module (reproduced as irrecoverable kernel deadlock of the mount/linker subsystem)
sys/kern/vfs_init.c:264 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3099 Medium 5.3 hpfs_write consumes unvalidated on-disk extent length: (runl+1)*DEV_BSIZE int overflow → towrite==0 → zero-size getblk/bread + size_t underflow in uiomove → unkillable kernel livelock (and latent OOB copyin)
sys/vfs/hpfs/hpfs_vnops.c:394 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3213 Medium 5.3 Stale RC_REPSTATUS survives dup-reply-cache slot reuse: rc_status aliases the cached rc_reply mbuf pointer (union type confusion) — kernel heap-pointer material and wrong status-only replies served to unauthenticated remote clients on retransmission
sys/vfs/nfs/nfs_srvcache.c:212 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3389 Medium 5.3 ip6a_dstia6 stores an uncounted in6_ifaddr pointer in the mbuf that outlives the address across the deferred transport-processing netmsg (UAF read)
sys/netinet6/ip6_input.c:490 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3457 Medium 5.3 gif(4) clone-destroy tears down softc state with no ifnet serializer while in-flight gif_output()/in_gif_output() dereferences it — use-after-free, reproduced kernel panic
sys/netinet/in_gif.c:101 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3673 Medium 5.3 mpt_timeout() uses the CCB after xpt_done() hands it back — callout_stop() does not interlock against the in-progress timeout callback (freed/recycled CCB -> wild deref or wrong-request abort)
sys/dev/disk/mpt/mpt_cam.c:1240 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4037 Medium 5.3 polaris10_populate_cac_table overflows BapmVddcVid{Lo,Hi,Hi2}Sidd[16] and OOB-reads vddc_voltage_table.entries[32]
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:712 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4038 Medium 5.3 polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<NUM_VFT_COLUMNS] when the count is lower
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1555 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4208 Medium 5.3 legacyEepromDiag() HAL_DIAG_EEPROM_EXP_* union type confusion: returns EEPROM-derived wild pointer/size that ath_ioctl_diag copyout()s (non-canonical -> panic), plus HAL_DIAG_EEPROM full-struct dump leaking 6 kernel heap pointers
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:1725 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4693 Medium 5.3 sili_pm: pm_read/pm_write recycle the ata_xfer while the chip still owns the slot — deferred poll timeout returns ATA_S_ONCHIP and the accessors put the ccb back on the free list with ap_expired processing pending
sys/dev/disk/sili/sili_pm.c:657 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4764 Medium 5.3 Type confusion in hpt_get_info: goto is_array passes RAID-1 member disk to hpt_copy_array_info -> punned union fields (bArnMember=df_on_line=1, bit21/22 of disk capacity as rf_rebuilding/rf_verifying, pMember[0]=Device.mv) cause kernel SIGFPE panic on unprivileged sysctl hptmv.status read
sys/dev/raid/hptmv/hptproc.c:523 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4844 Medium 5.3 drm_sched_entity_fini dependency cleanup check-then-uses entity->dependency while drm_sched_entity_clear_dep NULLs it unsynchronized from fence-signaling context — dma_fence_remove_callback(NULL/stale) NULL-deref lockmgr panic or UAF (tight-window TOCTOU, beyond DF-1927's scheduler-thread race)
sys/dev/drm/scheduler/sched_entity.c:279 · pass 2 · new
 none untested not_testable untriaged — —
DF-5249 Medium 5.3 Lockless sc->cmdq[] ring: producers store .func before args with no barrier and consumer reads are unordered; torn publish yields func(NULL), 16-slot wrap yields type-confused callbacks and silently lost commands
sys/bus/u4b/wlan/if_run.c:1041 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5547 Medium 5.3 fwmem_read_block() advertises a quadlet-rounded receive length for a shorter destination buffer — 1-3 responder-controlled bytes written past the end of the caller's buffer (kernel OOB write)
sys/bus/firewire/fwmem.c:197 · pass 2 · new
 kernel out-of-bounds WRITE of 1-3 fully responder-controlled bytes past the RPC destination buffer (proven cross-chunk into the adjacent 32-byte heap chunk via production fwmem_strategy->fwmem_read_block->fw_rcv/fw_rcv_copy); on current DFly physio the plain user read(2) path absorbs it into bounce-buffer slack, kernel-originated (UIO_SYSSPACE) reads / direct bio issuers get the full heap overrun reproduced fixed untriaged — —
DF-2985 Low 5.3 sysent[] entry swaps are unsynchronized against unlocked syscall dispatch: non-atomic 24-byte struct assignment (register/deregister) races trap.c's separate sy_narg/sy_call loads (torn dispatch), and deregister has no in-flight quiesce — kldunload frees module text while a victim thread executes inside sy_call (UAF execution)
sys/kern/kern_syscalls.c:67 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2988 Low 5.3 RB_SCAN concurrency contract overstates the machinery: deleting a node that is another concurrent scan's in-flight element is an unguarded use-after-free
sys/kern/subr_rbtree.c:302 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-3072 Low 5.3 tmpfs_alloc_vp KKASSERT(!TMPFS_VNODE_DOOMED) at subr.c:402 is an unguarded race window: NFS fhtovp lookups on an unlinked file during inactive's DOOMED..reclaim interval panic INVARIANTS kernels
sys/vfs/tmpfs/tmpfs_subr.c:395 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4095 Low 5.3 emu_intr2 tests and calls sc->mpu_intr/sc->mpu without the lock, racing emu_muninit + mpu401_uninit's kfree at detach — heap UAF on struct mpu401
sys/dev/sound/pci/emu10k1.c:1196 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4220 Low 5.3 build_evenly_distributed_points() with num_entries==0 writes 24 bytes past a kcalloc(3) heap object; num_entries==1 divides by zero (kernel #DE panic)
sys/dev/drm/amd/display/modules/color/color_gamma.c:1077 · pass 2 · new
 none reproduced inconclusive untriaged — —
DF-4323 Low 5.3 pcm_unregister() can complete while dsp_clone() sleeps in PCM_WAIT (which holds no SD_F_BUSY), leaving the woken handler to run snd_clone_alloc(NULL)/snd_clone_disabled on freed state and PCM_RELEASE on the freed d->lock — NULL-deref / lock use-after-free panic
sys/dev/sound/pcm/sound.c:1165 · pass 2 · new
 dsp_clone validates under PCM_LOCK and only then does PCM_WAIT/ACQUIRE untested not_testable untriaged — —
DF-4419 Low 5.3 Use-after-free race: unprivileged bktr ioctls race privileged msp_detach and write into the freed msp3400c struct (no locking, admitted by 'XXX mutex lock required')
sys/dev/video/bktr/msp34xx.c:1206 · pass 2 · new
 UAF write into freed M_DEVBUF block via msp_wake_thread racing msp_detach during kldunload; heap corruption ceiling on dedicated allocation, realistically panic untested not_testable untriaged — —
DF-4647 Low 5.3 acpi_fujitsu: in-flight CTLFLAG_ANYBODY sysctl handler executes on freed softc, freed sysctl oids and freed module text after detach — unprivileged-holdable UAF window (oid_running drain in kern_sysctl.c is dead code)
sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:340 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5699 Low 5.3 prop_dictionary_ingest() runs driver handlers on a borrowed, unpinned object reference after the dictionary lock is dropped — concurrent key removal frees the object underneath the callback (CWE-416)
sys/libprop/prop_ingest.c:133 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2820 Info 5.3 Double-free containment in _kfree_obj is INVARIANTS-only: the compiled-in KMALLOC_CHECK_DOUBLE_FREE bitmap and all ring-sanity checks are no-ops in production kernels, so a double free silently duplicates or drops free-ring pointers
sys/kern/kern_kmalloc.c:959 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3987 High 5.2 Poisoned cur_link_settings.lane_count outlives link training: dp_test_send_phy_test_pattern OOB stack WRITE past lane_settings[4] (~3KB span) and hpd_rx_irq_check_link_loss_status OOB stack READ past the 6-byte union hpd_irq_data
sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1772 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4247 High 5.2 No central bounds-validation layer for VBIOS PowerPlay parsing: offsets/counts/indices never checked against soft_pp_table_size (central fix for the DF-1468/1469/1470/1472 family)
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:61 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3433 Medium 5.2 if_stf teardown races its in-flight decap consumers: unguarded MOD_UNLOAD frees the softc under the lock-free encaptab walk and past the async NETISR_IPV6 queue carrying rcvif=&sc->sc_if - use-after-free (DF-3425 gif twin, wider async vector)
sys/net/stf/if_stf.c:210 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4080 Medium 5.2 oce_detach frees ifp (if_free) while interrupts are still enabled and EQ0 deliberately re-armed by oce_if_deactivate: async MCC event in the window reaches oce_mq_handler -> if_link_state_change on the freed ifnet (use-after-free)
sys/dev/netif/oce/oce_if.c:322 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4773 Medium 5.2 apple_smc: detach frees sensor-key state while its per-device sysctl oids stay registered until device_delete — post-detach UAF read / NULL-ioport panic window (DF-4647 family)
sys/dev/apple/smc/smc_sysctl.c:169 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-5282 Medium 5.2 ehci_init latches unvalidated device-controlled register geometry (CAPLENGTH/N_PORTS): every EOREAD4/EOWRITE4 lands at attacker-chosen in-BAR offsets, blind/mute interrupt handling live-locks the system on first port event, and OOB MMIO results on undersized-BAR hardware
sys/bus/u4b/controller/ehci.c:308 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3425 Low 5.2 gif(4) teardown races the lock-free netisr encaptab walk: encap_detach() LIST_REMOVE+kfree vs encap4_input() walk calling gif_encapcheck() on the softc — use-after-free panic (reproduced)
sys/net/gif/if_gif.c:176 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3530 Low 5.2 v1 ng_ether teardown frees priv with no synchronization against data-plane readers (DF-3529 ng7 twin; v1 lacks ng7's cpu0 funnel)
sys/netgraph/ether/ng_ether.c:321 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3618 Low 5.2 ath_vap_delete second TX drain races live taskqueue workers before kfree(avp) — author-acknowledged use-after-free window on vap teardown
sys/dev/netif/ath/ath/if_ath.c:1785 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3669 Low 5.2 ix_detach never terminates the self-re-arming per-ring tx_gc_timer: pending callout fires on freed tx_rings → use-after-free (write into freed slab + callout-queue corruption)
sys/dev/netif/ix/if_ix.c:373 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3681 Low 5.2 igb_detach never terminates the self-re-arming sc->timer and per-ring tx_gc_timer (callout_stop only, which does not interlock against an in-progress callback): re-arm after detach → use-after-free on freed softc/rings and, under kldunload, execution of unmapped module text
sys/dev/netif/igb/if_igb.c:327 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3822 Low 5.2 aac_detach frees the container list with no aac_container_lock while the still-live interrupt path aac_handle_aif and the aac_query_disk ioctl traverse it — use-after-free race
sys/dev/raid/aac/aac.c:679 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3955 Low 5.2 Double free of rdev->pm.dpm.ps (and leak of parsed ps_priv states) on the kzalloc-failure path of kv_parse_power_table
sys/dev/drm/radeon/kv_dpm.c:2675 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4276 Low 5.2 cbb_detach() deletes the bridge children before stopping the slot event thread — cbb_insert/cbb_removal operate on freed child devices (UAF race), and the RUNNING-flag startup window lets detach free the softc under a live thread
sys/dev/pccard/pccbb/pccbb.c:285 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4332 Low 5.2 Read-only GUI ioctls walk live array state with no driver lock while DELETE_ARRAY frees it - use-after-free race (panic or kernel-pointer copyout)
sys/dev/raid/hptmv/gui_lib.c:163 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4615 Low 5.2 ips_copperhead_reinit ignores ips_copperhead_queue_init's return: freed status queue left dangling → interrupt-context UAF read/write; every forced reinit also leaks the previous queue mapping
sys/dev/raid/ips/ips.c:630 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4619 Low 5.2 ar5413: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write corrupting RF bank state
sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:495 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4648 Low 5.2 ar2316: unbounded kk write in getGainBoundariesAndPdadcsForPowers overflows pcdacTable[128] into RF bank scratch (twin of DF-4619/ar5413)
sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:454 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4660 Low 5.2 ar2413: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write corrupting RF bank scratch (twin of DF-4619/ar5413, DF-4648/ar2316)
sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:451 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4677 Low 5.2 cmx_detach lifetime holes: dying is checked unlocked before CMX_LOCK (TOCTOU across lockuninit) and registered knotes are never detached from sc->kq.ki_note — knote cleanup after softc free is a use-after-free
sys/dev/misc/cmx/cmx.c:265 · pass 2 · new
 cmx_detach lifetime holes: unlocked dying TOCTOU across lockuninit, and registered knotes never detached from ki_note - post-free knote cleanup is a UAF write untested not_testable untriaged — —
DF-4707 Low 5.2 amr_pci_detach's EBUSY guard is defeated: AMR_STATE_OPEN is cleared on ANY close (not last) and is TOCTOU-open — kldunload frees the softc while a /dev/amr0 descriptor still references it via dev->si_drv1 (UAF)
sys/dev/raid/amr/amr_pci.c:365 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4875 Low 5.2 afd_describe(): ksprintf of device-controlled u64 mediasize into char[16] — deterministic 1-byte NUL stack overflow at attach
sys/dev/disk/nata/atapi-fd.c:446 · pass 2 · new
 none untested not_testable untriaged — —
DF-5116 Low 5.2 dcons_crom_detach NULLs post_busreset with no synchronization against fw_busreset's unlocked check-then-call dispatch running in the fwohci interrupt handler — a physical bus reset racing kldunload executes dcons_crom_post_busreset on freed softc: interrupt-context UAF write (bzero of sc->unit + crom_add_* stores)
sys/dev/misc/dcons/dcons_crom.c:196 · pass 2 · new
 none untested not_testable untriaged — —
DF-5250 Low 5.2 run_key_set defers a raw ieee80211_key pointer that can be node-embedded (pairwise) and freed before run_key_set_cb executes - UAF read/write including k->wk_pad write
sys/bus/u4b/wlan/if_run.c:2368 · pass 2 · new
 UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252) untested not_testable untriaged — —
DF-5656 Low 5.2 USB dynamic dispatch unload hooks use a fixed 1-second tsleep as the only grace between live consumers and freed module text
sys/bus/u4b/usb_dynamic.c:113 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4060 Medium 5.1 amr_std_poll_command timeout leaks the slot as permanently busy while every caller releases the command: next use of the recycled amr_command panics ('amr: slot %d busy?'), a late completion double-completes the recycled command (bio/UAF confusion), and amr_rescan_drives livelocks spinning on amr_busyslots
sys/dev/raid/amr/amr.c:1348 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4179 Medium 5.1 twe_add_unit off-by-one: TWEIO_ADD_UNIT with unit==16 passes `unit > TWE_MAX_UNITS` and writes one struct past twe_drive[16] (OOB write into softc + ghost disk with unit truncated to 0)
sys/dev/raid/twe/twe.c:212 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-5477 Medium 5.1 efi_get_table(): firmware-fed physical st_cfgtbl stored and dereferenced as a kernel virtual pointer + st_entries walk with no bound — deterministic fatal kernel fault on the first EFIIOC_GET_TABLE ioctl of any conforming EFI boot; unbounded OOB read walk where mapped
sys/platform/pc64/x86_64/efirt.c:411 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2811 Low 5.1 SHT_SYMTAB/SHT_STRTAB sh_size truncated into signed int symcnt/strcnt → negative kmalloc()/vn_rdwr() lengths → kmem_slab_alloc panic; modulo-wrap and short-read/uninitialized-buffer variants
sys/kern/link_elf.c:590 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3222 Low 5.1 dirfs_mount copyinstr fallback re-interprets a failed user data pointer as a kernel address — wild vkernel-kernel read / fatal trap from mount(2)
sys/vfs/dirfs/dirfs_vfsops.c:126 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3292 Low 5.1 SIOCS80211 MESH_RTCMD ADD/DELETE dereference the raw user-supplied ireq->i_data pointer in kernel (no copyin)
sys/netproto/802_11/wlan/ieee80211_mesh.c:3654 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4227 Low 5.1 cyapa detach/module-unload leaves open fds, blocked readers and kqueue hooks on a vanished softc — NULL-deref panic / dispatch through freed module ops
sys/dev/smbus/cyapa/cyapa.c:545 · pass 2 · new
 none untested not_testable untriaged — —
DF-4297 Low 5.1 kbd_detach frees the live genkbd_softc under open /dev/kbdN descriptors: blocked reader never woken, write-after-free at :757, fatal KNOTE-on-freed-memory trap via stale kb_callback.kc_arg at :905
sys/dev/misc/kbd/kbd.c:597 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4311 Low 5.1 vga_switcheroo MOD_UNLOAD/MOD_SHUTDOWN frees module state and lets the module unload while DRM modules hold live symbol relocations and (on hybrid hardware) registered clients — use-after-unload panic / heap UAF
sys/dev/video/vga/vga_switcheroo.c:1022 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4996 Low 5.1 Child-attach-failure path runs ral_pci_detach() after the child already unwound itself: ieee80211_ifdetach() LIST_REMOVEs a never-attached ieee80211com → NULL-pointer write → kernel panic (unreachable double-free tail behind it)
sys/dev/netif/ral/if_ral_pci.c:275 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5041 Low 5.1 _PRT Source device used as a PCI interrupt link device with no NULL/driver validation: type-confused softc read (and NULL device deref) panic at boot
sys/dev/acpica/acpi_pcib.c:111 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5454 Low 5.1 Config bridges forward unvalidated reg/width into the PCIe MMIO backend whose reg-only bound allows OOB read/write past the MMCFG kernel_map mapping
sys/bus/pci/x86_64/pci_bus.c:61 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5464 Low 5.1 icu_abi MSI/MSI-X allocation count validated only by INVARIANTS-only KASSERTs — OOB write past caller's 32-int array, negative-index scan-walk panic, and count==0 livelock holding icu_irqmap_tok on production kernels
sys/platform/pc64/icu/icu_abi.c:460 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4926 Medium 5.0 nvmm MOD_UNLOAD tears down the hypervisor (nvmm_fini: all machine/vcpu locks lockuninit'd, impl freed, nvmm_impl=NULL) while /dev/nvmm is still dispatching ioctls — destroy_dev() runs last; unprivileged ioctl storm races kldunload into NULL-deref panic (UAF paths code-proven)
sys/dev/virtual/nvmm/nvmm_dragonfly.c:366 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3463 Low 5.0 gre decapsulation leaves m->m_pkthdr.rcvif pointing into gre_softc while ip_reass can hold the fragment chain far past if_detach's netmsg_service_sync barrier — post-destroy reassembly processes the packet through freed gre_softc memory (delayed UAF reads in ip_input)
sys/netinet/ip_gre.c:184 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4130 Low 5.0 Firmware-controlled NIC_CREATE_WQ response db_offset used unvalidated as MMIO write offset on every TX doorbell
sys/dev/netif/oce/oce_mbox.c:1710 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5691 Low 5.0 prop_dictionary _nocopy twins export borrowed-pointer lifetime hazards into _KERNEL with 26 live dm/tbridge callers — dm_dev_status_ioctl:409 and dm_table_deps_ioctl:619-620 actively dangle the borrowed name/uuid pointers mid-function (latent kernel UAF-read; set twin: frozen-size UAF/leak/overflow, zero callers)
sys/libprop/prop_dictionary_util.c:183 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2751 Medium 4.7 funsetown() KKASSERT race: pre-token *sigiop load dereferenced after concurrent fsetown() frees and slab-recycles the sigio — unprivileged kernel panic on INVARIANTS (stock) builds via pipe F_SETOWN/close/exit (DF-2682 sibling)
sys/kern/sys_pipe.c:1023 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2831 Medium 4.7 dssize()/diskpsize consume dp->d_slice without ds_token — use-after-free walk of struct diskslices/disklabel during forced reprobe, and DSO_RAWPSIZE fallback silently substitutes whole-disk size for partition devices
sys/kern/subr_diskslice.c:849 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2908 Medium 4.7 varsymset lifetime race at process exit: sibling LWP uses p_varsymset after final varsymset_clean/lockuninit — permanent unprivileged M_VARSYM kernel-memory leak (plus INVARIANTS panic window in lockuninit)
sys/kern/kern_varsym.c:437 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3193 Medium 4.7 fuse_unmount() frees fmp under in-flight statfs/statvfs: FUSE is MPSAFE (VFS_MPLOCK no-op) and fuse_statfs/statvfs take no fmp reference, so a forced umount plus daemon fd-close kfree's fmp while a statfs thread sleeps on its IPC — the wake/timeout path locks and walks freed (recycled) kernel memory
sys/vfs/fuse/fuse_vfsops.c:190 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-3239 Medium 4.7 p_fd NULL-deref/UAF in vn_fullpath()->cache_fullpath() against an exiting target read via /proc/pid/map
sys/vfs/procfs/procfs_map.c:181 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3303 Medium 4.7 free_bw_list() runs unschedule_bw_meter() on bw_meter_timers[] without mroute_token (del_mfc / del_bw_upcall DELETE_ALL) — race vs bw_meter_process panic/UAF
sys/net/ip_mroute/ip_mroute.c:1115 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3892 Medium 4.7 cm_callout is callout_init_mp (lock-free) but mpssas_scsiio_timeout asserts and manipulates mps_lock-protected state: deterministic KKASSERT panic on the first SCSI IO timeout (stock INVARIANTS/GENERIC kernels), lock-free race with interrupt completion otherwise
sys/dev/raid/mps/mps_sas.c:1490 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3941 Medium 4.7 cxm(4): cxm_read() consumes the DMA ring with no serialization — a stale ring offset paired with a different buffer underflows `size - offset` (size_t) and uiomove()s past the 61440-byte DMA buffer; read/write desync also discloses never-DMA'd (uninitialized) kernel heap via read(2)
sys/dev/video/cxm/cxm.c:2262 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-4145 Medium 4.7 ucNumDPMLevels==0 pplib state leaves num_levels==0: levels[-1] window writes 0 into the MSB of pi->requested_rps.ps_priv (non-canonical pointer deref -> panic) and feeds heap-garbage sclk into watermark programming
sys/dev/drm/radeon/trinity_dpm.c:974 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4164 Medium 4.7 radeon_unmap_vram_bos walks rdev->gem.objects without gem.mutex while unprivileged GEM create/close list_add/kfree the same list: UAF read / list corruption race in the PM clock-change path
sys/dev/drm/radeon/radeon_pm.c:146 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4310 Medium 4.7 ste_stop()/ste_intr STATS_OFLOW issue the synchronous callout_stop() while holding if_serializer while the 1 Hz non-MP ste_stats_update callback must first block in lwkt_serialize_enter on that serializer — AB-BA deadlock (DF-3715 family), plus STOP-override timer resurrection at detach (UAF)
sys/dev/netif/ste/if_ste.c:790 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4369 Medium 4.7 hpt_timeout()/os_cmddone() completion race: non-synchronizing callout_stop() frees the PCOMMAND while the timeout handler dereferences it (UAF -> wild ldm_reset_vbus -> panic)
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:411 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4374 Medium 4.7 Sysctl read handlers unlock before touching the HAL and never test sc_invalid — racing device_detach frees the HAL object and unmaps the BARs before the oids are removed, giving an unprivileged reader a use-after-free panic
sys/dev/netif/ath/ath/if_ath_sysctl.c:256 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4621 Medium 4.7 amdgpu_dm debugfs: OR-combined valid_input accepts invalid DP lane_count; stored unvalidated and consumed by a lane_settings[LANE_COUNT_DP_MAX=4] write loop -> stack OOB write (LATENT: file not compiled)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:195 · pass 2 · new
 none untested not_testable untriaged — —
DF-4625 Medium 4.7 output_poll_execute's self-rearm structurally survives drm_kms_helper_poll_disable/poll_fini on the DragonFly workqueue shim — poll work executes up to 10s AFTER cancel_delayed_work_sync returned (mid-suspend connector probe on a suspended GPU, or UAF on a torn-down drm_device)
sys/dev/drm/drm_probe_helper.c:653 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4636 Medium 4.7 radeon_acpi: ACPI_OBJECT type confusion and missing Buffer.Length validation in all four ATIF/ATCS return parsers — firmware-controlled kernel wild-pointer read and heap OOB read (panic)
sys/dev/drm/radeon/radeon_acpi.c:212 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-4874 Medium 4.7 afd_detach() in-flight teardown race: UAF of afd_softc/struct disk + shared dscheck/dsgone disk-layer race — twin of reproduced DF-4797 (ad)
sys/dev/disk/nata/atapi-fd.c:134 · pass 2 · new
 none untested not_testable untriaged — —
DF-5220 Medium 4.7 Use-after-free: execlists engine-init failure kfree()s the engine while engine->timeline.link is still on gt.timelines; the unwind's neighbor list_del writes kernel pointers into the freed chunk
sys/dev/drm/i915/i915_timeline.c:28 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5462 Medium 4.7 Lockless cam_extend array: ptopen/ptclose/ptstrategy/ptioctl UAF read races ptctor's cam_extend_set growth (kfree of ea->ps) — kernel pointer used from freed memory
sys/bus/cam/scsi/scsi_pt.c:153 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2610 Low 4.7 icmp6_redirect_input dereferences stale ip6/nd_rd pointers after IP6_EXTHDR_CHECK may reallocate the mbuf (latent UAF read)
sys/netinet6/icmp6.c:2160 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2688 Low 4.7 OOM kill block operates on bigproc without p_token and without liveness revalidation (TOCTOU vs concurrent exit)
sys/vm/vm_pageout.c:1826 · pass 2 · new
 none untested not_testable untriaged — —
DF-2763 Low 4.7 journal_mountctl journal lifecycle is lock-free: concurrent install/remove double-detach panics on INVARIANTS and double-kfrees/UAF-writes mnt_jbitmap on release kernels
sys/kern/vfs_jops.c:162 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2951 Low 4.7 sysctl_hostname dereferences p->p_ucred up to four times with no p_spin/crhold and not via td_ucred — racy freed-credential read (cratom_proc can crfree the cred between load and deref), wild pr_host[256] copyout; DF-2868-class sibling with a jailed-root trigger
sys/kern/kern_mib.c:221 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2953 Low 4.7 logtimeout() use-after-free read of sc_sigio: pgsigio() on a struct sigio freed by a concurrent FIOSETOWN ioctl
sys/kern/subr_log.c:247 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2992 Low 4.7 flush_pagedep_deps: bwrite(inodedep->id_buf) dereferences id_buf after dropping the softdep lock — diverges from the file's own copy-first discipline (softdep_update_inodeblock), micro-window UAF read / NULL deref
sys/vfs/ufs/ffs_softdep.c:4655 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-3196 Low 4.7 nfs_nget_nonblock revalidation restart retains a stale vp across vput(vp); goto loop — any execution of the NFSTOV(np) != vp branch double-vputs the same vnode (refcount underflow → premature vnode recycling / assert panic); the adjacent retry path's own comment states the rule this restart forgot
sys/vfs/nfs/nfs_node.c:271 · pass 2 · new
 none untested not_testable untriaged — —
DF-3302 Low 4.7 add_mfc() uses mfc_find() result before taking mroute_token — UAF-write race against del_mfc() kfree
sys/net/ip_mroute/ip_mroute.c:976 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-3414 Low 4.7 if_clone_destroy() lookup/act TOCTOU: drops the ifnet lock between ifunit() lookup and teardown — concurrent destroyers double-free the clone unit and UAF the ifnet (framework component of the reproduced DF-3407 panic)
sys/net/if_clone.c:104 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3453 Low 4.7 pfil COW hook-list free races pfil_run_hooks() walkers on threads netmsg_service_sync() never waits for (softclock via ip_mroute tbf_reprocess_q→ip_output; IFF_IDIRECT bridge interrupt threads) — use-after-free with indirect call through pfh->pfil_func; stock INVARIANTS kernel panics on the mroute softclock path
sys/net/pfil.c:110 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3467 Low 4.7 check_uid/check_gid dereference an unreferenced, unlocked inpcb on the output path — use-after-free read race against in_pcbdetach()->kfree(inp)
sys/net/ipfw3_layer4/ip_fw3_layer4.c:120 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3492 Low 4.7 pppoe_ticker dereferences hook->private/sp->neg unconditionally and races ng_pppoe_disconnect freeing the session — NULL-deref/UAF panic (DF-3488 twin)
sys/netgraph/pppoe/ng_pppoe.c:1490 · pass 2 · new
 none untested not_testable untriaged — —
DF-3510 Low 4.7 ng_socket: unsynchronized priv->node / priv->datasock reads in ngc_send/ngd_send/ngs_connect/ngs_disconnect/ngs_rcvdata race mtx-protected teardown — NULL-deref/UAF panic
sys/netgraph7/socket/ng_socket.c:310 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3517 Low 4.7 v1 ng_socket: ngsock/ngpcb lifetime entirely unsynchronized across socket threads, netisr and synchronous-dispatch contexts — NULL-deref/UAF race (DF-3510 ng7 twins, worse: no locks at all, refs-blind kfree)
sys/netgraph/socket/ng_socket.c:257 · pass 2 · new
 none untested not_testable untriaged — —
DF-3529 Low 4.7 ng_ether control-plane teardown frees priv without synchronizing against BGL-held data-path callbacks (speculative UAF)
sys/netgraph7/ether/ng_ether.c:313 · pass 2 · new
 none untested not_testable untriaged — —
DF-3611 Low 4.7 Double free of rdev->pm.dpm.ps (plus leak of parsed ps_priv states) on the allocation-failure path of si_parse_power_table — radeon twin of amdgpu DF-3588
sys/dev/drm/radeon/si_dpm.c:6855 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3771 Low 4.7 ahci_port_free() teardown use-after-free: armed per-CCB timeout callouts never cancelled and in-flight CCBs never failed before kfree
sys/dev/disk/ahci/ahci.c:997 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3816 Low 4.7 dev.mpr.N.dump_reqs sysctl: unlocked walk of live command/chain lists (UAF read) plus fixed 128-byte reads past device-sized frames
sys/dev/raid/mpr/mpr.c:1904 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3855 Low 4.7 ext-TMDS init parser desynchronisation: non-IGP case-0 record missing 'index += 4' — value/terminator bytes re-executed as MMIO commands
sys/dev/drm/radeon/radeon_combios.c:2955 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3884 Low 4.7 drm_dp_mst_topology_mgr_destroy/suspend never flush tx_work: pending work can run after teardown (DF-3699 family)
sys/dev/drm/drm_dp_mst_topology.c:3254 · pass 2 · new
 race-window NULL panic / teardown UAF untested — untriaged — —
DF-3918 Low 4.7 Allocation-failure path in mpr_mapping_allocate_memory kfrees NULL (panic on DragonFly) / stale pointers; mpr_mapping_initialize return ignored by both callers
sys/dev/raid/mpr/mpr_mapping.c:2177 · pass 2 · new
 logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919) untested — untriaged — —
DF-4284 Low 4.7 midi_unload() TAILQ_FOREACH advances through midi_destroy()-freed entries — use-after-free read with groom-controlled pointer consumption
sys/dev/sound/midi/midi.c:1469 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4551 Low 4.7 als_intr registered before channels exist (and kept after they are freed): IRQ in the attach/detach window runs chn_intr(NULL)/chn_intr(freed) — NULL-deref/UAF panic; als_resource_free releases the I/O region before tearing down the handler
sys/dev/sound/pci/als4000.c:648 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4558 Low 4.7 MOD_UNLOAD ignores device_delete_child() failure and unconditionally kfrees the external softc while free_softc() can leave the cam_sim registered — post-kldunload use-after-free (lockmgr on freed+uninited state_lock) on the still-reachable SIM
sys/dev/disk/nata/atapi-cam.c:894 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4680 Low 4.7 Unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2317=128] — 80-byte intra-object heap OOB write into RF bank scratch (twin of DF-4619/4648/4660)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:429 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4753 Low 4.7 cxm_msp_* audio-decoder path runs with zero serialization: unprivileged ioctls sleep ~0.5s in cxm_msp_wait_for_lock while cxm_detach (kldunload) frees the softc — use-after-free (DF-4419 cxm twin; cxm_open is_opened TOCTOU folded)
sys/dev/video/cxm/cxm_msp34xxx.c:588 · pass 2 · new
 panic inconclusive inconclusive untriaged — —
DF-4821 Low 4.7 radeon_ring_backup() uses the hardware rptr as the first ring index without ptr_mask — bogus GPU/writeback value gives a wild kernel OOB read (panic) during GPU reset
sys/dev/drm/radeon/radeon_ring.c:299 · pass 2 · new
 panic untested not_testable untriaged — —
DF-5011 Low 4.7 dimm_mod_unload() drains dimm_softc references owned by still-attached drivers, kfree()ing live objects — victim use-after-free into freed heap/unmapped module text (proven kernel panic)
sys/dev/misc/dimm/dimm.c:316 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5046 Low 4.7 idad_detach frees the idad softc under open descriptors and in-flight bios — DF-5013/DF-5025 family detach UAF
sys/dev/raid/ida/ida_disk.c:302 · pass 2 · new
 none untested not_testable untriaged — —
DF-5115 Low 4.7 ips_pci_detach clears sc->configured before ips_adapter_free can return EBUSY: one failed detach permanently corrupts the state machine — retried detaches silently succeed without ips_pci_free, leaving the adapter IRQ handler registered against softc freed at module-unload unit destruction (interrupt-context UAF read/write), and ips_pci_shutdown permanently skips the cache flush
sys/dev/raid/ips/ips_pci.c:202 · pass 2 · new
 none untested not_testable untriaged — —
DF-5140 Low 4.7 iwm_notification_wait_free() frees the wait structure with no drain of threads still sleeping in iwm_wait_notification(); the only guard is a KASSERT compiled out on non-INVARIANTS kernels, so a detach racing an in-flight waiter operates on freed memory
sys/dev/netif/iwm/if_iwm_notif_wait.c:108 · pass 2 · new
 stalled control threads / detach-race UAF write untested not_testable untriaged — —
DF-5157 Low 4.7 ath LED blink callout is re-armed by draining tx-completion tasks AFTER ath_stop()'s single cancel — no drain in ath_detach, callout fires into freed softc/HAL (use-after-free)
sys/dev/netif/ath/ath/if_ath_led.c:166 · pass 2 · new
 none untested not_testable untriaged — —
DF-5212 Low 4.7 cxm(4) REMOTE_GETKEY: cxm_ir_key() tsleeps 50 ms inside an unserialized ioctl while cxm_detach frees the softc and destroys sc->iicbus — use-after-free (IR-path twin of DF-4753/DF-3941 family)
sys/dev/video/cxm/cxm_ir.c:114 · pass 2 · new
 panic inconclusive inconclusive untriaged — —
DF-5280 Low 4.7 pci_devq mutated without pci_token (pci_read_device/pci_freecfg) while PCIOCGETCONF walks the list under pci_token — use-after-free read race
sys/bus/pci/pci.c:576 · pass 2 · new
 VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281) untested not_testable untriaged — —
DF-5351 Low 4.7 MSI/MSI-X allocation count validated only by INVARIANTS-only KASSERTs — OOB write past caller's array, irqmap row-crossing writes and IPI IDT-gate smash on production kernels
sys/platform/pc64/apic/ioapic_abi.c:1256 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5518 Low 4.7 gpio_acpi detach does not quiesce in-flight GPIO address-space handler dispatches: use-after-free of softc/provider state (OpRegion half of the missing-drain defect; complements DF-1094/DF-2307)
sys/bus/gpio/gpio_acpi/gpio_acpi.c:486 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5528 Low 4.7 fwohci_pci_detach() swallows child-detach failure, force-deletes the firewire child and returns unconditional success — orphaned attached child + live callouts over unmapped BAR/freed DMA rings once a firewire-bus child vetoes detach (latent panic/UAF, lying kldunload)
sys/bus/firewire/fwohci_pci.c:350 · pass 2 · new
 none untested not_testable untriaged — —
DF-5744 Low 4.7 apple_gmux: missing I/O-region length validation (GMUX_MIN_IO_LEN dead code) → out-of-bounds x86 port I/O from crafted ACPI _CRS
sys/gnu/dev/misc/apple_gmux/apple-gmux.c:77 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5198 Info 4.7 fire_saver(): set_video_mode() return value ignored — on failure vid aliases the stale 32KB text window and the 64000-byte blit (repeated every 25 Hz tick) overruns it into 0xC0000+ (DF-5114/DF-5197 twin)
sys/dev/misc/syscons/fire/fire_saver.c:69 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5304 Info 4.7 fwohci_irx_disable/fwohci_itx_disable free DMA buffers after a fixed 1-tick tsleep without confirming the OHCI context halted (device-write UAF window into freed memory)
sys/bus/firewire/fwohci.c:1269 · pass 2 · new
 device-driven heap UAF window on non-compliant hardware untested not_testable untriaged — —
DF-5541 Info 4.7 gpio_intel teardown methods trust the cookie: stale/double GPIO_FREE_INTR reaches gpio_cherryview_unmap_intr with pin == -1, uint16_t-wrapped to 65535 → OOB kernel-KVA read + masked write ~4.5MB past the BAR mapping (deterministic KKASSERT panic on INVARIANTS kernels)
sys/bus/gpio/gpio_intel/gpio_intel.c:256 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5299 Low 4.6 usbd_get_phys() type-confuses the USB controller's newbus ivars as struct pci_devinfo * without any bus-type or NULL check — NULL/wild deref panic or limited kernel-heap leak into the V4L2 bus_info string on non-PCI controllers
sys/bus/u4b/usb_device.c:2249 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3280 Medium 4.5 if_getgroupmembers() walks a stale struct ifg_group pointer across an ifgroup_lock release: SIOCGIFGMEMB use-after-free read reachable by unprivileged users
sys/net/if.c:1324 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4278 Medium 4.5 R300_ZB_ZPASS_ADDR reloc patch records nothing and validates nothing: unvalidated u32 offset past the relocation BO becomes the GPU occlusion-counter write target (cross-BO GPU OOB increment-write)
sys/dev/drm/radeon/r300.c:1073 · pass 2 · new
 none untested not_testable untriaged — —
DF-3615 Low 4.5 Unvalidated hardware-fed ts_antenna indexes ast_ant_tx[8]/sc_ant_tx[8] in ath_tx_update_stats — latent OOB write with function-pointer-table and past-allocation reach (RX twin clamps after field crashes)
sys/dev/netif/ath/ath/if_ath.c:4197 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4644 Low 4.5 Adapter/vidsw/vidcdevsw array lifecycle races in fb.c: vid_realloc_array frees outside vga_token, tokenless readers, and a vid_register free-slot index race — UAF read/write window and cross-driver type confusion
sys/dev/video/fb/fb.c:76 · pass 2 · new
 none untested not_testable untriaged — —
DF-4651 Low 4.5 fm801_pci_attach failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc — mixer-UAF family, 14th instance (DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537/4550/4610)
sys/dev/sound/pci/fm801.c:620 · pass 2 · new
 none untested not_testable untriaged — —
DF-5573 Low 4.5 ppb_MS_init_msq(): instruction index `ins` never bounds-checked — controlled OOB kernel write up to +8184 bytes from the microsequence array
sys/bus/ppbus/ppb_msq.c:201 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5690 Info 4.5 prop_array_util _nocopy helpers export borrowed-pointer lifetime hazards into _KERNEL: unpinned get_cstring_nocopy return dangles on slot replace/array release; set_cstring_nocopy references caller-owned kernel memory forever with ps_size frozen at creation while externalize/prop_string_cstring re-read to the current NUL (latent UAF read / plist info leak / heap overflow)
sys/libprop/prop_array_util.c:205 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2768 Medium 4.4 Off-by-one in unix98 pty clone limit: unit==MAXPTYS accepted, ptis[MAXPTYS] out-of-bounds read (uninitialized pointer) + out-of-bounds pointer write
sys/kern/tty_pty.c:176 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2774 Medium 4.4 mountlist_exists() provides no lifetime guarantee: stale vp->v_pfsmp used after nullfs unmount for VFS accounting and quota enforcement — wrong-mount EDQUOT/negative usage (deterministic), struct mount UAF window (racy)
sys/kern/vfs_mount.c:692 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3073 Medium 4.4 nfs_unmount() continues teardown after vflush(FORCECLOSE) fails on a busy device vnode: frees the nfsmount and destroys the nfsnode objcache with a live nfsnode (UAF condition, allocator-confirmed) and dounmount() then panics deterministically ('unmount: dangling vnode')
sys/vfs/nfs/nfs_vfsops.c:1217 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3428 Medium 4.4 generic_netmap_rxsync: 32-bit wrap in the ring->reserved sanitization drives the userspace-release loop index out of [0,lim] — unkillable kernel livelock holding the kring lock
sys/net/netmap/netmap_generic.c:641 · pass 2 · new
 none build_failed not_testable untriaged — —
DF-3449 Medium 4.4 dummynet3 MOD_UNLOAD never unregisters its ipfw3 hooks: stale filter_funcs[2][] and module registration make check_body()'s unguarded indirect call execute unmapped module text (deterministic panic)
sys/net/dummynet3/ip_dummynet3_glue.c:2013 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3502 Medium 4.4 delport/rmnode never clear the member's ac_netgraph (IFP2NG); rmnode clears the shared ng_ether_input_p unconditionally -> dangling node pointer detonates in ng_fec_input on the next RX frame after any later fec node re-arms the global: reproduced page-fault panic at NULL+0x3f8 in interrupt context
sys/netgraph/fec/ng_fec.c:379 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3601 Medium 4.4 hdaa_sysctl_reconfig: device-tree mutation inside a sysctl handler self-deadlocks the global sysctllock — permanent kernel freeze from the documented reconfiguration interface
sys/dev/sound/pci/hda/hdaa.c:6474 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3837 Medium 4.4 evergreen_ib_parse()/evergreen_vm_packet3_check(): no packet-fits-in-IB validation + fixed-offset payload reads without pkt->count checks → OOB reads up to 5 dwords past the IB sub-allocation + kernel-log disclosure oracle (DF-3592/DF-3764 family, pre-SI VM path)
sys/dev/drm/radeon/evergreen_cs.c:3519 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4895 Medium 4.4 complete_raid5_write() launches RAID-4/5 second-phase I/O via vn_strategy(drive->vp) on a teardown-vulnerable vnode — deterministic NULL-vp kernel panic (fatal trap 12 in vn_strategy), closed-vnode UAF window in the mid-flight variant
sys/dev/raid/vinum/vinuminterrupt.c:427 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2744 Low 4.4 disk_dumpcheck(): media_blocks − reserved_blocks unsigned underflow defeats the crash-dump bounds check; DEV_BSIZE unit mismatch for non-512B media
sys/kern/subr_disk.c:909 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2946 Low 4.4 kern.stathz boot tunable ingested with no validation → kernel integer-divide fault at statclock systimer registration (unbootable system)
sys/kern/subr_param.c:201 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2948 Low 4.4 kern.ncallout fetched after the only clamp → int-overflowed callwheel sizing in swi_softclock_setup: zero-byte per-CPU allocations panic vm_map (latent 2^30-iteration OOB init loop; infinite boot loop on ≤2-CPU)
sys/kern/subr_param.c:327 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3084 Low 4.4 doff_t (int32) truncation of crafted directory i_size >= 2^31 yields negative dp->i_offset -> ext2_write KASSERT panic on INVARIANTS kernels (EINVAL elsewhere)
sys/vfs/ext2fs/ext2_lookup.c:424 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3380 Low 4.4 pfsync callout handlers execute in the softclock thread without pf_token: deterministic INVARIANTS panic ~5s after SIOCSETPFSYNC syncdev configuration (ASSERT_LWKT_TOKEN_HELD at pfsync_bulkfail entry)
sys/net/pf/if_pfsync.c:1168 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3932 Low 4.4 MLYIO_COMMAND size handling: DataTransferLength==INT_MIN negates/wraps into kmalloc(0xFFFFFFFF80000000, M_INTWAIT) — kernel panic (sink PROVEN on guest); plus unbounded wired allocation and ignored dmamap_load failure
sys/dev/raid/mly/mly.c:2889 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4114 Low 4.4 TBI-mode nge(4) deletes itself: sc->nge_miibus = dev passed to device_delete_child(dev, dev) — unbounded nge_detach recursion on detach, live-device kobj_delete UAF on attach failure
sys/dev/netif/nge/if_nge.c:864 · pass 2 · new
 none untested not_testable untriaged — —
DF-4685 Low 4.4 amdgpu_fence_slab_fini: rcu_barrier() is a no-op — kldunload with pending call_rcu entries unmaps module text before the >=1s delay line fires amdgpu_fence_free: fatal trap 12 (reproduced; fix validated on rebuilt kernel)
sys/dev/drm/amd/amdgpu/amdgpu_fence.c:69 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4803 Low 4.4 parityops()/parityrebuild() compute the transfer size with an overflowing 'stripesize << DEV_BSHIFT': one checkparity/rebuildparity ioctl on a >=2 GiB-stripe RAID-5 plex panics the kernel (kmem_slab_alloc exhaustion)
sys/dev/raid/vinum/vinumrevive.c:274 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5313 Low 4.4 daioctl(DAIOCTRIM) reads its 16-byte argument by direct user-pointer dereference with no copyin: kernel page fault (panic) on unmapped user pointer and user-memory race across the synchronous loop
sys/bus/cam/scsi/scsi_da.c:423 · pass 2 · new
 stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313) untested not_testable untriaged — —
DF-3298 Medium 4.3 Use-after-free in carp_proto_input: IP reassembly holds dangling rcvif into freed carp_softc across ifconfig carpN destroy
sys/netinet/ip_carp.c:703 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3204 Low 4.3 krpc_call leaks the reply mbuf chain on the RPC_PROGMISMATCH exit — reachable by spoofed replies, by DF-3203's stale read, and by legitimate v2-only servers during mountd version fallback
sys/vfs/nfs/krpc_subr.c:391 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4881 Low 4.3 onoe ath_rate_getxtxrates() stores hardware rate codes into ath_rc_series.rix (rate-table INDEX) fields and clobbers the correct series-0 index — wrong-entry rt->info[] derefs on every multi-rate-retry frame, heap OOB read on 11n HALs (DF-4850 amrr twin)
sys/dev/netif/ath/ath_rate/onoe/onoe.c:143 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2848 Low 4.2 taskqgroup_create() heap OOB write: unvalidated cnt writes struct taskqgroup_cpu slots past the fixed tqg_queue[MAXCPU] array
sys/kern/subr_gtaskqueue.c:788 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2907 Low 4.2 md_get_mbuf() ignores md_get_mem() failure (silent short copy / INVARIANTS panic) and md_done() leaves md_cur/md_pos dangling
sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3090 Low 4.2 NFSSVC_MNTD path type-confuses any filesystem's mount into struct nfsmount: VROOT check without vfstype check before VFSTONFS(vp->v_mount)
sys/vfs/nfs/nfs_syscalls.c:175 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3299 Low 4.2 carp_group_demote_adj()/carp_send_ad_all() execute outside netisr0: unsynchronized demotion counter, wrong-CPU callout arming, unlocked carpif_list walk
sys/netinet/ip_carp.c:2765 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4322 Low 4.2 dsp_clone() funnels concurrently-running clone handlers through one shared `static struct cdev *dev` — an unprivileged open of /dev/dspN can be handed another card's clone cdev (reproduced), and the stale static can hand devfs a destroyed cdev under concurrent pcm_unregister (traced UAF)
sys/dev/sound/pcm/dsp.c:2381 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4742 Low 4.2 vce_v2_0: VCE bo sized exactly AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short — DATA window ends 256 bytes past vcpu_bo (DF-4524 v3 shape, v2 instance)
sys/dev/drm/amd/amdgpu/vce_v2_0.c:424 · pass 2 · new
 none untested not_testable untriaged — —
DF-4832 Low 4.2 uvd_v1_0_resume programs VCPU cache windows +128B into vcpu_bo at full sizes — STACK/SESSION window overruns the pinned bo by 128 bytes into the adjacent VRAM object (radeon UVD v1 twin of DF-4524/DF-4742)
sys/dev/drm/radeon/uvd_v1_0.c:121 · pass 2 · new
 none untested not_testable untriaged — —
DF-4988 Low 4.2 Passthru SGL write destination steered by user-controlled gcmd->size byte: up to ~860 bytes of DMA descriptors written past the request's 1024-byte command packet into neighboring requests of the shared command pool
sys/dev/raid/tws/tws_user.c:126 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5229 Low 4.2 uvd_v4_2_resume programs the VCPU cache-window chain +0x200 into vcpu_bo with a full-blob region0 size — chain ends 512 bytes past the pinned bo with the shipping CIK UVD firmware (radeon twin of DF-4832/DF-4524/DF-4742)
sys/dev/drm/radeon/uvd_v4_2.c:47 · pass 2 · new
 none untested not_testable untriaged — —
DF-5767 Low 4.2 ohci_controller_init latches unvalidated device-reported NDP (0-255) into sc_noport: kernel-driven OOB MMIO reads AND writes past the 0x100-byte OHCI register file on every roothub event (DF-5268/5282/5296 register-geometry family, OHCI variant)
sys/bus/u4b/controller/ohci.c:286 · pass 2 · new
 none untested not_testable untriaged — —
DF-3419 Medium 4.1 pfi_kif_update() walks kif->pfik_dynaddrs under crit_enter() only while pf_rm_rule()/pfi_dynaddr_remove() free the entries under pf_token on another CPU — cross-CPU use-after-free of pfi_dynaddr (kernel panic)
sys/net/pf/pf_if.c:470 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3470 Medium 4.1 Ratectl registry has no in-use accounting: nrefs unload-guard exists but amrr/rssadapt/none never increment it — kldunload of an in-use algorithm leaves every vap->iv_rate dangling into unmapped module text; next ir_* indirect call (world-readable rate_stats sysctl, any TX, vap detach) executes unmapped code
sys/netproto/802_11/wlan/ieee80211_ratectl.c:58 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3715 Medium 4.1 em_stop() can deadlock the callout subsystem against em_timer/em_82547_move_tail (AB-BA): callout_stop() synchronously waits for a callback that is blocked on the serializer the stopper holds — mechanism PROVEN on the guest kernel via protocol-replica module (caller stuck D3/wchan 'costp')
sys/dev/netif/em/if_em.c:2222 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4125 Medium 4.1 Dangling rdev->pm.dpm.ps after kfree-without-NULL in rv6xx_parse_power_table (:1908-1912) + swallowed rv6xx_dpm_init error -> double free in rv6xx_dpm_fini (:2106); ps_priv[0..i-1] leaked (rv6xx twin of DF-4023/DF-3973/DF-4117)
sys/dev/drm/radeon/rv6xx_dpm.c:1908 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5071 Medium 4.1 amrd_strategy has no AMR_STATE_SHUTDOWN gate and nothing ever drains amr_bioq — bios park forever, issuers wedge in unkillable D-state (DF-2066/DF-5012/DF-5026 systemic class; distinct sink from DF-2082's in-flight UAF)
sys/dev/raid/amr/amr_disk.c:166 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2814 Low 4.1 objcache_destroy() purges remote CPUs' per-cpu magazines under only a local critical section — no cross-CPU exclusion (contract-reliant teardown; KKASSERT panic / magazine UAF if any in-flight get/put exists)
sys/kern/kern_objcache.c:929 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3045 Low 4.1 bootpc trusts interface sdl_alen without bounding it to chaddr[16]/hexstr[64] — over-long link address from an IFT_ETHER driver overflows the outgoing packet in-struct and smashes a 64-byte stack buffer via hexncpy
sys/vfs/nfs/bootp_subr.c:718 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3407 Low 4.1 tun(4) softc lifetime race: cdev open/close vs clone create/destroy unsynchronized — reproduced kernel panic (UAF family); tap DF-3405 twin
sys/net/tun/if_tun.c:214 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3411 Low 4.1 FIOSETOWN/TIOCSPGRP racing pgsigio: tun's async-SIGIO paths dereference a struct sigio that funsetown() frees outside sigio_token (generic UAF primitive, tun manifestation)
sys/net/tun/if_tun.c:536 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3473 Low 4.1 wlan_xauth: nrefs is never incremented (NULL ia_attach) so kldunload succeeds while VAPs hold raw iv_auth pointers — use-after-free of module text/data on later auth dispatch
sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:62 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3509 Low 4.1 ng_fec_rmnode vs ng_fec_tick callout race: callout_stop does not wait for an in-flight tick, IFF_RUNNING is never cleared on the rmnode path, and tick re-arms itself -> callout can fire on &priv->fec_timeout after kfree(priv)
sys/netgraph/fec/ng_fec.c:614 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3711 Low 4.1 arcmsr_detach() tears down DMA pool and cdev before deregistering the CAM SIM; MSIX IRQ resources leaked
sys/dev/raid/arcmsr/arcmsr.c:4632 · pass 2 · new
 detach-order UAF + IRQ resource leak untested — untriaged — —
DF-3898 Low 4.1 mps_detach_sas frees sassc/sim after a 30-second bounded wait even if the scanner thread never exited: use-after-free reads and writes from mpssas_scanner_thread
sys/dev/raid/mps/mps_sas.c:820 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4084 Low 4.1 sis_stop uses callout_stop (which does not interlock against an in-progress callback) while sis_tick re-arms itself as its last serialized action: timer resurrects after stop; on detach the late tick dereferences freed softc/miibus/bus resources (use-after-free) — DF-3715 callout-discipline family
sys/dev/netif/sis/if_sis.c:1123 · pass 2 · new
 none untested not_testable untriaged — —
DF-4271 Low 4.1 callout_stop() does not interlock with the self-serializing, self-re-arming wb_tick: repeating post-detach use-after-free of the softc
sys/dev/netif/wb/if_wb.c:1590 · pass 2 · new
 none untested not_testable untriaged — —
DF-4301 Low 4.1 vkbd_term() ignores kbd_unregister() failure and frees a possibly still-registered/busy keyboard (latent UAF)
sys/dev/misc/vkbd/vkbd.c:848 · pass 2 · new
 none untested not_testable untriaged — —
DF-4394 Low 4.1 hpt_shutdown_vbus frees LDM memory and adapter handles before terminating the vbus timer callout - pending timer callback runs on freed memory (shutdown-window UAF)
sys/dev/raid/hptrr/hptrr_osm_bsd.c:363 · pass 2 · new
 In the shutdown path the vbus lock is dropped, LDM command pools are freed and adapter handles kfree'd, but the periodic vbus timer (callout_init_lk'd to the vbus lock, armed for background RAID/rebuild tasks) is only terminated AFTERWARDS untested not_testable untriaged — —
DF-4402 Low 4.1 tws_cam_attach error symmetry: missing return after cam_sim_alloc failure -> xpt_bus_register(NULL) NULL-deref panic at attach; sc->sim left dangling/registered on later failure paths
sys/dev/raid/tws/tws_cam.c:173 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4409 Low 4.1 acpi_asus_detach removes the wrong ACPI notify handler: installed handler survives detach and fires into freed/unloaded driver state (use-after-free)
sys/dev/acpica/acpi_asus/acpi_asus.c:810 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4410 Low 4.1 acpi_asus LED state changes run in an undrained AcpiOsExecute task: detach/led_destroy free the softc under a pending acpi_asus_led_task (UAF window)
sys/dev/acpi_asus/acpi_asus.c:922 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4440 Low 4.1 atmel_mxtread/write/kqfilter dereference softc without the NULL guard used by open/close/ioctl — NULL-deref (later UAF) via fd held across driver detach/kldunload
sys/dev/smbus/atmel_mxt/atmel_mxt.c:653 · pass 2 · new
 Deterministic NULL-deref panic (later UAF) via fd held across driver detach/kldunload; root-triggered self-DoS untested not_testable untriaged — —
DF-4570 Low 4.1 cancel_fake_irq() drains fake_irq before hangcheck, so a concurrently-running hangcheck callback can re-arm fake_irq after its drain — intel_breadcrumbs_fake_irq fires on a torn-down engine (use-after-free at driver unload)
sys/dev/drm/i915/intel_breadcrumbs.c:840 · pass 2 · new
 UAF read/write on freed engine->breadcrumbs at driver unload (panic-class; worse on heap reuse) untested not_testable untriaged — —
DF-4590 Low 4.1 tws_detach/attach-unwind never cancel driver callouts (reset_cb, reinit poll, per-req timeouts) before freeing the softc — use-after-free panic at driver unload during reset recovery
sys/dev/raid/tws/tws.c:346 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4744 Low 4.1 ahci_pci_detach() has no interlock against an in-flight ahci_intr() on another CPU — hardirq-context UAF of sc_ports[]/ap and access to the already-unmapped ABAR during controller detach
sys/dev/disk/ahci/ahci_attach.c:589 · pass 2 · new
 none untested not_testable untriaged — —
DF-4806 Low 4.1 ppi: interrupt handler registered with a cdev_t argument but consumed as device_t - wild-pointer deref and instant kernel panic on the first parallel-port IRQ (currently defused by a sibling bug: the legacy IRQ allocation can never succeed, leaving 1284 peripheral mode dead)
sys/dev/misc/ppi/ppi.c:160 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4841 Low 4.1 Post-reset OBFL refill is a no-op: sense_bufs[].posted survives the controller soft reset, so tws_init_obfl_q() re-run by the recovery path posts nothing — firmware left with zero response frames, permanent I/O hang after any successful reset recovery
sys/dev/raid/tws/tws_hdm.c:118 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4943 Low 4.1 offset_to_id returns success for all DDC-family offsets without ever writing *id — dal_gpio_service_create_irq then switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6/7 into hpd_regs[6] (OOB)
sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:172 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4976 Low 4.1 flr_work never drained at mailbox teardown — xgpu_ai_mailbox_put_irq() lacks cancel_work_sync(), so a queued FLR work survives put_irq and uses amdgpu_device after hw_fini/free (UAF at driver detach)
sys/dev/drm/amd/amdgpu/mxgpu_ai.c:365 · pass 2 · new
 none untested not_testable untriaged — —
DF-4994 Low 4.1 vega10_smu_init error path kfrees hwmgr->smu_backend without NULLing it, defeating vega10_smu_fini's NULL guard — latent double-free/UAF (the vega12 DF-4951 shape)
sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:288 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-5006 Low 4.1 acpi_cpu has no detach teardown: ACPI notify handler (context=sc), both sysctl contexts and the sensordev outlive the softc → use-after-free on driver/module detach; attach error paths leak the same resources and orphan the first child
sys/dev/acpica/acpi_cpu.c:67 · pass 2 · new
 none untested not_testable untriaged — —
DF-5093 Low 4.1 wbsio_detach never detaches its lm child (no bus_generic_detach): driver unload leaves a dangling attached child with a live 5s sensor task, leaked rman ports, and a NULL-ops parent — any later bus op on the child is a guaranteed NULL-deref panic
sys/dev/powermng/wbsio/wbsio.c:268 · pass 2 · new
 guaranteed NULL-deref panic on later child bus op (root-gated) untested not_testable untriaged — —
DF-5217 Low 4.1 LKM screen-saver module unload TOCTOU: remove_scrn_saver samples scrn_blanked and clears current_saver with no syscons_lock, so kldunload can unmap the saver module (fade_saver et al.) while fade_saver is still executing — use-after-free of module text and statics
sys/dev/misc/syscons/fade/fade_saver.c:46 · pass 2 · new
 kernel UAF executing freed module text - panic ceiling untested not_testable untriaged — —
DF-5478 Low 4.1 efi_create_1t1_map(): md_pages*EFI_PAGE_SIZE wraparound passes the runtime-map guard — multi-petabyte kmalloc(M_WAITOK) fill loop wedges the boot
sys/platform/pc64/x86_64/efirt.c:255 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5562 Low 4.1 ohci_pci_detach() swallows device_delete_children() failure: unconditional controller reset, IRQ/MMIO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success
sys/bus/u4b/controller/ohci_pci.c:329 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5771 Low 4.1 mmc_rescan_cards()/mmc_delete_cards() free card ivars unconditionally after device_delete_child() — latent UAF if a child driver's detach ever fails
sys/bus/mmc/mmc.c:1728 · pass 2 · new
 slow kernel-memory leak (5770) / latent UAF (5771) untested not_testable untriaged — —
DF-2960 Info 4.1 kcollect_register pins no caller-module lifetime; kcollect_unregister unenforced — latent UAF (indirect call + strlen) for loadable-module consumers
sys/kern/kern_collect.c:81 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3438 Info 4.1 Cipher registry has no reference accounting: ieee80211_crypto_unregister clears ciphers[] while keys may still hold wk_cipher into the module; policy-module nrefs gate read unsynchronized at MOD_UNLOAD ('XXX disallow if references') - kldunload TOCTOU -> UAF
sys/netproto/802_11/wlan/ieee80211_crypto.c:194 · pass 2 · new
 none untested not_testable untriaged — —
DF-4483 Info 4.1 build_rq_buffer malloc-failure path frees the whole request via abortrequest() and then every caller frees it again (latent double-free / UAF)
sys/dev/raid/vinum/vinumrequest.c:833 · pass 2 · new
 Latent heap double-free/UAF landmine (dead today: Malloc is M_WAITOK and never fails) untested not_testable untriaged — —
DF-5763 Info 4.1 netbt_dispose wired as dom_dispose is a dead-code booby trap: it destroys the three GLOBAL netbt vm_zones per socket flush — one PR_RIGHTS flag bit away from a deterministic global UAF/double-free (rig-proven, 3/3 panics at zdestroy+0x19)
sys/netbt/bt_proto.c:128 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2830 Medium 4.0 Off-by-one NUL-terminator clobber in sysctl_vm_zone name padding causes kernel-stack OOB read in unprivileged vm.zone output (13+ char zone names, in-tree trigger rfcomm_credit)
sys/vm/vm_zone.c:835 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4299 Low 4.0 emu_pcm_attach late-failure path frees sc while the mixer remains registered: dangling mixer devinfo UAF on /dev/mixer ioctls and leaked AC97 submixer
sys/dev/sound/pci/emu10kx-pcm.c:1399 · pass 2 · new
 none untested not_testable untriaged — —
DF-5040 Low 4.0 vbus_ext->timer never drained before vbus_ext is freed at shutdown: os_timer_for_ldm() fires on freed memory (UAF)
sys/dev/raid/hpt27xx/hpt27xx_os_bsd.c:230 · pass 2 · new
 probe panic / shutdown-window UAF per finding untested not_testable untriaged — —
DF-2742 Low 3.9 diskstrategy consumes dp->d_slice with no serialization while disk_probe/disk_invalidate replace and free it — use-after-free window for every in-flight bio
sys/kern/subr_disk.c:1246 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3495 Low 3.9 v1 ng_l2tp session-hook / hook-private use-after-free: unreferenced cached hook+hpriv used across a microsecond-scale window while concurrent rmhook frees both
sys/netgraph/l2tp/ng_l2tp.c:661 · pass 2 · new
 none not_reproduced — untriaged — —
DF-4139 Low 3.9 throw_rude_remark strcpy of up-to-1024-byte message into ioctl_reply->msg[256]: up to 4 bytes past the VINUM_CREATE ioctl allocation, plus dangling static ioctl_reply (UAF write)
sys/dev/raid/vinum/vinumconfig.c:114 · pass 2 · new
 none untested not_testable untriaged — —
DF-4195 Low 3.9 drm_connector_register() error path leaves dangling connector->kdev — latent double-free on re-register; unchecked kzalloc in the sysfs stub
sys/dev/drm/drm_connector.c:453 · pass 2 · new
 none untested not_testable untriaged — —
DF-5552 Low 3.9 cam_devq reference count is a non-atomic int and cam_devq_release() frees the devq with active I/O after only a warning
sys/bus/cam/cam_queue.c:242 · pass 2 · new
 none untested not_testable untriaged — —
DF-4675 Info 3.9 bktr_detach removes only the minor==unit device node — /dev/tunerN (unit+16) and /dev/vbiN (unit+32) persist after detach, stranding cdevs that reference the driver's dev_ops (use-after-free after module unload)
sys/dev/video/bktr/bktr_os.c:325 · pass 2 · new
 bktr_detach removes only minor==unit - /dev/tunerN and /dev/vbiN persist, stranding cdevs referencing the driver's dev_ops (dev_ops UAF after module unload) untested not_testable untriaged — —
DF-2931 Medium 3.8 if_getanyethermac() type-confusion via uuid_node() leaks kernel driver-softc memory into unprivileged uuidgen(2) output (and returns wrong 'MAC' on vtnet/ena/oce)
sys/kern/kern_uuid.c:86 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2717 Medium 3.6 nlookup_init()/retry path read the shared fd_ncdir/fd_nrdir nchandle pairs without fd_spin while sibling threads swap them — torn (ncp,mount) pairs and hold-after-drop race on the jail '..'-gate comparison inputs
sys/kern/vfs_nlookup.c:149 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4710 Medium 3.6 feed_eq_feed FXROUND/FXDIV align-overshoot at the SND_FXDIV_MAX boundary: reads/writes up to align-1 bytes past the caller's byte window and returns count+align-1 (sndbuf_acquire ring overflow; tmpbuf OOB write when the 64KB-exact allocation geometry holds)
sys/dev/sound/pcm/feeder_eq.c:461 · pass 2 · new
 none reproduced — untriaged — —
DF-2760 Low 3.6 sys_getsid reads the p_pgrp->pg_session chain without pt->p_token; sys_setpgid reads curp->p_session unlocked — lifetime race vs. enterpgrp's pgrp free (stale/UAF read)
sys/kern/kern_prot.c:153 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2855 Low 3.6 rman_reserve_resource window arithmetic wraps when count-1 > end: allocation escapes the caller's [start,end] window (and can produce an inverted r_end < r_start node when start+count-1 overflows)
sys/kern/subr_rman.c:224 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-3308 Low 3.6 IPV6_MULTICAST_IF caches an unreferenced ifnet pointer that is never purged for TCP6 pcbs → dangling im6o->im6o_multicast_ifp after interface destruction
sys/netinet6/ip6_output.c:2253 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3333 Low 3.6 nm_kr_rxpos() single conditional subtract turns DF-0359's corrupted nr_hwcur/nr_hwavail into an out-of-bounds slot write in netmap_transmit()
sys/net/netmap/netmap.c:910 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3371 Low 3.6 ip_setmoptions IP_ADD_MEMBERSHIP: route reference dropped before rt_ifp is read — use-after-release race and permanent rtentry leak when the lookup held the last reference
sys/netinet/ip_output.c:1658 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3460 Low 3.6 rssadapt_sysctl_interval dereferences vap->iv_rs freed by rssadapt_deinit during the vap-teardown window before ieee80211_sysctl_vdetach removes the oid — unprivileged 4-byte kernel-heap UAF read (world-readable sysctl), root 4-byte UAF write; amrr twin is the default ratectl
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:151 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3624 Low 3.6 Double free of adev->pm.dpm.ps on the kzalloc-failure path of ci_parse_power_table (plus leak of already-parsed ci_ps states)
sys/dev/drm/amd/amdgpu/ci_dpm.c:5694 · pass 2 · new
 OOM-gated double free untested — untriaged — —
DF-3747 Low 3.6 sccngetch(): 8-byte size_t store through (size_t *)&fkeycp pun writes 4 bytes past a kernel static; unclamped bcopy into the 17-byte static fkey trusts the DF-1503-corruptible fkeytab length
sys/dev/misc/syscons/syscons.c:2005 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4108 Low 3.6 vge TX short-frame pad path writes one fragment past vge_frag[7] when a <60-byte frame arrives with 7 DMA segments (vge_encap maxsegs off-by-one corrupts the next descriptor's vge_sts/vge_ctl)
sys/dev/netif/vge/if_vge.c:676 · pass 2 · new
 none untested not_testable untriaged — —
DF-4206 Low 3.6 vlv_dsi_init !fixed_mode error path kfrees a registered drm_connector without drm_connector_cleanup — dangling entry on mode_config.connector_list and in the mode-object IDR
sys/dev/drm/i915/vlv_dsi.c:1860 · pass 2 · new
 none untested not_testable untriaged — —
DF-5263 Low 3.6 mtw_key_set defers the raw ieee80211_key pointer; pairwise keys are node-embedded, so a node freed before mtw_key_set_cb runs makes the callback read and WRITE (k->wk_pad) freed node memory
sys/bus/u4b/wlan/if_mtw.c:1940 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5604 Low 3.6 device_set_usb_desc uses shared per-udev scratch after dropping the enum lock — transiently unterminated buffer makes device_set_desc_copy's strlen/strcpy an OOB heap read disclosed via device_printf("<%s>")
sys/bus/u4b/usb_util.c:110 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4450 Low 3.5 hsw_activate_psr2() overflows two 4-bit EDP_PSR2_CTL fields when sink reports max resync latency, corrupting IDLE_FRAME/FRAME_BEFORE_SU/TP2_TIME in one register write
sys/dev/drm/i915/intel_psr.c:415 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4687 Low 3.5 ar2425: unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] — intra-object heap OOB write into RF bank scratch (twin of DF-4619/4648/4660/4680)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:452 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4690 Low 3.5 cardbus_cis: decode_tuple_bar keeps the attacker-controlled 32-bit CIS BAR size (truncated to a negative int) and passes it unchecked as the resource count; 1<<(ffs(0x80000000)-1) = 1<<31 signed-overflow UB also yields a negative count — both beyond DF-1811's ffs(0) case
sys/dev/pccard/cardbus/cardbus_cis.c:308 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5175 Low 3.5 CIS-controlled PCMCIA I/O window size drives out-of-allocation port I/O in ata_pccard_attach()
sys/dev/disk/nata/ata-card.c:93 · pass 2 · new
 none untested not_testable untriaged — —
DF-5495 Info 3.5 uether_rxmbuf() sets m_len/m_pkthdr.len from the caller-supplied len with no clamp — the core's unguarded RX entry point (live instance: DF-5396 urndis 2-byte heap overflow)
sys/bus/u4b/net/usb_ethernet.c:563 · pass 2 · new
 mbuf cluster leak per stall-unplug cycle (DF-5494) / future unguarded-len overflows (DF-5495) untested not_testable untriaged — —
DF-3730 Low 3.4 ciss_cam_complete_fixup: padstr writes 16 bytes into the 4-byte inq->revision -> 12-byte heap overflow past short CAM INQUIRY buffers
sys/dev/raid/ciss/ciss.c:3325 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-4134 Low 3.4 give_plex_to_volume() writes vol->plex[MAXPLEX] past the last member of struct volume when the 'too many plexes' throw is swallowed by disk-config mode
sys/dev/raid/vinum/vinumconfig.c:198 · pass 2 · new
 none untested not_testable untriaged — —
DF-4342 Low 3.4 ngmn_newhook channel aliasing: DOWN-state reuse admits two live hooks on one schan — silent second connect, blackholed peer hook, permanent nhooks drift blocking line reconfig, and a concurrent dual-teardown double-free enabler
sys/dev/netif/mn/if_mn.c:470 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5104 Low 3.4 led_attach() kstrdup()s the GPIOATTACH consumer arg without type validation: GPIO_TYPE_INT delivers an integer-as-pointer (arbitrary strlen/kstrdup deref) and the string variant is not termination-bounded (kernel-stack over-read)
sys/dev/misc/gpio/gpio_led.c:186 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5647 Low 3.4 Negative port/portsize/maddr/msize hints accepted: poisoned resource-list entries (inverted start>end ranges, sign-extended UINT64_MAX bases) and rman double-claims of already-allocated I/O ports
sys/bus/isa/isahint.c:61 · pass 2 · new
 kernel resource bookkeeping corruption (inverted rle/rman ranges, overlapping/double-claimed I/O ports) reproduced fixed untriaged — —
DF-3531 Medium 3.3 ng7 ng_tty: closing the tty with a pending chand callout permanently leaks the ng_item + node reference (ng_uncallout twin of DF-3515/DF-3523)
sys/netgraph7/tty/ng_tty.c:453 · pass 2 · new
 leak reproduced inconclusive untriaged — —
DF-2735 Low 3.3 socket_wait() leaks one file descriptor into the caller's fd table on every call (and on its error path)
sys/kern/sys_generic.c:1699 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2746 Low 3.3 sys_mincore() off-by-one: kernel writes one NUL byte below the user-supplied vec pointer; vecindex/lastvecindex truncate at 8TB ranges
sys/vm/vm_mmap.c:829 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2819 Low 3.3 kmalloc_obj zone-limit accounting uses cacheline-aligned ks_objsize while callers must derive limits from unaligned sizeof — tmpfs inode quota exhausts (ENOSPC) at ~85% of the configured cap
sys/kern/kern_kmalloc.c:899 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2956 Low 3.3 timespec2fattime: post-2107 timestamps silently wrap the 7-bit FAT year field and truncate t2 64→32 bits — far-future utimes() persisted as arbitrary plausible dates (year-4.4M stored as 2023-11-23)
sys/kern/subr_fattime.c:157 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3114 Low 3.3 hammer_ioc_gethistory ATKEY: ++cursor.key_beg.key signed-overflow at HAMMER_MAX_KEY wraps to INT64_MIN (full history disclosed for a past-EOF key); obj_type default EINVAL silently overwritten
sys/vfs/hammer/hammer_ioctl.c:296 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3159 Low 3.3 msdosfs_setattr→detrunc/deextend lack the va_size upper-bound check the write path has: ftruncate beyond FAT's 32-bit max silently drives deextend past the on-disk size field instead of EFBIG
sys/vfs/msdosfs/msdosfs_denode.c:509 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-3240 Low 3.3 Signed-overflow bypass of the buflen guard in procfs_domap(): wrapped sum survives the INT_MAX check, int-truncated sbuf, wild fault-protected kernel-side read
sys/vfs/procfs/procfs_map.c:61 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4924 Low 3.3 gfx_v9_0 gfx-ring emit_frame_size never reserves the 2-dword TMZ FRAME_CONTROL emission that amdgpu_ib_schedule() makes unconditionally — ring-reservation overrun of 2 dwords for every CS job with num_ibs == 24 (mod 64)
sys/dev/drm/amd/amdgpu/amdgpu_ib.c:159 · pass 2 · new
 dos not_reproduced not_testable untriaged — —
DF-3051 Info 3.3 statfs/statvfs accounting overflow and unvalidated compat feature bits (has_journal RW without replay)
sys/vfs/ext2fs/ext2_vfsops.c:296 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-3397 Info 3.3 rx-ring init writes 4-byte int into const uint16_t nr_buf_size, clobbering the adjacent flags field (latent — module does not build on DFly)
sys/net/netmap/netmap_mem2.c:974 · pass 2 · new
 none build_failed not_testable untriaged — —
DF-5682 Info 3.3 prop_number_unsigned() is the only prop_number accessor without a type guard - type-confused 4-byte heap OOB read (bitfield word at +40..43 vs 40-byte prop_string)
sys/libprop/prop_number.c:379 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3349 Low 3.2 LACP leaks the slow-protocols multicast membership and ifma refcount on every member-port removal: if_delmulti_ifma is #if 0'd out and no equivalent cleanup exists in the tree
sys/net/lagg/ieee8023ad_lacp.c:544 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3670 Low 3.2 ixgbe_calc_eeprom_checksum_generic walks NVM sections on NVM-resident pointer/length with u16 index and no word_size bounds — upstream FreeBSD fix missing in DragonFly
sys/dev/netif/ix/ixgbe_common.c:2214 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3274 Low 3.1 Use-after-free read in TX accounting: m->m_pkthdr.len read after m_freem(m) when the control queue is full
sys/net/sppp/if_spppsubr.c:1318 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3638 Low 3.1 ath_tx_retry_clone() dmasetup-failure path: node reference leaked forever and nbf recycled to the free list with bf_m dangling at a freed mbuf
sys/dev/netif/ath/ath/if_ath_tx.c:4568 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4548 Low 3.1 ar5212_attach: halKeyCacheSize taken unclamped from 4-bit EEPROM AR_EEP_KCENTRIES field (up to 32768) vs 128-entry hardware key table; every HAL keycache bounds check validates against the attacker-controlled value
sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:867 · pass 2 · new
 Latent MMIO OOB-write primitive (key-cache writes past the 128-entry table into PHY register space); defused in-tree by if_ath's ATH_KEYMAX=128 clamp untested not_testable untriaged — —
DF-2704 Low 3.0 vop_cache_operate_ap dispatches through mnt_vn_journal_ops unsynchronized against journal_detach kfree (UAF window, root-gated)
sys/kern/vfs_vopops.c:1781 · pass 2 · new
 none untested not_testable untriaged — —
DF-2936 Low 3.0 module_register_init MOD_LOAD-failure path destroys the module registry entry while kldload(2) reports success — module lifecycle desynchronized from linker-file lifecycle (zombie module, teardown-order inversion)
sys/kern/kern_module.c:110 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2969 Low 3.0 suspend_kproc holds no reference on the target thread: concurrent kthread_exit yields use-after-free read/write on a recycled struct thread and an unkillable sleeper
sys/kern/kern_kthread.c:188 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-2970 Low 3.0 linesw[] registry accepts conflicting registrations and deregisters in-use disciplines with no validation — dual NETGRAPHDISC(6) registration by netgraph and netgraph7 tty modules silently aliases/strands live ttys
sys/kern/tty_conf.c:105 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-3237 Low 3.0 iod-shutdown race: after nfssvc_iod_stop1() the reader re-queues EINPROGRESS requests onto nm_reqtxq whose only consumer (the writer thread) is already exiting — stranded nfsreq + nfsm_info + bio (biodone never called, buffer stuck B_BUSY), queue head embedded in the nfsmount that nfs_unmount then frees
sys/vfs/nfs/nfs_iod.c:134 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3281 Low 3.0 if_addgroup() increments ifg_refcnt outside ifgroup_lock and makes the find-or-create decision non-atomically: lost-update refcount -> premature group destruction with live references (latent UAF/double-free)
sys/net/if.c:1174 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3307 Low 3.0 ip6_output(): stale exthdrs[] mbuf pointers across pfil_run_hooks() → use-after-free read+write in the fragmentation path
sys/netinet6/ip6_output.c:658 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3401 Low 3.0 ip_fw3_ctl_nat_get_record walks all CPUs' lockless per-CPU NAT state with no synchronization; break-vs-continue truncation
sys/net/ipfw3_nat/ip_fw3_nat.c:585 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4137 Low 3.0 remove_plex_entry compacts vol->plex[] with a byte count instead of element count and decrements vol->plexes even when the plex was not found
sys/dev/raid/vinum/vinumconfig.c:1849 · pass 2 · new
 none untested not_testable untriaged — —
DF-4243 Low 3.0 dptexecuteccb send-failure path frees CCB without callout_stop — armed timeout later runs dpttimeout on stale/recycled state (premature abort of unrelated command / UAF read)
sys/dev/raid/dpt/dpt_scsi.c:778 · pass 2 · new
 none demonstrated on guest (no DPT hardware); source-level impact: stale armed callout after send failure → premature abort of unrelated command / UAF-read on recycled ccb untested not_testable untriaged — —
DF-4294 Low 3.0 Kernel heap OOB read via non-NUL-terminated NGM_TEXT_CONFIG data fed to strcmp/strtol
sys/dev/misc/musycc/musycc.c:1013 · pass 2 · new
 Kernel heap over-read (match/no-match oracle; page-fault panic at arena boundary). Root-only ngctl + LMC1504 hardware. untested not_testable untriaged — —
DF-4343 Low 3.0 mn_attach error-path asymmetry: discarded BAR resource handles (unreleasable), leaking ENXIO returns, failures reported as attach success, dangling sc->node after node destruction, and no device_detach
sys/dev/netif/mn/if_mn.c:1302 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4534 Low 3.0 lptclose() frees the I/O buffers while the lptout callout and the registered interrupt handler can still execute (use-after-free read window)
sys/dev/misc/lpt/lpt.c:596 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4640 Low 3.0 ips: attach-time info-command timeout unwind frees the DMA buffer and recycles the static command slot while the adapter still owns the command - device UAF write / zeroed-callback call on late completion
sys/dev/raid/ips/ips_commands.c:313 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4972 Low 3.0 Magic-map desync across master swap leaves dangling drm_file* in the old master's idr → use-after-free bit-write via DRM_IOCTL_AUTH_MAGIC
sys/dev/drm/drm_auth.c:65 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-5167 Low 3.0 bt_pci_attach() error unwind after bus_setup_intr() failure leaves an XPT-registered SIM and wildcard CAM path live over released port/IRQ rman records, freed DMA memory and a lockuninit'd softc lock (UAF-class teardown)
sys/dev/disk/buslogic/bt_pci.c:152 · pass 2 · new
 none untested not_testable untriaged — —
DF-4776 Info 3.0 am7990_start_locked feeds unbounded mbuf chains into lance_put, memcpy'ing into the fixed LEBLEN(1522)-byte TX slot with no clamp (dead-code twin of DF-4746)
sys/dev/netif/lnc/am7990.c:523 · pass 2 · new
 none untested not_testable untriaged — —
DF-5194 Info 3.0 Snake movement engine confines itself purely by wall-bounce arithmetic writing through the completely unchecked sc_vtb_putc: any geometry inconsistency escapes and runs away with unbounded 2-byte OOB writes marching through the video window into adjacent DMAP'd memory (latent — no in-tree path produces the trigger)
sys/dev/misc/syscons/snake/snake_saver.c:100 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5197 Info 3.0 set_video_mode() return value ignored in warp_saver(): on failure vid aliases the stale 32KB text window and the 64000-byte bzero (plus every star write) overruns it by 32KB into 0xC0000+ (DF-5114 twin)
sys/dev/misc/syscons/warp/warp_saver.c:87 · pass 2 · new
 none untested not_testable untriaged — —
DF-5202 Info 3.0 rain_saver(): set_video_mode() return value ignored — on blank-time failure vid aliases the stale 32KB text window and the 64000-byte bzero + drop-fill overrun it into 0xC0000+, while blanked/vid state commits as if the saver were active (DF-5114/DF-5197/DF-5198 family twin, last saver)
sys/dev/misc/syscons/rain/rain_saver.c:77 · pass 2 · new
 latent out-of-window MMIO writes + text-mode corruption untested not_testable untriaged — —
DF-5002 Low 2.9 miibus leaks every kmalloc'd newbus ivars (mii_attach_args per PHY child, mii_probe_args per bus) — nothing in the kernel ever frees them
sys/dev/netif/mii_layer/mii.c:157 · pass 2 · new
 none untested not_testable untriaged — —
DF-5537 Low 2.8 vconswinch_intr() manipulates tty token-protected state (t_winsize write, t_pgrp read + pgsignal) without tp->t_token — INTR_MPSAFE lock-protocol violation with theoretical pgrp use-after-free (self-pinned in practice) and vconsole double-load vs vconsterm
sys/platform/vkernel64/platform/console.c:276 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3107 Medium 2.5 ufs_checkpath uses vp->v_mount after vput() drops intermediate ancestors to refcount 0 — read of unreferenced/reclaimable vnode on every deep rename (FreeBSD caches mp; ext2_checkpath shares the bug)
sys/vfs/ufs/ufs_lookup.c:1158 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2885 Low 2.5 kern_ptrace permission checks dereference tracer (and pre-token target) ucred pointers with no crhold and no token — freed-cred read racing cratom_proc (DF-2868 analog in sys_process.c)
sys/kern/sys_process.c:153 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-3071 Low 2.5 tmpfs memory/node limit enforcement is check-then-act: tm_pages_used ENOSPC test races its atomic_add (and tm_nodes_inuse check races the TMPFS_LOCK'd increment) — concurrent growth can overshoot tmpfs limits
sys/vfs/tmpfs/tmpfs_subr.c:1007 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3334 Low 2.5 netmap_mem_get_info() failure paths unbalance the adapter refcount: premature free/UAF (NIOCREGIF) and pinned adapters (NIOCGINFO)
sys/net/netmap/netmap.c:1331 · pass 2 · new
 none untested not_testable untriaged — —
DF-3359 Low 2.5 rtsock message builders fully trust producer sa_len for source reads — no clamp against sizeof(sockaddr_storage) (DF-3320 residual: OOB heap read leaked to unprivileged route-socket listeners)
sys/net/rtsock.c:1140 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3484 Low 2.5 Global netgraph queue (ngqbase/ngqlast/ngqfree) manipulated under crit_enter only: cross-CPU producer races silently orphan queue entries, permanently leaking their mbufs/messages and pinning node/hook references
sys/netgraph/netgraph/ng_base.c:1871 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3572 Low 2.5 u32 wrap in SKL DDB data-rate sum over-subscribes the per-pipe DDB (un-carried Linux v5.2 u64 rework)
sys/dev/drm/i915/intel_pm.c:4216 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3840 Low 2.5 1-byte use-after-free read in iwi_frame_intr(): frame->rate read at :1353 from the old rx mbuf after ieee80211_input() consumed/freed it (softled enabled by default)
sys/dev/netif/iwi/if_iwi.c:1353 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3851 Low 2.5 dc_setfilt_21143/dc_setfilt_xircom enqueue the setup frame with no TX-ring-space check: descriptor clobber of an in-flight frame, leaked mbuf, and tx_cnt overrun when invoked on a saturated ring
sys/dev/netif/dc/if_dc.c:1055 · pass 2 · new
 TX-power correctness (bwn) / mbuf leak + ring wedge (dc) untested — untriaged — —
DF-3896 Low 2.5 Unsigned resid underflow on the DATA_UNDERRUN path: csio->resid = cm_length − IOC-supplied TransferCount with no clamp (DF-3675 twin)
sys/dev/raid/mps/mps_sas.c:1943 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4041 Low 2.5 polaris10 MVDD stash walks: SmioTable2.Pattern reads entries[count] instead of entries[level]; populate_mvdd_value walks the raw MCLK-dependency count past mvdd_voltage_table.entries[32]
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:657 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4142 Low 2.5 wi_rx_intr ignores wi_read_bap() failure: uninitialized kernel heap delivered to the 802.11 stack and BPF (device-fed info disclosure)
sys/dev/netif/wi/if_wi.c:1356 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4265 Low 2.5 amdgpu_cs_wait_all_fences reads fence->error after the final dma_fence_put (use-after-free read, value returned as ioctl errno)
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1501 · pass 2 · new
 none untested not_testable untriaged — —
DF-4969 Low 2.5 adw_pci_attach error unwinds leak the PCI register/IRQ resources (and the softc on the setup() path): adw_free() never calls bus_release_resource
sys/dev/disk/advansys/adw_pci.c:211 · pass 2 · new
 none untested not_testable untriaged — —
DF-5350 Low 2.5 Unsynchronized dmat->segments allocation and map_count bookkeeping race under concurrent map create/destroy (double allocation leak; tag UAF window)
sys/platform/pc64/x86_64/busdma_machdep.c:337 · pass 2 · new
 device-side out-of-window DMA (DF-5349) / segments leak + tag UAF window (DF-5350) untested not_testable untriaged — —
DF-2701 Info 2.5 swap_pager_getpage() 20-second timeout diagnostic dereferences the completed-and-released pbuf (use-after-free read in console path)
sys/vm/swap_pager.c:1527 · pass 2 · new
 none untested not_testable untriaged — —
DF-2913 Info 2.5 plimit COW swap stores p->p_limit without p->p_spin, leaving a theoretical ref-acquisition race window against cross-process readers (schedcpu)
sys/kern/kern_plimit.c:189 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3185 Info 2.5 vfs_findname() bcmp of buflen+1 bytes can read past the NUL of kernel rodata name tables (match/no-match oracle on adjacent .rodata bytes)
sys/vfs/procfs/procfs_subr.c:491 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5584 Low 2.4 usb_idesc_foreach() uint8_t alt-index wraparound on configs with >256 alternate settings (missing upstream FreeBSD 6da5df47 fix)
sys/bus/u4b/usb_parse.c:135 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3214 Low 2.3 netaddr_match union type confusion for RC_NAM cache entries: rc_nam pointer compared as an IPv4 address in the dup-reply-cache hash walk — spoofed-source false cache hits and a silently inert duplicate cache for non-AF_INET transports
sys/vfs/nfs/nfs_srvcache.c:194 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3504 Low 2.3 ng7 twin of DF-0512: finish_accept copies an unbounded sa (sa_len up to 255) into ng_ksocket_accept.addr declared as a fixed struct sockaddr
sys/netgraph7/ksocket/ng_ksocket.c:1250 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3551 Low 2.3 mbuf+meta leak on the debug-hook data path: the only NG_FREE_DATA is gated on an unreachable condition (v1 twin of DF-0690)
sys/netgraph/ng_sample.c:237 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4596 Low 2.3 set_drive_parms() re-Mallocs drive->freelist without freeing the previous allocation (leak on drive re-init)
sys/dev/raid/vinum/vinumio.c:143 · pass 2 · new
 none untested not_testable untriaged — —
DF-5135 Low 2.3 TUNABLE_bool stores a 4-byte int through (int*)&_Bool_param: setting any i915 bool tunable silently corrupts the following parameters (and the registered names are mangled to KBUILD_MODNAME.<param>)
sys/dev/drm/i915/i915_params.c:80 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3220 Info 2.3 Mount/unmount error-path hygiene family: KTR_LOG reads freed dmp->dm_path after kfree, dirfs_root KTR prints uninitialized `error`, and mp->mnt_data is left dangling over freed dmp on failed mounts
sys/vfs/dirfs/dirfs_vfsops.c:131 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4339 Low 2.0 atom_parse name[512] stays unterminated when the VBIOS message is 511 printable bytes — %s leaks uninitialized kernel stack past the buffer to console/log; msg string also walked unbounded past the image
sys/dev/drm/radeon/atom.c:1276 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3005 Low 1.9 Read-after-free of cdev->si_name in devfs_destroy_related_without_flag_worker after devfs_destroy_dev_worker frees the device
sys/vfs/devfs/devfs_core.c:1508 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3041 Low 1.9 hammer_install_volume dereferences the volume header after brelse(bp) — buffer-cache use-after-release read of vol0_stat_bigblocks into f_blocks
sys/vfs/hammer/hammer_ondisk.c:250 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3420 Low 1.9 pfi_update_status() snapshots the pf-group member-list head outside the ifgroup lock, then walks the snapshot — use-after-free of ifg_member under concurrent group churn
sys/net/pf/pf_if.c:722 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3666 Low 1.9 sumo_rlc_init() save/restore buffer object undersized for the ON/LN/TN packed format: deterministic 172-byte write past the 324-byte BO
sys/dev/drm/radeon/evergreen.c:4155 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3913 Low 1.9 intel_sdvo_connector_state leaked when intel_sdvo_connector_init() fails (all four SDVO connector init paths)
sys/dev/drm/i915/intel_sdvo.c:2481 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4052 Low 1.9 nfe_alloc_{rx,tx}_ring error paths destroy data[i].map in a loop over j — dmamap leak + tag map_count underflow on attach failure
sys/dev/netif/nfe/if_nfe.c:1725 · pass 2 · new
 none untested not_testable untriaged — —
DF-4128 Low 1.9 Ignored rv6xx_convert_clock_to_stepping failures (:249-250, :302) leave uninitialized stepping structs programmed into the SPLL; VBIOS-driven step count overruns the SPLL step register block into VID_RT@0x6f8+
sys/dev/drm/radeon/rv6xx_dpm.c:225 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4205 Low 1.9 vlv_dsi_init dereferences vbt.dsi.config without a NULL/dangling guard — boot-time NULL-page panic or UAF read of freed config
sys/dev/drm/i915/vlv_dsi.c:1797 · pass 2 · new
 none untested not_testable untriaged — —
DF-4955 Low 1.9 mpr_pci_free destroys the parent DMA tag while mpr_free can early-return without freeing the 7 child tags — DragonFly's bus_dma_tag_destroy kfree()s unconditionally, permanently leaking all IOC-facts DMA memory and tags on a wedged-controller failed attach
sys/dev/raid/mpr/mpr_pci.c:232 · pass 2 · new
 leak untested not_testable untriaged — —
DF-5042 Low 1.9 adv_pci_attach leaks parent_dmat on the adv_init() and IRQ failure unwinds — init_level is bumped to the ccb_infos teardown tier after creating parent_dmat
sys/dev/disk/advansys/adv_pci.c:202 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5074 Low 1.9 acpi_acad has no device_detach: ACPI notify handler (context=dev), global ACPIIO_ACAD_GET_STATUS ioctl hook and hw.acpi.acline sysctl OID are never removed (DF-5006-family; resource pinning + blocked kldunload, structurally non-UAF today)
sys/dev/acpica/acpi_acad.c:76 · pass 2 · new
 none untested not_testable untriaged — —
DF-5091 Low 1.9 acpi_button has no device_detach: ACPI notify handler and fixed-event handler (context = softc) plus PRW wake GPE are never removed — DF-5006/DF-5074 family teardown gap, guaranteed UAF if a detach path is ever added
sys/dev/acpica/acpi_button.c:74 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5094 Low 1.9 Unbounded vinum daemon instantiation with pid-blind lazy abdication: N concurrent daemons, unkillable P_SYSTEM processes, non-unloadable module; the plausible multi-consumer daemonq double-free is refuted on current DragonFly only by incidental MP-token serialization
sys/dev/raid/vinum/vinumdaemon.c:83 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5103 Low 1.9 apple_fw detach leaves softc-backed world-readable sysctls live while newbus frees the softc: use-after-free read window during driver unload
sys/dev/apple/fw/apple_fw.c:144 · pass 2 · new
 none untested not_testable untriaged — —
DF-5124 Low 1.9 hyperv_md_uninit() frees the reference-TSC DMA page without quiescing in-flight hyperv_tc64 readers — shutdown-time use-after-free read window
sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:96 · pass 2 · new
 none untested not_testable untriaged — —
DF-5149 Low 1.9 pps driver has no device_detach and never destroy_dev()s its make_dev() cdev (DF-5006/5074/5091 teardown-gap family): /dev/ppsN and the ppbus child are permanent, module unload is structurally blocked, and a future naive detach is an interrupt-context UAF
sys/dev/misc/pps/pps.c:103 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5150 Low 1.9 acpi_lid has no device_detach: ACPI_DEVICE_NOTIFY handler installed with context = softc, AcpiOsExecute deferrals of that softc, and the enabled PRW wake GPE are never removed — DF-5091 (acpi_button) mirror; guaranteed UAF if a detach path is ever added
sys/dev/acpica/acpi_lid.c:66 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5158 Low 1.9 ata_ati_chipinit AHCI fallback attaches with dangling ctlr->r_res2: double bus_release_resource (rman UAF/panic) at detach
sys/dev/disk/nata/chipsets/ata-ati.c:108 · pass 2 · new
 none untested not_testable untriaged — —
DF-5404 Low 1.9 sgread(): unlocked re-check of rdwr->state races another reader's remove+free — 4-byte use-after-free read and tsleep on a freed object (PINTERLOCKED pattern)
sys/bus/cam/scsi/scsi_sg.c:795 · pass 2 · new
 UAF-read driven control flow (DF-5404) / uninit stack tag match (DF-5405) untested not_testable untriaged — —
DF-5440 Low 1.9 targbhctor leaks the softc when targbhenlun() fails: cam_periph_alloc() never calls the dtor on ctor failure
sys/bus/cam/scsi/scsi_targ_bh.c:384 · pass 2 · new
 per-attach softc leak + speculative abort-refusing-SIM UAF (DF-5440) / stale CTIO timeout (DF-5441) untested not_testable untriaged — —
DF-5544 Low 1.9 uhci_pci_detach() swallows device_delete_children() failure: unconditional IRQ/IO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success
sys/bus/u4b/controller/uhci_pci.c:374 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5631 Low 1.9 kqueue_del() latent API hazards: close-before-delete EV_DELETE-ENOENT panics the whole vkernel; delete-vs-dispatch kfree races kqueue_intr()'s in-flight udata dispatch on another vCPU host thread (zero in-tree callers today)
sys/platform/vkernel64/platform/kqueue.c:164 · pass 2 · new
 none untested not_testable untriaged — —
DF-2726 Info 1.9 cluster_write() reads bp->b_bio2.bio_offset after bdwrite()/bawrite() released the buffer — type-stable use-after-free reads corrupting write-clustering heuristics
sys/kern/vfs_cluster.c:1340 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-2942 Info 1.9 sysref_activate's negative-space gate is ambiguous between initializing and terminating: an activate during the termination window resurrects the object and drives double (or unbounded) termination with zero layer diagnostics
sys/kern/kern_sysref.c:164 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3556 Info 1.9 ng_ipfw is unbuildable dead code on this tree — DF-0735/DF-0736 cannot manifest on any buildable kernel
sys/netgraph7/ng_ipfw.c:44 · pass 2 · new
 none (unbuildable dead code) reproduced — untriaged — —
DF-4894 Info 1.9 aac_disk_dump() consumes firmware-derived geometry with no host-side clamping: max_sectors==0 → infinite dump loop, sg_tablesize/SectorCount/BlockNumber overflow the FIB fields, single static dump map shared across controllers
sys/dev/raid/aac/aac_disk.c:256 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4968 Info 1.9 radeon GART table_size / num_gpu_pages 32-bit wrap (DF-2012's radeon twin): missing table-size invariant check in radeon_gart_table_{vram,ram}_alloc — power-of-two validator currently forces the wrapped size to 0 (fail-closed)
sys/dev/drm/radeon/radeon_gart.c:68 · pass 2 · new
 none untested not_testable untriaged — —
DF-5098 Info 1.9 oce_page_list() hardcodes the segment bound (8) regardless of the destination pages[] array size — latent out-of-bounds write into RQ/CQ mailbox commands
sys/dev/netif/oce/oce_util.c:258 · pass 2 · new
 latent intra-object OOB write into fw command struct untested not_testable untriaged — —
DF-5114 Info 1.9 dragon_saver(): set_video_mode() return value ignored — on failure vid would alias the wrong (32KB text) video window and 64000-byte writes would overrun it
sys/dev/misc/syscons/dragon/dragon_saver.c:192 · pass 2 · new
 latent out-of-window video MMIO writes (not kernel RAM) untested not_testable untriaged — —
DF-5281 Info 1.9 Vendor-database parsing: ksscanf("%80[^\n]") writes up to 81 bytes into kmalloc(80); pci_load_vendor_data() writes one byte past the preloaded blob
sys/bus/pci/pci.c:3243 · pass 2 · new
 VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281) untested not_testable untriaged — —
DF-5652 Info 1.9 elcr_read_trigger/elcr_write_trigger: irq bounds enforced only by an INVARIANTS-only KASSERT with no signed lower bound — negative irq executes a C-undefined shift that aliases a real ISA bit and programs the live ELCR port; irq>=16 silently corrupts the shadow on production kernels
sys/platform/pc64/icu/elcr.c:57 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5665 Info 1.9 FRAMEUP stack-walk heuristic accepts non-monotonic, non-aligned, non-contained frame pointers — a stale kernel %rbp can fault the chain walk (panic-only ceiling; hardening)
sys/cpu/x86_64/misc/ktr.c:67 · pass 2 · new
 none untested not_testable untriaged — —
DF-5319 Info 1.8 usbd_req_get_ss_hub_descriptor() length formula overflows struct usb_hub_ss_descriptor by one byte for nports >= 249 — latent kernel stack OOB write with device-controlled byte
sys/bus/u4b/usb_request.c:1503 · pass 2 · new
 1-byte device-controlled write past 42-byte stack struct if a caller forwards unclamped bNbrPorts untested not_testable untriaged — —
DF-3008 Low 1.1 devfs_find_device_by_devid/name return an unreferenced cdev: kern.devname sysctl (CTLFLAG_ANYBODY) reads si_name after devfs_lock is released — microscopic UAF-read race
sys/vfs/devfs/devfs_core.c:910 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4684 Low 1.1 amdgpu_fence_wait_empty: dead dma_fence_get_rcu bail — racing reader resurrects and keeps using an already-released fence (double-free tail empirically blocked by the port's refcount_inc saturation)
sys/dev/drm/amd/amdgpu/amdgpu_fence.c:295 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2893 Info 1.1 sockbuf drop/flush family ignores M_SOLOCKED — latent use-after-free window against sorecvtcp's token-released uiomove loop
sys/kern/uipc_sockbuf.c:473 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2954 Info 1.1 vfs_unmount tears down quota accounting (VFS_ACDONE) before the filesystem unmount commits — failed unmounts leave a live mount with accounting already 'done'
sys/kern/vfs_vfsops.c:131 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2982 Info 1.1 Stale comments describe retired page-swapblk design, misdocumenting the OBJT_DEFAULT no-swap-metadata invariant that three files silently depend on
sys/vm/default_pager.c:33 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3472 Info 1.1 raw_attach failure contract violated by callers: rts_attach frees the rawcb while so->so_pcb still points at it and the pcb socket reference is never dropped (latent — soreserve cannot fail in current DF)
sys/net/raw_cb.c:81 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3602 Info 1.1 Off-by-one OOB write in hdaa_pcmchannel_setup: ch->io[ret] = -1 with ret==16 writes one nid_t past nid_t io[16]
sys/dev/sound/pci/hda/hdaa.c:5317 · pass 2 · new
 intra-object clobber only untested — untriaged — —
DF-4810 Info 1.1 AHCI command-table stride ATA_AHCI_CT_SIZE=256 != sizeof(struct ata_ahci_cmd_tab)=1152: latent work-area OOB the moment per-tag (NCQ) dispatch is enabled
sys/dev/disk/nata/chipsets/ata-ahci.c:254 · pass 2 · new
 none untested not_testable untriaged — —
DF-4838 Info 1.1 amdgpu userptr MMU-notifier invalidation is entirely absent on DragonFly — inert shim, compiled-out amdgpu_mn.c, stubbed userptr ioctl; latent missed-invalidation GPU DMA + stripped-kref p->mn UAF if ever enabled
sys/dev/drm/amd/amdgpu/amdgpu_mn.c:72 · pass 2 · new
 none untested not_testable untriaged — —
DF-5060 Info 1.1 feed_format_init does not bound the channel count: AFMT's 5-bit channel field (up to 31) flows unvalidated into ialign/oalign sizing against a reservoir and FXDIV table dimensioned for SND_CHN_MAX — latent reservoir heap overflow and snd_fxdiv_table OOB index if a >SND_CHN_MAX-channel format ever becomes constructible
sys/dev/sound/pcm/feeder_format.c:48 · pass 2 · new
 none (latent invariant gap) untested not_testable untriaged — —
DF-5144 Info 1.1 Latent unchecked res_pool deref + lockless dc->current_state walk in dead public API dc_plane_get_status()
sys/dev/drm/amd/display/dc/core/dc_surface.c:115 · pass 2 · new
 none untested not_testable untriaged — —
DF-5159 Info 1.1 WARN-only range guards: silent 64-bit wrap in bw_int_to_fixed_nonconst / bw_frc_to_fixed / bw_mul in release builds
sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:49 · pass 2 · new
 none untested not_testable untriaged — —
DF-5178 Info 1.1 hw_hpd set_config consumes the gpio_config_data tagged union's hpd member without validating config_data->type
sys/dev/drm/amd/display/dc/gpio/hw_hpd.c:107 · pass 2 · new
 latent tagged-union confusion -> masked MMIO mis-programming untested not_testable untriaged — —
DF-5225 Info 1.1 amdgpu_vf_error: signed int ring counters used as modulo array indices — 2^31 wrap is signed-overflow UB and produces negative array-index writes (contained inside amdgpu_vf_error_buffer)
sys/dev/drm/amd/amdgpu/amdgpu_vf_error.c:42 · pass 2 · new
 latent signed-overflow UB, in-struct self-corruption ceiling untested not_testable untriaged — —
DF-5709 Info 1.1 HEX_NCPYLEN(s) does not parenthesize its argument — compound expressions mis-size caller buffers 3x undersize, latent linear overflow inside hexncpy
sys/libkern/hexncpy.c:56 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3441 Low 0.8 div_bind() writes sin_addr = INADDR_ANY at offset 4..8 of the user bind sockaddr before any length validation (OOB write lands in own-chunk slab slack)
sys/netinet/ip_divert.c:472 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2737 Info 0.8 Dead code: oid_running is never incremented, so the dynamic-oid teardown drain and CTLFLAG_DYING machinery in sysctl_remove_oid_locked are inoperative
sys/kern/kern_sysctl.c:384 · pass 2 · new
 none untested not_testable untriaged — —
DF-3417 Info 0.8 in6_ifdetach purges UDP moptions from udbinfo[0] only while the IPv4 twin loops all CPUs — latent purge gap that is complete today only by accident of udp6_attach()
sys/netinet6/in6_ifattach.c:818 · pass 2 · new
 none not_reproduced — untriaged — —
DF-4464 Info 0.8 uguru_attach sensor-table loop writes sc_sensors[i] with no bound against UGURU_MAX_SENSORS — one table entry away from a kernel softc overflow
sys/dev/powermng/uguru/uguru.c:867 · pass 2 · new
 Latent softc overflow if a future board table exceeds 27 entries (max today 26) untested not_testable untriaged — —
DF-5329 Info 0.8 cam_periph_invalidate()'s underflow guard is dead code: `u_int32_t refcount < 0` never fires, so periph refcount underflows (DF-5273/DF-5327 classes) are silent
sys/bus/cam/cam_periph.c:576 · pass 2 · new
 silent integrity failure: the CAM core's only periph-refcount underflow detector (cam_periph.c:576) provably never fires because refcount is u_int32_t and is compared < 0; underflowed periphs (DF-5273/DF-5327 classes) become silent zombies with no diagnostic reproduced not_testable untriaged — —
DF-5379 Info 0.8 sub_info->uvc_info stores a dangling pointer to the initializer's dead stack frame (persisted in the heap control graph)
sys/bus/u4b/uvc/uvc_ctrls.c:776 · pass 2 · new
 latent stale-stack back-pointer in the heap control graph untested not_testable untriaged — —
DF-5010 Info 0.7 vkd_doio performs COW-mode bcopy and backing-file pread/pwrite with no driver-level bounds check on bio_offset/b_bcount (latent arbitrary-offset OOB R/W in the vkernel host process; shielded today only by dscheck)
sys/dev/virtual/vkernel/disk/vdisk.c:311 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-4050 Info 0.6 adjust_display_pll_v2 never executes the AdjustDisplayPll BIOS command (missing EXEC block; always returns BP_RESULT_FAILURE)
sys/dev/drm/amd/display/dc/bios/command_table.c:1457 · pass 2 · new
 none untested not_testable untriaged — —
DF-2690 Info 0.5 m_extadd() lacks the M_EXT precondition guard m_mclget() has — calling it on a cluster mbuf yields m_sharecount()/m_free() type confusion and a wrong-cache objcache_put
sys/kern/uipc_mbuf.c:1477 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2790 Info 0.5 blist API performs no domain validation: count==0 triggers shift-by-64 UB that can clear a whole leaf or poison a live node as a terminator (bm_bighint = -1); blist_create lacks a BLIST_MAXBLKS guard (int64 radix wrap → infinite loop)
sys/kern/subr_blist.c:188 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-2817 Info 0.5 lwkt_token_swap() lower-bound-only KKASSERTs: <2-token invocation corrupts memory before td_toks_array in non-INVARIANTS kernels
sys/kern/lwkt_token.c:952 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2919 Info 0.5 vfs_register() walks sysctl__vfs_children without SYSCTL_XLOCK while unlinking/relinking the iterated oid mid-loop
sys/kern/vfs_init.c:338 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2987 Info 0.5 refcount_release/_n have no underflow floor or INVARIANTS assert — double-release silently wraps the count to 0xFFFFFFFF and hides DF-2941-class double-put/double-free bugs at runtime
sys/kern/kern_refcount.c:54 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3089 Info 0.5 nfs_getauth()/nfs_savenickauth() take NFSKERBKEY_T (u_char[2]) as a parameter but bcopy sizeof(NFSKERBKEY_T) == 8 bytes into/out of 2-byte struct members — padding-absorbed today, latent overflow on any layout change
sys/vfs/nfs/nfs_syscalls.c:1075 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3123 Info 0.5 Latent memory-safety landmines in the #if 0-disabled htree write path: heap memcpy overflow in the index-node split, four double-brelse-after-bwrite error paths, u16 reclen truncation at 64K blocks
sys/vfs/ext2fs/ext2_htree.c:457 · pass 2 · new
 none untested not_testable untriaged — —
DF-3210 Info 0.5 krpc_call() early-error exits (socreate/sosetopt/sobind) leak the caller's request mbuf chain — md_mount/md_lookup_swap's 'message already freed' ownership contract is false
sys/vfs/nfs/nfs_mountrpc.c:146 · pass 2 · new
 none untested not_testable untriaged — —
DF-3306 Info 0.5 expire_upcalls() frees bw meters without unschedule_bw_meter() — latent UAF (FreeBSD divergence; unreachable today)
sys/net/ip_mroute/ip_mroute.c:1423 · pass 2 · new
 none untested fixed untriaged — —
DF-3899 Info 0.5 Off-by-one bounds guard in intel_get_shared_dpll_id(): one-past-end pointer passes the WARN_ON and yields id == num_shared_dpll (== 7 == I915_NUM_PLLS on ICL)
sys/dev/drm/i915/intel_dpll_mgr.c:103 · pass 2 · new
 none untested not_testable untriaged — —
DF-4131 Info 0.5 Latent stack OOB in oce_mbox_eqd_modify_periodic: protocol array delay[8] filled from set_eqd[OCE_MAX_EQ=32] with num<=neqs
sys/dev/netif/oce/oce_mbox.c:1795 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4282 Info 0.5 drm addmap/rmmap validation gaps: unbounded _DRM_SCATTER_GATHER offset, x86_64 offset-wrap check compiled out, RM_MAP lacks ownership check (tokens enumerable via unauthenticated GET_MAP)
sys/dev/drm/drm_bufs.c:311 · pass 2 · new
 Currently theoretical (root-gated creation + the mmap units mismatch). untested not_testable untriaged — —
DF-4463 Info 0.5 amdtemp_detach frees dev.cpu.N.temperature oids but leaves dangling entries in the cpu devices' sysctl contexts — latent UAF if a cpu device is ever destroyed
sys/dev/powermng/amdtemp/amdtemp.c:674 · pass 2 · new
 Latent UAF/double-free if a cpu device is ever hot-destroyed (none today - pc64 cpu driver has no detach) untested not_testable untriaged — —
DF-4536 Info 0.5 lptopen() sc_state check-then-set TOCTOU: double open double-allocates and the paired closes double-free the same M_LPT chunks (latent — currently blocked by the mplock)
sys/dev/misc/lpt/lpt.c:458 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4565 Info 0.5 Unbounded flicker-filter table index: a non-matching flicker_removal exits the SLOPE_limit walk at i==5 and reads SLOPE_value[5]/YCOEF_value[5]/YCOEF_EN_value[5] one element past the [5]-element arrays (latent; unreachable with current constants)
sys/dev/drm/radeon/radeon_legacy_tv.c:647 · pass 2 · new
 none untested not_testable untriaged — —
DF-4578 Info 0.5 amdgpu_amdkfd_gfx_v8: entire gfx8 KFD backend is dead code on DragonFly; latent unvalidated vmid/engine index arithmetic and a structurally broken fw-NULL guard must be fixed before KFD is ever enabled (gfx8 sibling of DF-4499)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:245 · pass 2 · new
 none untested not_testable untriaged — —
DF-4638 Info 0.5 ig_hal: e1000_read_posted_mbx/e1000_write_posted_mbx dispatch to ops.read/ops.write with unvalidated size, bypassing the read-clamp/write-reject discipline enforced only by the non-posted wrappers — latent kernel-buffer overflow footgun on the live igb VF path
sys/dev/netif/ig_hal/e1000_mbx.c:246 · pass 2 · new
 none demonstrated (latent API hazard): any future caller of e1000_read_posted_mbx/e1000_write_posted_mbx with size > mbx->size(16) gets an unconditional ops.read/ops.write word loop (e1000_mbx.c:476-477/:512-513/:697-698/:736-737) past its buffer — kernel overflow with PF-controlled mailbox content plus OOB E1000_VMBMEM register-array writes; all in-tree callers (e1000_vf.c) pass sizes 1/2/3/16 with correctly sized buffers untested not_testable untriaged — —
DF-4746 Info 0.5 am79900_start_locked feeds unbounded mbuf chains into lance_put, which memcpy's them into a fixed LEBLEN(1522)-byte TX buffer slot with no length clamp
sys/dev/netif/lnc/am79900.c:560 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4811 Info 0.5 aps(4): every EC transaction reads and writes I/O port 0x161F, one byte past the driver's allocated 0x1f-byte I/O resource window
sys/dev/powermng/aps/aps.c:102 · pass 2 · new
 none untested not_testable untriaged — —
DF-4912 Info 0.5 Dead stats module carries a latent length==0 off-by-one OOB write in mod_stats_update_event (unsigned wrap → event_string[-1]); module not compiled by any Makefile — delete it or guard
sys/dev/drm/amd/display/modules/stats/stats.c:316 · pass 2 · new
 none untested not_testable untriaged — —
DF-4921 Info 0.5 Parent-NIC softc type confusion gated only by 4-char driver-name prefix (strncmp "stge")
sys/dev/netif/mii_layer/ip1000phy.c:435 · pass 2 · new
 none untested not_testable untriaged — —
DF-4944 Info 0.5 id_to_offset GPIO_ID_GPIO_PAD branch compares the derived mask against the pin-index bound GPIO_GPIO_PAD_MAX: valid pads 5..30 wrongly rejected; en≥32 hits the C11 6.5.7 UB shift and is accepted with a bogus mask
sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:378 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4984 Info 0.5 dm_target_snapshot.c is unbuildable, unregistered dead scratch code (dmirror DF-4973 class) whose latent memory-safety bugs — cross-allocator free, double-unbusy refcount underflow, NULL-deref panics — must never be revived; delete it
sys/dev/disk/dm/snapshot/dm_target_snapshot.c:113 · pass 2 · new
 none untested not_testable untriaged — —
DF-5056 Info 0.5 smu10_smu_init error paths leave hwmgr->smu_backend dangling after kfree(priv)
sys/dev/drm/amd/powerplay/smumgr/smu10_smumgr.c:232 · pass 2 · new
 latent UAF hardening, not reachable in this tree untested not_testable untriaged — —
DF-5069 Info 0.5 psm_fini_power_state_table() leaves hwmgr->boot_ps and hwmgr->uvd_ps dangling into the freed hwmgr->ps allocation (incomplete cleanup; no in-tree reader today)
sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:102 · pass 2 · new
 none untested not_testable untriaged — —
DF-5101 Info 0.5 Non-atomic, lock-inconsistent dev->irq_enabled test-and-clear in drm_irq_uninstall() admits double driver->irq_uninstall()+free_irq(), amplified into a double-free/UAF by the unlocked free_irq() lookup in linux_irq.c
sys/dev/drm/drm_irq.c:182 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5118 Info 0.5 dcons_crom_detach half-clears the global dcons state: dcons_conf->dma_map is left dangling over the map freed two lines below and the module-static dcons_paddr is never reset — a re-attached dcons_crom takes dmamap_cb's 'already set' early-return and can never re-wire dcons_conf, silently disabling DMA sync; memory safety rests solely on the incidental dma_tag!=NULL guards in dcons_os.c
sys/dev/misc/dcons/dcons_crom.c:199 · pass 2 · new
 none untested not_testable untriaged — —
DF-5142 Info 0.5 rdrand_rng() asm loop body executes unconditionally: called with limit < 8 it writes a full 8-byte RDRAND word past a sub-word buffer
sys/dev/crypto/rdrand/rdrand.c:85 · pass 2 · new
 latent 8B OOB write on sub-word call / GPU DMA to aliased physical pages untested not_testable untriaged — —
DF-5156 Info 0.5 orm_identify() scan loop lacks a MAX_ROMS bound — latent OOB write past the 196-byte orm_softc (rid[]/res[]), currently unreachable because the ISA bus caps SYS_RES_MEMORY rids at ISA_NMEM=8
sys/dev/misc/orm/orm.c:104 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5185 Info 0.5 intel_guc_ads_create() indexes GUC_MAX_ENGINES_NUM-sized ADS arrays with sparse engine->guc_id (hw_id) values — out-of-bounds array writes on ICL (VCS3_HW=6) that stay contained inside the packed blob but corrupt GuC-visible ADS fields
sys/dev/drm/i915/intel_guc_ads.c:109 · pass 2 · new
 corrupted GuC-visible ADS data (in-blob contained) untested not_testable untriaged — —
DF-5317 Info 0.5 USB_FS_STOP bounds-checks u.pstop->ep_index but indexes the array with u.pstart->ep_index — latent union type-confusion, benign only because the two ioctl structs are layout-identical
sys/bus/u4b/usb_generic.c:1435 · pass 2 · new
 latent unchecked index (DF-5317) / unpriv log flooding (DF-5318) untested not_testable untriaged — —
DF-5499 Info 0.5 passioctl() runs CAMIOCOMMAND/CAMGETPASSTHRU with no periph reference across unkillable blocking sleeps (DF-5273/5327 hold/release class) — latent premature-free/UAF, currently blocked by devfs close semantics
sys/bus/cam/scsi/scsi_pass.c:451 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5585 Info 0.5 Quirk-apply fast path trusts stale pf / absent pf_last state: latent write-after-free and NULL-page write (unreachable with the shipped quirk table)
sys/bus/pccard/pccard_cis_quirks.c:248 · pass 2 · new
 none untested not_testable untriaged — —
DF-5625 Info 0.5 ppb_ecp_sync()/ppb_reset_epp_timeout() return indeterminate register garbage: interface declares int methods, the only implementations are void (C UB through the DEVMETHOD dispatch)
sys/bus/ppbus/ppb_base.c:159 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5641 Info 0.5 isa_alloc_resource/isa_release_resource cast grandchild ivars via DEVTOISA unconditionally — type-confused (often NULL) resource-list pointer passed through, safe today only because resource_list_alloc/release early-forward on passthrough
sys/bus/isa/x86_64/isa.c:85 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2864 Info 0.3 Per-candidate struct mount + syncer-thread leak and permanent vfc_refcount leak on failed root-mount attempts (mp overwritten next iteration; error path never drops mp->mnt_vfc->vfc_refcount)
sys/kern/vfs_conf.c:435 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5328 Medium — cam_periph_alloc() TOCTOU on the borrowed cam_periph_find() pointer: camperiphfree() can free the periph between find() and the unlocked NEW_DEV_FOUND/deferred_callback stores (UAF write), and camperiphfree() can see the flag set before deferred_callback is published (NULL/garbage indirect call)
sys/bus/cam/cam_periph.c:176 · pass 2 · new
 none observed; code-level race: camperiphfree() can free the periph inside cam_periph_alloc()'s find()->flag-store window (UAF write into freed 144B M_CAMPERIPH chunk) and camperiphfree() can observe CAM_PERIPH_NEW_DEV_FOUND with an unpublished NULL deferred_callback -> indirect call through NULL/garbage not_reproduced not_testable untriaged — —
DF-3060 Low — dm_fdlist is walked and mutated without any common lock — nresolve's TAILQ scan races dirfs_node_setpassive's INSERT/REMOVE on SMP vkernels (UAF / list corruption)
sys/vfs/dirfs/dirfs_vnops.c:171 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-0569 High 9.8 Heap OOB write via byte-swapped alias_port used as array index: every NAT deployment corrupts heap ~1.6% of connections
sys/net/ipfw3_nat/ip_fw3_nat.c:436
 panic reproduced fixed untriaged — —
DF-2597 High 9.8 TCP-MD5 signature option writes past 40-byte opt[] stack buffer with no bounds check
sys/netinet/tcp_output.c:186
 none not_reproduced not_testable untriaged — —
DF-0393 Critical 9.6 Remote heap buffer overflow via oversized Mesh ID IE in sta_add: memcpy 2+meshid[1] into se_meshid[34] with no bounds check
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:310
 panic reproduced fixed untriaged — —
DF-0285 High 9.6 Remote heap overflow via unchecked MESHID IE length in ieee80211_parse_meshid
sys/netproto/802_11/wlan/ieee80211_mesh.c:3456
 Real CWE-787 heap OOB write in ieee80211_parse_meshid (up to 223 bytes) reaching ni_mltimer.toc / ni_mlhtimer.toc pointers => indirect function-pointer-control RCE surface on wifi-equipped MBSS hosts; NOT runtime-triggerable on this KVM guest (no wifi hardware). inconclusive — untriaged — —
DF-0326 High 9.6 Remote heap overflow: unbounded SSID IE length copied into fixed 32-byte ni_essid
sys/netproto/802_11/wlan/ieee80211_node.c:815
 remote-unauth heap overflow corrupting ni_chan kernel pointer (panic/DoS minimum, code-exec plausible) on any host with a wlan radio inconclusive — untriaged — —
DF-0631 High 9.0 Use-after-free on ipfw3_state->stub after the owning rule is deleted
sys/net/ipfw3_basic/ip_fw3_state.c:210
 dos reproduced fixed untriaged — —
DF-1215 Critical 8.8 METEORSVIDEO ioctl allows unprivileged user to set arbitrary physical DMA target address
sys/dev/video/bktr/bktr_core.c:1396
 none inconclusive fixed untriaged — —
1083 High 8.8 Off-by-one in CROM_MAX_DEPTH check in crom_next() allows stack OOB write of 12 bytes
sys/bus/firewire/fwcrom.c:115
 panic reproduced fixed untriaged — —
DF-0616 High 8.8 Heap buffer overflow in generic_netmap_rxsync: unbounded m_copydata into fixed-size netmap buffer
sys/net/netmap/netmap_generic.c:669
 heap-oob-write reproduced fixed untriaged — —
DF-0753 High 8.8 Stale mbuf pointer after mpls_output may reallocate — use-after-free/double-free when route has PUSH op
sys/netproto/mpls/mpls_input.c:208
 panic reproduced fixed untriaged — —
DF-0981 High 8.8 Heap buffer overflow in run_bulk_rx_callback aggregated-frame path (m_getcl cluster too small for device-controlled dmalen)
sys/bus/u4b/wlan/if_run.c:2989
 heap-oob-write (hardware-gated on this guest; up to ~2035B on a run(4)-equipped host) reproduced fixed untriaged — —
DF-0987 High 8.8 cdcheckmedia unbounded TOC entry count overflows softc->toc.entries[100] -> heap corruption
sys/bus/cam/scsi/scsi_cd.c:2947
 panic reproduced fixed untriaged — —
DF-1020 High 8.8 OOB heap write in fw_bus_explore_callback via wire-controlled ongoaddr jump -> arbitrary 4-byte kernel heap write
sys/bus/firewire/firewire.c:1500
 none inconclusive not_testable untriaged — —
DF-1216 High 8.8 METEORSETGEO + METEORSACTPIXFMT pixel-format mismatch yields OOB DMA write and OOB uiomove heap info-leak
sys/dev/video/bktr/bktr_core.c:1084
 leak:4177936 reproduced not_testable untriaged — —
DF-1410 High 8.8 Unauthenticated remote heap overflow in xe RX: missing upper-bound check on frame length before copying into 2KB mbuf cluster
sys/dev/netif/xe/if_xe.c:752
 leak:heap reproduced not_testable untriaged — —
DF-0269 Medium 8.8 Stack buffer overflow in sppp_print_bytes: VLA sized len but hexncpy writes 3*len bytes
sys/net/sppp/if_spppsubr.c:5290
 panic not_reproduced not_testable untriaged — —
DF-0289 Medium 8.8 UAF/TOCTOU: mesh route pointers returned unreferenced, forward_to_gates drops lock mid-traversal
sys/netproto/802_11/wlan/ieee80211_mesh.c:230
 dos inconclusive not_testable untriaged — —
DF-2012 Medium 8.8 Integer overflow in GART table_size yields undersized VRAM table and OOB write via amdgpu_gart_bind/unbind
sys/dev/drm/amd/amdgpu/amdgpu_gart.c:362
 panic reproduced fixed untriaged — —
DF-0053 High 8.4 Heap buffer overflow in sysctl_jail_list (kern.jail.list) via unsigned underflow in size arithmetic
sys/kern/kern_jail.c:671
 panic reproduced fixed untriaged — —
DF-1264 High 8.4 drm_dp_sideband_msg_build OOB write past chunk[48] via unchecked msg_len from malicious MST hub
sys/dev/drm/drm_dp_mst_topology.c:349
 none inconclusive not_testable untriaged — —
DF-1314 High 8.4 Off-by-one in btc_copy_vbios_mc_reg_table + post-write bound check in btc_set_mc_special_registers allows VBIOS OOB write
sys/dev/drm/radeon/btc_dpm.c:1992
 none inconclusive not_testable untriaged — —
DF-1319 High 8.4 Unvalidated DisplayPort lane_count from malicious sink causes stack buffer overflow in link-training helpers
sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1784
 none inconclusive not_testable untriaged — —
DF-1437 High 8.4 Heap OOB write in sumo_construct_vid_mapping_table via unchecked VBIOS usVoltageIndex
sys/dev/drm/radeon/sumo_dpm.c:1624
 panic reproduced fixed untriaged — —
DF-1483 High 8.4 Integer overflow in user-fence offset check allows OOB GPU memory write
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:59
 panic reproduced fixed untriaged — —
DF-1837 High 8.4 Heap buffer overflow in dm_helpers_read_local_edid via uncapped EDID extension count
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:583
 panic reproduced fixed untriaged — —
DF-2349 High 8.4 uint8_t loop index in uvc_ctrl_init_dev wraps causing infinite loop and heap OOB write on malicious UVC descriptor
sys/bus/u4b/uvc/uvc_ctrls.c:925
 none not_reproduced not_testable untriaged — —
DF-2354 High 8.4 txd_fw buffer overflow on firmware load: 6 KB heap overflow + kernel-memory leak to USB device on every attach
sys/bus/u4b/wlan/if_mtw.c:128
 none not_reproduced not_testable untriaged — —
DF-1526 Medium 8.3 Missing RX length bounds check + RX buffer-length misprogramming allows heap OOB read (info leak) and DMA heap overflow write
sys/dev/netif/sf/if_sf.c:883
 none inconclusive — untriaged — —
DF-0291 High 8.2 Heap buffer overflow in setmlme_assoc_adhoc: unbounded im_ssid_len into 32-byte buffers
sys/netproto/802_11/wlan/ieee80211_ioctl.c:1568
 none observed; real shipped heap+stack overflow (CWE-787) unreachable on this guest (no wlan vap possible without a wifi radio) inconclusive — untriaged — —
DF-0362 High 8.2 pfr_fix_anchor unbounded slash-count loop causes size_t wraparound in bcopy/memset: kernel panic via DIOCRGETTABLES
sys/net/pf/pf_table.c:1740
 panic reproduced fixed untriaged — —
DF-0401 High 8.2 Heap buffer overflow via unchecked slot->len in VALE bridge forwarding: pkt_copy up to 65536 bytes into 2048-byte buffer
sys/net/netmap/netmap_vale.c:988
 none not_reproduced not_testable untriaged — —
DF-0449 High 8.2 Heap buffer overflow in ng_string_parse: missing *buflen bounds check before bcopy of user-supplied string
sys/netgraph/netgraph/ng_parse.c:704
 panic reproduced fixed untriaged — —
DF-1356 High 8.2 Heap overflow in AMR_CMD_PASS ioctl via unchecked cdb length
sys/dev/raid/amr/amr.c:825
 panic reproduced not_testable untriaged — —
DF-1499 High 8.2 Heap buffer overflow in NGM_TEXT_STATUS via status_chans + status_8370
sys/dev/misc/musycc/musycc.c:443
 leak:heap reproduced not_testable untriaged — —
DF-2425 Low 8.2 CDB heap overflow via unchecked cdb_len into 12-byte CmdBlock
sys/dev/disk/amd/amd.c:399
 panic reproduced fixed untriaged — —
1085 High 8.1 crom_parse_text() write-underflow when text leaf crc_len < 2 corrupts memory before the caller buffer
sys/bus/firewire/fwcrom.c:215
 panic reproduced fixed untriaged — —
DF-0492 High 8.1 Lockless race on L2TP seq/window state: concurrent timer + remote packet processing -> UAF on xwin[] mbufs and node private data
sys/netgraph/l2tp/ng_l2tp.c:1126
 panic reproduced not_testable untriaged — —
DF-0640 High 8.1 ieee80211_crypto_decap minimum-length check ignores hdrlen, causing OOB-read panic or mbuf double-free on crafted encrypted frames
sys/netproto/802_11/wlan/ieee80211_crypto.c:587
 none inconclusive not_testable untriaged — —
DF-0733 High 8.1 acl_check walks ACL hash without lock — UAF race vs concurrent acl_remove/acl_free_all from receive path (unauth remote)
sys/netproto/802_11/wlan_acl/ieee80211_acl.c:161
 dos reproduced fixed untriaged — —
DF-0767 High 8.1 nfs_lookitup returns uninitialized nfsnode pointer when server echoes parent filehandle — wild-pointer deref in create/mkdir/mknod/symlink
sys/vfs/nfs/nfs_vnops.c:3061
 panic reproduced fixed untriaged — —
DF-0117 High 8.0 UAF on kdmsg state in diskiodone: state refcount not held across async I/O
sys/kern/subr_diskiocom.c:372
 panic reproduced fixed untriaged — —
DF-1213 High 8.0 Unchecked device-supplied rxcd->rxd_idx yields OOB array access, OOB write, arbitrary-pointer write, and infinite loop in RX completion path
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2056
 none not_reproduced not_testable untriaged — —
DF-2575 High 8.0 ip_fw3_dummynet_io caches rule pointer in dn_pkt->dn_priv with no refcount rule deletion during pipe transit causes UAF read+write on reinject
sys/net/ipfw3/ip_fw3.c:630
 panic reproduced fixed untriaged — —
DF-0320 Medium 8.0 Reorder buffer rxa_m[] mutated without dedicated lock: RX races timer flush and ADDBA re-init (double-free/UAF)
sys/netproto/802_11/wlan/ieee80211_ht.c:780
 none inconclusive not_testable untriaged — —
DF-0783 Critical 7.8 ext2_rename writes 24 attacker-controlled bytes onto kernel stack via (caddr_t)&dirbuf — stack overflow corrupted ptr deref arbitrary free + info leak (CRITICAL)
sys/vfs/ext2fs/ext2_vnops.c:693
 panic reproduced fixed untriaged — —
DF-1171 Critical 7.8 Intel MatrixRAID parser: OOB heap write on ar_softc via unclamped map->total_disks
sys/dev/disk/nata/ata-raid.c:2165
 corruption reproduced not_testable untriaged — —
DF-1326 Critical 7.8 Stack buffer overflow in mpr_user_pass_thru: copyin of user-controlled RequestSize into 12-byte MPI2_REQUEST_HEADER before bounds check
sys/dev/raid/mpr/mpr_user.c:742
 uid0 → root reproduced fixed untriaged — —
DF-1359 Critical 7.8 Stack buffer overflow in mps_user_pass_thru via unbounded copyin into 12-byte tmphdr
sys/dev/raid/mps/mps_user.c:747
 uid0 → root reproduced fixed untriaged — —
DF-2132 Critical 7.8 dma_buf_get returns unrefcounted pointer; caller dma_buf_put over-drops f_count causing UAF (local unpriv->root)
sys/dev/drm/linux_dma-buf.c:174
 corruption reproduced fixed untriaged — —
DF-0509 High 7.8 Stack buffer overflow in ng_ksocket_sockaddr_unparse via negative pathlen (PF_LOCAL sun_len underflow)
sys/netgraph7/ksocket/ng_ksocket.c:323
 none not_reproduced — untriaged — —
DF-0676 High 7.8 Double-free of mbuf in XMIT_ALL error path via NG_FREE_ITEM + NG_FREE_M on a peeked (non-detached) mbuf
sys/netgraph7/one2many/ng_one2many.c:425
 corruption reproduced fixed untriaged — —
DF-0754 High 7.8 mpls_output() takes mbuf by-value but helpers silently reallocate head — root cause of DF-0753, also manifests in mpls_output_process double-free/leak + ip_output stale-m
sys/netproto/mpls/mpls_output.c:50
 panic reproduced fixed untriaged — —
DF-0776 High 7.8 Missing production bounds validation on B-tree node count/type — crafted image heap OOB read/write via bcopy element shift
sys/vfs/hammer/hammer_btree.c:818
 panic reproduced fixed untriaged — —
DF-0780 High 7.8 Heap buffer overflow in fuse_io_execute READ from oversized daemon reply — memcpy daemon-chosen size into fixed buffer
sys/vfs/fuse/fuse_vnops.c:2048
 panic reproduced fixed untriaged — —
DF-0803 High 7.8 Integer truncation in e2fs_gcount computation bypasses overflow check — heap OOB from crafted ext2 64bit image
sys/vfs/ext2fs/ext2_vfsops.c:620
 panic reproduced fixed untriaged — —
DF-0859 High 7.8 Unbounded ab_busycnt in hpfs_splitalsec/hpfs_concatalsec/hpfs_alblk2alsec bcopy overflows alsec heap buffer
sys/vfs/hpfs/hpfs_alsubr.c:225
 corruption reproduced fixed untriaged — —
DF-0861 High 7.8 hpfs_cpinit unbounded code-page inner loop writes attacker data past hpm_cpdblk allocation (heap overflow)
sys/vfs/hpfs/hpfs_subr.c:274
 panic reproduced fixed untriaged — —
DF-0887 High 7.8 Heap overflow in ffs_truncate symlink fast-path via unbounded bzero of attacker-controlled di_size
sys/vfs/ufs/ffs_inode.c:159
 panic reproduced fixed untriaged — —
DF-0894 High 7.8 Crafted fs_nindir in superblock causes OOB read/write of indirect-block buffers in ffs_balloc
sys/vfs/ufs/ffs_balloc.c:291
 panic reproduced fixed untriaged — —
DF-0903 High 7.8 Heap OOB write in ffs_write via crafted fs_qbmask (missing xfersize bounds check present in ffs_read)
sys/vfs/ufs/ufs_readwrite.c:292
 panic reproduced fixed untriaged — —
DF-0915 High 7.8 fuse_device_write trusts daemon ohd->len over actual write size yielding heap OOB read and overflow write
sys/vfs/fuse/fuse_device.c:182
 panic reproduced fixed untriaged — —
DF-0994 High 7.8 sastart ERR_PENDING drain uses stale bio pointer after goto again -> double biodone, queue corruption, bio UAF
sys/bus/cam/scsi/scsi_sa.c:1601
 panic reproduced fixed untriaged — —
DF-1057 High 7.8 FW_ASYREQ bcopy writes payload into &xfer->send.payload (field address) instead of xfer->send.payload (buffer) — kernel heap overflow + arbitrary kfree
sys/bus/firewire/fwdev.c:558
 none inconclusive not_testable untriaged — —
DF-1058 High 7.8 fw_write trusts user-supplied stream packet header len field for the second uiomove, overflowing the per-packet DMA buffer slot
sys/bus/firewire/fwdev.c:388
 none inconclusive not_testable untriaged — —
DF-1065 High 7.8 Use-after-free: bq->mem kfree()d while userspace mmap mappings keep wired fictitious pages pointing at freed memory
sys/bus/u4b/uvc/uvc_buf.c:517
 none not_reproduced not_testable untriaged — —
DF-1076 High 7.8 Slave-controlled block-read count overflows fixed 32-byte sc->block_data buffer in ISR
sys/bus/smbus/ichsmb/ichsmb.c:575
 panic reproduced not_testable untriaged — —
DF-1081 High 7.8 Stack buffer overflow in cue_setmulti: 8-byte hashtbl for 64-byte (512-bit) multicast hash table
sys/bus/u4b/net/if_cue.c:273
 none inconclusive not_testable untriaged — —
DF-1141 High 7.8 Heap OOB write in ci_setup_default_dpm_tables: VBIOS counts index fixed-size dpm_levels[8] unchecked
sys/dev/drm/amd/amdgpu/ci_dpm.c:3593
 none inconclusive not_testable untriaged — —
DF-1142 High 7.8 Heap OOB write in ci_populate_smc_uvd/vce/acp/samu_level: VBIOS counts index fixed-size SMU7 level arrays unchecked
sys/dev/drm/amd/amdgpu/ci_dpm.c:2791
 none inconclusive not_testable untriaged — —
DF-1146 High 7.8 i915_gem_fault missing offset bounds check and partial-view GMADR misaddressing allow cross-object GPU memory read/write
sys/dev/drm/i915/i915_gem.c:2229
 none inconclusive not_testable untriaged — —
DF-1149 High 7.8 Heap OOB write in SMC UVD/VCE/ACP/SAMU level population from unbounded VBIOS count
sys/dev/drm/radeon/ci_dpm.c:2689
 none inconclusive not_testable untriaged — —
DF-1150 High 7.8 Heap OOB write in ci_setup_default_dpm_tables from unbounded VBIOS dependency-table counts
sys/dev/drm/radeon/ci_dpm.c:3514
 none inconclusive not_testable untriaged — —
DF-1166 High 7.8 Heap overflow: unvalidated VBIOS dependency-table count overflows fixed dpm_levels[8] array
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:784
 none inconclusive not_testable untriaged — —
DF-1172 High 7.8 LSI v2 parser: OOB write on static ata_raid_arrays[] via unvalidated meta->raid_number
sys/dev/disk/nata/ata-raid.c:2802
 corruption reproduced not_testable untriaged — —
DF-1189 High 7.8 ciss_notify_logical: unbounded bus/target from controller notify event yields kernel OOB read/write
sys/dev/raid/ciss/ciss.c:3931
 corruption reproduced not_testable untriaged — —
DF-1190 High 7.8 ciss_init_logical: unbounded CISS_LUN_TO_BUS/TARGET at attach yields kernel OOB write of pointers and objects
sys/dev/raid/ciss/ciss.c:1386
 panic reproduced not_testable untriaged — —
DF-1191 High 7.8 ciss_cam_complete: controller-supplied sense_length overflows fixed-size csio->sense_data on CHECK_CONDITION
sys/dev/raid/ciss/ciss.c:3248
 panic reproduced not_testable untriaged — —
DF-1198 High 7.8 Heap buffer overflow via state_index/i index mismatch in radeon_atombios_parse_power_table_6
sys/dev/drm/radeon/radeon_atombios.c:2704
 panic reproduced not_testable untriaged — —
DF-1209 High 7.8 r100_packet3_load_vbpntr unsigned underflow on c==0 yields unbounded heap OOB writes via CS ioctl
sys/dev/drm/radeon/r100.c:1315
 panic reproduced fixed untriaged — —
DF-1258 High 7.8 Heap buffer overflow / OOB read in MFI_CMD and MFI_LINUX_CMD_2 ioctl SGL copyin/copyout
sys/dev/raid/mfi/mfi.c:2991
 none inconclusive not_testable untriaged — —
DF-1271 High 7.8 VBIOS-controlled mm_dep_table->count drives heap overflow in UVD/VCE/ACP SMC level population
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1320
 none inconclusive not_testable untriaged — —
DF-1272 High 7.8 VBIOS-controlled vdd_dep_on_sclk->count drives Sclk_voltageOffset[8] heap overflow in clock stretcher
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1584
 none inconclusive not_testable untriaged — —
DF-1282 High 7.8 OOB heap write via unchecked firmware-controlled DeviceIndex in _mapping_process_dpm_pg0
sys/dev/raid/mpr/mpr_mapping.c:2251
 panic reproduced not_testable untriaged — —
DF-1283 High 7.8 OOB heap write via unsigned underflow in slot arithmetic in _mapping_add_new_device/_mapping_add_new_pcie_device
sys/dev/raid/mpr/mpr_mapping.c:1637
 panic reproduced not_testable untriaged — —
DF-1284 High 7.8 Unbounded scatter-gather loop overflows pmap->psg[17], tmpSg[512] stack, and PRD heap table
sys/dev/raid/hptmv/entry.c:2800
 panic reproduced not_testable untriaged — —
DF-1311 High 7.8 Stack buffer overflow in hptiop_post_req_itl via unbounded SG list (HIGH_MEM_ACESS path)
sys/dev/raid/hptiop/hptiop.c:2417
 none inconclusive not_testable untriaged — —
DF-1337 High 7.8 Use-after-free write in chn_write (and UAF read in chn_read) via concurrent chn_resizebuf during uiomove unlock window
sys/dev/sound/pcm/channel.c:502
 none inconclusive not_testable untriaged — —
DF-1340 High 7.8 u32 integer overflow in CB/DB size validation bypasses BO bounds check (cross-process GPU memory corruption)
sys/dev/drm/radeon/r600_cs.c:430
 none inconclusive not_testable untriaged — —
DF-1342 High 7.8 r600_dma_cs_parse reads/writes IB past length_dw (heap OOB via DMA packet at IB end)
sys/dev/drm/radeon/r600_cs.c:2388
 none inconclusive not_testable untriaged — —
DF-1374 High 7.8 Unvalidated firmware DeviceIndex in _mapping_process_dpm_pg0 causes heap OOB write into mapping_table
sys/dev/raid/mps/mps_mapping.c:1495
 panic reproduced not_testable untriaged — —
DF-1375 High 7.8 Unvalidated slot arithmetic in topology-event handling causes heap OOB write (underflow + num_slots overflow)
sys/dev/raid/mps/mps_mapping.c:968
 panic reproduced not_testable untriaged — —
DF-1442 High 7.8 INQUIRY TRIM status writes past short inquiry buffer (heap overflow during DV probe)
sys/dev/disk/ahci/ahci_cam.c:1134
 panic reproduced fixed untriaged — —
DF-1470 High 7.8 VBIOS-supplied table offsets never validated against firmware image size
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:61
 panic reproduced fixed untriaged — —
DF-1534 High 7.8 Unbounded recursion in atom_op_calltable causes kernel stack overflow
sys/dev/drm/radeon/atom.c:624
 panic reproduced not_testable untriaged — —
DF-1535 High 7.8 Integer overflow in FB scratch bounds check enables heap OOB read/write
sys/dev/drm/radeon/atom.c:281
 panic reproduced not_testable untriaged — —
DF-1536 High 7.8 Unbounded PS operand index causes kernel stack OOB read/write via caller buffer
sys/dev/drm/radeon/atom.c:224
 panic reproduced not_testable untriaged — —
DF-1542 High 7.8 amdgpu atom_op_calltable unbounded recursion causes kernel stack overflow
sys/dev/drm/amd/amdgpu/atom.c:610
 panic reproduced not_testable untriaged — —
DF-1543 High 7.8 amdgpu atom FB scratch bounds check integer overflow enables heap OOB read/write
sys/dev/drm/amd/amdgpu/atom.c:270
 panic reproduced not_testable untriaged — —
DF-1544 High 7.8 amdgpu atom PS operand index unbounded -> kernel stack OOB read/write via caller buffer
sys/dev/drm/amd/amdgpu/atom.c:213
 panic reproduced not_testable untriaged — —
DF-1556 High 7.8 mps_config_get_raid_volume_pg0 missing MIN() guard on final bcopy — heap overflow from firmware-supplied PageLength
sys/dev/raid/mps/mps_config.c:1084
 panic reproduced not_testable untriaged — —
DF-1557 High 7.8 mps_wd_config_pages writes DD_column_map via firmware-supplied PhysDiskMap with no bounds check — heap OOB write past end of mps_softc
sys/dev/raid/mps/mps_config.c:460
 panic reproduced not_testable untriaged — —
DF-1574 High 7.8 Heap OOB write in get_vddc_lookup_table: buffer sized for 16 records, loop walks up to 255
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:168
 none not_reproduced not_testable untriaged — —
DF-1585 High 7.8 Use-after-free of fbc->compressed_llb on second cleanup / driver unload
sys/dev/drm/i915/intel_fbc.c:559
 panic reproduced not_testable untriaged — —
DF-1586 High 7.8 Heap buffer overflow in get_vddc_lookup_table: VBIOS ucNumEntries > caller max_levels writes ~2.5KB past slab object
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1026
 none not_reproduced not_testable untriaged — —
DF-1606 High 7.8 Kernel heap overflow via fixed-size cmi_order[128] array in /dev/hpcmi read path
sys/dev/acpica/acpi_hp/acpi_hp.c:147
 panic reproduced not_testable untriaged — —
DF-1662 High 7.8 i915: GEM context destroy ioctl double-close race -> refcount underflow -> UAF
sys/dev/drm/i915/i915_gem_context.c:278
 panic reproduced not_testable untriaged — —
DF-1664 High 7.8 twa: unbounded kvsprintf+strcpy into 98-byte parameter_data -> stack/heap overflow + format-string
sys/dev/raid/twa/tw_cl_misc.c:505
 panic reproduced not_testable untriaged — —
DF-1676 High 7.8 nvme: unvalidated device-controlled indices in nvme_poll_completions -> OOB write + RIP hijack
sys/dev/disk/nvme/nvme.c:713
 panic reproduced not_testable untriaged — —
DF-1692 High 7.8 amdgpu_debugfs: heap OOB read+write in amdgpu_debugfs_gpr_read via byte-offset/dword-index unit confusion
sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:701
 panic reproduced not_testable untriaged — —
DF-1719 High 7.8 amdgpu_gem: GEM_VA ioctl passes unchecked offset_in_bo/map_size into amdgpu_vm_bo_map enabling offset+size wrap to corrupt GPU page tables
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:644
 leak reproduced fixed untriaged — —
DF-1753 High 7.8 radeon_vce: OOB read and OOB write of IB buffer in cs_parse/cs_reloc via unchecked multi-dword command fields
sys/dev/drm/radeon/radeon_vce.c:565
 panic reproduced fixed untriaged — —
DF-1797 High 7.8 smu_helper: heap OOB write in phm_get_svi2_*_voltage_table and phm_trim_voltage_table via unchecked VBIOS count
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:244
 panic reproduced fixed untriaged — —
DF-1805 High 7.8 bktr_os: bktr_filter_detach calls knote_insert instead of knote_remove -> UAF via corrupted klist
sys/dev/video/bktr/bktr_os.c:724
 panic reproduced fixed untriaged — —
DF-1880 High 7.8 Heap OOB write in oce_hw_update_multicast: loop guard uses 64 but mac[] array has 32 slots
sys/dev/netif/oce/oce_hw.c:568
 panic reproduced fixed untriaged — —
DF-1881 High 7.8 UAF / double-free in reservation RCU readers via unsafe dma_fence_get_rcu shim and non-RCU dma_fence_free
sys/dev/drm/linux_reservation.c:357
 panic reproduced fixed untriaged — —
DF-1891 High 7.8 Unbounded ctlr->channels from AHCI CAP/PI registers: source-side of interrupt[] OOB (variant of DF-1716)
sys/dev/disk/nata/chipsets/ata-ahci.c:101
 panic reproduced not_testable untriaged — —
DF-1912 High 7.8 mdstrategy_preload uses stale buf pointer across biodone: UAF + OOB bcopy on preloaded md image
sys/dev/disk/md/md.c:349
 panic reproduced fixed untriaged — —
DF-1917 High 7.8 Unbounded sgl_off yields OOB SGE write into cmd->frame DMA allocation
sys/dev/raid/mrsas/mrsas_ioctl.c:219
 panic reproduced fixed untriaged — —
DF-1918 High 7.8 Unbounded sense_off yields OOB pointer-sized write into cmd->frame
sys/dev/raid/mrsas/mrsas_ioctl.c:266
 panic reproduced fixed untriaged — —
DF-1919 High 7.8 Integer truncation size_t->int in iov_len splits DMA alloc size from copyin size: heap overflow
sys/dev/raid/mrsas/mrsas_ioctl.c:161
 panic reproduced fixed untriaged — —
DF-2002 High 7.8 Forged EEPROM pwr_table_offset drives OOB write/read in ar9280AdjustPDADCValues (up to 64KB overflow)
sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c:188
 none inconclusive not_testable untriaged — —
DF-2028 High 7.8 Use-after-free in GDT_IOCTL_GENERAL: framework-owned ioctl buffer queued into persistent controller command list
sys/dev/raid/iir/iir_ctrl.c:245
 none inconclusive — untriaged — —
DF-2051 High 7.8 DFS_GET_THRESH writes sizeof(HAL_PHYERR_PARAM) into outdata without validating allocation or size (heap overflow / NULL-deref write)
sys/dev/netif/ath/ath_dfs/null/dfs_null.c:268
 panic reproduced fixed untriaged — —
DF-2059 High 7.8 Missing privilege check on SIOCGATHDIAG/SIOCGATHPHYERR/SIOCGATHSPECTRAL exposes raw HAL diagnostic surface to unprivileged users
sys/dev/netif/ath/ath/if_ath_ioctl.c:299
 none reproduced not_testable untriaged — —
DF-2079 High 7.8 Heap buffer overflow and NULL-deref panic in SPECTRAL_CONTROL_GET_PARAMS due to missing output-buffer validation
sys/dev/netif/ath/ath/if_ath_spectral.c:218
 none not_reproduced not_testable untriaged — —
DF-2145 High 7.8 tasklet_kill() UAF: premature return on TASKLET_STATE_RUN leaves dangling tasklet_entry; runner later calls t->func from freed memory
sys/dev/drm/linux_tasklet.c:170
 none not_reproduced not_testable untriaged — —
DF-2174 High 7.8 __hrtimer_task epilogue unconditionally clears timer->active, defeating callback re-arm via hrtimer_start + NORESTART — un-cancellable timer leading to UAF
sys/dev/drm/linux_hrtimer.c:59
 none not_reproduced not_testable untriaged — —
DF-2195 High 7.8 kthread_stop() frees the LWKT thread via a bogus timed tsleep, causing use-after-free / double-free of struct thread
sys/dev/drm/linux_kthread.c:97
 corruption reproduced fixed untriaged — —
DF-2268 High 7.8 Heap overflow in cdcheckmedia via uncapped num_entries from device-supplied TOC header
sys/bus/cam/scsi/scsi_cd.c:2947
 none not_reproduced not_testable untriaged — —
DF-2282 High 7.8 sgopen: missing cam_periph_acquire plus cam_periph_unlock-without-lock in securelevel path (lock/refcount protocol violation; refcount underflow->UAF)
sys/bus/cam/scsi/scsi_sg.c:385
 none not_reproduced not_testable untriaged — —
DF-2332 High 7.8 Stack buffer overflow in ACPI SMBus handler: buf[32] vs attacker-controlled GSBUS lengths
sys/bus/smbus/smbacpi/smbacpi.c:137
 none not_reproduced not_testable untriaged — —
DF-2339 High 7.8 Stack buffer overflow in cue_setmulti: 8-byte hashtbl indexed by 9-bit multicast hash
sys/bus/u4b/net/if_cue.c:273
 none not_reproduced not_testable untriaged — —
DF-2346 High 7.8 SIGIO recipient stored as raw unreferenced struct proc pointer -> use-after-free after fork+exit
sys/bus/u4b/usb_dev.c:1044
 none not_reproduced not_testable untriaged — —
DF-2389 High 7.8 Heap out-of-bounds write in link_add_prs when _PRS has more IRQ resources than _CRS
sys/dev/acpica/acpi_pci_link.c:311
 none not_reproduced not_testable untriaged — —
DF-2424 High 7.8 Scatter/gather list heap overflow via unchecked sglist_cnt in amdexecutesrb
sys/dev/disk/amd/amd.c:455
 none not_reproduced not_testable untriaged — —
DF-2428 High 7.8 Unbounded scatter/gather copy in btexecuteccb via CAM_SCATTER_VALID CCB (kernel heap overflow)
sys/dev/disk/buslogic/bt.c:1055
 none not_reproduced not_testable untriaged — —
DF-2446 High 7.8 dm_message_ioctl frees and dereferences an uninitialized stack msg pointer
sys/dev/disk/dm/dm_ioctl.c:1006
 panic reproduced fixed untriaged — —
DF-2488 High 7.8 Stack buffer overflow/underflow in ad_describe via unterminated model string
sys/dev/disk/nata/ata-disk.c:508
 none not_reproduced not_testable untriaged — —
DF-2493 High 7.8 Heap OOB write via untrusted disk index in ATA RAID metadata parsers
sys/dev/disk/nata/ata-raid.c:1806
 none not_reproduced not_testable untriaged — —
DF-2494 High 7.8 BSS out-of-bounds write on global ata_raid_arrays[] via untrusted LSI v2 raid_number
sys/dev/disk/nata/ata-raid.c:2802
 none reproduced fixed untriaged — —
DF-2495 High 7.8 Kernel stack/heap OOB write via untrusted total_disks in ata_raid_create and ata_raid_status ioctls
sys/dev/disk/nata/ata-raid.c:1051
 none reproduced fixed untriaged — —
DF-2506 High 7.8 TOCTOU kernel heap overflow in acd_send_cue via double-fetch of cuesheet->len
sys/dev/disk/nata/atapi-cd.c:1318
 none not_reproduced not_testable untriaged — —
DF-2510 High 7.8 Unbounded ctlr->channels (up to 32) overflows the fixed interrupt[8] dispatch array causing heap OOB write of function pointers and OOB indirect call on every IRQ
sys/dev/disk/nata/chipsets/ata-ahci.c:101
 none not_reproduced not_testable untriaged — —
DF-2517 High 7.8 Heap OOB write in sili_load_prb_callback via unchecked DMA segment count
sys/dev/disk/sili/sili.c:1245
 none not_reproduced not_testable untriaged — —
DF-2520 High 7.8 trm_ExecuteSRB writes user-controlled nseg SG entries into 32-slot pSRBSGL with no bounds check (heap overflow via pass(4) SCATTER_VALID)
sys/dev/disk/trm/trm.c:433
 none not_reproduced not_testable untriaged — —
DF-2521 High 7.8 trm_action bcopy of user-controlled cdb_len into 12-byte CmdBlock overflows the SRB struct (pass(4)-reachable heap corruption)
sys/dev/disk/trm/trm.c:591
 none not_reproduced not_testable untriaged — —
DF-2580 High 7.8 Missing bounds check on table id gives controlled kernel heap OOB read/write on every ipfw3 table opcode
sys/net/ipfw3_basic/ip_fw3_table.c:92
 panic reproduced fixed untriaged — —
DF-0547 Medium 7.8 Ring cleanup trusts userspace-writable buf_idx: cross-adapter double-free / buffer aliasing
sys/net/netmap/netmap_mem2.c:995
 corruption not_reproduced not_testable untriaged — —
DF-1235 Medium 7.8 Unbounded CDB copy into fixed 12-byte SRB CmdBlock overwrites SRB pointer fields
sys/dev/disk/trm/trm.c:591
 none not_reproduced not_testable untriaged — —
DF-1454 Medium 7.8 Heap buffer overflow in autosense data copy - missing sizeof(sense_data) bound
sys/dev/virtual/vmware/pvscsi/pvscsi.c:945
 none inconclusive — untriaged — —
DF-1848 Medium 7.8 ENA LLQ bounce buffer heap overflow via descs_left_in_line u16 underflow when device reports descs_num_before_header=0
sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:150
 none inconclusive — untriaged — —
DF-2469 Medium 7.8 Heap OOB write via double channel offset in RQCS_SYNCXFER_FAILED status handler
sys/dev/disk/isp/isp.c:6282
 none not_reproduced not_testable untriaged — —
DF-2492 Medium 7.8 OOB heap write/read on interrupt[8] via AHCI controllers with >8 ports
sys/dev/disk/nata/ata-pci.c:383
 none not_reproduced not_testable untriaged — —
DF-1046 High 7.6 uint8_t loop-counter wrap in uvc_ctrl_init_dev causes unbounded kernel heap overflow from malicious USB descriptor
sys/bus/u4b/uvc/uvc_ctrls.c:917
 corruption reproduced fixed untriaged — —
DF-2490 High 7.6 ATAPI PIO heap OOB write/read via unvalidated device byte_count_limit
sys/dev/disk/nata/ata-lowlevel.c:329
 none not_reproduced not_testable untriaged — —
DF-0017 High 7.5 Unbounded recursion in kdmsg_simulate_failure overflows the kernel thread stack (remote DoS)
sys/kern/kern_dmsg.c:1321
 panic reproduced fixed untriaged — —
DF-0417 High 7.5 Use-after-free race on nd_defrouter: defrtrlist_update returns unreferenced pointer consumed unlocked across RA prefix loop
sys/netinet6/nd6_rtr.c:285
 panic reproduced fixed untriaged — —
DF-0580 High 7.5 ieee80211_defrag UAF/dangling-pointer: DragonFly m_cat frees fragment but code reads wh + m_pkthdr.len after
sys/netproto/802_11/wlan/ieee80211_input.c:248
 none inconclusive not_testable untriaged — —
DF-0617 High 7.5 Use-after-free in ng_ether_rcv_upper: bridge_input_p() return value discarded, freed mbuf fed to ether_demux_oncpu
sys/netgraph7/ether/ng_ether.c:657
 dos reproduced fixed untriaged — —
DF-0740 High 7.5 gre_input2 missing packet length validation — m_len/m_pkthdr.len underflow from crafted GRE option flags (no checksum verification)
sys/netinet/ip_gre.c:148
 panic reproduced fixed untriaged — —
DF-0945 High 7.5 swapoff_one mutates global swapblist without vm_token, racing with concurrent page-out (blist corruption / UAF on resize)
sys/vm/swap_pager.c:536
 dos reproduced fixed untriaged — —
DF-1184 High 7.5 Heap buffer overflow in arcmsr_Read_iop_rqbuffer_data_D: 128-byte kmalloc overwritten by firmware-controlled data_len
sys/dev/raid/arcmsr/arcmsr.c:1446
 corruption reproduced not_testable untriaged — —
DF-1381 High 7.5 vge_newbuf RX-ring refill loop writes OOB when idx<VGE_RXCHUNK due to non-modular signed decrement
sys/dev/netif/vge/if_vge.c:1162
 panic reproduced not_testable untriaged — —
DF-2358 High 7.5 Heap buffer overflow in USB RX frame aggregation: m_getcl (2048B) too small for m_copydata of up to 4080B
sys/bus/u4b/wlan/if_run.c:3013
 none not_reproduced not_testable untriaged — —
DF-0533 Medium 7.5 Unsynchronized sc->inq/outq between hard ISR and netgraph forward: ifqueue corruption / UAF
sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:939
 none not_reproduced not_testable untriaged — —
DF-0581 Medium 7.5 ieee80211_setup_rates trusts attacker-controlled IE length byte: latent heap overflow of rs_rates[15]
sys/netproto/802_11/wlan/ieee80211_input.c:420
 none not_reproduced not_testable untriaged — —
DF-0730 Medium 7.5 ra_rate_thresh[3][8] heap OOB read/write — indexed up to rs_nrates-1(14) from remote peer rates IE
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:241
 heap-oob-rw (latent) reproduced fixed untriaged — —
DF-1060 Medium 7.5 FW_GTPMAP bcopy uses (topology_map->crc_len + 1) * 4 as the count — attacker-inflatable crc_len drives unbounded kernel OOB read up to 256 KB
sys/bus/firewire/fwdev.c:657
 none not_reproduced not_testable untriaged — —
DF-1249 Medium 7.5 dc_pnic_rx_bug_war unbounded copy loop - heap overflow if PNIC produces >5 descriptors
sys/dev/netif/dc/if_dc.c:2414
 none inconclusive not_testable untriaged — —
DF-1352 Medium 7.5 Heap overflow via unbounded device-supplied event_info_size in virtio-scsi
sys/dev/virtual/virtio/scsi/virtio_scsi.c:301
 panic reproduced fixed untriaged — —
DF-2285 Medium 7.5 Use-after-free in target teardown: fixed 500ms sleep before kfree(softc) does not drain in-flight CTIOs
sys/bus/cam/scsi/scsi_targ_bh.c:402
 panic reproduced not_testable untriaged — —
DF-0572 High 7.4 Per-CPU cfg_nat pointer cached in shared firewall rule: cross-CPU RB-tree races -> corruption
sys/net/ipfw3_nat/ip_fw3_nat.c:158
 dos reproduced fixed untriaged — —
DF-1236 High 7.4 Extended SCSI message accumulation overflows MsgInBuf[6] into adjacent SRB pointer fields
sys/dev/disk/trm/trm.c:1832
 none not_reproduced not_testable untriaged — —
DF-1395 High 7.4 Firmware-controlled size_of_struct in oce_read_mac_addr drives unbounded bcopy (heap overflow into softc)
sys/dev/netif/oce/oce_mbox.c:447
 panic reproduced not_testable untriaged — —
DF-1716 High 7.4 ata-pci: out-of-bounds interrupt[] write/read when AHCI reports >8 channels -> kernel heap corruption + RIP control on next IRQ
sys/dev/disk/nata/ata-pci.c:230
 panic reproduced fixed untriaged — —
DF-1737 High 7.4 ata-lowlevel: heap OOB write via unchecked ATAPI byte-count register polluting request->donecount
sys/dev/disk/nata/ata-lowlevel.c:329
 panic reproduced fixed untriaged — —
DF-0083 Medium 7.4 OOB write into cpu_topology_nodes[MAXCPU] during boot topology construction on high-CPU-count systems
sys/kern/subr_cpu_topology.c:115
 panic reproduced not_testable untriaged — —
DF-1385 Medium 7.4 Unbounded VBIOS num_entries overflows MC register table arrays (heap OOB write+read)
sys/dev/drm/radeon/cypress_dpm.c:1052
 none inconclusive — untriaged — —
DF-1950 Medium 7.4 Unvalidated ACPI ATRM return object: heap buffer overflow and type confusion in amdgpu_atrm_call
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:264
 none inconclusive — untriaged — —
DF-2484 Medium 7.4 Untrusted IOC-supplied indices index raid_disks/raid_volumes arrays without bounds checks (OOB read/write of kernel heap)
sys/dev/disk/mpt/mpt_raid.c:414
 none not_reproduced not_testable untriaged — —
DF-0074 High 7.3 DIOCGSLICEINFO heap buffer overflow via crafted GPT disk image (dss_nslices > MAX_SLICES)
sys/kern/subr_diskslice.c:556
 panic reproduced fixed untriaged — —
DF-0795 High 7.3 Stack buffer overflow in VFAT long-filename reassembly via crafted FAT directory entry — no kernel stack canary
sys/vfs/msdosfs/msdosfs_vnops.c:1662
 corruption reproduced fixed untriaged — —
DF-0806 High 7.3 dirfs_readlink off-by-one heap overflow and OOB read via truncated symlink target
sys/vfs/dirfs/dirfs_vnops.c:1328
 corruption reproduced not_testable untriaged — —
DF-2060 High 7.3 Invalid free / non-heap kfree in ath_ioctl_diag when HAL diagcode replaces result pointer (ATH_DIAG_DYN + HAL_DIAG_REVS/FATALERR)
sys/dev/netif/ath/ath/if_ath_ioctl.c:201
 panic reproduced not_testable untriaged — —
DF-2322 High 7.3 MSI-X table/PBA out-of-bounds MMIO read/write - no BAR-size validation against attacker-controlled table offset and vector count
sys/bus/pci/pci.c:1431
 none not_reproduced not_testable untriaged — —
DF-2356 High 7.3 Unvalidated hardware frame length in RX path allows heap OOB read / uninitialized-memory info leak
sys/bus/u4b/wlan/if_rum.c:1146
 none not_reproduced not_testable untriaged — —
DF-2401 High 7.3 intel_gtt_insert_page swaps index/physical arguments causing out-of-bounds MMIO write into Intel IGD BAR
sys/dev/agp/intel-gtt.c:1407
 none not_reproduced not_testable untriaged — —
DF-2114 Medium 7.3 ata_serialize() clobbers PCI bus pci_devinfo ivar on controller device -- heap OOB read + cross-device PCI config corruption on ATP850R
sys/dev/disk/nata/chipsets/ata-acard.c:206
 corruption reproduced fixed untriaged — —
DF-2522 Medium 7.3 trm_SRBdone auto-sense bcopy uses user-controlled sense_len to copy out of 32-byte DMA slot and into 32-byte csio field (heap OOB read+write via pass(4))
sys/dev/disk/trm/trm.c:2529
 leak reproduced fixed untriaged — —
DF-0275 Medium 7.2 Heap buffer overflow in WPA/RSN IE construction: variable-length IE written into fixed sizeof(ieee80211_ie_wpa)=100 slot
sys/netproto/802_11/wlan/ieee80211_output.c:1976
 none inconclusive not_testable untriaged — —
DF-2357 Medium 7.2 Wrong TX frame-size bound causes 16-byte overflow of USB DMA buffer
sys/bus/u4b/wlan/if_rum.c:438
 none reproduced not_testable untriaged — —
DF-0638 High 7.1 Decompress path avail_in integer underflow feeds OOB heap reads to inflate() from crafted PPP frame
sys/netgraph7/deflate/ng_deflate.c:539
 leak reproduced fixed untriaged — —
DF-0700 High 7.1 User-controlled edge count not bounded by MAX_EDGES — BSS OOB array write/read on centre_socks[]
sys/net/ipfw3_basic/ip_fw3_sync.c:143
 none not_reproduced not_testable untriaged — —
DF-0701 High 7.1 Heap OOB read in centre_conf bcopy and integer overflow in size math
sys/net/ipfw3_basic/ip_fw3_sync.c:143
 none not_reproduced not_testable untriaged — —
DF-0702 High 7.1 Mbuf UAF and double-free in centre_test and send_state (sosend consumes m, loop reuses it)
sys/net/ipfw3_basic/ip_fw3_sync.c:339
 none not_reproduced not_testable untriaged — —
DF-0766 High 7.1 Heap OOB write in NFS READDIR/READDIRPLUS reply XDR null-padding — missing nfsm_clget before pad bytes
sys/vfs/nfs/nfs_serv.c:3186
 none not_reproduced fixed untriaged — —
DF-0781 High 7.1 Kernel heap info leak via unvalidated namelen in fuse_vop_readdir — bcopy past reply buffer + len underflow wild ptr
sys/vfs/fuse/fuse_vnops.c:1066
 leak reproduced fixed untriaged — —
DF-0811 High 7.1 OOB kernel heap write in ext2_cg_block_bitmap_init via buggy ext2_block_in_group divisor — setbit at wild offset
sys/vfs/ext2fs/ext2_alloc.c:856
 panic reproduced fixed untriaged — —
DF-0820 High 7.1 ffs_mountfs performs no validation of superblock geometry (fs_ncg/fs_ipg/fs_fpg/fs_fsize/fs_frag/fs_sbsize) — crafted image causes div-by-zero/infinite-loop/heap-overflow/bzero-corruption/OOB-read
sys/vfs/ufs/ffs_vfsops.c:642
 panic reproduced fixed untriaged — —
DF-0831 High 7.1 Heap overflow in udf_getfid via negative frag_size from 4-byte FID alignment — size_t(-3) bcopy
sys/vfs/udf/udf_vnops.c:543
 panic reproduced fixed untriaged — —
DF-0888 High 7.1 ext2_indirtrunc bzero heap OOB write via ftruncate past indirect-block structural limit
sys/vfs/ext2fs/ext2_inode.c:138
 panic reproduced fixed untriaged — —
DF-1179 High 7.1 Heap OOB write in DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8]
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1200
 corruption reproduced not_testable untriaged — —
DF-1180 High 7.1 Heap OOB write in voltage-table builders: unbounded dep_table->count overflows entries[32]
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1026
 corruption reproduced not_testable untriaged — —
DF-1227 High 7.1 mpr_build_nvme_prp heap overflow via unbounded user-supplied data length
sys/dev/raid/mpr/mpr.c:2716
 none not_reproduced not_testable untriaged — —
DF-1259 High 7.1 mfi_stp_cmd unbounded SGE loop corrupts mfi_softc via size-[2] DMA arrays and STP frame SGL
sys/dev/raid/mfi/mfi.c:2724
 none inconclusive not_testable untriaged — —
DF-1754 High 7.1 radeon_vce: OOB read of p->relocs[] and wild pointer deref via non-multiple-of-4 chunk_relocs length_dw
sys/dev/drm/radeon/radeon_vce.c:470
 leak reproduced fixed untriaged — —
DF-1795 High 7.1 plip: heap overflow / OOB-read in lp_intr racing SIOCSIFMTU buffer swap
sys/dev/netif/plip/if_plip.c:348
 panic reproduced not_testable untriaged — —
DF-1818 High 7.1 sckmsrndr: fill_rect24 slow path over-advances draw_pos by 3*width per row writing past framebuffer mapping
sys/dev/misc/syscons/sckmsrndr.c:438
 panic reproduced fixed untriaged — —
DF-2133 High 7.1 dma_buf_export never initializes dmabuf->resv; GPU drivers dereference uninitialized slab pointer
sys/dev/drm/linux_dma-buf.c:127
 none not_reproduced not_testable untriaged — —
DF-2419 High 7.1 Heap OOB write in INQUIRY handler when data buffer length is 36..95 bytes
sys/dev/disk/ahci/ahci_cam.c:1109
 none not_reproduced not_testable untriaged — —
DF-0706 Medium 7.1 Lifecycle bugs in edge handler cleanup: UAF on replaced edge_sock, missing thread join, soclose+sofree imbalance
sys/net/ipfw3_basic/ip_fw3_sync.c:195
 none not_reproduced not_testable untriaged — —
DF-0998 Medium 7.1 TX DMA buffer overflow: mbuf length clamp uses wrong bound -> 16-byte heap overwrite past USB DMA buffer
sys/bus/u4b/wlan/if_rum.c:438
 none not_reproduced not_testable untriaged — —
DF-1197 Medium 7.1 2-byte DMA heap overflow in RX buffer when ETHER_ALIGN applied with jumbo MTU
sys/dev/netif/emx/if_emx.c:2918
 none not_reproduced not_testable untriaged — —
DF-1237 Medium 7.1 Scatter/gather list copy has no bounds vs the 32-entry hardware SG buffer
sys/dev/disk/trm/trm.c:434
 none not_reproduced not_testable untriaged — —
DF-1476 Medium 7.1 intel_gtt_insert_page swaps (index, physical) arguments to install_gtt_pte causing OOB MMIO write past BAR
sys/dev/agp/intel-gtt.c:1406
 none inconclusive — untriaged — —
DF-1551 Medium 7.1 snread subtracts 6 from u_short packet_length with no bound: underflow -> ~63KB kernel heap overflow write via insw into 2KB mbuf cluster
sys/dev/netif/sn/if_sn.c:983
 none inconclusive — untriaged — —
DF-2142 Medium 7.1 Unbounded wire-controlled pos in dcons_checkc allows kernel OOB read / panic via FireWire peer
sys/dev/misc/dcons/dcons.c:96
 panic reproduced fixed untriaged — —
DF-0315 High 7.0 UAF: wg_peer_destroy frees peer struct while data-plane paths access it without peer refcount
sys/net/wg/if_wg.c:589
 none observed dynamically (code-level UAF real + reachable; race window too narrow to panic on GENERIC) not_reproduced — untriaged — —
DF-0590 High 7.0 No serialization of bridge state in legacy netgraph/ng_bridge -- UAF in rehash, OOB heap write in GET_TABLE, deterministic KASSERT panics under concurrent traffic
sys/netgraph/bridge/ng_bridge.c:297
 none not_reproduced — untriaged — —
DF-0636 High 7.0 ngt_rcvdata accesses sc->outq without tp->t_token, racing with ngt_start (UAF write / queue corruption)
sys/netgraph7/tty/ng_tty.c:591
 none not_reproduced — untriaged — —
DF-0691 High 7.0 UAF / NULL-deref in mld6_input MLD_LISTENER_QUERY path: in6m freed concurrently with iteration
sys/netinet6/mld6.c:280
 none not_reproduced not_testable untriaged — —
DF-0692 High 7.0 UAF and unsynchronized list walk in mld6_fasttimeo over global in6_multihead
sys/netinet6/mld6.c:382
 panic not_reproduced not_testable untriaged — —
DF-0745 High 7.0 Dead callout_active guard + callback-owns-free design causes double-free / TAILQ corruption race in l2cap_request_free
sys/netbt/l2cap_misc.c:168
 panic reproduced fixed untriaged — —
DF-0843 High 7.0 Missing global lock on dirhash list enables use-after-free and list corruption across concurrent directory operations
sys/vfs/ufs/ufs_dirhash.c:302
 panic reproduced fixed untriaged — —
DF-0917 High 7.0 Use-after-free on fuse_ipc during tx completion (daemon read/write drops lock before fip access)
sys/vfs/fuse/fuse_ipc.c:112
 panic reproduced fixed untriaged — —
DF-0925 High 7.0 UAF in fuse_alloc_node races vnode reclaim (no refcount on fuse_node)
sys/vfs/fuse/fuse_node.c:106
 panic reproduced fixed untriaged — —
DF-1136 High 7.0 Heap buffer overflow in si_get_svi2_voltage_table: unbounded VBIOS count writes past entries[32]
sys/dev/drm/radeon/si_dpm.c:3939
 panic inconclusive not_testable untriaged — —
DF-1192 High 7.0 ciss_filter_physical: bus=CISS_EXTRA_BUS2(ea)-1 can be -1 -> OOB pointer write via ciss_physical[-1][target]
sys/dev/raid/ciss/ciss.c:1551
 panic reproduced not_testable untriaged — —
DF-1246 High 7.0 OOB read/write past IB end in evergreen_dma_cs_parse (no per-packet bounds check)
sys/dev/drm/radeon/evergreen_cs.c:2806
 none not_reproduced not_testable untriaged — —
DF-1296 High 7.0 Unchecked VBIOS UVD/VCE/ACP level counts cause heap OOB write past fixed-size SMC arrays
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1525
 panic reproduced not_testable untriaged — —
DF-1298 High 7.0 Heap overflow in update_slot_layout_info via unchecked ucConnNum
sys/dev/drm/amd/display/dc/bios/bios_parser.c:2634
 none inconclusive not_testable untriaged — —
DF-1305 High 7.0 Heap OOB write/read in kv_init_graphics_levels via unbounded VBIOS table->count
sys/dev/drm/radeon/kv_dpm.c:2355
 none inconclusive not_testable untriaged — —
DF-1416 High 7.0 Heap OOB write in power-state callback via unbounded ucNumDPMLevels
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1355
 panic reproduced fixed untriaged — —
DF-1487 High 7.0 Out-of-bounds descriptor write in wb_encap when TX chain fills all 16 fragments under minimum frame length
sys/dev/netif/wb/if_wb.c:1221
 leak:heap reproduced not_testable untriaged — —
DF-1640 High 7.0 Use-after-free + double-free of DM_TABLE_PARAMS string across table entries
sys/dev/disk/dm/dm_ioctl.c:688
 panic reproduced fixed untriaged — —
DF-1749 High 7.0 amdgpu_acpi: UAF - ACPI notify handler never removed on device detach
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:369
 panic reproduced fixed untriaged — —
DF-1843 High 7.0 UAF in device-mapper open path: dmopen releases busy reference before open lifetime, racing dm_dev_remove_ioctl
sys/dev/disk/dm/device-mapper.c:209
 panic reproduced fixed untriaged — —
DF-1863 High 7.0 TOCTOU in amdgpu_ctx_add_fence: concurrent CS double dma_fence_put -> UAF/double-free
sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:445
 panic reproduced fixed untriaged — —
DF-1927 High 7.0 UAF race in drm_sched_entity_fini: broken kthread_park allows concurrent scheduler pop_job during entity teardown
sys/dev/drm/scheduler/sched_entity.c:273
 panic reproduced fixed untriaged — —
DF-2146 High 7.0 Unbounded AUX reply byte count causes heap/stack OOB write on DP read path
sys/dev/drm/radeon/radeon_dp_auxch.c:177
 none not_reproduced not_testable untriaged — —
DF-2188 High 7.0 vmap_list traversed and mutated without consistent lock; races yield list corruption UAF and double-free
sys/dev/drm/linux_vmalloc.c:64
 corruption reproduced fixed untriaged — —
DF-2206 High 7.0 iounmap() walks the global iomap_list without iomap_lock, racing concurrent inserters/removers into UAF read, double-free and NULL-deref panic
sys/dev/drm/linux_iomapping.c:68
 panic reproduced fixed untriaged — —
DF-2292 High 7.0 FW_ASYREQ response copy overflows ioctl heap buffer with oversized FireWire RRESB payload
sys/bus/firewire/fwdev.c:576
 none not_reproduced not_testable untriaged — —
DF-2298 High 7.0 Heap OOB read/write via zero-length segment array from integer overflow in n
sys/bus/firewire/fwdma.c:145
 memcorrupt: demonstrated OOB-read-to-arbitrary-write through production fw_write (write target = groom-controlled pointer read 8 bytes past a 32-byte kmalloc; content = attacker iso payload, length up to u16 65535 per packet); fw_read is the arbitrary-read mirror; ungroomed firing = wild write/panic. uid=0 chain not completed -- entry requires a FireWire controller's /dev/fw* node (0660 root:operator), absent in QEMU; same evidence-class standard as DF-5413/DF-5548/DF-5613. reproduced fixed untriaged — —
DF-2435 High 7.0 Heap buffer overflow in status_str via ksprintf of negative strtouq offsets
sys/dev/disk/dm/crypt/dm_target_crypt.c:462
 panic reproduced fixed untriaged — —
DF-2443 High 7.0 UAF / double-free race in dm_dev_remove lifecycle (no-ref-held precondition)
sys/dev/disk/dm/dm_dev.c:65
 panic reproduced fixed untriaged — —
DF-2447 High 7.0 dm_dev_remove_ioctl / dm_dev_resume_ioctl use-after-free: dmv operated on after dm_dev_unbusy drops the last reference
sys/dev/disk/dm/dm_ioctl.c:349
 panic reproduced fixed untriaged — —
DF-0003 Medium 7.0 Negative unit number in devclass_alloc_unit causes heap OOB write via dc->devices[]
sys/kern/subr_bus.c:1064
 panic reproduced fixed untriaged — —
DF-0033 Medium 7.0 Unsynchronized fdtol->fdl_refcount ++ / list splice in rfork fdshare path (UAF via refcount race)
sys/kern/kern_fork.c:568
 panic reproduced fixed untriaged — —
DF-0420 Medium 7.0 Use-after-free in SCO reassembly buffer: sc_isoc_in_buffer retains dangling pointer after mbuf forwarded and realloc fails
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1103
 none inconclusive not_testable untriaged — —
DF-0497 Medium 7.0 TOCTOU use-after-free on rtentry in ng_btsocket_l2cap_raw_bind: releases rt_lock before storing pointer
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:690
 none inconclusive not_testable untriaged — —
DF-0513 Medium 7.0 Rule-chain mutation raced with concurrent ip6_fw_chk: lock-free linked list + kfree after crit_exit -> UAF on SMP
sys/net/ip6fw/ip6_fw.c:856
 none not_reproduced not_testable untriaged — —
DF-0521 Medium 7.0 PF_LOCAL sockaddr unparse: sun_len<pathoff underflow -> giant bcopy -> stack OOB write (DF-0509 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:321
 none not_reproduced not_testable untriaged — —
DF-0586 Medium 7.0 Lockless global hci_pcb list allows use-after-free during concurrent socket teardown and packet tap
sys/netbt/hci_socket.c:87
 none not_reproduced not_testable untriaged — —
DF-0589 Medium 7.0 sc->outq mbuf-queue race in ng_h4: IF_DEQUEUE in ng_h4_start (tty ctx) vs IF_DRAIN in disconnect/shutdown (netgraph ctx); NG_H4_LOCK is only per-CPU crit_enter
sys/netgraph7/bluetooth/drivers/h4/ng_h4.c:88
 dos inconclusive not_testable untriaged — —
DF-0755 Medium 7.0 Unlocked global trace index tcp_debx races into runaway out-of-bounds write (TCPDEBUG-only)
sys/netinet/tcp_debug.c:84
 none reproduced not_testable untriaged — —
DF-0774 Medium 7.0 Use-after-free in devfs_clone — clone handler freed during lock release window before nhandler call
sys/vfs/devfs/devfs_core.c:2322
 panic reproduced fix_failed untriaged — —
DF-0793 Medium 7.0 Use-after-free in async TRIM block-free path — ffs_blkfree stores unrefcounted mount/device pointers in deferred task
sys/vfs/ufs/ffs_alloc.c:1633
 none not_reproduced fixed untriaged — —
DF-1061 Medium 7.0 LOOPRECOVER watchdog silently abandons unacknowledged TLB invalidations, enabling stale-TLB use-after-free / info leak
sys/platform/pc64/x86_64/pmap_inval.c:342
 none not_reproduced not_testable untriaged — —
DF-1153 Medium 7.0 Use-after-free in reset functions when kzalloc fails (connector/crtc/plane state)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:3190
 none not_reproduced not_testable untriaged — —
DF-1289 Medium 7.0 Heap overflow of CAM CCB sense buffer from untrusted controller sense_length
sys/dev/raid/mly/mly.c:2356
 none not_reproduced not_testable untriaged — —
DF-1290 Medium 7.0 OOB write on softc via untrusted controller event channel/target/lun in mly_process_event
sys/dev/raid/mly/mly.c:1323
 none not_reproduced not_testable untriaged — —
DF-1295 Medium 7.0 METEORSSIGNAL stores curproc without reference causing UAF via fork+child-exit+DMA interrupt
sys/dev/video/cxm/cxm.c:2760
 none not_reproduced not_testable untriaged — —
DF-1300 Medium 7.0 dc_add_all_planes_for_stream writes plane_states[MAX_SURFACES=3] with unchecked plane_count (dead API, latent stack overflow)
sys/dev/drm/amd/display/dc/core/dc_resource.c:1564
 panic reproduced fixed untriaged — —
DF-1358 Medium 7.0 Stack buffer overflow in amr_quartz_get_work via controller-supplied completion count
sys/dev/raid/amr/amr.c:2095
 panic reproduced fixed untriaged — —
DF-1366 Medium 7.0 Heap OOB write in vegam_populate_smc_vce_level via unbounded VBIOS mm_dep_table->count
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1217
 none inconclusive — untriaged — —
DF-1367 Medium 7.0 Heap OOB write in vegam_populate_smc_uvd_level via unbounded VBIOS mm_dep_table->count
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1330
 none inconclusive — untriaged — —
DF-1368 Medium 7.0 Heap+stack OOB writes in clock-stretcher/AVFS/CAC table population via unbounded VBIOS counts
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:515
 none inconclusive — untriaged — —
DF-1411 Medium 7.0 DragonFly sysctl backlight handler captures drm_connector_state before modeset lock enabling UAF
sys/dev/drm/i915/intel_panel.c:1815
 none inconclusive — untriaged — —
DF-1417 Medium 7.0 Stack/heap OOB write in smu8_get_clock_by_type from unbounded SMU-derived count
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1613
 none inconclusive — untriaged — —
DF-1449 Medium 7.0 Unvalidated firmware-reported disk/volume indices cause OOB read/write in RAID arrays and IOC page buffers
sys/dev/disk/mpt/mpt_raid.c:414
 none inconclusive — untriaged — —
DF-1758 Medium 7.0 ips: card-controlled command_id indexes commandarray[] with no bounds check in both interrupt handlers -> OOB r/w + indirect call
sys/dev/raid/ips/ips.c:567
 none inconclusive — untriaged — —
DF-1911 Medium 7.0 r600_audio_update_hdmi walks encoder_list without mode_config.mutex: UAF race vs modeset/unload (variant of DF-1878)
sys/dev/drm/radeon/r600_hdmi.c:114
 none inconclusive — untriaged — —
DF-1959 Medium 7.0 dm_dev_remove use-after-free via concurrent stale-pointer removal: operator-group to root heap corruption
sys/dev/disk/dm/dm_dev.c:305
 none inconclusive — untriaged — —
DF-2041 Medium 7.0 Imported GEM obj->resv set to uninitialized dma_buf->resv heap memory
sys/dev/drm/i915/i915_gem_dmabuf.c:322
 panic reproduced fixed untriaged — —
DF-2072 Medium 7.0 Signed table_id bounds check allows OOB heap read/write in SMU10 table copy
sys/dev/drm/amd/powerplay/smumgr/smu10_smumgr.c:116
 none reproduced fixed untriaged — —
DF-2086 Medium 7.0 Double-free of ch->dma in ata_dmaalloc error path
sys/dev/disk/nata/ata-dma.c:151
 dos reproduced fixed untriaged — —
DF-2125 Medium 7.0 Lockless segment read in vm_phys_fictitious_to_vm_page races unreg->kfree yielding NULL-deref panic or UAF of vm_page array
sys/dev/drm/drm_vm.c:152
 corruption reproduced fixed untriaged — —
DF-2128 Medium 7.0 Multi-page sg entry OOB read/write in sg_pcopy_from_buffer / sg_pcopy_to_buffer via DMAP
sys/dev/drm/linux_scatterlist.c:167
 corruption reproduced fixed untriaged — —
DF-2189 Medium 7.0 vmap() computes allocation size in 32-bit arithmetic; large count overflows and maps count pages into undersized VA
sys/dev/drm/linux_vmalloc.c:55
 corruption reproduced fixed untriaged — —
DF-2191 Medium 7.0 UAF: sio_pccard_detach does not stop/drain dtr_ch and busy_ch callouts before softc is freed
sys/dev/serial/sio/sio_pccard.c:117
 corruption reproduced fixed untriaged — —
DF-2304 Medium 7.0 Double-free / UAF in fwohci_pci_add_child error path: detach deletes child then caller deletes it again
sys/bus/firewire/fwohci_pci.c:446
 panic reproduced not_testable untriaged — —
DF-2331 Medium 7.0 Slave-controlled block-read byte count overflows sc->block_data[32] in interrupt handler
sys/bus/smbus/ichsmb/ichsmb.c:575
 none not_reproduced not_testable untriaged — —
DF-2353 Medium 7.0 Use-after-free on device disconnect: sc->data freed before /dev/videoX cdev is destroyed
sys/bus/u4b/uvc/uvc_drv.c:2493
 panic reproduced fixed untriaged — —
DF-2382 Medium 7.0 Heap OOB write in cmi_order[] when BIOS exposes >128 CMI instances
sys/dev/acpica/acpi_hp/acpi_hp.c:1165
 none not_reproduced not_testable untriaged — —
DF-2414 Medium 7.0 Unvalidated 32-bit ccb_index read from firmware LRAM used to index ccb_infos[] in all four halt/error paths - OOB read NULL-deref and UAF
sys/dev/disk/advansys/advlib.c:1005
 none not_reproduced not_testable untriaged — —
DF-2453 Medium 7.0 Use-after-free of target config in async read iodone callback
sys/dev/disk/dm/flakey/dm_target_flakey.c:303
 none not_reproduced not_testable untriaged — —
DF-2474 Medium 7.0 Stale base pointer in isp_pci_mbxdma error cleanup causes kernel-heap multi-free
sys/dev/disk/isp/isp_pci.c:1600
 none not_reproduced not_testable untriaged — —
DF-2552 Medium 7.0 Integer overflow in sbuf_extend/sbuf_extendsize yields undersized reallocation and ~2GiB heap overflow
sys/kern/subr_sbuf.c:131
 none reproduced fixed untriaged — —
DF-2553 Medium 7.0 sbuf_uionew truncates ssize_t uio_resid to int length then uiomove()s full original size into undersized buffer
sys/kern/subr_sbuf.c:237
 none reproduced fixed untriaged — —
DF-0105 Low 7.0 DT_CALLOUT_ARMED set before callout_reset creates enqueue/cancel race (panic or tq_callouts underflow + spurious UAF)
sys/kern/subr_taskqueue.c:355
 none reproduced fixed untriaged — —
DF-0557 Low 7.0 Callout UAF race on hook disconnect/node shutdown: callout_stop doesnt drain ticker
sys/netgraph/lmi/ng_lmi.c:1062
 panic reproduced fixed untriaged — —
DF-1001 Low 7.0 INQUIRY EVPD Unit Serial Number pre-fill writes past short CAM buffer
sys/bus/u4b/storage/umass.c:2326
 none reproduced fixed untriaged — —
DF-1002 Low 7.0 INQUIRY EVPD Supported Page List augmentation trusts device-supplied length against unvalidated buffer
sys/bus/u4b/storage/umass.c:2578
 none reproduced fixed untriaged — —
DF-1016 Low 7.0 FIOASYNC stores raw struct proc pointer without PHOLD -> kernel heap UAF on process exit via fork
sys/bus/u4b/usb_dev.c:1044
 none reproduced fixed untriaged — —
DF-1154 Low 7.0 Unbounded per-CRTC plane count can overflow MAX_SURFACES stack/heap buffers
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4496
 panic reproduced fixed untriaged — —
DF-1435 Low 7.0 DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled length field
sys/dev/disk/nata/atapi-cd.c:1582
 none reproduced fixed untriaged — —
DF-2034 Low 7.0 Signed table_id comparison allows OOB array index in vega10_copy_table_from_smc / _to_smc
sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:37
 panic reproduced fixed untriaged — —
DF-2209 Low 7.0 Stale pointer after kfree in drm_sysfs_connector_remove -- connector->kdev not NULLed, creating latent UAF via drm_sysfs_connector_add early-return guard
sys/dev/drm/drm_sysfs.c:35
 dos reproduced fixed untriaged — —
DF-2234 Low 7.0 iconv_add() and iconv_register_cspair() accept unbounded charset names; iconv_sysctl_cslist() strcpy overflows 31-byte stack buffer
sys/libiconv/iconv.c:179
 panic reproduced fixed untriaged — —
DF-2248 Low 7.0 min() truncates 64-bit size_t to 32-bit u_int then stores in signed int: negative loop count unbounded buffer overrun
sys/libiconv/iconv_xlat.c:86
 panic reproduced not_testable untriaged — —
DF-2249 Low 7.0 convchar==1 path converts one byte without checking inbytesleft/outbytesleft > 0: 1-byte OOB read/write
sys/libiconv/iconv_xlat.c:92
 none reproduced fixed untriaged — —
DF-0490 High 6.8 Type confusion in in_lifaddr_ioctl: AF_INET6 check matches IPv6 addresses cast to in_ifaddr — unpriv heap OOB read/info leak via SIOCGLIFADDR
sys/netinet/in.c:908
 leak:0 reproduced fixed untriaged — —
DF-0983 High 6.8 Heap overflow in urtwn_efuse_read_data via crafted efuse extended header on RTL8188EU
sys/bus/u4b/wlan/if_urtwn.c:1755
 panic reproduced fixed untriaged — —
DF-1011 High 6.8 Integer overflow in nitv (uint16_t) during UVC descriptor parsing -> ~250KB heap buffer overflow
sys/bus/u4b/uvc/uvc_drv.c:1674
 panic reproduced fixed untriaged — —
DF-2288 High 6.8 OOB heap write/read in fw_bus_explore_callback via unchecked ongoaddr (Config ROM parser)
sys/bus/firewire/firewire.c:1500
 none not_reproduced not_testable untriaged — —
DF-2289 High 6.8 Off-by-one stack buffer overflow in crom_next depth guard allows kernel stack corruption
sys/bus/firewire/fwcrom.c:115
 none not_reproduced not_testable untriaged — —
DF-2359 High 6.8 urtwn_efuse_read_data writes past sc->rom union on malicious USB device (RTL8188EU extended efuse header)
sys/bus/u4b/wlan/if_urtwn.c:1756
 none not_reproduced not_testable untriaged — —
DF-1097 Medium 6.8 Use-after-free and double-free in fwohci_pci_add_child error path
sys/bus/firewire/fwohci_pci.c:442
 none not_reproduced not_testable untriaged — —
DF-1268 Medium 6.8 Unbounded VBIOS dependency-table counts overflow fixed SMU7 level arrays (heap OOB write)
sys/dev/drm/amd/amdgpu/kv_dpm.c:2422
 none inconclusive not_testable untriaged — —
DF-1280 Medium 6.8 Unchecked reply-frame offset in mpt_intr allows OOB read/write via malicious IOC address reply
sys/dev/disk/mpt/mpt.c:734
 none inconclusive not_testable untriaged — —
DF-1767 Medium 6.8 virtqueue: host-controlled descriptor indices used without runtime bounds validation cause OOB read/write
sys/dev/virtual/virtio/virtio/virtqueue.c:559
 none inconclusive — untriaged — —
DF-1868 Medium 6.8 Write-reply stack buffer overflow in aux_engine: missing bound of returned_byte against reply_data[16]
sys/dev/drm/amd/display/dc/i2caux/aux_engine.c:415
 none inconclusive — untriaged — —
DF-1882 Medium 6.8 Stack buffer overflow/underflow in ad_describe via non-NUL-terminated IDENTIFY model string
sys/dev/disk/nata/ata-disk.c:508
 none inconclusive — untriaged — —
DF-1938 Medium 6.8 Write-reply stack overflow via self-comparing bound check in read_channel_reply (cross-file with DF-1868)
sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:316
 none inconclusive — untriaged — —
DF-2361 Medium 6.8 P packet out-of-bounds stack write via NUM_REGS/struct mismatch and missing lower bound
sys/cpu/x86_64/misc/x86_64-gdbstub.c:438
 dos reproduced fixed untriaged — —
DF-2362 Medium 6.8 m/M packets accept unbounded length overflowing 400-byte static I/O buffers
sys/cpu/x86_64/misc/x86_64-gdbstub.c:118
 dos reproduced fixed untriaged — —
DF-1694 Low 6.8 dce_aux: stack buffer overflow in AUX write-reply path (bound check compares HW field against itself)
sys/dev/drm/amd/display/dc/dce/dce_aux.c:285
 panic reproduced fixed untriaged — —
DF-0410 High 6.7 Heap buffer overflow in ng_encode_string: buffer allocated by strlen(raw) but loop iterates attacker-controlled slen
sys/netgraph7/netgraph/ng_parse.c:919
 none reproduced not_testable untriaged — —
DF-0472 High 6.7 ip_fw3_ctl_add_rule missing cmd_len validation: heap over-read + info leak + OOB function pointer call
sys/net/ipfw3/ip_fw3.c:950
 leak:~1KB reproduced fixed untriaged — —
DF-0668 High 6.7 Unbounded table id in all dispatch/ioctl handlers -> per-CPU heap OOB write, OOB read, and wild function-pointer call
sys/net/ipfw3_basic/ip_fw3_table.c:92
 panic reproduced fixed untriaged — —
DF-0720 High 6.7 Heap overflow: if_alloc(IFT_PPP) returns sizeof(struct ifnet) but sppp_attach writes ~1KB of struct sppp fields past allocation (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:249
 none not_reproduced not_testable untriaged — —
DF-0897 High 6.7 Stack buffer overflow via non-NUL-terminated name/linkname in devfs_rule_ioctl
sys/vfs/devfs/devfs_rules.c:104
 panic reproduced fixed untriaged — —
DF-1064 High 6.7 Unbounded CPU counter in MADT LAPIC/x2APIC enumeration causes out-of-bounds kernel BSS writes
sys/platform/pc64/acpica/acpi_madt.c:274
 panic reproduced fixed untriaged — —
DF-1066 High 6.7 Integer underflow in uvc_buf_queue_mmap_locked bounds check allows out-of-bounds vtophys() when buf_size==0
sys/bus/u4b/uvc/uvc_buf.c:107
 none not_reproduced not_testable untriaged — —
DF-1133 High 6.7 RLC v2.0 firmware register-list parsing: integer-overflow kmalloc + unvalidated offset to heap OOB write/read
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1106
 panic inconclusive not_testable untriaged — —
DF-1134 High 6.7 cz_init_cp_jump_table: unvalidated jt_offset/jt_size from CE/PFP/ME/MEC fw headers -> OOB read/write
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1301
 panic inconclusive not_testable untriaged — —
DF-1163 High 6.7 gfx_v7_0_init_cp_pg_table heap OOB write+read via untrusted firmware jt_offset/jt_size
sys/dev/drm/amd/amdgpu/gfx_v7_0.c:3788
 none inconclusive not_testable untriaged — —
DF-1203 High 6.7 Heap buffer overflow via unbounded ucStateEntrySize in power table parsing
sys/dev/drm/radeon/ni_dpm.c:3927
 none not_reproduced not_testable untriaged — —
DF-1407 High 6.7 Unbounded i2c_bus[i] write via BIOS-controlled num_indices in amdgpu_atombios_i2c_init
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:140
 panic reproduced fixed untriaged — —
DF-1503 High 6.7 SETFKEY signed-flen heap/static overflow via imin(-1, MAXFK) wrapped into u_char .len
sys/dev/misc/kbd/kbd.c:1090
 leak:heap reproduced not_testable untriaged — —
DF-1529 High 6.7 hpt_create_array_v2 dereferences unvalidated Members[1..nDisk-1] as kernel pointers (arbitrary kernel memory write)
sys/dev/raid/hptmv/gui_lib.c:571
 leak:heap reproduced not_testable untriaged — —
DF-1539 High 6.7 Heap buffer overflow in NGM_TEXT_STATUS handler via unbounded ksprintf into 1024-byte response
sys/dev/netif/mn/if_mn.c:352
 leak:heap reproduced not_testable untriaged — —
DF-1560 High 6.7 Heap buffer overflow in pp_dpm_set_pp_table via sysfs pp_table write
sys/dev/drm/amd/powerplay/amd_powerplay.c:676
 panic reproduced not_testable untriaged — —
DF-1563 High 6.7 Heap overflow via unbounded CAM scatter-gather count in hpt_scsi_io
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:715
 leak:heap reproduced not_testable untriaged — —
DF-1578 High 6.7 Heap OOB write in INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN via missing dxfer_len check
sys/dev/raid/hptrr/hptrr_osm_bsd.c:582
 none not_reproduced not_testable untriaged — —
DF-1732 High 6.7 vinumio: heap buffer overflow - unbounded config-line copy in vinum_scandisk reads attacker-controlled disk data into 2KB buffer
sys/dev/raid/vinum/vinumio.c:763
 panic reproduced fixed untriaged — —
DF-1851 High 6.7 32-bit integer overflow in hptmv HPT_IOCTL_PARAM size check enables kernel heap overflow
sys/dev/raid/hptmv/hptproc.c:292
 panic reproduced fixed untriaged — —
DF-1894 High 6.7 Integer overflow in dmc_header->fw_size*4 causes unbounded heap OOB read in intel_csr_load_program
sys/dev/drm/i915/intel_csr.c:404
 panic reproduced fixed untriaged — —
DF-1946 High 6.7 amdgpu_ucode_validate only checks datasize==size_bytes: no minimum size, no header cross-validation (root of DF-1838 family)
sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251
 leak:24+ reproduced fixed untriaged — —
DF-1947 High 6.7 Integer underflow + missing bounds in amdgpu_ucode_init_single_fw/patch_jt memcpy: heap OOB write
sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:347
 panic reproduced fixed untriaged — —
DF-0056 Medium 6.7 Heap overflow via unchecked p_filesz > p_memsz in PT_LOAD segment loading
sys/kern/link_elf.c:507
 panic reproduced fixed untriaged — —
DF-0402 Medium 6.7 Direct kernel dereference of user-controlled pointer in netmap_bdg_learning before copyin: panic or kernel info-leak
sys/net/netmap/netmap_vale.c:994
 none not_reproduced not_testable untriaged — —
DF-0573 Medium 6.7 Unvalidated ioc->id used as nats[] index: OOB read/write of pointer array
sys/net/ipfw3_nat/ip_fw3_nat.c:745
 panic reproduced fixed untriaged — —
DF-1112 Medium 6.7 Stack buffer overflow: 32-byte buf[] used for GSBUS BLOCK/BYTES transfers carrying up to 255 bytes
sys/bus/smbus/smbacpi/smbacpi.c:137
 none not_reproduced not_testable untriaged — —
DF-1128 Medium 6.7 Zero-level power state: OOB read performance_levels[-1] and integer underflow memset overflow in SMC state upload
sys/dev/drm/amd/amdgpu/si_dpm.c:5662
 leak:4 reproduced fixed untriaged — —
DF-1176 Medium 6.7 Unvalidated RLC firmware header fields cause integer overflow in kmalloc and OOB heap read/write
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:691
 panic reproduced not_testable untriaged — —
DF-1178 Medium 6.7 gfx_v9_1_parse_ind_reg_list: stack buffer overflow on indirect_start_offsets[10] and unbounded OOB read
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:2084
 none not_reproduced not_testable untriaged — —
DF-1185 Medium 6.7 arcmsr_iop_message_xfer writes up to 1031 bytes past CAM buffer sized by dxfer_len
sys/dev/raid/arcmsr/arcmsr.c:2604
 none not_reproduced fixed untriaged — —
DF-1221 Medium 6.7 RX completion req_id used as array index without bounds check (OOB read/write/panic)
sys/dev/virtual/amazon/ena/ena.c:1450
 none inconclusive not_testable untriaged — —
DF-1820 Medium 6.7 amr_pci: UAF - amr_pci_intr runs concurrently with DMA/command teardown in amr_pci_free; interrupt torn down LAST
sys/dev/raid/amr/amr_pci.c:477
 none inconclusive — untriaged — —
DF-1854 Medium 6.7 Heap overflow in psp_asd_load via unvalidated asd_ucode_size from PSP ASD firmware header
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:254
 none inconclusive — untriaged — —
DF-1933 Medium 6.7 Heap OOB write in dm_target_stripe_table via unchecked ksnprintf return value
sys/dev/disk/dm/striped/dm_target_striped.c:208
 none inconclusive — untriaged — —
DF-1955 Medium 6.7 Unvalidated firmware header fields enable heap overflow in ASD firmware copy (variant of DF-1838/1854/1875)
sys/dev/drm/amd/amdgpu/psp_v10_0.c:142
 none inconclusive — untriaged — —
DF-2015 Medium 6.7 vce_v1_0_load_fw trusts unvalidated firmware-blob fields (num/len/datasize) causing kernel heap OOB write and OOB read
sys/dev/drm/radeon/vce_v1_0.c:158
 none reproduced not_testable untriaged — —
DF-2104 Medium 6.7 radeon ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> kernel heap OOB read and arbitrary SMC SRAM write (radeon twin of DF-2096)
sys/dev/drm/radeon/ci_smc.c:186
 none reproduced fixed untriaged — —
DF-2119 Medium 6.7 Double dma_fence_put on normal benchmark completion (heap double-free / UAF)
sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:36
 corruption reproduced fixed untriaged — —
DF-2156 Medium 6.7 _alloc_safe_mem size math is broken: heap underflow on small req_sz and integer overflow on huge req_sz
sys/dev/misc/tbridge/safe_mem.c:80
 corruption reproduced fixed untriaged — —
DF-0480 Low 6.7 TCP-MD5 signature option construction overflows 40-byte opt[] stack buffer (disabled by default)
sys/netinet/tcp_output.c:779
 dos reproduced fixed untriaged — —
DF-1007 Low 6.7 fwohci_rx_enable ignores fwohci_add_rx_buf allocation failure -> db[-1] OOB write
sys/bus/firewire/fwohci.c:1406
 none reproduced fixed untriaged — —
DF-1482 Low 6.7 vr_encap copies m_pkthdr.len bytes into fixed MCLBYTES TX buffer without bounds check: heap overflow when MTU raised
sys/dev/netif/vr/if_vr.c:1288
 panic reproduced fixed untriaged — —
DF-1823 Low 6.7 aac_cam: unbounded sense-data bcopy heap overflow in aac_cam_complete (min(sense_len,sense_returned) not bounded to sizeof(sense_data)=32)
sys/dev/raid/aac/aac_cam.c:608
 none reproduced not_testable untriaged — —
DF-1825 Low 6.7 evdev_mt: unbounded match_slot in SYN_MT_REPORT path causes OOB heap read/write and KKASSERT panic
sys/dev/misc/evdev/evdev_mt.c:416
 none reproduced not_testable untriaged — —
DF-2084 Low 6.7 mpu401_un_init frees mpu401 struct without stopping/draining the live callout (use-after-free via mpu401_timeout)
sys/dev/sound/midi/mpu401.c:103
 dos reproduced fixed untriaged — —
DF-0797 High 6.6 Unvalidated vol_no from crafted volume header causes kernel heap OOB write in volume_map bitmap
sys/vfs/hammer/hammer_ondisk.c:210
 panic reproduced fixed untriaged — —
DF-1320 High 6.6 Unbounded MST stream_count overflows stack work_table[MAX_CONTROLLER_NUM=6] in update_mst_stream_alloc_table
sys/dev/drm/amd/display/dc/core/dc_link.c:2322
 none inconclusive not_testable untriaged — —
DF-1400 High 6.6 Stack buffer overflow in wi_write_wep LUCENT WEP-key load (wk_keylen up to 16 copied into wi_keydat[14])
sys/dev/netif/wi/if_wi.c:1751
 panic reproduced not_testable untriaged — —
DF-1781 High 6.6 drm_crtc: uninitialized heap read in drm_mode_setcrtc cleanup derefs garbage connector pointers
sys/dev/drm/drm_crtc.c:713
 panic reproduced fixed untriaged — —
DF-1243 Medium 6.6 mrsas_get_pd_list indexes local_pd_list with unchecked firmware deviceId (OOB write)
sys/dev/raid/mrsas/mrsas.c:3307
 none not_reproduced not_testable untriaged — —
DF-1244 Medium 6.6 mrsas_get_ld_list indexes ld_ids with unchecked firmware targetId (OOB byte write)
sys/dev/raid/mrsas/mrsas.c:3380
 none inconclusive not_testable untriaged — —
DF-1561 Medium 6.6 Stack OOB write in pp_dpm_get_pp_num_states when hwmgr->num_ps > 16
sys/dev/drm/amd/powerplay/amd_powerplay.c:619
 none inconclusive — untriaged — —
DF-1625 Medium 6.6 Integer overflow in VCE create-command img_size bypasses BO size validation
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:823
 panic reproduced fixed untriaged — —
DF-2507 Medium 6.6 afd_reinit frees softc without destroying disk orphaning device with freed memory (UAF / NULL-deref panic)
sys/dev/disk/nata/atapi-fd.c:176
 none not_reproduced not_testable untriaged — —
DF-0489 High 6.5 Neighbor Advertisement handler leaks route refcount on every received NA: remote kernel memory exhaustion DoS
sys/netinet6/nd6_nbr.c:734
 none not_reproduced not_testable untriaged — —
DF-0508 High 6.5 L2CAP ConfigReq unknown-option echo inflates m_pkthdr.len past mbuf data -> remote kernel heap info leak
sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c:599
 leak:252 reproduced not_testable untriaged — —
DF-0594 High 6.5 TKIP RX length underflow on too-short frames -> OOB read and KASSERT panic in wep_decrypt/michael_mic/m_copydata
sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:266
 panic reproduced fixed untriaged — —
DF-0596 Medium 6.5 Unsynchronized SMP race on xmitWin causes heap OOB write on timeSent[] in ng_pptpgre
sys/netgraph/pptpgre/ng_pptpgre.c:121
 dos reproduced fixed untriaged — —
DF-1646 Medium 6.5 bre() plex_concat builds rqe with negative sdoffset for subdisk-gap plexes, corrupting/arbitrary-leaking drive data outside the subdisk
sys/dev/raid/vinum/vinumrequest.c:494
 panic reproduced fixed untriaged — —
DF-2541 Medium 6.5 Network input paths X_ipip_input and pim_input dereference viftable/last_encap_vif without mroute_token racing vif teardown to NULL deref or 5.5MB OOB read
sys/net/ip_mroute/ip_mroute.c:1716
 panic reproduced fix_failed untriaged — —
DF-0524 High 6.4 Stored raw pointer to member ifnet with no refcount: UAF when member interface destroyed
sys/netgraph/fec/ng_fec.c:408
 panic reproduced fix_failed untriaged — —
DF-0525 High 6.4 ng_fec_tick iterates port list with no list lock: UAF race vs addport/delport
sys/netgraph/fec/ng_fec.c:579
 none not_reproduced not_testable untriaged — —
DF-0662 High 6.4 Use-after-free of readq: ng_device_disconnect frees readq BEFORE destroy_dev drains in-flight operations
sys/netgraph/ng_device.c:407
 none not_reproduced not_testable untriaged — —
DF-0732 High 6.4 TOCTOU in MACCMD_LIST: as_nacls read without lock before buffer sizing — heap OOB write (grow) and uninit heap info leak (shrink)
sys/netproto/802_11/wlan_acl/ieee80211_acl.c:313
 panic reproduced fixed untriaged — —
DF-1018 High 6.4 TRIM req->data heap buffer overflow and OOB DMA read via device-controlled small secsize
sys/bus/cam/scsi/scsi_da.c:1341
 none inconclusive not_testable untriaged — —
DF-1109 High 6.4 TOCTOU double-fetch of d->nmsgs in I2CRDWR ioctl causes kernel heap buffer overflow
sys/bus/iicbus/iic.c:291
 none not_reproduced not_testable untriaged — —
DF-1346 High 6.4 Heap buffer overflow populating VCE/UVD SMC levels from unclamped VBIOS MM-dependency count
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1298
 none inconclusive not_testable untriaged — —
DF-1496 High 6.4 Unbounded VBIOS ucSclkEntryNum overflows fixed 8-entry stack table in atomctrl_get_smc_sclk_range_table
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1368
 panic reproduced fixed untriaged — —
DF-1783 High 6.4 radeon_bios: heap buffer overflow in radeon_atrm_call - unbounded memcpy of ACPI-returned buffer into 256K BIOS buffer
sys/dev/drm/radeon/radeon_bios.c:183
 panic reproduced fixed untriaged — —
DF-0246 Medium 6.4 UAF: eventhandler dispatch traverses entry list without token while deregister frees entries
sys/kern/subr_eventhandler.c:114
 panic not_reproduced not_testable untriaged — —
DF-0296 Medium 6.4 UAF/cross-node races: peer hooks/nodes dereferenced without reference or peer-token
sys/netgraph7/netgraph/ng_base.c:1092
 dos inconclusive not_testable untriaged — —
DF-0306 Medium 6.4 UAF in add_bw_upcall: mfc pointer used after mroute_token released across blocking kmalloc
sys/net/ip_mroute/ip_mroute.c:2285
 none inconclusive not_testable untriaged — —
DF-0355 Medium 6.4 nd6_sysctl_drlist/prlist iterate defrouter/prefix lists without nd6_mtx: UAF race with RA processing
sys/netinet6/nd6.c:2168
 none inconclusive not_testable untriaged — —
DF-0503 Medium 6.4 ifnet locking-contract violation and stored-pointer UAF on member ifnets
sys/netgraph7/ng_fec.c:370
 none not_reproduced not_testable untriaged — —
DF-0529 Medium 6.4 Double-kfree/interior-pointer kfree in ng_fec_constructor error paths: heap corruption
sys/netgraph/fec/ng_fec.c:1085
 panic reproduced fix_failed untriaged — —
DF-0605 Medium 6.4 Use-after-free in pfi_get_ifaces() RB tree walk under concurrent interface detach
sys/net/pf/pf_if.c:763
 panic reproduced fixed untriaged — —
DF-0609 Medium 6.4 Missing return after m_freem in netisr_characterize causes UAF read and NULL-deref panic
sys/net/netisr.c:515
 panic reproduced fixed untriaged — —
DF-0664 Medium 6.4 Missing locking enables TOCTOU/UAF races across all device entry points
sys/netgraph/ng_device.c:309
 none not_reproduced not_testable untriaged — —
DF-0712 Medium 6.4 Undersized kmalloc in ieee80211_alloc_countryie: 3-byte heap overflow when channel list has >=84 distinct power runs
sys/netproto/802_11/wlan/ieee80211_regdomain.c:248
 none_observable_intra_object_padding reproduced fixed untriaged — —
DF-0735 Medium 6.4 ip_input/ip_output called from netgraph thread context: ASSERT_NETISR_NCPUS panic (INVARIANTS) and PFIL list UAF (production)
sys/netgraph7/ng_ipfw.c:245
 panic reproduced fixed untriaged — —
DF-0949 Medium 6.4 sys_mlockall use-after-free: stale vm_map_entry pointer held across vm_fault_wire which releases the map lock
sys/vm/vm_mmap.c:1066
 panic reproduced fixed untriaged — —
DF-1045 Medium 6.4 UAF in targclose: softc kfree'd before periph's targdtor runs
sys/bus/cam/scsi/scsi_target.c:207
 none not_reproduced not_testable untriaged — —
DF-1294 Medium 6.4 Unvalidated hypervisor sq_idx causes stack buffer overflow in ena_com_ind_tbl_convert_from_device
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1156
 none not_reproduced not_testable untriaged — —
DF-1404 Medium 6.4 cuse_server_open re-initializes global cuse_global_mtx on every /dev/cuse open corrupting lock state
sys/dev/misc/cuse/cuse.c:791
 none inconclusive — untriaged — —
DF-1502 Medium 6.4 Lockless driver: interrupt handler races musycc_disconnect freeing tx/rx descriptor rings (UAF)
sys/dev/misc/musycc/musycc.c:1341
 none inconclusive — untriaged — —
DF-1609 Medium 6.4 Heap OOB write in PowerPlay table entry callback via unbounded levels[index]
sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:736
 panic reproduced fixed untriaged — —
DF-1667 Medium 6.4 ath EDMA: m_rxpending use-after-free / double-free in ath_edma_stoprecv vs deferred tasklet
sys/dev/netif/ath/ath/if_ath_rx_edma.c:188
 panic reproduced fixed untriaged — —
DF-1685 Medium 6.4 agp: UAF / TOCTOU race between agp_find_memory and AGP_{BIND,UNBIND,FREE}_MEMORY
sys/dev/agp/agp.c:488
 panic reproduced fixed untriaged — —
DF-1768 Medium 6.4 ar9285_reset: unbounded EEPROM pwrPdg delta causes OOB write/read in GetGainBoundariesAndPdadcs
sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:650
 none inconclusive — untriaged — —
DF-1961 Medium 6.4 Heap OOB write in k8pnow_decode_pst insertion sort from unchecked pst->n_states>16
sys/dev/powermng/powernow/powernow.c:99
 none inconclusive — untriaged — —
DF-2157 Medium 6.4 Global safe_mem list has no concurrency protection: concurrent alloc/free corrupts linkage (UAF / double-unlink)
sys/dev/misc/tbridge/safe_mem.c:55
 corruption reproduced fixed untriaged — —
DF-2159 Medium 6.4 Unlocked traversal of irq_list in disable_irq/enable_irq and free_irq lookup yields UAF, double-free and SLIST_REMOVE NULL-deref panic
sys/dev/drm/linux_irq.c:116
 corruption reproduced fixed untriaged — —
DF-2233 Medium 6.4 Lockless list traversal in iconv_open/iconv_lookupcs/iconv_lookupconv allows use-after-free via concurrent module unload
sys/libiconv/iconv.c:146
 panic reproduced fixed untriaged — —
DF-2383 Medium 6.4 Use-after-free of softc in acpi_hp_notify vs. acpi_hp_detach (DF-2381 AcpiOsWaitEventsComplete no-op)
sys/dev/acpica/acpi_hp/acpi_hp.c:591
 panic reproduced not_testable untriaged — —
DF-2397 Medium 6.4 Unsynchronized AGP memory list operations enable UAF and TAILQ corruption via concurrent ioctls
sys/dev/agp/agp.c:455
 none not_reproduced not_testable untriaged — —
DF-2499 Medium 6.4 TAILQ_FOREACH iterates pending_hcbs while freeing each element use-after-free read
sys/dev/disk/nata/atapi-cam.c:885
 none not_reproduced not_testable untriaged — —
DF-2500 Medium 6.4 In-flight ATA requests outlive atapi_cam_detach atapi_cb dereferences freed hcb and destroyed state_lock
sys/dev/disk/nata/atapi-cam.c:619
 none not_reproduced not_testable untriaged — —
DF-2536 Medium 6.4 Sense-data bcopy length not capped to 32-byte sense buffer kernel heap overflow into CCB and info leak of request-frame memory
sys/dev/disk/mpt/mpt_cam.c:3141
 none not_reproduced not_testable untriaged — —
DF-0679 Low 6.4 Use-after-free: dangling match/nomatch hook pointers when ng_bpf_setprog fails in newhook
sys/netgraph7/bpf/ng_bpf.c:280
 none reproduced fixed untriaged — —
DF-0694 Low 6.4 wep_setkey missing upper-bound key length validation allows stack overflow in RC4 key buffer
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:122
 panic reproduced fixed untriaged — —
DF-1068 Low 6.4 pci_token does not serialize ioctl against kernel-side pci_devq mutation -> UAF/double-free window
sys/bus/pci/pci_user.c:59
 none reproduced fixed untriaged — —
DF-1394 Low 6.4 Heap OOB write in seq_open when more than 32 MIDI devices registered
sys/dev/sound/midi/sequencer.c:541
 none reproduced not_testable untriaged — —
DF-1501 Low 6.4 Heap OOB write in musycc_attach when PCI device reports nchan > NPORT
sys/dev/misc/musycc/musycc.c:1494
 panic reproduced fixed untriaged — —
DF-1649 Low 6.4 acpi_ec: EcSpaceHandler missing Width<=64 bound -> OOB past UINT64 Value buffer
sys/dev/acpica/acpi_ec.c:818
 panic reproduced fixed untriaged — —
DF-1670 Low 6.4 if_vke: select()/FD_SET stack buffer overflow when sc_fd >= FD_SETSIZE
sys/dev/virtual/vkernel/net/if_vke.c:631
 panic reproduced fixed untriaged — —
DF-1779 Low 6.4 radeon_dp_mst: latent unbounded idx into new_attribs[6]/cur_stream_attribs[6] + ignored VCPI alloc failure
sys/dev/drm/radeon/radeon_dp_mst.c:114
 panic reproduced fixed untriaged — —
DF-2113 Low 6.4 Use-after-free: unimplemented led_detach leaves dangling gpio pointer in surviving LED cdevs
sys/dev/misc/gpio/gpio_led.c:206
 none reproduced fixed untriaged — —
DF-2115 Low 6.4 Double dma_fence_put (UAF / double-free) on self-test copy-mismatch or kmap-failure paths
sys/dev/drm/amd/amdgpu/amdgpu_test.c:140
 none reproduced fixed untriaged — —
DF-2599 Low 6.4 output_ifp stored without ifnet lifetime protection UAF on interface detach
sys/netgraph7/ng_source.c:623
 none reproduced not_testable untriaged — —
DF-0593 Info 6.4 Latent UAF: fairq_class_destroy does not clear dangling pif_default pointer (currently unreachable via pf ioctls)
sys/net/altq/altq_fairq.c:428
 none not_reproduced not_testable untriaged — —
DF-1491 Info 6.4 Missing MIN() bound in mpr_config_get_raid_volume_pg0 allows firmware-controlled heap-buffer overrun into caller struct
sys/dev/raid/mpr/mpr_config.c:1295
 none reproduced not_testable untriaged — —
DF-0764 Medium 6.3 Stale worklist_tail in add_to_worklist — process_worklist_item LK_NOWAIT can free the tail causing UAF write + orphaned items + unmount panic
sys/vfs/ufs/ffs_softdep.c:462
 dos reproduced fixed untriaged — —
DF-0974 Medium 6.3 xpt_action_sasync_cb use-after-free race on async_node during concurrent register/unregister
sys/bus/cam/cam_xpt.c:3353
 none not_reproduced not_testable untriaged — —
DF-1194 Medium 6.3 ciss_init_logical and ciss_free use <= instead of < on ciss_logical array (off-by-one OOB write/kfree)
sys/dev/raid/ciss/ciss.c:1376
 none not_reproduced not_testable untriaged — —
DF-1285 Medium 6.3 INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN write fixed-size replies past dxfer_len-sized kernel buffer
sys/dev/raid/hptmv/entry.c:2709
 none inconclusive not_testable untriaged — —
DF-1398 Medium 6.3 Off-by-one OOB array access in all four remove_*_entry functions (index==allocated passes > check)
sys/dev/raid/vinum/vinumconfig.c:1728
 none inconclusive — untriaged — —
DF-1475 Medium 6.3 Off-by-one in PhyNum target-ID fallback allows heap OOB write past sassc->targets[]
sys/dev/raid/mpr/mpr_sas_lsi.c:885
 none inconclusive — untriaged — —
DF-1814 Medium 6.3 tw_cl_init: tw_cli_init_connection double-inserts req into FREE_Q on any submit_and_poll failure -> queue list corruption
sys/dev/raid/twa/tw_cl_init.c:677
 none inconclusive — untriaged — —
DF-2214 Medium 6.3 32-bit integer overflow in DMA copy size (num_gpu_pages << 12) silently truncates copy
sys/dev/drm/radeon/rv770_dma.c:44
 corruption reproduced fixed untriaged — —
DF-1255 Low 6.3 vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:466
 none reproduced fixed untriaged — —
DF-1384 Low 6.3 TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers
sys/dev/netif/nge/if_nge.c:1148
 none reproduced not_testable untriaged — —
DF-1637 Low 6.3 Double-free of crypto_session on cryptoapi_cipher_setkey failure
sys/dev/disk/dm/crypt/dm_target_crypt.c:559
 panic reproduced fixed untriaged — —
DF-2153 Low 6.3 Unchecked integer overflow in dma_fence_array_create size computation yields heap OOB write (latent, EXPORT_SYMBOL)
sys/dev/drm/linux_fence-array.c:173
 corruption reproduced fixed untriaged — —
DF-1413 High 6.1 Unchecked VBIOS conn_num drives OOB write past connectors[16] in update_slot_layout_info
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1732
 panic reproduced fixed untriaged — —
DF-1473 High 6.1 u16 truncation in EventDataLength*4 size computation causes zero-size alloc panic and undersized-buffer OOB read
sys/dev/raid/mpr/mpr_sas_lsi.c:136
 panic reproduced not_testable untriaged — —
DF-1642 High 6.1 kfree of uninitialized msg pointer in dm_message_ioctl when DM_MESSAGE_STR absent
sys/dev/disk/dm/dm_ioctl.c:1006
 panic reproduced fixed untriaged — —
DF-1696 High 6.1 mps_sas_lsi: u16 truncation of EventDataLength*4 panics on kmalloc(0) and yields OOB heap read
sys/dev/raid/mps/mps_sas_lsi.c:128
 panic reproduced not_testable untriaged — —
DF-2024 High 6.1 size_t underflow in multi-part SSIF write loop causes unbounded kernel heap OOB read and DoS
sys/dev/misc/ipmi/ipmi_ssif.c:126
 none inconclusive not_testable untriaged — —
DF-2227 High 6.1 Unbounded while(*cp!="\"") scan in XML attribute-value parser causes heap OOB read / kernel panic
sys/libprop/prop_object.c:484
 panic reproduced fixed untriaged — —
DF-0862 Medium 6.1 hpfs_bminit integer overflow in hpm_dbnum computation undersizes bitmap arrays OOB read/write
sys/vfs/hpfs/hpfs_subr.c:109
 panic reproduced fixed untriaged — —
DF-1012 Medium 6.1 Heap underflow write when VS_COLORFORMAT or VS_FRAME precedes any VS_FORMAT descriptor
sys/bus/u4b/uvc/uvc_drv.c:1836
 none not_reproduced not_testable untriaged — —
DF-1223 Medium 6.1 XPT_RESET_DEV frees a regular-pool command via the high-priority free list, corrupting command-pool accounting
sys/dev/raid/mpr/mpr_sas.c:3351
 none inconclusive not_testable untriaged — —
DF-1547 Medium 6.1 Missing cdb_len bounds check overflows the LRAM queue slot (sibling of DF-1356)
sys/dev/disk/advansys/advansys.c:548
 none inconclusive — untriaged — —
DF-2594 Medium 6.1 Unvalidated redo_data_bytes and REDO record size in recovery cause OOB kernel-memory read on mount of crafted image
sys/vfs/hammer/hammer_recover.c:1225
 panic reproduced fixed untriaged — —
DF-2595 Medium 6.1 Missing zero-length packet guard causes type confusion in bpf_filter OOB read panic
sys/netgraph/bpf/ng_bpf.c:403
 none reproduced fixed untriaged — —
DF-0471 High 6.0 ip_fw3_ctl_x: size_t underflow in sopt_valsize when <4 causes unbounded bcopy heap corruption/panic
sys/net/ipfw3/ip_fw3.c:1038
 panic reproduced fixed untriaged — —
DF-0661 High 6.0 Kernel stack overflow via unchecked user-controlled VLA in ngdread/ngdwrite
sys/netgraph/ng_device.c:509
 panic reproduced fixed untriaged — —
DF-1397 High 6.0 Heap overflow in plex/subdisk auto-naming via strcat past filled 64-byte name field
sys/dev/raid/vinum/vinumconfig.c:1455
 panic reproduced fixed untriaged — —
DF-0476 Medium 6.0 ip_fw3_register_module: strncpy bounded by strlen(src) not sizeof(dst): buffer overflow + missing NUL
sys/net/ipfw3/ip_fw3.c:180
 leak:22bytes reproduced fixed untriaged — —
DF-1177 Medium 6.0 rv_init_cp_jump_table: unbounded jt_size OOB write + NULL deref on missing mec2 firmware
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1078
 panic reproduced not_testable untriaged — —
DF-1733 Medium 6.0 vinumio: heap overflow on drivelist[] - DRIVEPARTS(35) smaller than loop bound (240) in vinum_scandisk
sys/dev/raid/vinum/vinumio.c:678
 none inconclusive — untriaged — —
DF-1750 Medium 6.0 amdgpu_acpi: heap OOB read and ACPI_OBJECT type confusion in 4 ATIF/ATCS return buffer parsers
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:199
 none inconclusive — untriaged — —
DF-1769 Medium 6.0 ar9285_reset: chain loop uses AR5416_MAX_CHAINS=3 on 4k EEPROM struct with calPierData2G[1][3] -> OOB type-confusion via txMask
sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:607
 none inconclusive — untriaged — —
DF-1875 Medium 6.0 Unvalidated PSP firmware header fields cause heap OOB write in fw_pri_buf (sysdrv + sos load) — variant of DF-1838 for Vega20/Navi10
sys/dev/drm/amd/amdgpu/psp_v11_0.c:122
 none inconclusive — untriaged — —
DF-1964 Medium 6.0 Orphaned worker thread / use-after-free when write-side _init fails in dm_target_delay_init
sys/dev/disk/dm/delay/dm_target_delay.c:104
 none inconclusive — untriaged — —
DF-2039 Medium 6.0 Use-after-free: discard_buffer_callout not drained before freeing sc->buf and destroying dev_lock in tpm20_release
sys/dev/crypto/tpm/tpm20.c:137
 panic reproduced fixed untriaged — —
DF-2065 Medium 6.0 si_load_smc_ucode ignores limit and trusts firmware header offset/size fields without bounds checking -- heap OOB read and unbounded SMC SRAM write
sys/dev/drm/radeon/si_smc.c:211
 panic reproduced not_testable untriaged — —
DF-2078 Medium 6.0 goto restart_search reads OOB past power-state array returning OOB pointer used to program SMC
sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:214
 dos reproduced fixed untriaged — —
DF-2105 Medium 6.0 Integer overflow in u32 bounds checks in ci_set_smc_sram_address and ci_copy_bytes_to_smc (wraparound defeats SMC SRAM upper bound)
sys/dev/drm/radeon/ci_smc.c:36
 none reproduced fixed untriaged — —
DF-2141 Medium 6.0 tokenize() writes token pointers with no bounds check -> static-BSS OOB write via VINUM_CREATE ioctl
sys/dev/raid/vinum/vinumparser.c:162
 corruption reproduced fixed untriaged — —
DF-2207 Medium 6.0 Signed 32-bit overflow in iounmap() byte-size math (npages * PAGE_SIZE) yields OOB pmap_unmapdev / wrong phys_avail match for >=2 GB mappings
sys/dev/drm/linux_iomapping.c:80
 panic reproduced fixed untriaged — —
DF-2262 Medium 6.0 XPT_DEV_MATCH trusts user-supplied EDT cookie kernel pointers: arbitrary kernel-address deref UAF KASLR leak
sys/bus/cam/cam_xpt.c:2446
 panic reproduced fixed untriaged — —
DF-0042 Low 6.0 Relocation r_offset never bounds-checked against target section size (OOB / wild kernel write)
sys/kern/link_elf_obj.c:940
 none reproduced fixed untriaged — —
DF-0061 Low 6.0 Relocation r_offset never bounds-checked against module size (DF-0042 analogue, wild write)
sys/kern/link_elf.c:714
 none reproduced fixed untriaged — —
DF-0072 Low 6.0 Missing sign/upper-bound validation on cfh_nfiles before heap alloc + file read (DoS; 32-bit integer-overflow heap OOB)
sys/kern/kern_checkpoint.c:596
 none reproduced fixed untriaged — —
DF-0975 Low 6.0 XPT_DEV_MATCH cookie fields are user-controlled kernel pointers blindly dereferenced (arbitrary kread / panic)
sys/bus/cam/cam_xpt.c:2444
 none reproduced fixed untriaged — —
DF-1313 Low 6.0 Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field
sys/dev/raid/hptiop/hptiop.c:1085
 none reproduced not_testable untriaged — —
DF-1317 Low 6.0 Heap buffer overflow in sbp_fix_inq_data via short INQUIRY data buffer
sys/dev/disk/sbp/sbp.c:1504
 none reproduced fixed untriaged — —
DF-1533 Low 6.0 Unbounded cmd_7k->generic.size used as SG-list write offset in 9K_SA passthru
sys/dev/raid/twa/tw_cl_io.c:295
 panic reproduced fixed untriaged — —
DF-1684 Low 6.0 scvidctl: integer overflow in sc_set_pixel_mode bounds check allows OOB video-memory write via KDRASTER
sys/dev/misc/syscons/scvidctl.c:318
 panic reproduced fixed untriaged — —
DF-2047 Low 6.0 tbridge_printf size_t underflow yields OOB kernel write once 128kB buffer fills
sys/dev/misc/tbridge/tbridge.c:139
 panic reproduced fixed untriaged — —
DF-0423 Medium 5.9 Stale reg_mif_num after MRT6_DEL_MIF: remote NULL-deref panic via PIM REGISTER to freed register mif
sys/netinet6/ip6_mroute.c:642
 panic inconclusive not_testable untriaged — —
DF-0741 Medium 5.9 gre_mobile_input bcopy size underflow (m_len-msiz-ip_hl*4) — huge overwrite when mobile header larger than mbuf
sys/netinet/ip_gre.c:223
 panic reproduced fixed untriaged — —
DF-1155 Medium 5.9 Heap overflow in isp_handle_platform_atio CDB copy (parallel SCSI target mode)
sys/dev/disk/isp/isp_freebsd.c:1926
 none not_reproduced not_testable untriaged — —
DF-0356 Low 5.9 nd6_resolve ln_hold mbuf accessed without nd6_mtx: UAF race with nd6_timer
sys/netinet6/nd6.c:2078
 dos reproduced fixed untriaged — —
DF-0486 Low 5.9 syncache_insert dereferences possibly-uninitialized sc2 in cache-overflow path when cachelimit=0
sys/netinet/tcp_syncache.c:359
 dos reproduced fixed untriaged — —
DF-0657 Low 5.9 ccmp_decrypt block-straddle path bounds-checked only by KASSERT (OOB read+write on oddly fragmented RX mbuf chains)
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:619
 panic reproduced fixed untriaged — —
DF-0044 Medium 5.8 mount_get_by_nc returns struct mount without a hold -> use-after-free via cache_fullpath racing dounmount
sys/kern/vfs_mount.c:1235
 none on this non-INVARIANTS kernel (race too tight); theoretical local DoS / info-leak if the race is won (unprivileged if vfs.usermount=1, else races a privileged unmount) not_reproduced — untriaged — —
DF-0137 Medium 5.8 Unlocked TAILQ traversal in varsymset_init() during fork: data race/UAF
sys/kern/kern_varsym.c:519
 panic reproduced fixed untriaged — —
DF-0565 Medium 5.8 Callout lifetime: ng_uncallout non-synchronizing + nglmi_shutdown omits ng_uncallout — ng7 twin of DF-0557
sys/netgraph7/lmi/ng_lmi.c:1053
 panic not_reproduced not_testable untriaged — —
DF-0725 Medium 5.8 if_clone_destroy UAF: drops ifnet_lock before dereferencing ifp->if_dname/if_dunit — concurrent destroy frees ifnet
sys/net/if_clone.c:110
 panic reproduced fixed untriaged — —
DF-1383 Medium 5.8 Out-of-bounds write in tl_encap when TX mbuf chain has exactly TL_MAXFRAGS non-empty mbufs totaling <64 bytes
sys/dev/netif/tl/if_tl.c:1794
 none inconclusive — untriaged — —
DF-2087 Medium 5.8 acpi_mapbase tracking list is mutated without any lock; concurrent AcpiOsMapMemory/UnmapMemory race into UAF and list corruption
sys/dev/acpica/Osd/OsdMemory.c:59
 dos reproduced fixed untriaged — —
DF-2252 Medium 5.8 Off-by-one NUL write before caller buffer when inlen <= 0
sys/libkern/hexncpy.c:52
 panic reproduced fixed untriaged — —
DF-2417 Medium 5.8 ADW_TARGET_GROUP macro off-by-factor-4 causes heap OOB write/read on user_sdtr[4] for all wide-SCSI targets (tid >= 4)
sys/dev/disk/advansys/adwlib.c:754
 none not_reproduced not_testable untriaged — —
DF-0380 Low 5.8 Non-atomic refcount --node->refs/--hook->refs under crit_enter only: cross-CPU UAF/double-free race
sys/netgraph/netgraph/ng_base.c:473
 dos reproduced fixed untriaged — —
DF-0395 Low 5.8 sta_lookup returns entry with table lock released: callers dereference unlocked TOCTOU use-after-free window
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1283
 dos reproduced fixed untriaged — —
DF-1916 Low 5.8 QCB free-list and queue manipulation race on SMP: crit_enter does not block cross-CPU ida_intr
sys/dev/raid/ida/ida.c:118
 panic reproduced fixed untriaged — —
DF-0195 High 5.7 Unlocked devstat list: concurrent device detach vs sysctl walk yields UAF (world-readable sysctl)
sys/kern/subr_devstat.c:268
 leak reproduced fixed untriaged — —
DF-2572 High 5.7 Use-after-free / NULL-deref: connection list mutated and traversed with no synchronization
sys/netgraph/ng_device.c:309
 none not_reproduced not_testable untriaged — —
DF-0965 Medium 5.7 twofish_set_key performs no key-length validation, allowing OOB stack writes and ctx corruption if reached with unsupported keylen
sys/crypto/twofish/twofish.c:425
 none not_reproduced not_testable untriaged — —
DF-1072 Medium 5.7 pnp_create_devices ANSI tag trim loop reads/writes stack below buf[0] with no lower bound
sys/bus/isa/pnp.c:398
 none not_reproduced not_testable untriaged — —
DF-1090 Medium 5.7 pnp_parse_desc accesses fixed descriptor offsets without validating payload length, causing heap OOB read and OOB byte-write
sys/bus/isa/pnpparse.c:90
 none not_reproduced fixed untriaged — —
DF-1464 Medium 5.7 Unbounded scatter/gather list copy overflows per-CCB sg_list when CAM_SCATTER_VALID is set
sys/dev/raid/dpt/dpt_scsi.c:730
 none inconclusive — untriaged — —
DF-1709 Medium 5.7 iwm_scan: integer overflow in iwm_scan_size()/iwm_config_umac_scan via unbounded firmware n_scan_channels -> heap OOB write
sys/dev/netif/iwm/if_iwm_scan.c:486
 none inconclusive — untriaged — —
DF-1713 Medium 5.7 evdev: use-after-free race on ev_absinfo/ev_mt vs concurrent device detach in unlocked ioctls
sys/dev/misc/evdev/cdev.c:351
 none inconclusive — untriaged — —
DF-2000 Medium 5.7 UAF race in icioctl SIOCSIFMTU vs concurrent icoutput (TX) and icintr (RX)
sys/dev/netif/ic/if_ic.c:205
 none inconclusive not_testable untriaged — —
DF-2263 Medium 5.7 EOF drain loop in sastart re-processes freed bio (double biodone / kernel hang)
sys/bus/cam/scsi/scsi_sa.c:1603
 dos reproduced fixed untriaged — —
DF-2336 Medium 5.7 Unbounded MMIO read/write in xHCI extended-capability list traversal
sys/bus/u4b/controller/xhci_pci.c:398
 none not_reproduced not_testable untriaged — —
DF-0088 Low 5.7 No runtime validation in free_unrl against out-of-range/double-free (KASSERT-only, defense-in-depth)
sys/kern/subr_unit.c:556
 none reproduced fixed untriaged — —
DF-0280 Low 5.7 Integer overflow in ptr_array allocation in pf_setup_pfsync_matching (32-bit only theoretical)
sys/net/pf/pf_ioctl.c:942
 none reproduced fixed untriaged — —
DF-0578 Low 5.7 SLIOCSUNIT struct-assigns embedded callout nodes: callout queue corruption
sys/net/sl/if_sl.c:365
 panic reproduced fixed untriaged — —
DF-1187 Low 5.7 arcmsr_build_srb 4GB-boundary split can overflow ARCMSR_CDB.u scatter list
sys/dev/raid/arcmsr/arcmsr.c:974
 panic reproduced not_testable untriaged — —
DF-1466 Low 5.7 Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data)
sys/dev/raid/dpt/dpt_scsi.c:858
 none reproduced fixed untriaged — —
DF-1477 Low 5.7 agp_i810_bind_memory offset check bypassed via 64-bit integer wraparound -> OOB GTT writes
sys/dev/agp/intel-gtt.c:1259
 panic reproduced fixed untriaged — —
DF-2007 Low 5.7 amdgpu_sa_bo_manager_fini mutates lists without acquiring sa_manager->wq.lock -- UAF / list-corruption race with concurrent reader
sys/dev/drm/amd/amdgpu/amdgpu_sa.c:77
 none reproduced not_testable untriaged — —
DF-2049 Low 5.7 No synchronization: concurrent LOADTEST frees tbridge_testcase out from under running test kthread (UAF)
sys/dev/misc/tbridge/tbridge.c:240
 panic reproduced not_testable untriaged — —
DF-2117 Low 5.7 drm_scdc_read/drm_scdc_write accept size_t but assign to uint16_t i2c_msg.len with no bounds check; drm_scdc_write can overflow 1+size before kmalloc/memcpy
sys/dev/drm/drm_scdc_helper.c:66
 none reproduced fixed untriaged — —
DF-2376 Low 5.7 Fire-and-forget AcpiOsExecute battery tasks can run after detach using freed softc (UAF)
sys/dev/acpica/acpi_cmbat.c:154
 panic reproduced not_testable untriaged — —
DF-1042 Medium 5.6 lapic_set_cpuid missing bounds validation allows OOB write to APIC ID mapping arrays via crafted MADT
sys/platform/pc64/apic/lapic.c:1212
 panic reproduced fixed untriaged — —
DF-1884 Medium 5.6 Missing bounds check on plexno in parityops allows OOB read/write on PLEX array
sys/dev/raid/vinum/vinumrevive.c:259
 none inconclusive — untriaged — —
DF-1506 Low 5.6 Missing emu_intr_unregister on detach and attach-failure leaves dangling IRQ consumer pointing at freed emu_pcm_info (UAF)
sys/dev/sound/pci/emu10kx-pcm.c:1453
 panic reproduced fixed untriaged — —
DF-0807 High 5.5 dirfs_readdir for-loop increment uses already-advanced dp — heap OOB read and memory disclosure
sys/vfs/dirfs/dirfs_vnops.c:1277
 leak reproduced not_testable untriaged — —
DF-0923 High 5.5 UAF of vm_map_backing and vm_map across per-iteration unlock in /proc/<pid>/map
sys/vfs/procfs/procfs_map.c:65
 panic reproduced fixed untriaged — —
DF-1329 High 5.5 Integer overflow in mpr_diag_read_buffer bounds check allows OOB read of diag DMA buffer
sys/dev/raid/mpr/mpr_user.c:1772
 none inconclusive not_testable untriaged — —
DF-2231 High 5.5 Unbounded attacker-controlled pref_len in _prop_object_copyin causes kernel panic / memory exhaustion (prop_object_copyin_limit dead variable)
sys/libprop/prop_kern.c:383
 dos reproduced fixed untriaged — —
DF-2281 High 5.5 sgwrite: size_t->int truncation of uio_resid into buf_len plus unchecked kmalloc/M_ZERO memset-on-NULL yields local kernel panic
sys/bus/cam/scsi/scsi_sg.c:648
 none not_reproduced not_testable untriaged — —
DF-0782 Medium 5.5 Integer overflow in fuse_vop_write at offset near INT64_MAX triggers KKASSERT panic via negative newsize
sys/vfs/fuse/fuse_vnops.c:1469
 panic reproduced fixed untriaged — —
DF-0919 Medium 5.5 Unvalidated fs->fs_frag causes kernel panic and OOB array access in FFS bitmap/fragacct helpers
sys/vfs/ufs/ffs_subr.c:195
 panic reproduced fixed untriaged — —
DF-0926 Medium 5.5 Type-confusion panic in fuse_alloc_node when daemon reuses nodeid with conflicting type
sys/vfs/fuse/fuse_node.c:106
 panic reproduced fixed untriaged — —
DF-1537 Medium 5.5 Unbounded WS operand index and NULL dereference when ws=0
sys/dev/drm/radeon/atom.c:233
 none inconclusive — untriaged — —
DF-1559 Medium 5.5 Signedness bug in copy_batch min_t causes kernel heap overflow with large batch_len
sys/dev/drm/i915/i915_cmd_parser.c:1104
 none inconclusive — untriaged — —
DF-1944 Medium 5.5 afd_reinit frees softc without destroying disk cdev: orphan /dev/afd* NULL-deref/UAF on next I/O
sys/dev/disk/nata/atapi-fd.c:168
 none inconclusive — untriaged — —
DF-1981 Medium 5.5 Missing feature-arg-count validation in _init_features allows kernel panic via crafted dmsetup table string
sys/dev/disk/dm/flakey/dm_target_flakey.c:131
 none inconclusive — untriaged — —
DF-2035 Medium 5.5 Divide-by-zero kernel panic in vega20_fan_ctrl_set_fan_speed_rpm via 8*speed uint32 wraparound
sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:186
 panic reproduced fixed untriaged — —
DF-2215 Medium 5.5 Unconditional memset on FREEBLKS bios writes to unmapped KVA causing kernel panic
sys/dev/disk/dm/dm_target_zero.c:43
 none not_reproduced not_testable untriaged — —
DF-2232 Medium 5.5 Signed integer overflow in idr_grow() growth loop causes kernel hang or panic-sized kmalloc
sys/libkern/linux_idr.c:427
 dos reproduced fixed untriaged — —
DF-2245 Medium 5.5 Unbounded recursion in kqsort causes kernel stack overflow on adversarial input
sys/libkern/qsort.c:173
 none not_reproduced not_testable untriaged — —
DF-2561 Medium 5.5 Accept-filter NULL-deref/UAF race in soisconnected vs do_setopt_accept_filter
sys/kern/uipc_socket2.c:252
 none not_reproduced not_testable untriaged — —
DF-1309 Low 5.5 Static buffer overflow in ath_ee_FillVpdTable via crafted EEPROM pdg power range >126
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2427
 none reproduced not_testable untriaged — —
DF-0612 Medium 5.4 ieee80211_parse_tdma() join path skips IE length and tdma_slot validation, enabling heap OOB write via setbit() from crafted beacon
sys/netproto/802_11/wlan/ieee80211_tdma.c:645
 oob_write reproduced fixed untriaged — —
DF-2578 Medium 5.4 OOB heap write via unchecked tdma_slot in ieee80211_parse_tdma
sys/netproto/802_11/wlan/ieee80211_tdma.c:657
 none not_reproduced not_testable untriaged — —
DF-0103 Medium 5.3 p_tracenode/p_traceflag mutated without target p_token -> refcount double-drop/UAF and NULL-deref TOCTOU
sys/kern/kern_ktrace.c:506
 panic reproduced fixed untriaged — —
DF-0162 Medium 5.3 Global modules TAILQ mutated without mod_token: unpriv readers race with privileged kldload/unload
sys/kern/kern_module.c:141
 none not_reproduced fixed untriaged — —
DF-0176 Medium 5.3 cttyioctl forwards ioctls to ttyvp without vnode reference (UAF race)
sys/kern/tty_tty.c:238
 none not_reproduced fixed untriaged — —
DF-1070 Medium 5.3 Teardown race in scsi_targ_bh: fixed hz/2 sleep with no wakeup allows CTIO completion after softc kfree (UAF)
sys/bus/cam/scsi/scsi_targ_bh.c:342
 none not_reproduced not_testable untriaged — —
DF-1120 Medium 5.3 Buddy allocator unbounded merge in ___sym_mfree causes heap OOB write past h[] array
sys/dev/disk/sym/sym_hipd.c:408
 panic reproduced not_testable untriaged — —
DF-1231 Medium 5.3 Use-after-free race in aac_getnext_aif: AIF context list traversed and dereferenced without aac_aifq_lock
sys/dev/raid/aac/aac.c:3519
 none not_reproduced not_testable untriaged — —
DF-1492 Medium 5.3 Missing minimum COUNT validation in r300_packet3_check allows OOB read/write past IB buffer
sys/dev/drm/radeon/r300.c:1176
 none inconclusive — untriaged — —
DF-1909 Medium 5.3 acp_hw_fini frees genpd without pm_genpd_remove: dangling UAF in global genpd list
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:217
 none inconclusive — untriaged — —
DF-2167 Medium 5.3 Integer overflow in evergreen_copy_dma size computation (sibling of DF-2091)
sys/dev/drm/radeon/evergreen_dma.c:115
 corruption reproduced fixed untriaged — —
DF-0021 Low 5.3 Signed-int overflow in oversized kmalloc size reconstruction (*kup << PAGE_SHIFT)
sys/kern/kern_slaballoc.c:1202
 leak reproduced fixed untriaged — —
DF-1082 Low 5.3 miibus device_t UAF race between uether_ifdetach and unprivileged SIOCGIFMEDIA ioctl
sys/bus/u4b/net/usb_ethernet.c:289
 panic reproduced fixed untriaged — —
DF-1101 Low 5.3 Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len, enabling OOB read via dup_sockaddr
sys/platform/vkernel64/x86_64/autoconf.c:351
 panic reproduced fixed untriaged — —
DF-1900 Low 5.3 Integer overflow in last_valid_bit can drive clear_bit with negative index into stack bitmap (latent: CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:127
 panic reproduced fixed untriaged — —
DF-2253 Low 5.3 sep==NULL misplaces NUL terminator and truncates output
sys/libkern/hexncpy.c:56
 none reproduced fixed untriaged — —
DF-2534 Low 5.3 xa_strategy / xa_size dereference sc without lifetime lock racing xa_terminate_check free
sys/dev/disk/xdisk/xdisk.c:801
 leak reproduced not_testable untriaged — —
DF-0365 Medium 5.2 ieee80211_media_setup unbounded rate-set merge overflows stack buffer rs_rates[15]: 17 unique rates across 11a/b/g/HALF/QUARTER
sys/netproto/802_11/wlan/ieee80211.c:1564 · 📝
 none not_reproduced not_testable disputed orchestrator —
DF-0633 Medium 5.2 ip_fw3_ctl_state_get reads every other CPU RB tree without synchronization
sys/net/ipfw3_basic/ip_fw3_state.c:422
 none not_reproduced not_testable untriaged — —
DF-0683 Medium 5.2 hci_disable modifies queues and link list without hci_devlock, racing with hci_intr (panic / mbuf UAF)
sys/netbt/hci_unit.c:250
 none not_reproduced not_testable untriaged — —
DF-0689 Medium 5.2 Unsynchronized encaptab list yields use-after-free in encap4_input/encap6_input dispatch
sys/netinet/ip_encap.c:174
 none not_reproduced not_testable untriaged — —
DF-1804 Medium 5.2 snp: UAF / infinite-loop race between snpclose and concurrent snplwrite/snp_in on snooped tty
sys/dev/misc/snp/snp.c:484
 none inconclusive — untriaged — —
DF-0248 Low 5.2 Lockless SLIST traversal in accept_filt_get races with crit_enter-only add/del -> UAF
sys/kern/uipc_accf.c:99
 none reproduced fixed untriaged — —
DF-2204 Low 5.2 No device-removal path and non-idempotent add: stale/UAF list nodes and list corruption on re-add
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85
 panic reproduced fixed untriaged — —
DF-0477 Medium 5.1 ip_fw3_ctl_get_modules: bcopy without checking strlen(module_str) <= sopt_valsize: buffer overflow
sys/net/ipfw3/ip_fw3.c:985
 dos reproduced fixed untriaged — —
DF-1540 Medium 5.1 Use-after-free read of dangling sch->hook in NGM_TEXT_STATUS after hook disconnect
sys/dev/netif/mn/if_mn.c:474
 none inconclusive — untriaged — —
DF-1989 Medium 5.1 No BAR bounds validation on TPM-reported buffer offsets and sizes
sys/dev/crypto/tpm/tpm_crb.c:187
 none inconclusive not_testable untriaged — —
DF-2110 Medium 5.1 Negative PCX width/height passes mode-match and drives a multi-exabyte bcopy -> kernel panic / OOB write past the video window
sys/dev/video/fb/pcx/splash_pcx.c:176
 panic reproduced fixed untriaged — —
DF-2121 Medium 5.1 Unsigned integer underflow in EFI variable name NUL-terminator check causes OOB read / kernel panic
sys/dev/misc/efirt/efidev.c:110
 panic reproduced fixed untriaged — —
DF-2410 Medium 5.1 TPM-reported CRB buffer offsets/sizes used as BAR offsets without any BAR bounds check (and off-by-one in offset normalization)
sys/dev/crypto/tpm/tpm_crb.c:188
 none not_reproduced not_testable untriaged — —
DF-0008 Low 5.1 vfs_setpublicfs() use-after-vput of root vnode + refcount leak on VFS_VPTOFH error
sys/kern/vfs_subr.c:2255
 none not_reproduced — untriaged — —
DF-0024 Low 5.1 Heap overflow in linker_search_path() via over-long kldload module name
sys/kern/kern_linker.c:1458
 corruption reproduced fixed untriaged — —
DF-0426 Low 5.1 MFC table protected only by crit_enter (local-CPU) not token/lock: cross-CPU UAF race
sys/netinet6/ip6_mroute.c:359
 dos reproduced fixed untriaged — —
DF-0726 Low 5.1 if_cloners list and if_cloners_count accessed without synchronization — unprivileged SIOCIFGCLONERS races module load/unload UAF
sys/net/if_clone.c:43
 none not_reproduced fixed untriaged — —
DF-1186 Low 5.1 arcmsr_handle_virtual_command INQUIRY always writes 36 bytes regardless of CAM dxfer_len
sys/dev/raid/arcmsr/arcmsr.c:2947
 panic reproduced fixed untriaged — —
DF-2303 Low 5.1 Latent negative-length bcopy in fwohci_arcv split-header reassembly can cause kernel panic
sys/bus/firewire/fwohci.c:2729
 corruption not_reproduced fixed untriaged — —
DF-2407 Low 5.1 Signed/unsigned promotion in tpm_tis12_write makes a zero-length write read past the stack buffer into the TPM
sys/dev/crypto/tpm/tpm.c:821
 panic reproduced not_testable untriaged — —
DF-0106 Medium 5.0 dkcksum32 OOB read via crafted disklabel in writedisklabel path
sys/kern/subr_disklabel32.c:358
 no observable runtime panic/leak on the writedisklabel path (bug real in source); sibling DF-0107 demonstrates the shared root-cause panic not_reproduced — untriaged — —
DF-0262 Low 4.8 IPv6 NAT destination-translation corrupts source address (copy-paste bug)
sys/net/pf/pf.c:3896
 none reproduced fixed untriaged — —
DF-0615 Medium 4.7 Unsynchronized address-selection policy table: UAF race between unprivileged sysctl reader and privileged ioctl mutator
sys/netinet6/in6_src.c:728
 leak:3384 reproduced fixed untriaged — —
DF-0696 Medium 4.7 Missing return after NG_FREE_DATA in ng_etf_rcvdata turns discard path into NULL-deref panic
sys/netgraph/etf/ng_etf.c:381
 none not_reproduced not_testable untriaged — —
DF-1035 Medium 4.7 bus_dmamap_load_uio uses stale absolute segment index after advancing segs pointer -> KKASSERT panic or OOB write
sys/platform/pc64/x86_64/busdma_machdep.c:961
 none not_reproduced not_testable untriaged — —
DF-2026 Medium 4.7 Multi-part SSIF response read loop has no iteration cap -- infinite-loop DoS via malicious BMC
sys/dev/misc/ipmi/ipmi_ssif.c:255
 none inconclusive not_testable untriaged — —
DF-0076 Low 4.7 soisconnected derefs head->so_accf based on inherited child SO_ACCEPTFILTER flag (NULL-deref/UAF race)
sys/kern/uipc_socket2.c:252
 none reproduced fixed untriaged — —
DF-0108 Low 4.7 Unvalidated d_secsize in writedisklabel enables oversized I/O transfer
sys/kern/subr_disklabel32.c:336
 panic reproduced fixed untriaged — —
DF-0367 Low 4.7 lagg_input dereferences ifp->if_lagg unlocked: UAF during concurrent port detach
sys/net/lagg/if_lagg.c:1442
 dos reproduced fixed untriaged — —
DF-0396 Low 4.7 sta_iterate drops table lock across user callback: entry can be freed concurrently use-after-free
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1413
 dos reproduced fixed untriaged — —
DF-0891 Low 4.7 tmpfs_mount dereferences uninitialized root pointer before error check
sys/vfs/tmpfs/tmpfs_vfsops.c:212
 panic reproduced not_testable untriaged — —
DF-0935 Low 4.7 Stack buffer overflow via unbounded ksprintf into psbuf[512] in /proc/<pid>/rlimit
sys/vfs/procfs/procfs_rlimit.c:64
 none not_reproduced not_testable untriaged — —
DF-0978 Low 4.7 pmap_remove_all/pmap_remove_specific: pv_entry accessed without hold after releasing pm_spin (speculative UAF)
sys/platform/pc64/x86_64/pmap.c:4840
 none reproduced fixed untriaged — —
DF-1422 Low 4.7 isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters
sys/dev/disk/isp/isp_pci.c:1629
 none reproduced not_testable untriaged — —
DF-1425 Low 4.7 Unchecked HBA-controlled msg_len in screen-service writes NUL byte at arbitrary scratch offset
sys/dev/raid/iir/iir.c:1717
 none reproduced fixed untriaged — —
DF-1601 Low 4.7 ks_kbds slave list torn down without kbd_token in kbdmux_term, racing KBDIO_UNLOADING callback (UAF / list corruption)
sys/dev/misc/kbdmux/kbdmux.c:452
 panic reproduced fixed untriaged — —
DF-1986 Low 4.7 Missing cleanup on agp_via_attach failure leaks /dev/agpgart with freed softc -> NULL-deref kernel panic
sys/dev/agp/agp_via.c:180
 none reproduced not_testable untriaged — —
DF-1988 Low 4.7 radeon_sa_bo_manager_fini manipulates SA lists without holding wq.lock (race condition / potential UAF)
sys/dev/drm/radeon/radeon_sa.c:82
 none reproduced not_testable untriaged — —
DF-2074 Low 4.7 mlxd_strategy dereferences stale/uninitialized bio_driver_info instead of dev->si_drv1
sys/dev/raid/mlx/mlx_disk.c:161
 panic reproduced not_testable untriaged — —
DF-2147 Low 4.7 Unguarded aux_offset[instance] array index from firmware-derived i2c_id
sys/dev/drm/radeon/radeon_dp_auxch.c:63
 corruption reproduced fixed untriaged — —
DF-2158 Low 4.7 _free_safe_mem dereferences hdr->alloc_sz to compute tail/mem before any integrity check (OOB read)
sys/dev/misc/tbridge/safe_mem.c:116
 corruption reproduced fixed untriaged — —
DF-2396 Low 4.7 UAF: sysctl sensor read races kfree of sensor arrays in detach
sys/dev/acpica/aibs/atk0110.c:268
 corruption not_reproduced not_testable untriaged — —
DF-2544 Low 4.7 Missing bounds check in devclass_alloc_unit permits heap underflow write / NULL-deref panic for negative non-wildcard unit
sys/kern/subr_bus.c:1067
 panic reproduced not_testable untriaged — —
DF-2565 Low 4.7 in_delayed_cksum writes through unchecked m_pullup return and silently drops the (possibly reallocated) mbuf pointer
sys/netinet/ip_output.c:949
 none reproduced not_testable untriaged — —
DF-2340 High 4.6 Multicast filter buffer allocated before device descriptor is fetched -> write through ZERO_LENGTH_PTR in kue_setmulti
sys/bus/u4b/net/if_kue.c:488
 panic reproduced fixed untriaged — —
DF-1040 Medium 4.6 Unvalidated 32-bit CIS longlink/MFC target address causes wild bus_space_read_1 and kernel panic
sys/bus/pccard/pccard_cis.c:386
 panic inconclusive not_testable untriaged — —
DF-1278 Medium 4.6 Infinite recursion in mpt_configure_ioc due to tn++ post-increment bypasses retry limit -> stack overflow
sys/dev/disk/mpt/mpt.c:2630
 none inconclusive not_testable untriaged — —
DF-1626 Medium 4.5 VCE IB parser lacks per-field dword bounds, enabling OOB read (pass 1) and OOB write (pass 2) into shared SA BO pool
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:724
 panic reproduced fixed untriaged — —
DF-0434 Low 4.5 bpf_filter_read (knote f_event) reads bd_* state and re-arms callout without bpf_token: race
sys/net/bpf.c:1206
 dos reproduced fixed untriaged — —
DF-0511 Low 4.5 UAF/stale-socket race in deferred upcall ng_ksocket_incoming2: queued so pointer may be freed by shutdown
sys/netgraph7/ksocket/ng_ksocket.c:985
 none reproduced fixed untriaged — —
DF-0951 Low 4.5 Missing vm_token on LIST_REMOVE in zinitna ZONE_INTERRUPT error path allows zlist corruption race with sysctl_vm_zone
sys/vm/vm_zone.c:358
 panic reproduced not_testable untriaged — —
DF-0968 Low 4.5 rijndael_blockEncrypt CBC mode reads/writes full 16-byte block even when numBlocks==0 (non-block-aligned inputLen)
sys/crypto/rijndael/rijndael-api-fst.c:93
 leak reproduced not_testable untriaged — —
DF-1679 Low 4.5 drm_open updates dev->open_count without drm_global_mutex (documented lock contract violation)
sys/dev/drm/drm_file.c:330
 none reproduced fixed untriaged — —
DF-1878 Low 4.5 radeon_dp_work_func walks connector_list without mode_config mutex (acknowledged in source)
sys/dev/drm/radeon/radeon_irq_kms.c:98
 panic reproduced fixed untriaged — —
DF-2126 Low 4.5 Legacy DMA mmap path returns a kernel virtual address where a page-frame-number is required (type confusion in a_result)
sys/dev/drm/drm_vm.c:66
 leak reproduced fixed untriaged — —
DF-2473 Low 4.5 isp_handle_platform_atio copies firmware CDB length into 16-byte cdb_bytes without bound (target-mode heap overflow)
sys/dev/disk/isp/isp_freebsd.c:1926
 limited_write reproduced fixed untriaged — —
DF-0895 High 4.4 OOB heap read via unvalidated FUSE daemon reply size in INIT/STATFS/STATVFS
sys/vfs/fuse/fuse_vfsops.c:216
 leak:80bytes reproduced fixed untriaged — —
DF-2571 High 4.4 Kernel stack overflow via user-controlled VLA in ngdread() and ngdwrite()
sys/netgraph/ng_device.c:509
 none not_reproduced not_testable untriaged — —
DF-0055 Medium 4.4 Use-after-free of shared udev event dictionary in udev_event_externalize (multi-reader)
sys/kern/kern_udev.c:540
 panic reproduced fixed untriaged — —
DF-0502 Medium 4.4 ng_fec_shutdown infinite loop when member interface destroyed: dangling pointer + unkillable loop
sys/netgraph7/ng_fec.c:1335
 dos inconclusive not_testable untriaged — —
DF-0528 Medium 4.4 ng_fec_rmnode infinite loop when member interface vanished: dangling ptr + unkillable loop
sys/netgraph/fec/ng_fec.c:1224
 none not_reproduced not_testable untriaged — —
DF-1423 Medium 4.4 Integer overflow in raw-service ioctl bounds check bypasses scratch-size guard
sys/dev/raid/iir/iir.c:1036
 none inconclusive — untriaged — —
DF-1516 Medium 4.4 Integer overflow in buffer bounds check bypasses offset validation in check_overlay_src
sys/dev/drm/i915/intel_overlay.c:1033
 none inconclusive — untriaged — —
DF-2081 Medium 4.4 Missing privilege check on SIOCGATHSPECTRAL allows unprivileged radio reconfiguration and enables memory bugs
sys/dev/netif/ath/ath/if_ath_spectral.c:181
 dos reproduced fixed untriaged — —
DF-2203 Medium 4.4 Unbounded write to stack array tmp_topology overflows when hive exceeds 4 nodes
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:66
 panic reproduced fixed untriaged — —
DF-2592 Medium 4.4 Kernel heap memory disclosure via ip_fw3_ctl_set_get unbounded bcopy from 4-byte field
sys/net/ipfw3/ip_fw3_set.c:206
 leak:4088 reproduced fixed untriaged — —
DF-0059 Low 4.4 Uninitialized segs[1]/segs[0] dereference when fewer than 2 PT_LOAD segments
sys/kern/link_elf.c:399
 none reproduced fixed untriaged — —
DF-0642 Low 4.4 Signed nssid bypass in ieee80211_scan_copy_ssid causes heap buffer overflow and kernel panic
sys/netproto/802_11/wlan/ieee80211_scan.c:296
 panic reproduced fixed untriaged — —
DF-0746 Low 4.4 Use-after-free in l2cap_rtx: req->lr_id read after zfree in DPRINTF
sys/netbt/l2cap_misc.c:190
 none reproduced fixed untriaged — —
DF-0853 Low 4.4 high_sierra flag is sticky — type confusion when descriptors are mixed in crafted ISO
sys/vfs/isofs/cd9660/cd9660_vfsops.c:334
 none reproduced fixed untriaged — —
DF-1304 Low 4.4 mlx_user_command DCDB fixup writes dcdb_physaddr past undersized heap buffer
sys/dev/raid/mlx/mlx.c:1872
 none reproduced not_testable untriaged — —
DF-1372 Low 4.4 oce_handle_passthrough writes through direct user-pointer dereference (SMAP panic)
sys/dev/netif/oce/oce_if.c:1806
 none reproduced not_testable untriaged — —
DF-1592 Low 4.4 Unvalidated csio->cdb_len overflows cmd_pkt->cmd.pkt_a.cdb[16] in tws_execute_scsi
sys/dev/raid/tws/tws_cam.c:757
 panic reproduced fixed untriaged — —
DF-1651 Low 4.4 sbsh: SIOCLOADFIRMW firmware pointer dereferenced in kernel without copyin -> fatal page fault
sys/dev/netif/sbsh/if_sbsh.c:409
 panic reproduced fixed untriaged — —
DF-1700 Low 4.4 vn: signed integer overflow in file-backed disk-size math (vn->sc_size = vn_size * PAGE_SIZE / DEV_BSIZE)
sys/dev/disk/vn/vn.c:559
 panic reproduced fixed untriaged — —
DF-1838 Low 4.4 PSP firmware header fields used without bounds validation: heap overflow and OOB read on corrupt SOS/ASD firmware
sys/dev/drm/amd/amdgpu/psp_v3_1.c:126
 none reproduced not_testable untriaged — —
DF-1905 Low 4.4 Missing AcpiRemoveNotifyHandler in detach leaves dangling ACPI notify handler: UAF/freed-text jump after kldunload
sys/dev/acpica/acpi_dock/acpi_dock.c:518
 panic reproduced fixed untriaged — —
DF-1915 Low 4.4 ida_detach frees DMA maps and QCB memory while I/O may be in flight: UAF/panic
sys/dev/raid/ida/ida.c:276
 panic reproduced fixed untriaged — —
DF-2009 Low 4.4 Negative uio_resid in led_write causes guaranteed kernel panic (OOB write to non-canonical address)
sys/dev/misc/led/led.c:232
 none reproduced not_testable untriaged — —
DF-2150 Low 4.4 dm-linear loads tables with no offset/length bounds check; offset arithmetic overflows and breaks device confinement
sys/dev/disk/dm/linear/dm_target_linear.c:75
 none reproduced fixed untriaged — —
DF-2347 Low 4.4 Lockless check/use race on bus->ifp between usbpf_xfertap and clone/teardown causes NULL-deref/UAF panic
sys/bus/u4b/usb_pf.c:362
 panic reproduced not_testable untriaged — —
DF-2381 Low 4.4 Use-after-free in detach: deferred ACPI notify callback runs on freed softc (AcpiOsWaitEventsComplete is a no-op in DragonFly)
sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:331
 panic reproduced not_testable untriaged — —
DF-2515 Low 4.4 SCSI CDB heap buffer overflow past orb[7] into ind_ptr on 16-byte CDBs
sys/dev/disk/sbp/sbp.c:2337
 limited_write reproduced fixed untriaged — —
DF-1075 Medium 4.3 Multicast filter buffer allocated before device descriptor is read -> OOB write / kernel panic on interface up
sys/bus/u4b/net/if_kue.c:488
 panic reproduced not_testable untriaged — —
DF-0394 Low 4.3 SSID/rates/xrates copies rely solely on upstream parse_beacon validation: KASSERT is no-op on production kernels
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:282
 none reproduced fixed untriaged — —
DF-1073 Low 4.3 pnp_check_quirks PNP_QUIRK_EXTRA_IO writes past ic_port[ISA_NPORT] without bounds check
sys/bus/isa/pnp.c:335
 none reproduced fixed untriaged — —
DF-1121 Low 4.3 Extended SCSI message with length=7 causes 1-byte DMA write past msgin[8] into lastmsg
sys/dev/disk/sym/sym_hipd.c:1652
 panic reproduced fixed untriaged — —
DF-1654 Medium 4.2 sbsh: RX descriptor length=0 with only 2046 bytes after m_adj(m,2) -> heap overflow
sys/dev/netif/sbsh/if_sbsh.c:767
 panic reproduced fixed untriaged — —
DF-1968 Medium 4.2 Integer overflow in radeon fbcon size math yields undersized GEM object with stale full pitch
sys/dev/drm/radeon/radeon_fb.c:154
 none inconclusive — untriaged — —
DF-0119 Info 4.2 Latent OOB write if aux_data/aux_size invariant breaks
sys/kern/subr_diskiocom.c:207
 none reproduced fixed untriaged — —
DF-1699 Medium 4.1 vn: unsynchronized UAF race between vnstrategy I/O path and VNIOCDETACH/vnclear
sys/dev/disk/vn/vn.c:260
 none inconclusive — untriaged — —
DF-1744 Medium 4.1 mpt_pci: use-after-free - DMA request pool freed before interrupt handler torn down
sys/dev/disk/mpt/mpt_pci.c:657
 none inconclusive — untriaged — —
DF-2607 Medium 4.1 TOCTOU/UAF on bus->ifp between usbpf_xfertap (bus-locked) and usbpf_clone_destroy (unlocked)
sys/bus/u4b/usb_pf.c:362
 none not_reproduced not_testable untriaged — —
DF-0298 Low 4.1 ng_type->refs refcount mutated without typelist lock
sys/netgraph7/netgraph/ng_base.c:636
 none reproduced fixed untriaged — —
DF-0523 Low 4.1 Deferred INTERNAL_UPCALL re-invokes upcall against torn-down node/socket: UAF/NULL deref (DF-0511 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:623
 none reproduced fixed untriaged — —
DF-0637 Low 4.1 ngt_close frees sc while ngt_timeout callout can still reference it (UAF / deadlock)
sys/netgraph/tty/ng_tty.c:256
 none not_reproduced — untriaged — —
DF-0985 Low 4.1 mtw_ucode_write heap overflow via oversized firmware ILM/DLM lengths (firmware-supplied metadata overflows txd_fw->buf[])
sys/bus/u4b/wlan/if_mtw.c:1056
 none reproduced fixed untriaged — —
DF-1094 Low 4.1 Use-after-free of acpi_event_info during detach races in-flight AcpiOsExecute event work
sys/bus/gpio/gpio_acpi/gpio_acpi.c:341
 panic reproduced fixed untriaged — —
DF-1100 Low 4.1 Unsynchronized use-after-free of bus->ifp in usbpf_xfertap (DONE tap path)
sys/bus/u4b/usb_pf.c:362
 panic reproduced fixed untriaged — —
DF-1220 Low 4.1 acpi_eval_osc() dereferences _OSC return without validating it is a Buffer
sys/dev/acpica/acpi.c:1326
 none reproduced fixed untriaged — —
DF-1303 Low 4.1 mlx_getslot uses firmware-reported me_max_commands as array bound without clamping to MLX_NSLOTS
sys/dev/raid/mlx/mlx.c:1962
 none reproduced fixed untriaged — —
DF-1701 Low 4.1 vn: unlocked SLIST vn_list mutations vs SLIST_FOREACH in vnget -> list corruption / UAF
sys/dev/disk/vn/vn.c:137
 panic reproduced fixed untriaged — —
DF-1831 Low 4.1 ichwd_attach fail path dereferences ZERO_LENGTH_PTR softc, panicking on attach failure
sys/dev/misc/ichwd/ichwd.c:603
 panic reproduced fixed untriaged — —
DF-1842 Low 4.1 amr_cam_attach overflows amr_cam_sim[] if controller reports more than AMR_MAX_CHANNELS channels
sys/dev/raid/amr/amr_cam.c:170
 panic reproduced fixed untriaged — —
DF-1906 Low 4.1 UAF on clockmod_dom in clockmod_dom_sysctl_select across sysctl_handle_string sleep
sys/dev/powermng/clockmod/clockmod.c:430
 none not_reproduced fixed untriaged — —
DF-1963 Low 4.1 Use-after-free in MOD_UNLOAD: kfree(k8pnow_current_state) before sysctl_ctx_free
sys/dev/powermng/powernow/powernow.c:322
 panic reproduced fixed untriaged — —
DF-2082 Low 4.1 amrd_detach runs without synchronizing in-flight bios UAF in amrd_intr after controller detach
sys/dev/raid/amr/amr_disk.c:276
 dos reproduced fixed untriaged — —
DF-2116 Low 4.1 UAF/TOCTOU race: IRQ handler dereferences sc->mpu while detach frees it (mpu401_uninit runs before emu_intr_unregister)
sys/dev/sound/pci/emu10kx-midi.c:223
 corruption reproduced fixed untriaged — —
DF-2143 Low 4.1 splash_unregister leaves stale decoder pointers in decoder_set (use-after-unload)
sys/dev/video/fb/splash.c:146
 corruption reproduced fixed untriaged — —
DF-2228 Low 4.1 ACPI notify-handler use-after-free in detach via DragonFly no-op AcpiOsWaitEventsComplete stub
sys/gnu/dev/misc/apple_gmux/apple-gmux.c:919
 none not_reproduced not_testable untriaged — —
DF-2261 Low 4.1 PROBE_SERIAL_NUM_1 OOB-read of VPD 0x80 response and XPT_GDEV_TYPE overflow of cgd->serial_num[252]
sys/bus/cam/cam_xpt.c:6335
 leak reproduced fixed untriaged — —
DF-2307 Low 4.1 UAF race in gpio_acpi_unmap_aei: deferred AEI event handler dereferences freed info struct
sys/bus/gpio/gpio_acpi/gpio_acpi.c:347
 panic reproduced fixed untriaged — —
DF-2326 Low 4.1 pci_devq traversal in PCIOCGETCONF is unprotected: pci_token is single-taker races pci_freecfg (UAF)
sys/bus/pci/pci_user.c:59
 none not_reproduced not_testable untriaged — —
DF-2374 Low 4.1 Use-after-free race between acpiioctl() hook dispatch and acpi_deregister_ioctl()
sys/dev/acpica/acpi.c:3407
 corruption not_reproduced not_testable untriaged — —
DF-2393 Low 4.1 Use-after-free of softc in notify handler during detach (AcpiOsWaitEventsComplete is a no-op) DF-2381 class
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:273
 panic not_reproduced not_testable untriaged — —
DF-2409 Low 4.1 Use-after-free via un-drained discard_buffer_callout on device detach
sys/dev/crypto/tpm/tpm20.c:138
 panic reproduced not_testable untriaged — —
DF-2454 Low 4.1 Buggy ksnprintf length tracking in dm_target_stripe_table/info overruns heap params buffer when output is truncated
sys/dev/disk/dm/striped/dm_target_striped.c:170
 none reproduced not_testable untriaged — —
DF-2457 Low 4.1 fd_detach stops only two of fd three callouts leaving fd_iotimeout armed over freed softc
sys/dev/disk/fd/fd.c:1090
 panic reproduced not_testable untriaged — —
DF-2526 Low 4.1 trm_detach tears down DMA/IOPORT resources before bus_teardown_intr interrupt handler can execute against freed memory during detach
sys/dev/disk/trm/trm.c:3696
 corruption reproduced fixed untriaged — —
DF-2528 Low 4.1 Unlocked vn_softc state in vnstrategy/vnget races vnclear -> NULL deref or UAF
sys/dev/disk/vn/vn.c:272
 none not_reproduced not_testable untriaged — —
DF-2530 Low 4.1 Unclamped sense_len overflows 32-byte inline sense_data buffer on CHECK CONDITION
sys/dev/disk/vpo/vpo.c:266
 limited_write reproduced fixed untriaged — —
DF-0368 Info 4.1 lagg_clone_create error path calls if_free on embedded ifnet: latent double-free if protocol attach ever fails
sys/net/lagg/if_lagg.c:304
 none reproduced not_testable untriaged — —
DF-0385 Info 4.1 config_red kfrees caller-owned possibly-embedded struct on red_lookup_depth==0 path: latent UAF — same as v1
sys/net/dummynet3/ip_dummynet3.c:1364
 none reproduced not_testable untriaged — —
DF-1710 Info 4.1 amdgpu_vcn: firmware header fields used without bounds checks - heap overflow via crafted firmware (defense-in-depth)
sys/dev/drm/amd/amdgpu/amdgpu_vcn.c:126
 panic reproduced fixed untriaged — —
DF-1904 Info 4.1 snprintf_count returns UINT_MAX when called with bufSize==0 risking wild-pointer writes (latent: no caller in tree)
sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer_debug.c:48
 none reproduced not_testable untriaged — —
DF-2314 Medium 4.0 Missing large_len>0 guard in ANSI-string trim walks buf[] backwards (OOB stack read + NUL write + stack info-leak via device desc)
sys/bus/isa/pnp.c:399
 leak reproduced fixed untriaged — —
DF-2315 Low 4.0 pnp_check_quirks PNP_QUIRK_EXTRA_IO writes ic_port[] past ISA_NPORT without bounds check
sys/bus/isa/pnp.c:335
 corruption reproduced fixed untriaged — —
DF-2525 Low 4.0 trm_check_eeprom default-load writes 8-byte u_long into 4-byte field schema 122-byte OOB write of static trm_eepromBuf[] on x86_64 at attach
sys/dev/disk/trm/trm.c:3304
 limited_write reproduced fixed untriaged — —
DF-0095 Low 3.9 Per-process shmmap_state sized at alloc-time shmseg but all loops re-read LIVE root-writable shminfo.shmseg - OOB when raised
sys/kern/sysv_shm.c:284
 none reproduced fixed untriaged — —
DF-0295 Low 3.9 UAF race in setappie: non-atomic pointer swap/free vs concurrent beacon/IE readers
sys/netproto/802_11/wlan/ieee80211_ioctl.c:2272
 none reproduced fixed untriaged — —
DF-0597 Low 3.9 Use-after-free in ng_pptpgre (netgraph7) session timer callbacks after hook disconnect frees hpriv
sys/netgraph7/pptpgre/ng_pptpgre.c:494
 panic reproduced fixed untriaged — —
DF-0629 Low 3.9 ng_ether_rcv_upper skips bridge_input_p handoff, bypassing bridge input filtering on upper-hook-injected packets
sys/netgraph/ether/ng_ether.c:582
 none reproduced fixed untriaged — —
DF-2014 Low 3.9 radeon_gart_unbind GPU-page index t desyncs from CPU-page index p when a page slot is NULL, leaving stale DMA mappings in the GART table
sys/dev/drm/radeon/radeon_gart.c:254
 none reproduced not_testable untriaged — —
DF-0413 Info 3.9 Primitive parse functions write to output buffer without checking *buflen: missing defense-in-depth bounds check
sys/netgraph7/netgraph/ng_parse.c:332
 none reproduced not_testable untriaged — —
DF-2101 Low 3.7 DSCSR_10FDX status branch sets IFM_HDX instead of IFM_FDX (duplex misreport -> duplex-mismatch DoS)
sys/dev/netif/mii_layer/amphy.c:268
 none reproduced fixed untriaged — —
DF-0147 Low 3.6 Signed/unsigned accounting: int64_t delta added to uint64_t ac_bytes can wrap
sys/kern/vfs_quota.c:160
 none reproduced fixed untriaged — —
DF-0209 Low 3.6 clist_nextc trusts caller cp without validating within live ring window
sys/kern/tty_subr.c:229
 none reproduced fixed untriaged — —
DF-0537 Low 3.6 TOCTOU race on priv->datasock in ng_connect_data: check unlocked, set under lock
sys/netgraph7/socket/ng_socket.c:790
 dos reproduced fixed untriaged — —
DF-0549 Low 3.6 netmap_obj_offset returns 0 on error indistinguishable from valid offset 0: masks failures
sys/net/netmap/netmap_mem2.c:227
 none reproduced fixed untriaged — —
DF-0639 Low 3.6 Compress path avail_in integer underflow (avail_in = inlen - 1) on 0-length mbuf
sys/netgraph7/deflate/ng_deflate.c:451
 panic reproduced fixed untriaged — —
DF-0851 Low 3.6 Stale dereference of rootp after pribp released — use-after-free style read on buffer cache recycle
sys/vfs/isofs/cd9660/cd9660_vfsops.c:435
 none not_reproduced fixed untriaged — —
DF-1005 Low 3.6 usbd_get_phys strlen(phys)-1 underflows to 255 when phys empty -> OOB null-byte write at phys[255] (latent)
sys/bus/u4b/usb_device.c:2273
 none reproduced fixed untriaged — —
DF-1043 Low 3.6 ufoma sysctl handlers access freed sc_modetable after detach (UAF)
sys/bus/u4b/serial/ufoma.c:453
 none not_reproduced not_testable untriaged — —
DF-1525 Low 3.6 Unbounded channel index causes OOB write past openedaudio[] in sound_oss_sysinfo
sys/dev/sound/pcm/sound.c:1308
 dos reproduced fixed untriaged — —
DF-0099 Low 3.4 Off-by-one heap NUL-byte overflow in vfs_mountroot_try via ksscanf width/buffer-size mismatch
sys/kern/vfs_conf.c:419
 none reproduced fixed untriaged — —
DF-0462 Low 3.4 bzero targets wrong field (&conf not &stats) with wrong size (session_stats=32 not sess_config=8): 24-byte intra-struct overflow
sys/netgraph7/l2tp/ng_l2tp.c:748
 none reproduced fixed untriaged — —
DF-0722 Low 3.4 Unit-number bitmap length tracked in unsigned char: truncates after ~2040 nodes causing duplicate unit allocation (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:103
 dos inconclusive — untriaged — —
DF-1241 Low 3.4 iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-byte overflow of cmd descriptor ring
sys/dev/netif/iwi/if_iwi.c:1784
 none reproduced fixed untriaged — —
DF-1686 Low 3.4 agp: off-by-one in agp_mmap aperture bounds check exposes one physical page past the AGP aperture
sys/dev/agp/agp.c:860
 none reproduced fixed untriaged — —
DF-2205 Low 3.4 Error path leaves half-initialized device on hive list and masks subsequent failures
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85
 none reproduced fixed untriaged — —
DF-2238 Low 3.4 Off-by-two OOB write when full input line terminated with Enter
sys/ddb/db_input.c:264
 none reproduced fixed untriaged — —
DF-2399 Low 3.4 as_isopen boolean refcount mismatch causes cross-process memory wipe and device_unbusy on still-open device
sys/dev/agp/agp.c:781
 corruption reproduced not_testable untriaged — —
DF-1078 Medium 3.3 vkernel DDB backtrace leaks kernel addresses to world-readable msgbuf (DF-1077 class) + missing Xfast_syscall boundary stop
sys/platform/vkernel64/x86_64/db_trace.c:280
 none not_reproduced not_testable untriaged — —
DF-0216 Low 3.3 sysctl_kcollect_data copies past user buffer (unsigned underflow in bounds check)
sys/kern/kern_collect.c:235
 none reproduced fixed untriaged — —
DF-1232 Low 3.3 Kernel heap address leak to userspace via fibctx->unique in aac_open_aif
sys/dev/raid/aac/aac.c:3451
 leak:4 reproduced fixed untriaged — —
DF-1275 Low 3.3 VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:341
 none reproduced fixed untriaged — —
DF-1321 Low 3.3 OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25]
sys/dev/sound/pci/envy24.c:2038
 none reproduced fixed untriaged — —
DF-1602 Low 3.3 draw_txtmouse reads/writes scp->scr past vtb_size on the bottom screen row (FIXME-acknowledged)
sys/dev/misc/syscons/scvgarndr.c:340
 panic reproduced fixed untriaged — —
DF-1702 Low 3.3 scmouse: heap buffer overflow in mouse_cut - per-line \r bytes not accounted for in cut_buffer sizing
sys/dev/misc/syscons/scmouse.c:92
 none reproduced fixed untriaged — —
DF-2129 Low 3.3 apple_smc_mmio_key_read silently under-fills caller buffer, leaking kernel stack via sysctl
sys/dev/apple/smc/smc_mmio.c:75
 none reproduced fixed untriaged — —
DF-2284 Low 3.3 sgwrite/sgread leak sg_rdwr + ccb + buf when read() is never matched; sgoninvalidate/sgcleanup never drain rdwr_done (memory exhaustion + invalidation UAF surface)
sys/bus/cam/scsi/scsi_sg.c:169
 leak reproduced not_testable untriaged — —
DF-0169 Info 3.3 sysref_get has no refcount overflow guard
sys/kern/kern_sysref.c:66
 none reproduced not_testable untriaged — —
DF-0517 Info 3.3 IPV6_FW_GET leaks one unused mbuf per call + walks chain without lock
sys/net/ip6fw/ip6_fw.c:1101
 none reproduced not_testable untriaged — —
DF-0140 Low 3.0 Unchecked queue argument -> OOB write on wc_blocked[queue]
sys/kern/subr_sleepqueue.c:266
 none reproduced fixed untriaged — —
DF-0620 Low 3.0 Off-by-one OOB write in IPV6_CHECKSUM offset validation in rip6_output
sys/netinet6/raw_ip6.c:403
 dos reproduced fixed untriaged — —
DF-0728 Low 3.0 CHANNEL/XCHANNEL priority inversion between attachv and chan_change — 4-byte overflow if driver sets both bits
sys/netproto/802_11/wlan/ieee80211_radiotap.c:103
 leak reproduced fixed untriaged — —
DF-1108 Low 3.0 Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len (pc64 sibling of DF-1101)
sys/platform/pc64/x86_64/autoconf.c:274
 panic reproduced fixed untriaged — —
DF-1348 Low 3.0 Unbounded bcopy of CDB into CmdBlock[12] overflows SRB on >12-byte CDBs
sys/dev/disk/amd/amd.c:399
 none reproduced fixed untriaged — —
DF-1531 Low 3.0 hpt_get_logical_devices writes one DEVICEID before the count check (4-byte heap overflow when nMaxCount=0)
sys/dev/raid/hptmv/gui_lib.c:479
 panic reproduced fixed untriaged — —
DF-1736 Low 3.0 vinumio: sappend in format_config writes 1-2 bytes past malloc config buffer when text reaches end
sys/dev/raid/vinum/vinumio.c:415
 panic reproduced fixed untriaged — —
DF-1771 Low 3.0 intel_dsi_vbt: unbounded attacker-controlled len in mipi_exec_send_packet causes heap OOB read (v3 sequences)
sys/dev/drm/i915/intel_dsi_vbt.c:124
 panic reproduced fixed untriaged — —
DF-1772 Low 3.0 intel_dsi_vbt: integer overflow in DSI timing math writes wrong DPHY/Hs-to-Lp register values
sys/dev/drm/i915/intel_dsi_vbt.c:566
 panic reproduced fixed untriaged — —
DF-1833 Low 3.0 amdpm_bread returns unbounded slave-supplied block count, enabling OOB read and kernel-stack info leak
sys/dev/powermng/amdpm/amdpm.c:613
 none reproduced not_testable untriaged — —
DF-1962 Low 3.0 Undersized freqs_available[80] overflows when formatting 16-state list (80 chars + NUL = 81)
sys/dev/powermng/powernow/powernow.c:343
 panic reproduced fixed untriaged — —
DF-0112 Info 3.0 __sccl scanset range-fill writes tab[256] when range endpoint is 0xFF
sys/kern/subr_scanf.c:605
 none reproduced fixed untriaged — —
DF-0154 Info 3.0 KKASSERT-only invariants vanish on production kernels (UAF/queue-corruption risk)
sys/kern/kern_systimer.c:148
 none reproduced not_testable untriaged — —
DF-1378 Low 2.9 Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach
sys/dev/disk/buslogic/bt.c:420
 none reproduced fixed untriaged — —
DF-2345 Low 2.9 INQUIRY EVPD response fabrication writes to CCB data buffer without validating dxfer_len
sys/bus/u4b/storage/umass.c:2326
 none reproduced not_testable untriaged — —
DF-0335 Info 2.9 in_pcbportrange can invert hi<lo causing u_short underflow and out-of-range port binds
sys/netinet/in_pcb.c:2533
 none reproduced not_testable untriaged — —
DF-1792 Info 2.7 puc: dangling ivars pointer in attach error path - use-after-free of puc_device
sys/dev/misc/puc/puc.c:327
 panic reproduced not_testable untriaged — —
DF-0177 Low 2.5 cttykqfilter forwards knote to ttyvp with no token and no reference
sys/kern/tty_tty.c:284
 none reproduced fixed untriaged — —
DF-0360 Low 2.5 nm_dump_buf writes unbounded hex dump into fixed 8 KiB static buffer _dst
sys/net/netmap/netmap.c:322
 none reproduced fixed untriaged — —
DF-0512 Low 2.5 Unbounded sockaddr stored into fixed-size struct sockaddr in accept response: type confusion latent
sys/netgraph7/ksocket/ng_ksocket.c:1250
 panic reproduced fixed untriaged — —
DF-0635 Low 2.5 Pred1Compress outbuf overflow: input size bound check off by 6, up to 7-byte heap OOB write
sys/netgraph7/ng_pred1.c:397
 panic reproduced fixed untriaged — —
DF-1338 Low 2.5 SGE scatter/gather table bounds mismatch allows latent OOB write in sili_load_prb_callback
sys/dev/disk/sili/sili.c:1245
 none reproduced fixed untriaged — —
DF-1365 Low 2.5 fd_detach does not stop fd->tohandle callout (UAF on detach race)
sys/dev/disk/fd/fd.c:1090
 none reproduced fixed untriaged — —
DF-1571 Low 2.5 xa_size dereferences sc with no lock; UAF if xa_terminate_check runs concurrently
sys/dev/disk/xdisk/xdisk.c:828
 panic reproduced fixed untriaged — —
DF-1928 Low 2.5 Off-by-one NUL byte write in acpi_battery_clean_str past struct acpi_bif / ioctl union
sys/dev/acpica/acpi_battery.c:326
 panic reproduced fixed untriaged — —
DF-2433 Low 2.5 TOCTOU on CCDF_INITED allows concurrent CCDIOCSET to leak memory and vnodes
sys/dev/disk/ccd/ccd.c:1310
 none not_reproduced not_testable untriaged — —
DF-2563 Low 2.5 Compress path heap buffer overflow via incorrect worst-case expansion bound
sys/netgraph7/ng_pred1.c:397
 none reproduced not_testable untriaged — —
DF-0539 Info 2.5 ieee80211_node_dectestref implements non-atomic decrement-and-test: latent UAF trap
sys/netproto/802_11/wlan/ieee80211_dragonfly.c:497
 none reproduced not_testable untriaged — —
DF-0601 Info 2.5 ng_source_rcvdata races unsynchronized on snd_queue (latent: file is orphaned and non-compiling)
sys/netgraph7/ng_source.c:270
 none not_reproduced not_testable untriaged — —
DF-0717 Info 2.5 Memory leak in netmap_open when devfs_set_cdevpriv fails — kfree missing on error path
sys/net/netmap/netmap_freebsd.c:382
 none reproduced fixed untriaged — —
DF-2192 Info 2.5 GEM object leak on pin_pages failure in batch pool create path
sys/dev/drm/i915/i915_gem_batch_pool.c:133
 none reproduced fixed untriaged — —
DF-2375 Info 2.5 Off-by-one NUL heap write in acpi_battery_clean_str past the _BIF oeminfo field
sys/dev/acpica/acpi_battery.c:321
 none not_reproduced not_testable untriaged — —
DF-1790 Medium 2.4 amdgpu_atombios_dp: OOB kernel-stack read in DP link training via malicious sink MAX_LANE_COUNT > 4
sys/dev/drm/amd/amdgpu/atombios_dp.c:264
 none inconclusive — untriaged — —
DF-0450 Medium 2.3 OOB kernel heap read in ng_string_unparse via unbounded strlen on binary data without NUL terminator
sys/netgraph/netgraph/ng_parse.c:722
 leak:2 reproduced fixed untriaged — —
DF-0846 Low 2.3 Credential and vnode-reference leak when Q_QUOTAON re-enables quotas on same vnode
sys/vfs/ufs/ufs_quota.c:437
 leak reproduced fixed untriaged — —
DF-0869 Low 2.3 Missing bounds validation in hammer_format_volume_header allows signed-int64 overflow in vol_buf_beg/end
sys/vfs/hammer/hammer_volume.c:652
 panic reproduced fixed untriaged — —
DF-0957 Low 2.3 kmem_alloc3/kmem_alloc_attr ignore vm_map_insert return; round_page() overflow to size=0 yields bogus non-zero addr
sys/vm/vm_kern.c:219
 panic reproduced not_testable untriaged — —
DF-1079 Low 2.3 Unbounded length in m/M GDB commands overflows remcomOutBuffer / reads remcomInBuffer out of bounds
sys/cpu/x86_64/misc/x86_64-gdbstub.c:313
 none reproduced fixed untriaged — —
DF-1080 Low 2.3 P command register-index check (regno < NUM_REGS=22) allows stack OOB write past the registers struct
sys/cpu/x86_64/misc/x86_64-gdbstub.c:438
 none reproduced fixed untriaged — —
DF-1270 Low 2.3 Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame
sys/dev/raid/mps/mps_sas.c:1685
 none reproduced fixed untriaged — —
DF-1500 Low 2.3 Unbounded ksprintf into fixed 8-byte schan.hookname in musycc_newhook
sys/dev/misc/musycc/musycc.c:167
 none reproduced not_testable untriaged — —
DF-1688 Low 2.3 agp: signed-int loop variable in agp_generic_unbind_memory overflows for >2 GB allocations
sys/dev/agp/agp.c:609
 panic reproduced fixed untriaged — —
DF-1803 Low 2.3 snp: SNPGTTY writes 8-byte cdev_t into 4-byte dev_t user buffer - kernel pointer leak + 4-byte overrun
sys/dev/misc/snp/snp.c:582
 leak:4 reproduced fixed untriaged — —
DF-1816 Low 2.3 ppatomfwctrl: off-by-one stride in GPIO-pin lookup causes unconditional 7-byte OOB read past table allocation
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:183
 none reproduced not_testable untriaged — —
DF-2416 Low 2.3 Heap OOB read+write via unbounded sense_len in autosense bcopy
sys/dev/disk/advansys/adwcam.c:1321
 none reproduced not_testable untriaged — —
DF-0085 Low 1.9 taskqgroup_drain_all uses wrong loop bound (ncpus instead of tqg_cnt) - latent UAF if API adopted
sys/kern/subr_gtaskqueue.c:806
 none reproduced fixed untriaged — —
DF-0183 Low 1.9 UAF of tsleep wait channel when racing unregister of in-flight resident image
sys/kern/imgact_resident.c:291
 none reproduced fixed untriaged — —
DF-0336 Low 1.9 tcp6_getcred hands live cred pointer to blocking copyout (UAF window) unlike IPv4 path
sys/netinet/tcp_subr.c:1366
 leak reproduced fixed untriaged — —
DF-0381 Low 1.9 NGM_LISTHOOKS dereferences hook->peer without lock or ref: TOCTOU NULL-deref/UAF vs concurrent disconnect
sys/netgraph/netgraph/ng_base.c:1374
 dos reproduced fixed untriaged — —
DF-0506 Low 1.9 ng_fec_ether_cmdmulti iterates if_multiaddrs lockless + leaks membership on partial kmalloc failure
sys/netgraph7/ng_fec.c:542
 panic reproduced fixed untriaged — —
DF-1055 Low 1.9 sgwrite truncates uio_resid to int and does not validate reply_len, enabling allocation-size confusion
sys/bus/cam/scsi/scsi_sg.c:648
 none reproduced fixed untriaged — —
DF-1195 Low 1.9 Missing goto out after ME/RLC firmware size checks allows malformed firmware use and kernel heap OOB read
sys/dev/drm/radeon/r600.c:2559
 panic reproduced fixed untriaged — —
DF-1201 Low 1.9 VT_PROCESS scp->proc stored without refcount; signal_vt_rel/acq PHOLD can hit freed/reused proc struct (UAF / pid-recycling)
sys/dev/misc/syscons/syscons.c:1251
 panic reproduced fixed untriaged — —
DF-1266 Low 1.9 Missing bounds validation on drm_fbdev_overalloc enables u32 overflow in framebuffer height
sys/dev/drm/drm_fb_helper.c:2014
 none reproduced fixed untriaged — —
DF-1826 Low 1.9 intel_guc: intel_guc_fini leaves shared_data_vaddr dangling after freeing mapping -> UAF
sys/dev/drm/i915/intel_guc.c:187
 none reproduced not_testable untriaged — —
DF-1877 Low 1.9 dp_work and audio_work not flushed in radeon_irq_kms_fini: UAF after device teardown
sys/dev/drm/radeon/radeon_irq_kms.c:313
 panic reproduced fixed untriaged — —
DF-2073 Low 1.9 ResetKeyCacheEntry MIC-clear path lacks runtime bounds check on entry+64 (HALASSERT inert in release)
sys/dev/netif/ath/ath_hal/ar5212/ar5212_keycache.c:86
 panic reproduced not_testable untriaged — —
DF-2220 Low 1.9 kobject_release leaks kobj->name string allocated by kobject_init_and_add
sys/dev/drm/linux_kobject.c:39
 denial_of_service reproduced fixed untriaged — —
DF-2235 Low 1.9 Read-before-bounds-check: 1-byte OOB read of source buffer in UCS-2/UTF-16 input parsing
sys/libiconv/iconv_ucs.c:247
 panic reproduced fixed untriaged — —
DF-2430 Low 1.9 Off-by-one NUL write past bt->model[5] in Inquire-Model parsing
sys/dev/disk/buslogic/bt.c:420
 none reproduced not_testable untriaged — —
DF-2444 Low 1.9 dm_dev_create assigns freed dmv to *dmvp on insert-failure path
sys/dev/disk/dm/dm_dev.c:264
 none reproduced not_testable untriaged — —
DF-2456 Low 1.9 FD_FORM formats with unbounded attacker nsecs over-reading fd_formb heap buffer via DMA/PIO
sys/dev/disk/fd/fd.c:2311
 none reproduced not_testable untriaged — —
DF-0160 Info 1.9 xio_init_kbuf silently truncates when kbytes exceeds XIO_INTERNAL_SIZE
sys/kern/kern_xio.c:113
 none reproduced not_testable untriaged — —
DF-0251 Info 1.9 PC_TO_INDEX u_quad_t overflow on 64-bit (correctness only, bounds check prevents OOB)
sys/kern/subr_prof.c:86
 none reproduced not_testable untriaged — —
DF-0377 Info 1.9 config_red error path kfrees struct that may be embedded member of dn_pipe: latent UAF/invalid-free
sys/net/dummynet/ip_dummynet.c:1359
 none reproduced not_testable untriaged — —
DF-0440 Info 1.9 red_pkttime computed as int64 then stored into int: truncation/overflow for jumbo MTU or low m2
sys/net/altq/altq_hfsc.c:451
 none reproduced not_testable untriaged — —
DF-0608 Info 1.9 sizeof(ips) pointer-vs-struct typo in NGM_CISCO_GET_IPADDR response sizing
sys/netgraph7/iface/ng_iface.c:724
 none reproduced fixed untriaged — —
DF-0939 Info 1.9 Unbounded bcopy of sv_name into 256-byte stack buffer in procfs_dotype (latent; no in-tree sv_name >= 256B)
sys/vfs/procfs/procfs_type.c:54
 none reproduced not_testable untriaged — —
DF-0980 Info 1.9 pmap_remove_pages skips cross-CPU TLB invalidation (cpu_invltlb only, no smp_invltlb)
sys/platform/pc64/x86_64/pmap.c:5727
 none reproduced not_testable untriaged — —
DF-1119 Info 1.9 Firmware header fields used as array indices without bounds checks (heap OOB read/write via corrupted ucode)
sys/dev/drm/radeon/cik.c:1873
 none reproduced not_testable untriaged — —
DF-1941 Info 1.9 Detach does not drain AcpiOsExecute callbacks: stale softc use-after-free (latent, AcpiOsWaitEventsComplete is no-op stub)
sys/dev/acpica/acpi_cmbat.c:154
 none reproduced not_testable untriaged — —
DF-1999 Info 1.9 amdgpu_gfx_compute_mqd_sw_fini kfrees mqd_backup without NULLing the slot (double-free landmine)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:366
 panic reproduced fixed untriaged — —
DF-1621 Low 1.1 Unbounded bcopy of user-controlled csio->cdb_len into 32-byte CDB32 frame (DF-1356/1547 class)
sys/dev/raid/mrsas/mrsas_cam.c:489
 panic reproduced fixed untriaged — —
DF-2068 Low 1.1 Unchecked capacity*struct_size multiplication can overflow in construct/presized/reserve (latent heap OOB)
sys/dev/drm/amd/display/dc/basics/vector.c:43
 none reproduced fixed untriaged — —
DF-0082 Info 1.1 Latent heap overflow in sbuf_extend via int truncation of caller length (zero callers, unreachable today)
sys/kern/subr_sbuf.c:150
 none reproduced fixed untriaged — —
DF-0215 Info 1.1 Wait-counter inc/dec can overflow into control bits (theoretical)
sys/kern/lwkt_serialize.c:271
 none reproduced not_testable untriaged — —
DF-0230 Info 1.1 table_blocks computed before entries/entsz validation (fragile ordering)
sys/kern/subr_diskgpt.c:131
 none reproduced not_testable untriaged — —
DF-1208 Info 1.1 intel_runtime_pm_get_if_in_use() returns true without taking wakeref on DragonFly, causing unbalanced put() underflow
sys/dev/drm/i915/intel_runtime_pm.c:4039
 none reproduced not_testable untriaged — —
DF-1263 Info 1.1 dsp_oss_syncgroup frees inserted smrd without removing from sg->members on unreachable M_WAITOK error branch
sys/dev/sound/pcm/dsp.c:2913
 none reproduced not_testable untriaged — —
DF-1930 Info 1.1 chn_removefeeder leaves stale parent pointer on new chain head (latent UAF)
sys/dev/sound/pcm/feeder.c:253
 none reproduced not_testable untriaged — —
DF-0908 Low 0.8 size_t underflow in trailing-slash strip causes OOB access on empty mount path
sys/vfs/dirfs/dirfs_vfsops.c:137
 none reproduced not_testable untriaged — —
DF-1858 Low 0.8 Negative framebuffer offset in bmp_SetPix via RLE delta-move: OOB write below va_window
sys/dev/video/fb/bmp/splash_bmp.c:258
 none not_reproduced — untriaged — —
DF-0094 Info 0.8 shmrealloc initializes OLD shmsegs[] instead of newsegs[] - heap OOB write + uninit new array (dead code)
sys/kern/sysv_shm.c:683
 none reproduced fixed untriaged — —
DF-0721 Info 0.8 Build break: IFP2SP and SP2IFP macros referenced 12 times but never defined anywhere in sys/
sys/netgraph7/ng_sppp.c:254
 none reproduced not_testable untriaged — —
DF-1379 Info 0.8 btexecuteccb SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
sys/dev/disk/buslogic/bt.c:836
 none reproduced not_testable untriaged — —
DF-1824 Info 0.8 aac_cam: unbounded CDB bcopy overflows struct aac_srb.cdb[16] into sg_map
sys/dev/raid/aac/aac_cam.c:443
 panic reproduced fixed untriaged — —
DF-1896 Info 0.8 intel_csr_ucode_fini kfree dmc_payload without NULLing pointer: dangling pointer (latent UAF)
sys/dev/drm/i915/intel_csr.c:557
 none reproduced not_testable untriaged — —
DF-2144 Info 0.8 decoders counter never increments except at DELTA-aligned boundaries (registration array logic bug)
sys/dev/video/fb/splash.c:124
 corruption reproduced fixed untriaged — —
DF-2371 Low 0.5 twofish_set_key performs no key-length validation enabling stack/struct OOB writes and mk_tab corruption on out-of-range key_len_bits
sys/crypto/twofish/twofish.c:425
 none reproduced not_testable untriaged — —
DF-0087 Info 0.5 Signed integer overflow (C UB) in new_unrhdr last computation when high=INT_MAX
sys/kern/subr_unit.c:257
 none reproduced fixed untriaged — —
DF-0153 Info 0.5 EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit; no bounds guard
sys/kern/kern_spinlock.c:206
 none reproduced not_testable untriaged — —
DF-0550 Info 0.5 Ring-size computation uses 32-bit multiply without overflow check: latent heap overflow
sys/net/netmap/netmap_mem2.c:927
 none reproduced not_testable untriaged — —
DF-0579 Info 0.5 Unbounded mbuf-to-stack copy in slstart BPF path: latent stack overflow
sys/net/sl/if_sl.c:536
 none reproduced not_testable untriaged — —
DF-0614 Info 0.5 NGM_CISCO_GET_IPADDR response sized with sizeof(ips) (pointer) instead of sizeof(*ips) (struct)
sys/netgraph/iface/ng_iface.c:697
 none reproduced fixed untriaged — —
DF-0964 Info 0.5 Missing bounds check on ivlen in cryptoapi_cipher_encrypt/decrypt (latent stack buffer overflow)
sys/crypto/cryptoapi/cryptoapi.c:1118
 none reproduced fixed untriaged — —
DF-1117 Info 0.5 re_rar_set reads 2 bytes past 6-byte MAC buffer via u_int32_t cast (benign OOB stack read)
sys/dev/netif/re/re.c:3903
 none reproduced not_testable untriaged — —
DF-1850 Info 0.5 ksprintf overflows 9-byte msp/dpl version string buffers by up to 2 bytes (lands in struct padding, no impact today)
sys/dev/video/bktr/bktr_audio.c:442
 none reproduced fixed untriaged — —
DF-2013 Info 0.5 sili_pci_detach leaves sc_pregs dangling (typo nulls sc_regs twice)
sys/dev/disk/sili/sili_attach.c:375
 panic reproduced fixed untriaged — —
DF-2179 Info 0.5 Signed-integer overflow UB in SM() shift of EEPROM antdiv_ctl1
sys/dev/netif/ath/ath_hal/ar9002/ar9285_diversity.c:98
 none reproduced fixed untriaged — —
DF-2388 Info 0.5 Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:210
 — not_reproduced not_testable untriaged — —
DF-2440 Info 0.5 _table() passes DM_MAX_PARAMS_SIZE instead of remaining buffer space to ksnprintf (latent OOB-write enabler)
sys/dev/disk/dm/delay/dm_target_delay.c:183
 — reproduced not_testable untriaged — —
DF-2162 Info 0.3 parent_dmat DMA tag leaked on bt_pci_attach error paths
sys/dev/disk/buslogic/bt_pci.c:142
 none reproduced fixed untriaged — —
DF-1461 High — Premature kfree of persistent per-slot swdesc in txp_rxbuf_reclaim error path causes UAF and double-free
sys/dev/netif/txp/if_txp.c:793
 panic reproduced not_testable untriaged — —
DF-1977 High — destroy_workqueue is #if 0 no-op; drain_workqueue does not wait for in-flight works; driver teardown UAF + permanent memory/thread leak
sys/dev/drm/linux_workqueue.c:243
 none inconclusive — untriaged — —
DF-1687 Low — agp: agp_close frees all GART state and clears as_isopen on EVERY close, not on last close
sys/dev/agp/agp.c:789
 dos reproduced fixed untriaged — —

Privilege escalation (general use) 226

Missing/wrong privilege checks, credential handling bugs, and anything already driven to uid=0 — general-use-case paths.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5816 Medium 5.5 unp_pcblist sysctl exports raw kernel pointers (unpcb/socket/sockaddr/vnode addresses + the AF_UNIX connection graph) to unprivileged users
sys/kern/uipc_usrreq.c:1476
 leak reproduced fixed untriaged — —
DF-5796 Low 3.7 m_copyback()/m_copyback2() write through shared (refcount>1) clusters with no M_WRITABLE gate — cross-packet data corruption; remote sink is bridge_output()'s in-place ether_shost rewrite on m_copypacket-shared flood copies
sys/kern/uipc_mbuf.c:2368
 none reproduced not_testable untriaged — —
DF-5797 Low 3.3 utimensat(2)/utimes(2)/futimens(2) let a non-owner with write permission set arbitrary file timestamps (POSIX permission-model violation, HAMMER2 default root)
sys/kern/vfs_syscalls.c:3961
 none reproduced not_testable untriaged — —
DF-5835 Low 3.3 tvtohz_high/tstohz_high/tvtohz_low/tstohz_low: signed int overflow at the sec == INT_MAX/hz boundary turns ~249-day timers into immediate fires (kernel UB, unprivileged)
sys/kern/kern_clock.c:1198
 none reproduced not_testable untriaged — —
DF-3978 Critical 8.8 NVMM SVM: host IA32_SYSENTER_CS/ESP/EIP MSRs left guest-controlled after every vmrun — any process pivots to ring 0 via 2-byte `sysenter`
sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1514 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-2929 High 8.8 systimer_init_oneshot() bzero of a queued timer silently corrupts gd_systimerq; reached via DRM hrtimer_start re-arm on every i915 auto-forcewake register access
sys/kern/kern_systimer.c:360 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3197 High 8.8 devfs rule ioctls have no privilege/jail check: jailed root rewrites host-wide devfs visibility and permissions (jail escape)
sys/vfs/devfs/devfs_rules.c:419 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-5741 High 8.8 Every raw HCI socket is created HCI_PRIVILEGED: the privilege check runs on the netmsg port where curproc==NULL and caps_priv_check_self() evaluates the lwp-less netisr thread — the unprivileged opcode/event security filter is dead code
sys/netbt/hci_socket.c:644 · pass 2 · new
 privesc reproduced fixed untriaged — —
DF-2738 Medium 8.1 CTLFLAG_PRISON never enforced: jailed uid-0 can write host-global sysctls (kern.maxfiles, kern.securelevel, debug.*, net.*, vm.*)
sys/kern/kern_sysctl.c:1438 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-2950 Medium 7.9 Jailed uid-0 passes the sysctl write gate and can write every host-global RW MIB defined here — kern.securelevel raised irreversibly from inside a jail (host root gets EPERM lowering it), plus kern.hostid/domainname/bootfile/maxprocperuid/maxposixlocksperuid/tls_extra corruption; CTLFLAG_PRISON is dead
sys/kern/kern_mib.c:142 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2815 Medium 7.8 Unserialized global dumper: set_dumper() EBUSY-check TOCTOU / torn struct copy, and clear-or-swap landing during an active dumpsys() → NULL di->priv dereferenced by dev_ddump() (kernel page fault while dumping) and torn-geometry dump misdirection to the wrong device
sys/kern/kern_shutdown.c:948 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4320 Medium 7.8 SIOCGATHDIAG/SIOCGATHPHYERR dispatched with no privilege check: unprivileged users get arbitrary device MMIO read/write (incl. plaintext WEP/TKIP keycache dump), EEPROM reads, and NULL-deref panics on ATH_DIAGAPI kernels
sys/dev/netif/ath/ath/if_ath_ioctl.c:299 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2900 Low 7.8 procfs_rwmem ignores kmem_alloc_pageable failure — kva=0 reaches pmap_kenter_quick(0,pa), overwriting pml4[0] of the current user pmap (page-table pivot) plus uiomove on VA 0
sys/vfs/procfs/procfs_mem.c:101 · pass 2 · new
 arbitrary_write not_reproduced not_testable untriaged — —
DF-3177 Medium 7.7 hpfs NFS file handles are a bare 32-bit LSN — generation field commented out of vptofh, no hpfid_len/ino validation in fhtovp, and vget accepts any sector whose first u32 is FN_MAGIC: forged handles turn attacker-written file content into live vnodes, composing into remote arbitrary-device R/W and heap corruption on exported mounts
sys/vfs/hpfs/hpfs_vfsops.c:424 · pass 2 · new
 none untested — untriaged — —
DF-3009 High 7.5 Zero-length SunRPC record mark from an NFS/TCP server returns a NULL reply mbuf — nfs_reply() dereferences mtod(NULL), deterministic client kernel panic
sys/vfs/nfs/nfs_socket.c:648 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3392 Medium 7.3 IPv6 firewall fully controllable by unprivileged local users: IPV6_FW_ADD/DEL/FLUSH/ZERO/GET setsockopt on any IPv6 datagram socket has no privilege check
sys/net/ip6fw/ip6_fw.c:1119 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2716 High 7.1 nlookup() misclassifies a leaf component followed by a trailing slash as an intermediate directory, dropping NLC_STICKY/NLC_APPENDONLY feedback — sticky-bit and append-only-directory deletion/rename restriction bypass
sys/kern/vfs_nlookup.c:653 · pass 2 · new
 authz_bypass (sticky-bit / append-only-dir deletion+rename restriction bypass; not uid0/panic/leak class) reproduced fixed untriaged — —
DF-4429 Medium 7.1 radeon_verify_access returns 0 unconditionally: GEM ownership check dropped — any video-group user can mmap every other user's GPU buffer objects
sys/dev/drm/radeon/radeon_ttm.c:234 · pass 2 · new
 Any local user in group video can mmap and read/write every other user's radeon GEM buffer object (Xorg scanout contents, other users' textures/uploads) by sweeping mmap offsets on /dev/dri/cardN: radeon_verify_access (radeon_ttm.c:234) is an unconditional 'return 0'; the drm_vma_node_verify_access ownership check that upstream radeon and the in-tree sibling amdgpu_ttm.c:311-325 perform was dropped in this port. Kernel-internal BOs (ttm_bo_type_kernel) carry no vma node and are not exposed; ceiling is user GEM objects. untested not_testable untriaged — —
DF-2769 High 7.0 Stale unix98 pty master re-open admitted by ptcopen (ptcclose disarms all gates): cross-user session takeover with root command injection when /dev/ptm is exposed by devfs rules
sys/kern/tty_pty.c:585 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-3699 High 7.0 lkpi queue_work() per-CPU double-enqueue: unprivileged irq-vs-waitboost race on rps->work corrupts the system workqueue STAILQs
sys/dev/drm/i915/i915_irq.c:1838 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2800 Medium 6.7 prison_priv_check allows SYSCAP_NOSETTIME in jails — jailed uid-0 sets the HOST system clock (settimeofday/clock_settime/adjtime/ntp_adjtime)
sys/kern/kern_jail.c:858 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3513 High 6.5 NG_BT_ITEMQ_DRAIN uses flag-only NG_FREE_ITEM: every packet queued in an HCI conq at connection destruction permanently leaks ng_item + mbuf + node/hook references (unbounded kernel memory exhaustion)
sys/netgraph7/bluetooth/hci/ng_hci_main.c:202 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3523 High 6.5 ng7 ng_uncallout() permanently leaks the pptpgre rack/sack timer ng_item + node/hook references (DF-3521 ng7 twin, two stacked defects; escalates to the DF-3514 panic)
sys/netgraph7/pptpgre/ng_pptpgre.c:968 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2898 Medium 6.5 sysent[0]/sysent[198] indirect-syscall gateway dispatches itself: unprivileged one-line syscall(SYS_syscall,0) deterministically panics the kernel (double fault on the kernel-stack guard)
sys/kern/init_sysent.c:17 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2963 Medium 6.5 GPT entry #127 maps to slice index 128, which dkmakeminor() silently truncates to 7 bits: duplicate major:minor cdevs and s127<->s0 cross-slice data aliasing (reads AND writes)
sys/kern/subr_diskgpt.c:175 · pass 2 · new
 data_integrity_aliasing reproduced fixed untriaged — —
DF-4362 Medium 6.5 Atomic-ioctl out-fence path leaks a struct file per commit against the port's stubbed fd/sync_file shims: get_unused_fd_flags() really allocates while fd_install/fput/put_unused_fd are no-op stubs and sync_file_create() returns NULL — permanent nfiles exhaustion (system-wide ENFILE DoS until reboot)
sys/dev/drm/drm_atomic_uapi.c:1048 · pass 2 · new
 dos untested not_testable untriaged — —
DF-5266 Medium 6.5 MTW_AID2WCID hashes 64 station AIDs into 8 WCIDs: in hostap with >8 stations the 9th+ pairwise key overwrites a colliding station's key slot, and downlink frames are then encrypted with ANOTHER station's key (cross-station confidentiality break on WPA2-Enterprise)
sys/bus/u4b/wlan/if_mtw.c:37 · pass 2 · new
 none untested not_testable untriaged — —
DF-5742 Medium 6.5 hci_mtap() taps into receive buffers with no flow control: sbappendaddr without any ssb_space/hiwat check — unprivileged unbounded consumer of the global mbuf pool (kernel-wide allocation failure, hard hang)
sys/netbt/hci_socket.c:1003 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3170 High 6.3 MFS bio queue shared between BGL-holding producers and a BGL-free consumer: unsynchronized cross-CPU TAILQ corruption (kernel panic; latent heap corruption on non-INVARIANTS builds) from unprivileged file I/O on a mounted MFS
sys/vfs/mfs/mfs_vfsops.c:184 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3590 Low 6.1 World-writable /dev/psm0 with zero privilege checks in psmioctl(): any local user can reprogram the PS/2 device, hold it hostage from moused/X (root gets EBUSY), and starve the shared i8042 keyboard port
sys/dev/misc/psm/psm.c:2025 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3350 Medium 6.0 config_pipe accepts negative bandwidth: NULL-deref panic (TAILQ_LAST on empty delay line) or permanent netisr wedge in the drain loop
sys/net/dummynet/ip_dummynet.c:621 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5684 Medium 5.8 sys_vquotactl() performs no privilege check — unprivileged users set/wipe quota limits for any uid/gid/mount, denying ALL writes (including root's) filesystem-wide
sys/kern/vfs_quota.c:328 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3311 Medium 5.7 Interface down/destroy tears down tasks/queues/softc while the receive upcall can still re-enqueue them (sockets closed last): late handshake/decrypt task fires on freed softc
sys/net/wg/if_wg.c:2166 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-2799 Medium 5.6 AB-BA kernel deadlock: jail_lock vs per-CPU gd_sysctllock — unprivileged `sysctl jail.list` readers vs root jail(2) permanently wedge the kernel
sys/kern/kern_jail.c:275 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2667 Medium 5.5 Unprivileged kernel NULL-pointer panic via mountctl(2) MOUNTCTL_MOUNTFLAGS with buflen=0: vfs_flagstostr() strlens a NULL buffer before its degenerate-length guard
sys/kern/vfs_syscalls.c:1281 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2759 Medium 5.5 Unprivileged kernel-log/kernel-pointer disclosure channel: default-config UCONSOLE lets any user's pty become constty and subr_prf.c streams all kernel messages to it, bypassing security.unprivileged_read_msgbuf and nullifying ptr_restrict against the %p leak population
sys/kern/subr_prf.c:396 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2834 Medium 5.5 Unbounded vmspace allocation in sys_vmspace_create: no per-process cap, each create pins a wired PML4 page + 8KB KVA + vmspace struct → unprivileged kernel-memory exhaustion DoS (requires vm.vkernel_enable=1)
sys/vm/vm_vmspace.c:146 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3187 Medium 5.5 hammer_ioc_scan_pseudofs feeds forged on-disk data_offset/data_len through hammer_btree_extract into the CRC engine and copyout — unprivileged kernel panic (wild kernel-memory read walk)
sys/vfs/hammer/hammer_pfs.c:358 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3238 Medium 5.5 NULL-deref kernel panic: procfs_domap() ignores vm_map_lookup_entry() failure and feeds NULL to RB_NEXT() during /proc/pid/map revalidation
sys/vfs/procfs/procfs_map.c:236 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3358 Medium 5.5 Unprivileged permanent kernel memory consumption and routing-plane exhaustion via RTM_GET + RTA_GENMASK (rtmask_add_global pollution)
sys/net/rtsock.c:738 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3366 Medium 5.5 Unprivileged kernel heap info leak via route(4) sockaddr alignment padding: route keys/gateways stored RT_ROUNDUP-sized but only sa_len initialized, copied out rounded to any local user via RTM_GET
sys/net/route.c:920 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3857 Medium 5.5 Divide-by-zero in dce_v10_0_latency_watermark: divides by available_bandwidth/disp_clk before any guard (DF-3828 DCE11 twin)
sys/dev/drm/amd/amdgpu/dce_v10_0.c:882 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3869 Medium 5.5 Zero-divisor (#DE kernel panic) in calculate_bandwidth: exact-zero divisor at dce_calcs.c:839 from UABI-legal degenerate modes, plus u32 division-by-zero at :1945
sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:839 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4526 Medium 5.5 ar5416AniControl NULL-pointer dereference when driven before the first channel reset (ah_curani == NULL): kernel panic via HAL_DIAG_ANI_CMD
sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:184 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4668 Medium 5.5 snp: snoop line discipline installable via unprivileged TIOCSETD; snplclose NULL-derefs t_sc on tty close (kernel panic)
sys/dev/misc/snp/snp.c:129 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5024 Medium 5.5 ath_ioctl_phyerr() copies out the UNINITIALIZED M_TEMP result buffer on its error paths — attacker-sized kernel heap disclosure to unprivileged users
sys/dev/netif/ath/ath_dfs/null/dfs_null.c:253 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5629 Medium 5.5 Kernel heap info leak to unprivileged user's tty via unterminated PT_INTERP path (uprintf %s)
sys/cpu/x86_64/misc/elf_machdep.c:58 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3819 Low 5.5 aac_ioctl_send_raw_srb sleeps on channel NULL while its CMFREE callback wakes channel &cm — permanent unkillable process when the FIB pool is exhausted
sys/dev/raid/aac/aac.c:3094 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4670 Low 5.5 ar5416GetDiagState: HAL_DIAG_CHECK_HANGS dereferences args==NULL when the ioctl omits ATH_DIAG_IN — NULL-deref panic (DF-1521 sibling, in-file)
sys/dev/netif/ath/ath_hal/ar5416/ar5416_misc.c:543 · pass 2 · new
 Unprivileged local kernel panic on ath(4)+ATH_DIAGAPI machines while DF-4320's missing priv check stands; NULL read at fixed address 0 - pure DoS untested not_testable untriaged — —
DF-3212 High 5.3 ffs_read OOB read into adjacent buffer-cache KVA: dead 'xfersize <= 0' guard lets a crafted fs_qbmask drive uiomovebp past the buffer (kernel .text/.rodata + other files' cached pages disclosed to an unprivileged reader)
sys/vfs/ufs/ufs_readwrite.c:141 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2979 Medium 5.3 physio consumes stale/uninitialized b_resid from the shared pbuf_mem pool and copyouts stale bounce-buffer contents before the B_ERROR check — failed raw reads disclose other contexts' kernel-resident I/O data
sys/kern/kern_physio.c:98 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3757 Medium 5.3 tulip_txput_setup() ring-full guard off-by-one (`ri_free == 1`): ri_free underflows to -1 and the setup frame is programmed over a chip-owned TX descriptor
sys/dev/netif/de/if_de.c:3631 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3348 Low 5.3 Unlocked/wrong-lock readers of the port list vs lagg_port_destroy: unlocked lagg_sysctl_active walk, and port if_ioctl/if_output/if_lagg torn down without the port serializer
sys/net/lagg/if_lagg.c:763 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5316 Medium 5.2 USB_SET_CONFIG / USB_SET_ALTINTERFACE ioctls perform privileged device reconfiguration (driver detach/re-attach, re-enumeration) with no privilege check, bypassing the SYSCAP_NODRIVER gate the same file enforces on the equivalent raw control requests
sys/bus/u4b/usb_generic.c:2096 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3469 Medium 5.1 sysctl_ifdata IFDATA_LINKSPECIFIC blindly copyouts driver-registered if_linkmib to unprivileged readers — sl(4) registers its ENTIRE sl_softc (5736 bytes: ifnet function pointers, softc/tty/heap addresses) — reproduced unprivileged kernel-pointer disclosure
sys/net/if_mib.c:178 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3109 Low 5.1 hammer_init_cursor error contract is broken: unconditional KKASSERT(error==0), removed cleanup, and 12 callers ignore the error — INVARIANTS panic or production NULL-node cursor dereference (btree_search reads NULL left_bound) on any root-node load failure
sys/vfs/hammer/hammer_cursor.c:156 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5669 Low 5.1 Deprecated ACPIIO_SETSLPSTATE ioctl bypasses the pc64 suspend-support gate and drives the unimplemented S2-S4 suspend path (stubbed machdep half), returning false success on failure
sys/platform/pc64/acpica/acpi_machdep.c:60 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2795 Medium 4.7 msgsnd missing sequence-number revalidation after tsleep: stale sleeper injects into an IPC_RMID'd-and-reallocated queue (cross-user message injection)
sys/kern/sysv_msg.c:605 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3215 Medium 4.7 hammer_generate_redo panics on UNDO/REDO FIFO exhaustion — unprivileged local kernel DoS via write()+fsync() (no backpressure on the frontend REDO path)
sys/vfs/hammer/hammer_redo.c:90 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3304 Medium 4.7 Unprivileged NULL-pointer dereference via IP_MULTICAST_VIF selecting a PIM REGISTER vif (ip_mdq rt=NULL -> pim_register_send -> rt->mfc_rp)
sys/net/ip_mroute/ip_mroute.c:2826 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3320 Medium 4.7 IPv4 address-set ioctls persist user-supplied sin_len verbatim into live in_ifaddr (ia_addr/ia_dstaddr/ia_broadaddr/ia_sockmask) — unprivileged kernel heap pointer disclosure via SIOCGIFCONF (ifconf sa_len copyout) and route sockets; the live IPv4 twin of DF-3318
sys/netinet/in.c:602 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3860 Medium 4.7 gpu_info firmware payload pointer built from unvalidated ucode_array_offset_bytes — kernel heap OOB read feeding AMDGPU_INFO disclosure and the DF-3698 walkers
sys/dev/drm/amd/amdgpu/amdgpu_device.c:1354 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3864 Medium 4.7 amdgpu_vm_init error paths dereference vm->root.base.bo before amdgpu_vm_bo_base_init assigns it — NULL-pointer panic on a render-node-reachable error path (unprivileged DoS)
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3097 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5683 Medium 4.7 sys_vquotactl() leaks the copyin'd prop_dictionary, command string, output array and result dictionary on every call — unprivileged, linear kernel heap exhaustion
sys/kern/vfs_quota.c:346 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2697 Medium 4.4 vaccess() grants group file-access permissions from the SAVED gid (cr_svgid): kernel-enforced group privileges survive setegid()/setgid() drops (POSIX mqueue access control fail-open)
sys/kern/vfs_subr.c:1752 · pass 2 · new
 access_bypass reproduced fixed untriaged — —
DF-2915 Medium 4.4 sleepq_lock() trusts uninitialized objcache memory: first use of the API on any chain panics (INVARIANTS) or corrupts the chain with a garbage wchan entry and live-locks the allocator loop (production)
sys/kern/subr_sleepqueue.c:145 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3128 Medium 4.4 mountmsdosfs() never bounds BPB volume geometry by the backing device size (FreeBSD's mediasize check dropped — in-tree XXX admits it): crafted FAT32 image wires attacker-chosen kernel heap (128 MiB/mount demonstrated, up to 512 MiB) and pins a 38 s non-SIGKILL-able FAT scan per mount
sys/vfs/msdosfs/msdosfs_vfsops.c:432 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3223 Medium 4.4 prune_check_nlinks() NULL-deref: forged on-disk inode record with data_offset==0 makes HAMMERIOC_PRUNE read cursor->data->inode.nlinks from absolute kernel address 0x48
sys/vfs/hammer/hammer_prune.c:330 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3224 Medium 4.4 /proc/pid/ctl signal delivery performs no authorization: ksignal() bypasses kill(2)'s CANSIGNAL (p_trespass + reaper_sigtest + pid-1 gate); open-time-only vnode gate is never revalidated across credential changes
sys/vfs/procfs/procfs_ctl.c:319 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3183 Low 4.4 Non-root tmpfs mounts take attacker-supplied root uid/gid (only mode is sanitized): forged directory ownership plus statfs f_owner overwrite breaks the unmount-ownership authorization (mounter lockout / arbitrary-uid unmount grant)
sys/vfs/tmpfs/tmpfs_vfsops.c:142 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3424 Low 4.4 in6_pcbsetlport() divide-by-zero on degenerate ephemeral port range — DF-0334's unfiled IPv6 twin (reproduced: one unpriv AF_INET6 bind panics)
sys/netinet6/in6_src.c:472 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3546 Low 4.4 v1 ng_bpf: cyclic ifMatch/ifNotMatch forwarding (incl. ifMatch == thisHook) + v1 core's unbounded synchronous ng_send_data recursion exhausts the kernel thread stack — deterministic panic
sys/netgraph/bpf/ng_bpf.c:419 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3001 Low 4.3 hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (VFS-contract divergence vs UFS): NFS SETATTR can forge timestamps on any file in an exported HAMMER1 filesystem
sys/vfs/hammer/hammer_vnops.c:2345 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-2791 Low 4.1 sys_rtprio() NULL lwp dereference on processes in the fork (SIDL) window — unprivileged EFAULT read of &((struct lwp*)0)->lwp_rtprio; privileged raw kernel write to 0x198 panics the kernel
sys/kern/kern_resource.c:704 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3634 Medium 3.8 Uninitialized kernel stack variable leaked to userspace by i915_gem_mmap_ioctl() when size==0 (DragonFly-only path)
sys/dev/drm/i915/i915_gem.c:1923 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-2874 Info 3.4 DIOCRECLUSTER has no privilege check and the kernel services dmsg peers with root credentials (raw RW with proc0.p_ucred, no open/keyid validation on I/O) — gated today only by diskopen's SYSCAP_RESTRICTEDROOT
sys/kern/subr_diskiocom.c:108 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-2867 Medium 3.3 ktrsyscall copies the unfetched argument tail of sysmsg.extargs into the trace file: unprivileged self-tracing leaks stale kernel-stack words (groom-echo + kernel-canonical pointers) from failed stack-argument fetches
sys/kern/kern_ktrace.c:111 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2706 Low 3.3 kern.proc.pid.<pid> sysctl bypasses security.ps_showallprocs — unprivileged full kinfo_proc disclosure of any process (incl. root, plus kernel-heap pointers)
sys/kern/kern_proc.c:1686 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2927 Low 3.3 debug.dump_modinfo sysctl is world-readable and discloses kernel pointers (kernel base, module load addresses, SSYM/ESYM, _DYNAMIC, ENVP, KERNEND)
sys/kern/subr_module.c:373 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2932 Low 3.3 Kernel v1 UUIDs disclose the host's real NIC MAC and exact wall-clock generation time to any unprivileged user (RFC 4122 sec 6 privacy exposure)
sys/kern/kern_uuid.c:86 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2955 Low 3.3 fattime2timespec: 32-bit unsigned DAY*day multiply wraps — every valid FAT date 2106-02-08..2107-12-31 decodes ~55.7 years in the past (2107-12-31 → 1971-11-23)
sys/kern/subr_fattime.c:233 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3024 Low 3.3 tmpfs_chtimes applies va_atime/va_mtime with no ownership/VA_UTIMES_NULL check — non-owner timestamp forgery (DF-3001 contract analog, locally reachable)
sys/vfs/tmpfs/tmpfs_vnops.c:486 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3112 Low 3.3 HAMMER1 ioctl dispatcher: 9 commands overwrite the caps_priv_check(SYSCAP_NOVFS_IOCTL) gate result and execute for unprivileged users (DF-0815 class on HAMMER1)
sys/vfs/hammer/hammer_ioctl.c:72 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3226 Low 3.3 ctl DETACH is exempt from all authorization: any same-euid bystander can rip a victim out of an active tracer's session (clear P_TRACED, delete pending SIGTRAP, reparent, unstop); wakeup(curp) also never wakes a blocked CTL_WAIT tracer
sys/vfs/procfs/procfs_ctl.c:122 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3259 Low 3.3 /proc/<pid>/rlimit read has no per-op authorization: any local user reads any process's full rlimit table
sys/vfs/procfs/procfs_rlimit.c:55 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3477 Low 3.3 Unprivileged PSM bind: ng_btsocket_l2cap_bind() has no privilege check — any local user can occupy reserved Bluetooth service PSMs (SDP=1, RFCOMM=3) and hijack inbound connections
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2037 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3636 Low 3.3 Leftover debug kprintf("i915_gem_fault: CHUNKING PASS") on the unprivileged per-fault partial-view path enables console/log-flood DoS
sys/dev/drm/i915/i915_gem.c:2323 · pass 2 · new
 none untested not_testable untriaged — —
DF-3080 Info 3.3 /proc/0 makes kernel-internal proc0 (swapper) addressable and readable by unprivileged users (atopid("0") slips past the NO_PID guard into pfs_pfind(0)→&proc0)
sys/vfs/procfs/procfs_vnops.c:798 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3243 Info 3.3 ufs_quotactl Q_GETQUOTA self-authorization is quota-type-blind: uid==cr_ruid satisfies the check for GRPQUOTA too, letting any user read the group-quota record for gid numerically equal to their uid
sys/vfs/ufs/ufs_vfsops.c:119 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-4441 Info 3.3 init_device kprintf leaks kernel heap pointer (COREBUF %p) to console — readable by unprivileged users via dmesg (security.unprivileged_read_msgbuf=1 default)
sys/dev/smbus/atmel_mxt/atmel_mxt.c:393 · pass 2 · new
 Kernel heap pointer disclosed to dmesg, readable unprivileged (security.unprivileged_read_msgbuf=1 default on guest) untested not_testable untriaged — —
DF-4514 Info 3.3 ath_lna_div: dead ath_lna_div_ioctl() unconditionally copyouts uninitialized kernel heap (kmalloc without M_ZERO, executed even after EINVAL) - latent uninitialized-memory disclosure if ever wired up
sys/dev/netif/ath/ath/if_ath_lna_div.c:176 · pass 2 · new
 None in-tree (dead code); latent chosen-length uninitialized kernel-heap disclosure if ever wired to an ioctl (and the diag ioctls themselves lacked priv checks per DF-4320) untested not_testable untriaged — —
DF-4527 Info 3.3 HAL_DIAG_ANI_CURRENT copies out the internal ar5212AniState including the kernel 'params' pointer: kernel heap address disclosure
sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:1081 · pass 2 · new
 none untested not_testable untriaged — —
DF-5318 Info 3.3 USB_SETDEBUG sets the global usb_debug level with no privilege check (only FWRITE on the fd) — unprivileged kernel-log flooding / console spam
sys/bus/u4b/usb_generic.c:2084 · pass 2 · new
 latent unchecked index (DF-5317) / unpriv log flooding (DF-5318) untested not_testable untriaged — —
DF-5501 Low 3.2 passioctl() never re-checks securelevel: a /dev/passN fd opened before the raise keeps full raw-SCSI passthrough (incl. disk writes) at securelevel >= 2
sys/bus/cam/scsi/scsi_pass.c:335 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3254 Low 3.0 hammer_ioc_dedup validates the forged data_offset zone AFTER hammer_btree_extract_data has already dereferenced it — privileged INVARIANTS-kernel panic (zone-0 KKASSERT) and attacker-steered in-volume wild read on production kernels (DF-3187 sink via the gated dedup entry point)
sys/vfs/hammer/hammer_dedup.c:66 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3542 Low 3.0 Unsynchronized ng_eiface_next_unit++ races under concurrent node creation — duplicate interface unit numbers and duplicate if_xname ifnets
sys/netgraph/eiface/ng_eiface.c:127 · pass 2 · new
 state-confusion (duplicate if_xname) untested not_testable untriaged — —
DF-3432 Low 2.8 udp6_connect() reads sin6_addr before any sa_len validation: heap OOB read past the user-copied sockaddr decides connect(2)'s errno (DF-3357/3372/3415 family, udp6_usrreq.c instance)
sys/netinet6/udp6_usrreq.c:596 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-5409 Low 2.8 cpu_sanitize_frame whitelists PSL_VM_UNSUPP — the gate that blocks the DF-5335 (bad-frame-at-iretq) route is incomplete for EFLAGS.VM
sys/platform/vkernel64/x86_64/cpu_regs.c:316 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2966 Low 2.5 net_add_domain publishes a domain into the global domains list before net_init_domain stubs its NULL pru_* entries — a socket created in the kldload window dispatches a NULL function pointer in the netisr protocol thread (guaranteed panic)
sys/kern/uipc_domain.c:137 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3206 Low 2.5 cd9660_lookup evaluates shared dp->i_ino after vn_unlock in the DOTDOT path: concurrent lookup race can bind '..' to an arbitrary concurrently-scanned inode (wrong parent vnode) or spuriously fail
sys/vfs/isofs/cd9660/cd9660_lookup.c:343 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3219 Low 2.5 dirfs_root lazy-init of dmp->dm_root is completely unlocked — concurrent VFS_ROOT creates two root nodes, leaks a dnp + host fd forever, and can produce a mount root vnode without VROOT
sys/vfs/dirfs/dirfs_vfsops.c:234 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3393 Low 2.5 rn_match/rn_insert/rn_delete compare loops bounded by the caller's clen(key) over-read the stored leaf-key allocation — unprivileged via RTM_GET
sys/net/radix.c:328 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3829 Low 2.5 NVMM VMX: host NMIs are silently swallowed while a vCPU is resident on the CPU
sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c:1252 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5073 Low 2.5 Uninitialized kernel-stack value exported to unprivileged users via world-readable hw.acpi.acline when firmware _PSR returns no object (DF-3793 root cause surfacing in acpi_acad)
sys/dev/acpica/acpi_acad.c:111 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2935 Info 2.5 Kernel-internal VOP_ACCESS(3-arg) callers silently get access(2)-style REAL-ID authorization semantics from vop_helper_access
sys/kern/vfs_helper.c:88 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3609 Info 2.3 ncr(4): CCB-supplied target_id/target_lun index per-adapter arrays without bounds checks in ncr_action/ncr_get_nccb (and CDB/sense length fields are trusted for DMA sizing) — hardening against privileged CAM injection
sys/dev/disk/ncr/ncr.c:3874 · pass 2 · new
 privileged-only OOB read/hardening untested — untriaged — —
DF-2794 Info 1.9 sys_lwp_rtprio() with tid == -1 ignores the target pid and always operates on the caller's own lwp
sys/kern/kern_resource.c:588 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3580 Info 1.9 Inverted privilege-check result in iwn_cdev_ioctl(): returns success when caps_priv_check fails
sys/dev/netif/iwn/if_iwn.c:5157 · pass 2 · new
 none untested not_testable untriaged — —
DF-4865 Info 1.9 cpuctl microcode update paths ignore rdmsr_safe() failures: uninitialized stack rev0/rev1/res printed to dmesg and used in the success decision
sys/dev/misc/cpuctl/cpuctl.c:289 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2852 Info 1.1 dev_dmmap/dev_dpsize don't preset a_result; dead dev_dclone never initializes a_name/a_namelen/a_cred/a_mode — uninitialized kernel stack passed to drivers by the dispatch shim
sys/kern/kern_device.c:261 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2743 Info 0.8 DIOCGKERNELDUMP handled with no privilege check or FWRITE gate (diskioctl → disk_dumpconf → set_dumper)
sys/kern/subr_disk.c:1186 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5692 Info 0.5 kfnmatch() diverges from userland fnmatch(3) in four machine-demonstrated ways — MAXNEST>=20-star silent FNM_NOMATCH, trailing-backslash literal, signed-char bracket ranges, PATHNAME-unterminated-bracket hard fail
sys/libkern/fnmatch.c:51 · pass 2 · new
 none reproduced fixed untriaged — —
DF-0165 High 8.4 caps_priv_check corrupts cap argument before prison_priv_check: bypasses per-cap jail policy (raw sockets + mounts in jail)
sys/kern/kern_caps.c:333
 jail-policy bypass reproduced fixed untriaged — —
DF-2511 High 8.4 Unvalidated controller-supplied subq_id and cmd_id in nvme_poll_completions enable kernel memory corruption
sys/dev/disk/nvme/nvme.c:713
 none not_reproduced not_testable untriaged — —
DF-1010 Low 7.8 fwohci_ioctl performs privileged OHCI register/PHY/DMA operations without priv_check_cred
sys/bus/firewire/fwohci.c:333
 none reproduced fixed untriaged — —
DF-0768 Medium 7.4 nfs_readdirplusrpc_uio signed-overflow in nfsm_rndup(i) corrupts RPC reply cursor — kernel memory info leak via getdents or panic
sys/vfs/nfs/nfs_vnops.c:2924
 panic reproduced fixed untriaged — —
DF-2418 Medium 7.4 Missing bounds check on device-controlled NCQ error tag causes OOB heap read/write in ahci_port_read_ncq_error
sys/dev/disk/ahci/ahci.c:3488
 none not_reproduced not_testable untriaged — —
DF-0141 High 7.3 Missing privilege check in sys_vquotactl: any user can set/read all quotas
sys/kern/vfs_quota.c:328
 dos reproduced fixed untriaged — —
DF-2300 Medium 7.3 Missing privilege check in FWOHCI_WRREG/RDREG ioctl allows operator-group users to write arbitrary OHCI hardware registers
sys/bus/firewire/fwohci.c:354
 limited_write reproduced fixed untriaged — —
DF-0769 High 7.1 hammer_vop_readdir OOB kernel-heap read / info leak via forged direntry data_len underflow
sys/vfs/hammer/hammer_vnops.c:1728
 panic (GENERIC/INVARIANTS ON); ~49160-byte kernel-heap info leak (production/INVARIANTS OFF) reproduced fixed untriaged — —
DF-2221 High 7.1 ar5312EepromRead unbounded OOB read of radio-config buffer reachable from unprivileged SIOCGATHDIAG/HAL_DIAG_EEREAD
sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:37
 none not_reproduced not_testable untriaged — —
DF-0931 Medium 7.1 setuid/setgid bit bypass in ffs_write via int truncation of size_t uio_resid
sys/vfs/ufs/ufs_readwrite.c:220
 uid0 → root reproduced fixed untriaged — —
DF-2236 Medium 7.1 iconv_xlat16_open trusts attacker-controlled cp_data size causing OOB heap read and NULL-deref panic
sys/libiconv/iconv_xlat16.c:68
 panic reproduced fixed untriaged — —
DF-1645 Medium 6.7 Unchecked / signedness-buggy msg->index allows OOB read+write of vinum SD/DRIVE/PLEX/VOL arrays via VINUM_SETSTATE(_FORCE)
sys/dev/raid/vinum/vinumstate.c:848
 panic reproduced fixed untriaged — —
DF-2278 Low 6.7 CAM_DATA_PHYS / CAM_SG_LIST_PHYS accepted by pass allowing user-supplied raw physical DMA addresses to reach the SIM
sys/bus/cam/scsi/scsi_pass.c:565
 panic reproduced fixed untriaged — —
DF-2350 Medium 6.2 Heap OOB read in VS frame descriptor interval parsing leaks kernel memory to userspace
sys/bus/u4b/uvc/uvc_drv.c:1900
 none not_reproduced not_testable untriaged — —
DF-0536 Medium 6.1 Unprivileged kernel heap over-read via non-NUL-terminated sg_data in ng_connect_data
sys/netgraph7/socket/ng_socket.c:752
 leak reproduced fixed untriaged — —
DF-0778 Medium 6.1 ufs_readlink OOB read / panic via i_size truncation to int — crafted FFS image heap info leak or DoS
sys/vfs/ufs/ufs_vnops.c:1740
 panic reproduced fixed untriaged — —
DF-2200 Medium 6.1 Missing runtime bounds check on gpio in 4/5 entry points (sibling of DF-2199)
sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c:42
 dos reproduced fixed untriaged — —
DF-0588 Medium 6.0 tunwrite leaks mbuf chain on unsupported address family (m_freem(m) vs m_freem(top))
sys/net/tun/if_tun.c:875
 dos reproduced fixed untriaged — —
DF-2246 Medium 6.0 Destructive DDB sysctls (debug.panic/panic2/enter_debugger) have no jail confinement: jailed root can crash or freeze entire host
sys/ddb/db_sysctl.c:56
 dos reproduced fixed untriaged — —
DF-1643 Low 5.8 Missing caps_priv_check on destructive ATA ioctls (IOCATADETACH/ATTACH/REINIT/REQUEST)
sys/dev/disk/nata/ata-all.c:369
 none reproduced fixed untriaged — —
DF-0272 High 5.5 Missing ifnet_unlock on error paths in SIOCAIFGROUP/SIOCDIFGROUP/SIOCGIFGROUP/SIOCSIFDESCR: permanent ifnet_mtx deadlock
sys/net/if.c:2389
 dos reproduced fixed untriaged — —
DF-0680 Medium 5.5 NULL-pointer dereference / local kernel panic via getsockopt on RFCOMM socket with unknown option (rfcomm_socket.c:121-126)
sys/netbt/rfcomm_upper.c:562
 panic reproduced fixed untriaged — —
DF-0682 Medium 5.5 NULL-deref panic in l2cap_ctloutput getsockopt path (l2cap_socket.c:126-131) — same defect class as DF-0680
sys/netbt/l2cap_upper.c:521
 panic reproduced fixed untriaged — —
DF-0829 Medium 5.5 HPFS EA ioctls walk past fn_int using unvalidated on-disk fn_ealen — kernel heap info leak via copyout
sys/vfs/hpfs/hpfs_vnops.c:144
 leak:65540 reproduced fixed untriaged — —
DF-0921 Medium 5.5 Missing privilege check in /proc/<pid>/map exposes VM layout and mapped file paths of any process
sys/vfs/procfs/procfs_map.c:56
 leak reproduced fixed untriaged — —
DF-1116 Medium 5.5 Integer divide-by-zero panic in fwdma_malloc_multiseg via esize==0 (FW_SSTBUF psize=0)
sys/bus/firewire/fwdma.c:153
 panic reproduced not_testable untriaged — —
DF-1434 Medium 5.5 CDRIOCSETBLOCKSIZE with arg=0 causes kernel divide-by-zero panic via rounddown()
sys/dev/disk/nata/atapi-cd.c:723
 none inconclusive — untriaged — —
DF-1520 Medium 5.5 Heap OOB read in ath_hal_getregdump via HAL_DIAG_REGS — loop bound on output space, not on input array size
sys/dev/netif/ath/ath_hal/ah.c:848
 none inconclusive — untriaged — —
DF-1521 Medium 5.5 NULL-deref kernel panic via HAL_DIAG_REGS / HAL_DIAG_EEREAD when caller passes result=NULL or args=NULL
sys/dev/netif/ath/ath_hal/ah.c:880
 none inconclusive — untriaged — —
DF-2052 Medium 5.5 DFS_SET_THRESH dereferences indata without verifying ATH_DIAG_IN was set (NULL-pointer-deref panic)
sys/dev/netif/ath/ath_dfs/null/dfs_null.c:260
 panic reproduced fixed untriaged — —
DF-0361 Low 5.5 Default netmap ioctl passthrough fabricates zeroed stack struct socket passed to ifioctl
sys/net/netmap/netmap.c:1488
 none reproduced fixed untriaged — —
DF-1819 Low 5.5 ar5210_misc: NULL pointer write in HAL_DIAG_EEREAD via ar5210GetDiagState (unprivileged local DoS)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:624
 none reproduced not_testable untriaged — —
DF-0522 Medium 5.3 thread0 root-credential fallback for socket operations (DF-0510 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:559
 none not_reproduced not_testable untriaged — —
DF-2135 Low 5.3 Missing smc_idx_lock around SMC indirect SRAM register access in radeon kv_smc.c (radeon twin of DF-2130)
sys/dev/drm/radeon/kv_smc.c:75
 none reproduced fixed untriaged — —
DF-1217 Medium 5.2 Unprivileged users get raw I2C-bus, EEPROM-write, and GPIO control over the capture card
sys/dev/video/bktr/bktr_core.c:2058
 none inconclusive not_testable untriaged — —
DF-2219 Medium 5.2 Unbounded array index in encode_pcie_lane_width() allows OOB .rodata read via crafted GPU VBIOS
sys/dev/drm/amd/powerplay/hwmgr/pppcielanes.c:56
 none not_reproduced not_testable untriaged — —
DF-2122 Medium 5.1 vinum_rqinfo: signed negative index yields out-of-bounds kernel-memory read past rqinfo[]
sys/dev/raid/vinum/vinummemory.c:219
 panic reproduced fixed untriaged — —
DF-2130 Medium 4.7 Missing smc_idx_lock spinlock on all SMC SRAM register access -- race condition corrupts GPU power-management state
sys/dev/drm/amd/amdgpu/kv_smc.c:78
 none reproduced fixed untriaged — —
DF-2140 Medium 4.7 NULL pointer dereference in construct() under memory pressure -> kernel panic
sys/dev/drm/amd/display/dc/core/dc_surface.c:42
 panic reproduced fixed untriaged — —
DF-2586 Medium 4.7 sysctl_kern_msgbuf OOB kernel-memory read via unsigned underflow in linear-section length
sys/kern/subr_prf.c:1177
 panic reproduced fixed untriaged — —
DF-2053 Low 4.7 Error-cleanup NULL-deref + refcount leak in amdgpu_bo_list_create iterates wrong indices (dormant: userptr disabled on DFBSD)
sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:142
 panic reproduced fixed untriaged — —
DF-2108 Low 4.7 Unchecked JOY_SOFTC() return dereferences NULL across all four dev entry points (local DoS / panic)
sys/dev/misc/joy/joy.c:157
 panic reproduced fixed untriaged — —
DF-2118 Low 4.7 NULL-deref panic in amdgpu_dig_monitor_is_duallink when encoder has no linked connector
sys/dev/drm/amd/amdgpu/amdgpu_encoders.c:196
 panic reproduced fixed untriaged — —
DF-2225 Low 4.7 _PROP_ONCE_RUN sets completion flag before calling init racing concurrent first-user into NULL-deref on uninitialized rb_tree
sys/libprop/prop_dictionary.c:288
 panic reproduced fixed untriaged — —
DF-0621 Medium 4.6 Privilege bypass: rip6_output uses cr_uid==0 instead of caps_priv_check for per-packet IPv6 options
sys/netinet6/raw_ip6.c:297
 none not_reproduced not_testable untriaged — —
DF-0510 Medium 4.5 Credential bypass via thread0 fallback in socket operations: root creds for all ksocket ops
sys/netgraph7/ksocket/ng_ksocket.c:546
 none not_reproduced not_testable untriaged — —
DF-0436 Medium 4.4 Heap OOB read + security-filter bypass via OGF=0/event=0: negative bitstr index into ng_btsocket_hci_raw_sec_filter
sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:669
 none not_reproduced not_testable untriaged — —
DF-0761 Medium 4.4 ipfw3 sockopt path bypasses securelevel>=3 firewall-mutability gate — missing check present in all sibling glue layers
sys/net/ipfw3/ip_fw3_glue.c:50
 policy-bypass reproduced fixed untriaged — —
DF-1633 Medium 4.4 drm_gem_mmap_single skips per-file access control, allowing any local DRM client to mmap arbitrary GEM objects via brute-forceable offset
sys/dev/drm/drm_gem.c:1082
 panic reproduced fixed untriaged — —
DF-0005 Low 4.4 TIOCSTI unrestricted terminal input injection with no killswitch
sys/kern/tty.c:1158
 none reproduced fixed untriaged — —
DF-1721 Low 4.4 amdgpu_gem: GEM_CREATE GDS-domain ALIGN(size,4) wrap to zero produces zero-size GEM object
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:248
 none reproduced fixed untriaged — —
DF-1722 Low 4.4 amdgpu_gem: GEM_VA ioctl VA-reserved-area bypass via HOLE_END then GMC_HOLE_MASK
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:566
 none reproduced fixed untriaged — —
DF-1975 Low 4.4 Unconditional kprintf debug spam in i915_gem_evict_something leaks GTT layout and enables local log/console DoS
sys/dev/drm/i915/i915_gem_evict.c:156
 none reproduced not_testable untriaged — —
DF-2004 Low 4.4 Missing zero-check on writable machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic
sys/dev/acpica/acpi_timer.c:310
 none reproduced not_testable untriaged — —
DF-2046 Low 4.4 dma_fence_default_wait returns negative value on clean timeout (unsigned wrap) misreported as error to unprivileged render clients
sys/dev/drm/linux_fence.c:124
 none reproduced fixed untriaged — —
DF-2201 Low 4.4 GPIO index unvalidated in 4/5 exported ar5212 HAL GPIO functions (HALASSERT compiled out; SetIntr has no check) -> UB shifts -> local DoS
sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:41
 dos reproduced fixed untriaged — —
DF-2241 Low 4.4 Signed divide/modulo by -1 on LONG_MIN triggers #DE trap leaking db_active wedging system after DDB exit
sys/ddb/db_expr.c:147
 dos reproduced fixed untriaged — —
DF-2264 Low 4.4 Control-device ioctl path leaks cam_periph_lock (SIM-wide deadlock)
sys/bus/cam/scsi/scsi_sa.c:849
 dos reproduced fixed untriaged — —
DF-2343 Low 4.4 Divide-by-zero and OOB read in umcs7840_calc_baudrate when rate==0
sys/bus/u4b/serial/umcs.c:1066
 panic reproduced not_testable untriaged — —
DF-2487 Low 4.4 Modifying ioctls (MPTIO_WRITE_CFG_PAGE MPTIO_RAID_ACTION) allowed via read-only file descriptor
sys/dev/disk/mpt/mpt_user.c:116
 none not_reproduced not_testable untriaged — —
DF-0409 Info 4.4 Unprivileged users can install IP source-route options (LSRR/SSRR) without privilege check
sys/netinet/ip_output.c:1097
 none reproduced not_testable untriaged — —
DF-0707 Low 4.1 Missing return after NG_FREE_ITEM in ng_etf_rcvdata — same pattern as DF-0696 (reduced impact in ng7)
sys/netgraph7/etf/ng_etf.c:377
 panic reproduced fixed untriaged — —
DF-1105 Low 4.1 NULL-pointer dereference panic via uhci_reset() in uhci_pci_attach error paths
sys/bus/u4b/controller/uhci_pci.c:286
 panic reproduced fixed untriaged — —
DF-0388 Medium 4.0 Kernel heap info leak via uninitialized rt_msghdr.rtm_inits in NET_RT_DUMP sysctl: no M_ZERO on buffer
sys/net/rtsock.c:1676
 leak:130bytes reproduced fixed untriaged — —
DF-0025 Low 4.0 Missing privilege check on sys_kldstat()/sys_kldsym() leaks kernel symbol and module addresses
sys/kern/kern_linker.c:940
 leak reproduced fixed untriaged — —
DF-2194 Low 3.6 Undefined-behavior mask in AcpiOsReadPciConfiguration zeroes all 32-bit PCI config reads
sys/dev/acpica/Osd/OsdHardware.c:96
 none reproduced fixed untriaged — —
DF-0188 Info 3.6 No defense-in-depth privilege check; acl_cnt not bounds-validated pre-VOP
sys/kern/kern_acl.c:74
 none reproduced not_testable untriaged — —
DF-2029 Info 3.6 iir_ioctl performs no privilege check on RAID management commands
sys/dev/raid/iir/iir_ctrl.c:221
 none reproduced fixed untriaged — —
DF-2199 Low 3.4 Missing/ineffective bounds checks on gpio pin in 4 of 5 entry points (UB in shift macros, register field corruption)
sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c:42
 dos reproduced fixed untriaged — —
DF-2379 Medium 3.3 Integer underflow in P-state sysctl readers leaks uninitialized kernel stack
sys/dev/acpica/acpi_cpu_pstate.c:1258
 none not_reproduced not_testable untriaged — —
DF-2557 Medium 3.3 Kernel stack info leak via SO_PASSCRED auto-created SCM_CREDS on AF_UNIX SOCK_DGRAM
sys/kern/uipc_usrreq.c:683
 leak:62 reproduced fixed untriaged — —
DF-0015 Low 3.3 Missing visibility/privilege check in kern.proc.pathname -> exe-path disclosure of arbitrary processes
sys/kern/kern_proc.c:2080
 leak reproduced fixed untriaged — —
DF-0120 Low 3.3 Unprivileged read of all kernel env variables (boot/loader secrets)
sys/kern/kern_environment.c:135
 leak:N reproduced fixed untriaged — —
DF-0135 Low 3.3 Integer overflow in l64_setdisklabel partition bounds check: p_boffset+p_bsize wraparound bypasses ENOSPC
sys/kern/subr_disklabel64.c:304
 none reproduced fixed untriaged — —
DF-0292 Low 3.3 Missing privilege check on SIOCG80211 (get path): unpriv info disclosure
sys/netproto/802_11/wlan/ieee80211_ioctl.c:3467
 leak reproduced fixed untriaged — —
DF-0499 Low 3.3 Unprivileged info disclosure: read-only L2CAP node ioctls (GET_CON_LIST, GET_CHAN_LIST) lack privilege check
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:850
 none reproduced fixed untriaged — —
DF-0814 Low 3.3 tmpfs_chmod swallows vop_helper_chmod error and always returns success — POSIX contract violation
sys/vfs/tmpfs/tmpfs_subr.c:1174
 none reproduced not_testable untriaged — —
DF-1218 Low 3.3 drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails
sys/dev/drm/drm_atomic_helper.c:2938
 none reproduced fixed untriaged — —
DF-1524 Low 3.3 Kernel pointer disclosure via unprivileged SIOCGATHNODERATESTATS rate-stats ioctl
sys/dev/netif/ath/ath_rate/sample/sample.c:1181
 leak:16 reproduced fixed untriaged — —
DF-1657 Low 3.3 radeon_uvd: destroy message missing filp ownership check -> cross-process UVD session teardown
sys/dev/drm/radeon/radeon_uvd.c:505
 none reproduced fixed untriaged — —
DF-1892 Low 3.3 Hardware-control sysctls exposed writable to unprivileged users (CTLFLAG_ANYBODY): local DoS via cpu_speed/backlight/fan
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:250
 none reproduced fixed untriaged — —
DF-2020 Low 3.3 DRM magic auth tokens leaked to unprivileged users via sysctl hw.dri.N.clients (cross-file drm_sysctl.c)
sys/dev/drm/drm_auth.c:58
 none reproduced not_testable untriaged — —
DF-2148 Low 3.3 Missing privilege check on PPS_IOC_KCBIND allows unprivileged kernel clock-discipline binding
sys/dev/misc/pps/pps.c:183
 none reproduced fixed untriaged — —
DF-2154 Low 3.3 Uninitialized kernel stack memory leaked to userspace via sysctl read of failing Sony ACPI node
sys/dev/acpica/acpi_sony/acpi_sony.c:183
 leak reproduced fixed untriaged — —
DF-2217 Low 3.3 Missing privilege check on NVMEIOCGETLOG allows unprivileged NVMe admin command execution
sys/dev/disk/nvme/nvme_ioctl.c:37
 none not_reproduced not_testable untriaged — —
DF-2391 Low 3.3 Uninitialized kernel stack leaked to unprivileged users via sysctl when ACPI get-method fails
sys/dev/acpica/acpi_sony/acpi_sony.c:183
 leak reproduced not_testable untriaged — —
DF-0037 Info 3.3 sys_getpgid / sys_getsid lack cross-session visibility checks (unprivileged pgid/sid enumeration)
sys/kern/kern_prot.c:106
 leak:64bytes reproduced fixed untriaged — —
DF-1077 Info 3.3 Panic backtrace writes raw kernel addresses to world-readable msgbuf
sys/platform/pc64/x86_64/db_trace.c:211
 none reproduced not_testable untriaged — —
DF-2226 Info 3.3 Internalizer accepts empty <key></key> violating keysym non-empty invariant guarded by _PROP_ASSERT
sys/libprop/prop_dictionary.c:1334
 — reproduced not_testable untriaged — —
DF-1380 Low 3.0 Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel heap
sys/dev/drm/amd/amdgpu/atombios_encoders.c:2156
 none reproduced not_testable untriaged — —
DF-2213 Low 3.0 OOB read on piotiming[] via raw mode&ATA_MODE_MASK index writes garbage PIO timing to disk controller
sys/dev/disk/nata/chipsets/ata-cyrix.c:67
 none reproduced fixed untriaged — —
DF-2372 Low 3.0 Undefined-behavior bit shift zeroes all 32-bit PCI config reads via ACPI
sys/dev/acpica/Osd/OsdHardware.c:96
 corruption reproduced not_testable untriaged — —
DF-0245 Medium 2.5 Per-cpu iowbytes counter underflow via thread migration accounting break
sys/kern/kern_iosched.c:79
 dos not_reproduced not_testable untriaged — —
DF-0022 Low 2.5 PPS_IOC_KCBIND missing privilege check allows unprivileged kernel-PLL binding (NTP confusion)
sys/kern/kern_clock.c:1680
 none reproduced fixed untriaged — —
DF-0190 Low 2.5 logopen performs no jail check beyond devfs file mode
sys/kern/subr_log.c:92
 none reproduced fixed untriaged — —
DF-0870 Low 2.5 Unprivileged kernel heap info leak via volume_list when device_name not NUL-terminated
sys/vfs/hammer/hammer_volume.c:107
 leak:device_path_string reproduced fixed untriaged — —
DF-1074 Low 2.5 nexus_deactivate_resource truncates MMIO size to 32 bits, leaving stale PTEs and orphaning KVA for >4 GiB BARs
sys/platform/pc64/x86_64/nexus.c:462
 none reproduced fixed untriaged — —
DF-1808 Low 2.5 ar5211_misc: HAL_DIAG_RFGAIN ioctl leaks kernel rodata pointer via embedded currStep pointer in GAIN_VALUES
sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680
 none reproduced not_testable untriaged — —
DF-2054 Low 2.5 Memory leak of userspace entry array on idr_alloc failure in BO_LIST_OP_CREATE
sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:285
 leak reproduced fixed untriaged — —
DF-0126 Info 2.5 TIOCCONS privilege check skipped when a_cred is NULL
sys/kern/tty_cons.c:486
 none reproduced not_testable untriaged — —
DF-0314 Info 2.5 Inconsistent privilege enforcement: RFC3542 GET path lacks priv check present in RFC2292 path
sys/netinet6/ip6_output.c:1942
 none reproduced not_testable untriaged — —
DF-0959 Info 2.5 KASSERT in old_dev_pager_fault checks paddr instead of dev_dmmap return value, never fires
sys/vm/device_pager.c:360
 none reproduced not_testable untriaged — —
DF-0080 Low 2.3 MEMRANGE_SET ioctl bypasses securelevel (mem_ioctl never checks FWRITE flag)
sys/kern/kern_memio.c:521
 none reproduced fixed untriaged — —
DF-0592 Low 2.3 Uninitialized kernel stack leaked to userspace via fairq_getqstats copyout of struct fairq_classstats
sys/net/altq/altq_fairq.c:282
 leak:176 reproduced fixed untriaged — —
DF-1631 Low 1.9 evdev_open leaks allocated client on every error path (memory-exhaustion DoS)
sys/dev/misc/evdev/evdev.c:118
 leak reproduced fixed untriaged — —
DF-1680 Low 1.9 lpt: backoff-clamp typo makes callout spin at 1-tick interval instead of backing off
sys/dev/misc/lpt/lpt.c:418
 dos reproduced fixed untriaged — —
DF-1993 Low 1.9 ath_btcoex_ioctl copies uninitialized kernel heap to userspace (latent; function currently has no caller)
sys/dev/netif/ath/ath/if_ath_btcoex.c:397
 none reproduced not_testable untriaged — —
DF-2031 Low 1.9 Resource leak in mfi_pci_attach when IRQ allocation fails (return bypasses cleanup)
sys/dev/raid/mfi/mfi_pci.c:288
 none reproduced not_testable untriaged — —
DF-1025 Info 1.9 Kernel pointer/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
sys/bus/cam/cam_periph.c:888
 none reproduced not_testable untriaged — —
DF-1897 Info 1.9 mmhub_v1_0_get_clockgating missing return on SR-IOV VF path reads host-managed registers
sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548
 none reproduced not_testable untriaged — —
DF-2139 Info 1.9 Raw RDRAND entropy bytes logged to world-readable kernel message buffer
sys/dev/crypto/rdrand/rdrand.c:175
 leak reproduced fixed untriaged — —
DF-2185 Info 1.9 backlight_lock is never lockinit()d — lockuninit() called instead during SYSINIT
sys/dev/misc/backlight/backlight.c:45
 panic reproduced fixed untriaged — —
DF-0427 Info 0.8 ip6_mrouter_set performs no explicit capability check: relies entirely on raw-socket attach privilege
sys/netinet6/ip6_mroute.c:265
 none reproduced not_testable untriaged — —
DF-1047 Info 0.5 Wrong loop bound (USB_DEV_QUIRKS_MAX vs USB_QUIRK_MAX) in USB_DEV_QUIRK_ADD/REMOVE quirk-name lookup
sys/bus/u4b/quirk/usb_quirk.c:883
 none reproduced fixed untriaged — —

Kernel memory leaks / uninitialized disclosure 987

Uninitialized or OOB-read disclosure of kernel memory, pointer leaks, missing zeroization.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5808 Medium 5.5 HAMMER mountctl(MOUNTCTL_MOUNTFLAGS) double-counts the result length — unprivileged OOB kernel heap read via unchecked copyout
sys/kern/vfs_subr.c:1281
 leak reproduced fixed untriaged — —
DF-5841 Info 4.7 mapped_ioctl: IOC_VOID|IOC_OUT commands copy out size bytes from the 128-byte on-stack ubuf.stkbuf — up to ~8KB kernel-stack overread primitive, gated only on fo_ioctl returning 0
sys/kern/sys_generic.c:674
 none not_reproduced not_testable untriaged — —
DF-5801 Info 0.5 vm_page_bits() and the valid/dirty setter family have no bounds validation in release kernels: KASSERT-only guard, shift UB, and silent uint8_t over-validation of m->valid/m->dirty
sys/vm/vm_page.c:3905
 none reproduced fixed untriaged — —
DF-5427 High 8.4 Signed/unsigned index confusion in VIDIOC_ENUM_FRAMEINTERVALS: unprivileged OOB read of kernel heap at attacker-controlled negative offset (info leak + fatal-trap DoS)
sys/bus/u4b/uvc/uvc_v4l2.c:562 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3091 High 8.2 pcbmap() accepts cluster numbers beyond pm_maxcluster (fatmask + reserved-range checks only) — crafted FAT chain yields cross-volume kernel-mediated read/write anywhere on the backing device beyond the mounted volume
sys/vfs/msdosfs/msdosfs_fat.c:184 · pass 2 · new
 cross-volume read+write: kernel-mediated out-of-volume disclosure and persistent tampering of device sectors beyond the mounted FAT volume (crafted media; root mount or vfs.usermount=1) reproduced fixed untriaged — —
DF-2910 Medium 8.2 disklabel64 read-path trust: crafted-media partition fields yield OOB absolute-media-offset I/O — cross-slice access, mod-2^64 wraparound slice escape, and ds_reserved EROFS label-area write bypass (concrete impact upgrade of DF-0134)
sys/kern/subr_disklabel64.c:183 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4754 Medium 8.2 ena_com_rx_pkt propagates the device-controlled RX completion req_id with no bounds check → driver indexes rx_buffer_info[req_id] far out of bounds (OOB read → wild mbuf* writes + kernel-memory disclosure)
sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:536 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3027 High 7.9 fuse_vop_getattr returns success without initializing *a_vap (dead mount / ENOSYS-latched GETATTR) — unprivileged kernel-stack info leak incl. kernel pointers via stat()/fstat()
sys/vfs/fuse/fuse_vnops.c:312 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5746 Medium 7.9 kern.iconv.add accepts unvalidated converter table sizes: ia_datalen=0 yields a deterministic NULL-deref panic in iconv_xlat16_open, and short tables yield attacker-directed kernel heap OOB reads disclosed to userspace through converted filenames
sys/libiconv/iconv.c:410 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4086 High 7.8 _mapping_get_ir_maprange off-by-one: end_idx == max_devices -> OOB reads and conditional 32-byte OOB write of mapping_table[] on IR events
sys/dev/raid/mps/mps_mapping.c:221 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4093 High 7.8 mpr _mapping_get_ir_maprange off-by-one: end_idx == max_devices -> OOB reads and two 32-byte OOB write sinks on IR paths (twin of DF-4086)
sys/dev/raid/mpr/mpr_mapping.c:254 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3713 Medium 7.5 em_rxeof trusts the 16-bit NIC descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len -> heap OOB read up to ~63.5KB past the 2048-byte RX cluster (positive direction of DF-1188)
sys/dev/netif/em/if_em.c:3692 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3759 Medium 7.5 alc_rxeof trusts the controller-DMA'd 14-bit RRS frame length with no bound vs nsegs*alc_buf_size/MCLBYTES: heap OOB read up to ~14.3KB past a 2KB RX cluster (kernel heap info leak) and negative m_len (panic)
sys/dev/netif/alc/if_alc.c:3307 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4045 Medium 7.5 stge_rxeof trusts the NIC-DMA'd 16-bit RxDMAFrameLen with no per-buffer bound: jumbo-MTU FrameEnd claim yields m_len up to 9022 on the 2048-byte cluster (up to 6974-byte heap OOB read into delivered frames); framelen < rxlen yields negative tail m_len -> m_copydata unsigned count -> ~4GB bcopy panic
sys/dev/netif/stge/if_stge.c:1606 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3525 High 7.4 ng_l2cap_lp_receive trusts the ACL payload-length claim: zero-byte fragments inflate m_pkthdr.len up to 65539 over ~8 real bytes -> lying ACL header on TX -> driver heap over-read disclosed over the air (DF-0508 sink, distinct llpi reassembly entry)
sys/netgraph7/bluetooth/l2cap/ng_l2cap_llpi.c:702 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3911 Medium 7.2 mpt_download_fw consumes the IOC-uploaded firmware image with zero validation: unchecked ImageSize and unbounded ext-image walk give wild kernel reads streamed to the device / page-fault panic
sys/dev/disk/mpt/mpt.c:2467 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4792 Medium 7.0 Signed int16_t table_id passes the only bounds check in vega20_copy_table_from/to_smc: uint16 API values 0x8000..0xFFFF index smu_tables.entry[] out of bounds (heap OOB read AND write) — DF-2021/DF-2034/DF-2072 family twin pass 1 missed for vega20
sys/dev/drm/amd/powerplay/smumgr/vega20_smumgr.c:164 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3487 Medium 6.8 ng_pppoe_rcvdata PRIMED branch: get_tag/scan_tags walk with unvalidated ph->length -> kernel heap OOB read disclosed in emitted PADO (DF-0414 sibling sink)
sys/netgraph7/pppoe/ng_pppoe.c:1194 · pass 2 · new
 leak reproduced — untriaged — —
DF-3491 Medium 6.8 PRIMED branch of ng_pppoe_rcvdata: ph->length never validated against the actual packet length — get_tag/scan_tags walk ~900 bytes past a 32-byte mbuf and the OOB heap bytes are disclosed in the emitted PADO (v1 live-stack twin of DF-3487; third sink distinct from DF-0457)
sys/netgraph/pppoe/ng_pppoe.c:1304 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3736 Medium 6.8 emx_rxeof trusts the 16-bit NIC descriptor length with no posted-buffer bound: unbounded m_len/m_pkthdr.len -> heap OOB read up to ~63.5KB past the 2046/2048-byte RX cluster (DF-3713 em(4) twin)
sys/dev/netif/emx/if_emx.c:3369 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4107 Medium 6.8 vge_rxeof trusts the NIC-DMA'd 14-bit RX descriptor length with no MCLBYTES clamp: single-fragment path sets m_len/pkthdr.len up to 16379 on a 2048-byte cluster (~14KB heap OOB read into if_input/BPF) and signed-underflows to -4 for BUFSIZ<4 (DF-3604/4055/4083 family)
sys/dev/netif/vge/if_vge.c:1268 · pass 2 · new
 none untested not_testable untriaged — —
DF-3966 Medium 6.7 rxeof trusts the device-fed 12-bit RX frame length against a 2048-byte cluster: m_len up to 4095 → up to 2047-byte OOB read past the mbuf cluster into ieee80211_input (kernel heap disclosure / parser crash)
sys/dev/netif/ral/rt2661.c:1101 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4067 Medium 6.7 ti_rxeof trusts the NIC-DMA'd 16-bit return-descriptor ti_len with no bound vs the backing buffer: std-ring m_len up to 65535 on a 2048-byte cluster (63489-byte heap OOB read into delivered frames), jumbo up to 56513 bytes past a 9024-byte slot — DF-3604/3989/4024/4045/4055 family, ti(4) instance
sys/dev/netif/ti/if_ti.c:1636 · pass 2 · new
 none observed (hardware-gated); source-level: kernel heap OOB read up to 63489 bytes past a 2048-byte std cluster (65535 on u16 ti_len) delivered into received frames via BPF/sockets; jumbo path up to 56513 bytes past a 9024-byte slot incl. past the contigmalloc block; page-fault panic variant inconclusive not_testable untriaged — —
DF-4862 Medium 6.7 amdgpu_cgs_get_firmware_info CP_MEC branch: info->image_size = jt_offset << 2 from an unvalidated firmware-header dword — SMU-side OOB DMA read of up to ~4 GB from the staged fw_buf window (DF-4774 shape on the CP branch, kernel-side fully in-bounds)
sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:221 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4250 Medium 6.5 Stale sassc->maxtargets after mprsas_realloc_targets desynchronizes every targets[] bounds check from the real array size (heap OOB read/write window |attach_facts - reset_facts| structs)
sys/dev/raid/mpr/mpr_sas_lsi.c:890 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3709 Medium 6.4 Firmware completion tokens consumed unvalidated: psrb_pool[SMID] OOB read (ARC1884) and wild vir2phy SRB dereference (types A-D)
sys/dev/raid/arcmsr/arcmsr.c:821 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-4083 Medium 6.4 sis_rxeof trusts the 12-bit DMA-written RX descriptor length (SIS_RXBYTES = (sis_ctl & 0xFFF) - 4, up to 4091) into m_len/m_pkthdr.len of a 2048-byte cluster with no clamp: up to ~2 KB kernel heap OOB read delivered to the network stack/BPF (DF-3604 length-trust family)
sys/dev/netif/sis/if_sis.c:1374 · pass 2 · new
 none untested not_testable untriaged — —
DF-3604 Medium 6.3 bce_rx_intr trusts NIC-DMA'd l2_fhdr_pkt_len with no MCLBYTES bound: heap OOB read up to ~63.5KB past the 2048-byte RX cluster, and unsigned underflow to ~4GB m_len (guaranteed panic)
sys/dev/netif/bce/if_bce.c:4396 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3630 Medium 6.3 iwm_handle_rxb: PAGE_SIZE sc_cmd_resp copy from possibly-offset response packet reads up to ~4KB past the 4096-byte RX cluster; iwm_alive_fn v3 fallback reads fixed struct without payload-length check
sys/dev/netif/iwm/if_iwm.c:5511 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3639 Medium 6.3 bnx_rxeof trusts NIC-DMA'd return-ring bge_len with no MCLBYTES bound: heap OOB read / kernel info leak up to ~63.5KB past the 2048-byte RX cluster
sys/dev/netif/bnx/if_bnx.c:2848 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3663 Medium 6.3 bge_rxeof trusts NIC-DMA'd return-ring bge_len with no MCLBYTES/jumbo bound: heap OOB read / kernel info leak up to ~63.5KB past the RX cluster (OOB write on i386 ALIGNBUG path)
sys/dev/netif/bge/if_bge.c:3138 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3692 Medium 6.3 RAID ioctls index ata_raid_arrays[lun] with an unvalidated int: OOB pointer-table read -> wild ar_softc (panic; DELETE = kfree of wild pointer, STATUS = kernel-memory copyout)
sys/dev/disk/nata/ata-raid.c:249 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3766 Medium 6.3 (value + 1) 32-bit wrap in r100_cs_track_check_pkt3_indx_buffer() bypasses the PACKET3_INDX_BUFFER offset check -> GPU OOB index fetch up to ~4GB past the BO
sys/dev/drm/radeon/r100.c:1909 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-3849 Medium 6.3 dc_rxeof trusts the NIC-DMA'd 14-bit RX frame length with no bound against the 2040-byte posted cluster: heap OOB read up to ~14 KB handed to the stack, and negative m_len on FRAMESZ<4 (DF-3604 family, dc(4) instance)
sys/dev/netif/dc/if_dc.c:2523 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3933 Medium 6.3 Single-segment RX frame length taken unclamped from the return descriptor: m_len/m_pkthdr.len up to 65535 on a 2046-byte cluster — heap OOB read (kernleak)
sys/dev/netif/age/if_age.c:2000 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4024 Medium 6.3 re_rxeof trusts the NIC-DMA'd 14-bit GFRAGLEN (RE_RXBYTES) with no bound vs MCLBYTES: single-fragment m_len up to 16379 on a 2048-byte cluster -> 14,331-byte heap OOB read into delivered frames; multi-fragment m_pkthdr.len past the fragment chain -> m_copydata NULL-walk panic — DF-3604/3759/3933/3989 family, re(4) instance
sys/dev/netif/re/if_re.c:1142 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4827 High 6.2 get_hw_supported_ddc_line validates DDC line against GPIO_DDC_LINE_COUNT(8) but sw_i2cs[] is sized MAX_PIPES(6): OOB read of scalar-overlay garbage pointer, then wild kernel write engine->ddc = ddc
sys/dev/drm/amd/display/dc/dce/dce_i2c_sw.c:91 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3048 High 6.1 s_inodes_count never validated against gcount*ipg — dirent inode numbers beyond the group-descriptor table OOB-read fs->e2fs_gd in ext2_vget
sys/vfs/ext2fs/ext2_vfsops.c:606 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3122 Medium 6.1 ext2_htree_check_next() loads dx nodes during the miss-walk with zero validation — attacker-driven directory-block walk and OOB heap read past the index buffer (kernel panic from crafted ext2 image)
sys/vfs/ext2fs/ext2_htree.c:127 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3706 Medium 6.1 vega10_setup_default_pcie_table reads bios entries[1] past the allocation when the VBIOS PCIE table has a single state (NUM_LINK_LEVELS=2)
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1232 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3872 Medium 6.1 mfi_check_for_sscd() dereferences NULL cm_data on MFI_CMD DCMD CFG_ADD with zero data_len (and heap-OOB-reads short buffers, bypassing pre/post checks)
sys/dev/raid/mfi/mfi.c:2679 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4452 Medium 6.1 Wild out-of-bounds read in acpi_pci_link_choose_irq(): unbounded _PRS extended-IRQ values and FADT SciInterrupt used as index into pci_link_interrupt_weights[256]
sys/dev/acpica/acpi_pci_link.c:1010 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4772 Medium 6.1 amdgpu_pasid_free_delayed leaks one exclusive-fence reference per call — the DFly reservation_object_get_fences_rcu shim drops upstream's else-put; unbounded unprivileged kernel heap leak via drm fd open/close churn
sys/dev/drm/amd/amdgpu/amdgpu_ids.c:111 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3689 Low 6.1 Heap OOB read via unvalidated u8 vddInd/vddcInd from VBIOS indexing the voltage-lookup tables
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1858 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5303 Low 6.1 DUMPDMA ioctl channel-bound off-by-one: dump_db() indexes ir[OHCI_DMA_IRCH] one past the array, type-confuses the fwohci_softc tail and walks it as a descriptor ring (panic / console heap leak); dump_dma() MMIO-reads past the 2KB register file
sys/bus/firewire/fwohci.c:372 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3483 Medium 6.0 ng_generic_msg() leaks the entire control message on NGM_MKPEER/NGM_CONNECT/NGM_NAME/NGM_RMHOOK arglen mismatch: permanent, unbounded kernel heap leak per failing generic control send (v1 sibling of netgraph7's DF-3474)
sys/netgraph/netgraph/ng_base.c:1263 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3697 Medium 6.0 RLC v2_1 save-restore-list offset/size fields parsed without any bounds check → wild-pointer memcpy (OOB kernel heap read / panic)
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:516 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3859 Medium 6.0 vega20_odn_edit_dpm_table VDDC_CURVE: one-sided signed bounds check (input_index > 2) lets negative user index through -> OOB read of od8_settings_array with values disclosed via pr_info (DF-3704 twin)
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2678 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4758 Medium 6.0 vinumsize() serves d_psize for every device type and indexes VOL[] with the subdisk/plex number — wrong-object swap sizing (deterministic) and heap OOB read for sdno/plexno >= volumes_allocated
sys/dev/raid/vinum/vinum.c:558 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5668 Medium 6.0 AcpiOsGetRootPointer() accepts hint.acpi.0.rsdp with zero validation — second kenv RSDP consumer feeding ACPICA; FADT-less crafted chain panics boot at AcpiTbLoadNamespace+0x36 (OOB read of Tables[0xFFFFFFFF])
sys/platform/pc64/acpica/OsdEnvironment.c:72 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4722 Low 5.9 ath_tdma_update passes the 0xff rateCodeToIndex sentinel into ath_hal_pkt_txtime — OOB read of rates->info[255] (64-entry table) and possible divide-by-zero panic from a received TDMA beacon
sys/dev/netif/ath/ath/if_ath_tdma.c:407 · pass 2 · new
 none untested not_testable untriaged — —
DF-2876 Medium 5.7 BLK_READ replies disclose stale shared pbuf-mem contents on EOF/error/short reads (cross-process, cross-device kernel-mediated info leak)
sys/kern/subr_diskiocom.c:594 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3716 Medium 5.7 mxge_rx_done_big trusts the NIC-DMA'd 16-bit completion length with no posted-cluster bound: heap OOB read up to ~63.5KB past the 2/4KiB RX cluster (DF-3604/3639/3663/3679/3713 family)
sys/dev/netif/mxge/if_mxge.c:2345 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4055 Medium 5.7 et_rxeof trusts the NIC-DMA'd rxstat length field: m_len/pkthdr.len set to up to 65535 with no bound against the actual buffer size (MHLEN/MCLBYTES/ET_JUMBO_FRAMELEN) — heap OOB read of up to ~64KB handed to if_input/BPF (DF-3604 family instance)
sys/dev/netif/et/if_et.c:1863 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4110 Medium 5.7 tl_intvec_rxeof trusts device-written 16-bit tlist_frsize: unbounded mbuf length on an MCLBYTES cluster (OOB read propagated up the network stack)
sys/dev/netif/tl/if_tl.c:1405 · pass 2 · new
 none untested not_testable untriaged — —
DF-4113 Medium 5.7 nge_rxeof trusts device-written 16-bit descriptor BUFLEN: unbounded mbuf length on the jumbo minicluster (OOB read propagated up the network stack)
sys/dev/netif/nge/if_nge.c:1225 · pass 2 · new
 none untested not_testable untriaged — —
DF-4352 Low 5.7 dce110_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319 twin)
sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:588 · pass 2 · new
 none untested not_testable untriaged — —
DF-4405 Low 5.7 amdgpu_uvd sw_init/resume trust unvalidated firmware ucode extent fields (ucode_size_bytes/ucode_array_offset_bytes) — sw_init bo_size u32 wrap, resume ~4GiB OOB read past the firmware blob and underflowed OOB memset_io (DF-1946 family instance)
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:250 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4495 Low 5.7 dce100_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319/4352/4375 family twin)
sys/dev/drm/amd/display/dc/dce100/dce100_resource.c:573 · pass 2 · new
 none untested not_testable untriaged — —
DF-5696 Low 5.7 kqsort keeps partition byte-distances in int: truncation plus signed/unsigned promotion through '(r = pd - pc) > es' corrupts the partition state at >=2.16 GiB — array pointer restarts 2.13 GiB past the end (OOB comparator reads, OOB swap writes); med3 'd=(n/8)*es' wraps at >=16 GiB
sys/libkern/qsort.c:109 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3667 Medium 5.6 ix_rxeof trusts NIC-DMA'd descriptor length with no rx_mbuf_sz bound: unbounded m_len/m_pkthdr.len → heap OOB read up to 63,487 bytes past the RX cluster (DF-3604/3639/3663 family)
sys/dev/netif/ix/if_ix.c:2974 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3102 High 5.5 Unaligned-offset read() on UDF files copies up to bsize-1 bytes past the buffer-cache buf into userspace (udf_readatoffset missing in-block size clamp)
sys/vfs/udf/udf_vnops.c:1046 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2698 Medium 5.5 hammer(1) MOUNTCTL_MOUNTFLAGS result-length double-count: unprivileged copyout reads up to ~U bytes past a kmalloc'd M_TEMP buffer (kernel heap pointer disclosure)
sys/vfs/hammer/hammer_vnops.c:2577 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2702 Medium 5.5 AF_UNIX SCM_RIGHTS raw kernel file-pointer leak via recvmsg(MSG_PEEK) — soreceive skips unp_externalize on the peek path
sys/kern/uipc_usrreq.c:1543 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2713 Medium 5.5 recvmsg(2) copies out uninitialized CMSG_SPACE tail padding of every kernel-built control message — unprivileged, groomable kernel heap disclosure
sys/kern/uipc_syscalls.c:1175 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2718 Medium 5.5 PT_INTERP interpreter string never NUL-terminated: kernel heap OOB read disclosed to unprivileged users via uprintf("ELF interpreter %s not found")
sys/kern/imgact_elf.c:668 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2952 Medium 5.5 Resident-exec stack remap silently fails (vm_map_stack KERN_NO_SPACE swallowed at imgact_resident.c:185): every exec of a registered binary runs on the registration snapshot's COW stack, disclosing the registering root process's stack contents to unprivileged exec'ers
sys/kern/imgact_resident.c:185 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3258 Medium 5.5 Uninitialized kernel-stack disclosure of dr[8..15] (64 bytes) via /proc/<pid>/dbregs and ptrace(PT_GETDBREGS)
sys/vfs/procfs/procfs_dbregs.c:57 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3858 Medium 5.5 vega20_get_sclk_od/get_mclk_od: count-1 underflow wild read (+34 GB) and DIV_ROUND_UP divide-by-zero on zero golden clock via world-readable pp_sclk_od/pp_mclk_od (DF-3686/DF-3707 twins)
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1326 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4183 Medium 5.5 amdgpu fb creation never validates framebuffer size against the backing GEM object (twin of DF-4181; covers BOTH legacy DCE and DC scanout stacks) — display engine scans out megabytes past a tiny BO, disclosing adjacent VRAM on the physical display
sys/dev/drm/amd/amdgpu/amdgpu_display.c:506 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4474 Medium 5.5 Kernel heap leak on dm ioctl error paths: unreleased prop_array_iterator (retaining the entire inbound cmd_data tree) in dm_table_load_ioctl; unreleased cmd_array in deps/status ENOENT paths
sys/dev/disk/dm/dm_ioctl.c:602 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4666 Medium 5.5 phm_find_closest_vddci has no empty-table guard — count==0 indexes entries[0xFFFFFFFF]: wild kernel read ~32 GiB past the heap object (panic)
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:426 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4673 Medium 5.5 METEORSETGEO grow path installs an unzeroed frame buffer — contigmalloc pages recycled from PQ_FREE/PQ_CACHE disclose stale kernel memory via mmap()/read() (attach path bzero's; grow path doesn't)
sys/dev/video/bktr/bktr_os.c:399 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5272 Medium 5.5 CDIOCREADSUBCHANNEL: non-zeroed kmalloc + short device transfer + device-inflated data_len clamp = uninitialized kernel heap disclosure
sys/bus/cam/scsi/scsi_cd.c:2141 · pass 2 · new
 leak:20 bytes/call of uninitialized kernel heap to a privileged reader, unlimited calls; demonstrated disclosure of a live kernel sysctl OID name string fragment ('...ilcd\0spray_leak\0') and of stable allocator/object remnants (ffffffff...01000000) across 64/64 ioctls x 3 rounds; evil-device-gated (same model as DF-0989, distinct path and mechanism: short transfer + device-inflated data_len clamp on a non-M_ZERO kmalloc). reproduced fixed untriaged — —
DF-5332 Medium 5.5 chgetelemstatus() allocates READ ELEMENT STATUS buffers without M_ZERO and ignores resid: short-but-GOOD device transfers disclose stale kernel heap through CHIOGSTATUS copyout (DF-5272 class)
sys/bus/cam/scsi/scsi_ch.c:1089 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4850 Low 5.4 amrr ath_rate_getxtxrates() writes hardware rate codes into ath_rc_series.rix (rate-table INDEX) fields and clobbers the correct series-0 index — wrong-entry rt->info[] derefs on every multi-rate-retry frame, HT mis-programming on 11n HALs, and a second OOB read sink when compounded with DF-1931
sys/dev/netif/ath/ath_rate/amrr/amrr.c:135 · pass 2 · new
 none untested not_testable untriaged — —
DF-5426 Info 5.4 usb_handle_request(): unguarded 'max_len -= off' offset subtraction relies on provider-length immutability — latent uint16 wrap yields an out-of-object DMA window (up to ~4 KiB/fragment OOB read on IN, mirror OOB write on OUT via a lying sub-driver); hardening
sys/bus/u4b/usb_handle_request.c:746 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2882 Medium 5.3 kvsscanf %*Nc suppress short-input branch leaves inr stale → conversions read past the input string's NUL (cross-object kernel heap disclosure into caller buffers)
sys/kern/subr_scanf.c:292 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3363 Medium 5.3 maxrate() heap out-of-bounds read via unvalidated htcap_ie from the verbatim-saved beacon IE blob: attacker-controlled AP selection
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:775 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3735 Medium 5.3 r600_pm_init_profile hardcodes clock-mode indices without num_clock_modes validation — default-config OOB heap read of per-state clock_info
sys/dev/drm/radeon/r600.c:685 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3945 Medium 5.3 CVE-2019-14615 carried: Gen9 indirect-context WA batch lacks the EU residual-state cleardown PIPE_CONTROL (cross-context GPU info leak on SKL/KBL/BXT/GLK/CFL)
sys/dev/drm/i915/intel_lrc.c:1581 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4152 Medium 5.3 Object-table walks dereference unvalidated VBIOS u16 offsets and stride unbounded/unchecked sizes — OOB kernel heap reads at attach (amdgpu twin of DF-3745)
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:318 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4155 Medium 5.3 amdgpu_atombios_lookup_voltage_object_v3: zero usSize strides forever; walk bounded only by an unvalidated usStructureSize (hang / OOB read at DPM init)
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:1415 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4168 Medium 5.3 DC bounds all VBIOS walks by the image's self-declared size byte (bios[2]*512) instead of the allocated buffer length
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1930 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4184 Medium 5.3 acd_fixate() sizes MODE SELECT data-out from device-fed write-param page_length: 265-byte transfer out of a 64-byte stack struct discloses ~201 bytes of kernel stack to the device
sys/dev/disk/nata/atapi-cd.c:1140 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2609 Low 5.3 Default-enabled ICMPv6 Node Information responder discloses hostname and full IPv6 address inventory to unauthenticated remote peers
sys/netinet6/icmp6.c:628 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3364 Low 5.3 tdma_isfull()/match_bss() heap out-of-bounds read via unvalidated tdma_ie slot count (up to ~30 bytes past the blob allocation)
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:959 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4560 Low 5.3 mpssas_fw_work dereferences fixed-offset event members without checking EventDataLength covers the struct: pre-loop ConfigElement[0].VolDevHandle at +0x0A and LOG_ENTRY LogData[0] at +0x14 read past the kmalloc'd event copy
sys/dev/raid/mps/mps_sas_lsi.c:273 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4789 Low 5.3 mpr_print_sgl walks the request-frame SGL unbounded, dereferences a possibly-NULL chain, and hexdumps a fixed 128 bytes — unconditional console path on firmware MPI2_IOCSTATUS_INVALID_SGL
sys/dev/raid/mpr/mpr_table.c:547 · pass 2 · new
 none untested not_testable untriaged — —
DF-4868 Low 5.3 mps_print_sgl walks the request-frame SGL unbounded, dereferences a possibly-NULL chain, and hexdumps fixed 128 bytes — unconditional console path on firmware MPI2_IOCSTATUS_INVALID_SGL (chain deref sits in the only walk, unlike the mpr twin)
sys/dev/raid/mps/mps_table.c:449 · pass 2 · new
 none untested not_testable untriaged — —
DF-4901 Low 5.3 cz_ih (Carrizo/Stoney APU): unvalidated device-DMA'd IH wptr — 4th instance of the DF-4843/4854/4887 family: a misaligned wptr permanently hard-spins the amdgpu interrupt thread, and the RB_OVERFLOW +16 recovery imports the bad phase, parking rptr within 12 bytes of ring end for an up-to-12-byte OOB read past the zero-slack 64 KiB GTT ring BO
sys/dev/drm/amd/amdgpu/cz_ih.c:192 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4902 Low 5.3 iceland_ih (Topaz): 5th and last unfiled instance of the unvalidated-wptr IH family — byte-identical to cz_ih.c in all vulnerable logic (permanent ithread spin on misaligned wptr + RB_OVERFLOW phase-import ring-end OOB read)
sys/dev/drm/amd/amdgpu/iceland_ih.c:192 · pass 2 · new
 dos untested not_testable untriaged — —
DF-5338 Low 5.3 kern_trap() broken fall-through for unhandled kernel-mode traps (T_PROTFLT/T_SEGNPFLT/T_BPTFLT/T_TRCTRAP): NULL p/lp deref for kernel threads, trapsignal(lp, i=0) sig-0 OOB read/call, and handler-returns-to-faulting-instruction livelock — pc64 ends these cases in trap_fatal
sys/platform/vkernel64/x86_64/trap.c:636 · pass 2 · new
 NULL-deref recursion / sig-0 OOB indirect call / silent livelock on any vkernel kernel fault untested not_testable untriaged — —
DF-4337 High 5.2 atom_context has no bios_size: every VBIOS offset dereference in the ATOM interpreter and master-table parsers is unbounded (OOB heap read up to 128KB; interpreter executes past the image) — central hub fix for the DF-4104/4152/4289 family
sys/dev/drm/radeon/atom.c:1194 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4345 High 5.2 amdgpu atom_context has no bios_size: every VBIOS offset dereference in the ATOM interpreter and master-table parsers is unbounded (OOB heap read up to 128KB; interpreter executes past the image) — central hub fix port of DF-4337 to the amdgpu twin
sys/dev/drm/amd/amdgpu/atom.c:268 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4396 High 5.2 CENTRAL FIX: Vega10 PowerPlay parser has no bounds-validation layer — all 22 firmware USHORT offsets, every UCHAR count and every revision dispatch consumed unvalidated against soft_pp_table_size (vega10 side of DF-4388)
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:72 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4059 Medium 5.2 amr_done trusts the controller completion list twice over: completion id 0 yields idx = -1 and reads amr_busycmd[-1] (OOB before the array -> garbage ac pointer deref), and on standard firmware the 8-bit mb_nstatus iterates mb_completed[46] out to 255 entries (stack OOB read past the local mailbox) — distinct from DF-1358 (the WRITE overflow inside amr_quartz_get_work)
sys/dev/raid/amr/amr.c:1786 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4288 Medium 5.2 VRAM_Info MC-register-table path: unvalidated VBIOS NULL/offset/stride — NULL-deref panic, OOB read walk, and stride-0 infinite loop at attach
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:148 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4289 Medium 5.2 SS-assignment walk bounded only by the table's own usStructureSize — up to 64KB OOB read past the ATOM table
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1231 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5363 Medium 5.2 CISTPL_CHECKSUM bounds check ignores tuple.mult: up to 4088 bytes of bus reads past the 4096-byte CIS mapping
sys/bus/pccard/pccard_cis.c:237 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5497 Medium 5.2 crom_next() dereferences the peer-derived nested-directory pointer (reg + 24-bit val, forward up to +64 MB) before any bounds check — OOB kernel read and deterministic kernel panic from a malicious FireWire device's Config ROM
sys/bus/firewire/fwcrom.c:122 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4312 Low 5.2 dcn10_link_encoder_create indexes 4-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source values (−1 and 4..9 / −1 and 4..7 / 4..6) — OOB kernel reads that become wild-MMIO register bases
sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:744 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4375 Low 5.2 dce112_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source — OOB const reads become the encoder's MMIO register bases (DF-4312/4319/4352 twin)
sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:577 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3650 Medium 5.1 OOB read in ci_parse_power_table's VCE state fill: clk_idx (ucClockInfoIndex & 0x3f) indexes clockInfo[] without the ucNumEntries bound used everywhere else
sys/dev/drm/radeon/ci_dpm.c:5654 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4774 Medium 5.1 smu7 SMC-firmware upload streams ucode payload from unchecked firmware-header offset/size: kernel heap OOB read up to 128 KB from ~4 GB past the blob (powerplay smu7 twin of DF-2065/DF-2096/DF-2104)
sys/dev/drm/amd/powerplay/smumgr/smu7_smumgr.c:461 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4814 Medium 5.1 parse_csr_fw bounds its stepping-search loop with attacker-controlled package_header->num_entries while the walked array is fixed fw_info[20]: unbounded kernel heap OOB read (panic / OOB dmc_offset)
sys/dev/drm/i915/intel_csr.c:134 · pass 2 · new
 code-level: kernel heap OOB read -> page-fault panic (DoS) plus OOB-read dmc_offset steering further fw->data indexing; kernel path not executable on the audit guest (only display device is QEMU std-VGA 0x1234:1111, parse_csr_fw gated on gen9+ HAS_CSR hardware); the exact parse loop + packed structs were replicated and executed on the guest, faulting past the buffer in both variants (run.log) untested not_testable untriaged — —
DF-5507 Medium 5.1 /dev/smb SMB_BREAD hands amdsmb_bread an UNINITIALIZED kernel-stack count (smb.c:317/323): SMB_BREAD dead for 224/256 stack bytes, and for garbage in [1,32) the driver reports a larger count than it stored -> kernel-stack disclosure via smbioctl copyout; bwrite transmits the garbage length on the wire (DF-5458 twin)
sys/bus/smbus/amdsmb/amdsmb.c:524 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5624 Medium 5.1 hard_sniff() flame-graph frame walk reads 8 bytes past the interrupted thread's kernel stack (fatal trap 12 / kernel-heap qword disclosure)
sys/platform/pc64/x86_64/mp_flame.c:136 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5650 Medium 5.1 SRAT walk performs no entry-extent or per-type length validation: affinity fields read (and printed) past the declared table end — console/dmesg disclosure of adjacent physical memory, and kernel page fault when the read crosses the mapdev page
sys/platform/pc64/acpica/acpi_srat.c:94 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4812 Low 5.1 hci_call() leaks the ACPI_ALLOCATE_BUFFER result buffer on a malformed GHCI return package: early 'return (ENXIO)' skips the AcpiOsFree that every other exit performs — unbounded M_ACPICA kernel heap leak per unprivileged sysctl read
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:437 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5465 Low 5.1 icu_abi_legacy_intr_config(): driver-facing ABI with KKASSERT-only irq bounds — silent OOB read-modify-write into icu_irqmaps on production kernels plus wild-index kernel page fault; returns void, no error path
sys/platform/pc64/icu/icu_abi.c:373 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5466 Low 5.1 Unvalidated hw.icu.msi_start boot tunable: negative value -> negative-index OOB scan/write in icu_abi_msi_alloc_intern() + msi_intr[] negative OOB read + setidt() overwrite of exception gates 0..31 -> triple-fault cold reset (ICU twin of DF-1037)
sys/platform/pc64/icu/icu_abi.c:323 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4777 Medium 4.8 ipmi_kcs: BMC-controlled reply byte count stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout
sys/dev/misc/ipmi/ipmi_kcs.c:411 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4948 Medium 4.8 ipmi_smic: BMC-controlled reply byte count stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout (DF-4777 twin)
sys/dev/misc/ipmi/ipmi_smic.c:320 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3012 Medium 4.7 hammer(1) in-memory record permanently leaked when hammer_blockmap_reserve() fails in hammer_ip_add_bulk() (and on the namekey-exhaustion ENOSPC path of hammer_ip_add_direntry)
sys/vfs/hammer/hammer_object.c:711 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3620 Medium 4.7 Wild OOB kernel read in ci_get_std_voltage_value_sidd when CAC leakage table count==0 (ZERO_LENGTH_PTR passes the entries!=NULL guard)
sys/dev/drm/amd/amdgpu/ci_dpm.c:2487 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3744 Medium 4.7 Unbounded LVDS mode-patch record walk and fake-EDID copy read past the VBIOS image buffer (conditional userspace EDID leak)
sys/dev/drm/radeon/radeon_atombios.c:1706 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3989 Medium 4.7 ale_rxeof trusts the controller-DMA'd 14-bit RRS frame length with no bound vs page/max_frame_size: m_devget heap OOB read up to ~14.8KB past the DMA Rx page into delivered mbufs (kernel heap info leak) — DF-3604/3759/3933 family, ale instance
sys/dev/netif/ale/if_ale.c:2204 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4171 Medium 4.7 count==0 underflow: ptable->entries[ptable->count - 1] reads index 0xFFFFFFFF in smu8_dpm_update_vce_dpm / smu8_dpm_update_uvd_dpm (smu10_hwmgr.c:851 twin)
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1258 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4190 Medium 4.7 Unchecked nonClockInfoIndex (u8) and clockInfoIndex (u8 x ucEntrySize) in sumo_parse_power_table index past the NonClockInfoArray/ClockInfoArray in the kmalloc'd BIOS image: heap OOB read up to ~6.1 KB / ~65 KB — OOB bytes ingested into rps->class/class2/caps/vclk driving boot_ps/UVD/thermal selection — sumo twin of DF-1401/1306/1140
sys/dev/drm/radeon/sumo_dpm.c:1495 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4492 Medium 4.7 rs780_dpm: unchecked VBIOS pplib offsets/indices/strides in rs780_parse_power_table give wild OOB kernel reads past the kmalloc'd BIOS image
sys/dev/drm/radeon/rs780_dpm.c:812 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4544 Medium 4.7 One-sided OD count clamps: VBIOS counts size the od_feature_capabilities/od_settings_max/min heap allocations downward while vega20_hwmgr consumers index them by fixed driver enums — heap OOB reads at driver init with the leaked u32s printed to the world-readable OD_RANGE sysfs node
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4796 Medium 4.7 reservation_object_get_fences_rcu leaks the exclusive-fence reference on the GFP_KERNEL slow-path retry (continue) — permanent kernel heap leak under allocation pressure
sys/dev/drm/linux_reservation.c:356 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4978 Medium 4.7 ipmi_ssif: BMC-accumulated reply length stored unclamped into ir_replylen — kernel-heap OOB read (info leak) via IPMICTL_RECEIVE_MSG(_TRUNC) copyout (DF-4777/DF-4948 shape, third transport)
sys/dev/misc/ipmi/ipmi_ssif.c:294 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5227 Medium 4.7 dma_alloc_coherent() returns non-zeroed (stale) kernel memory — Linux DMA API contract violation
sys/dev/drm/linux_dma.c:47 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5556 Medium 4.7 npxsave() missing FPU security wipe: previous FP owner's XMM0-15 are handed to the next exec'd image — cross-process/cross-exec FP-register info leak inside the vkernel
sys/platform/vkernel64/x86_64/npx.c:145 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3065 Low 4.7 ext2_reallocblks feeds unclamped attacker-controlled pref (crafted i_db[]/indirect values via ext2_blkpref) into dtog() as the cg index — OOB heap reads of e2fs_gd[]/e2fs_maxcluster[]/e2fs_clustersum[] and wild device I/O (root-sysctl-gated)
sys/vfs/ext2fs/ext2_alloc.c:302 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3591 Low 4.7 Legacy firmware size-check bypass in si_init_microcode() (err clobbered by later request_firmware success) -> heap OOB reads in constant-bounded legacy ucode loaders
sys/dev/drm/radeon/si.c:1806 · pass 2 · new
 kernleak reproduced not_testable untriaged — —
DF-3632 Low 4.7 NVM sections parsed at fixed word offsets against firmware-returned lengths (exact-size kmallocs) - heap OOB reads incl. regulatory[0x507] LAR read requiring >=2576 bytes
sys/dev/netif/iwm/if_iwm.c:2251 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3866 Low 4.7 emu_intr_unregister() uses caller-controlled slot index with no bounds check -> OOB read + four-field NULL write cluster at ihandler[-1] (NULLs sc->reg, sc->irq, sc->ih)
sys/dev/sound/pci/emu10kx.c:948 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3874 Low 4.7 Firmware-controlled list counts drive walks past fixed arrays: pdlist->count>240, ld_count>64, evt count>15 -> heap OOB reads and console disclosure
sys/dev/raid/mfi/mfi.c:1331 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-4104 Low 4.7 LVDS_Info parsed at unvalidated VBIOS data_offset: fixed 0x2C-byte struct reads run past the image-sized BIOS heap buffer (parse_data_header performs no bounds check; atom_context has no bios_size)
sys/dev/drm/amd/amdgpu/atombios_encoders.c:2081 · pass 2 · new
 none untested not_testable untriaged — —
DF-4385 Low 4.7 oce_img_flashing_required bcmp's the image CRC at a fixed ~1.31 MB offset with no fw->datasize check — sibling OOB-read site missed by DF-1573
sys/dev/netif/oce/oce_sysctl.c:458 · pass 2 · new
 none untested not_testable untriaged — —
DF-4887 Low 4.7 cik_ih: unvalidated device-DMA'd IH wptr — DF-4843/DF-4854 twin on the 16-byte CIK grid: a misaligned wptr permanently hard-spins the amdgpu interrupt thread, and the RB_OVERFLOW recovery preserves the bad phase so wptr∈[0xFFE4..0xFFEF]|OVERFLOW parks rptr at [0xFFF4..0xFFFF] → up to 12-byte OOB read past the zero-slack 64 KiB GTT ring BO
sys/dev/drm/amd/amdgpu/cik_ih.c:190 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4933 Low 4.7 dce110_vblank_set underflows pipe_offset for VUPDATE sources (vupdate_int_entry initializes no .src_id) — pipe_ctx[178] far-OOB read feeding a wild arm_vert_intr indirect call
sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:195 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5055 Low 4.7 dce80 vupdate entries carry no .src_id, so dce110_vblank_set (wired by dce80's own vblank_irq_info_funcs) re-derives DC_IRQ_SOURCE_INVALID and underflows pipe_offset to 178 → far-OOB pipe_ctx[178] read feeding a wild arm_vert_intr indirect call — the DF-4933 twin on the DCE80 table wiring
sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:82 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5079 Low 4.7 dce120 vupdate entries carry no .src_id, so dce110_vblank_set (wired by dce120's own vblank_irq_info_funcs) re-derives DC_IRQ_SOURCE_INVALID and underflows pipe_offset to 178 → far-OOB pipe_ctx[178] read feeding a wild arm_vert_intr indirect call — the DF-4933/DF-5055 twin on the DCE120 table wiring
sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:138 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5136 Low 4.7 vbt_sdvo_panel_type consumed as an unvalidated element index into the VBT BDB_SDVO_PANEL_DTDS table (dvo_timing + index) — root-set OOB read incl. negative offsets
sys/dev/drm/i915/i915_params.c:68 · pass 2 · new
 none untested not_testable untriaged — —
DF-5520 Low 4.7 isa_dmadone() bounce-buffer readback has no size clamp (asymmetric with isa_dmastart) and release keeps stale dma_bounced: unbounded OOB kernel read — deterministic panic, info leak into driver buffers
sys/bus/isa/x86_64/isa_dma.c:351 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3587 Medium 4.6 Wild OOB kernel read in btc_find_voltage when voltage-table count==0: entries[(u32)(count-1)] computes a ~31 GB wild index (0xffffffff)
sys/dev/drm/amd/amdgpu/si_dpm.c:3214 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4338 Medium 4.6 atom_index_iio indexes the 10-entry static atom_iio_len[] with an unvalidated VBIOS opcode byte (OOB read of kernel .data) and the garbage stride drives an unbounded walk past the BIOS image at attach
sys/dev/drm/radeon/atom.c:1254 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4346 Medium 4.6 amdgpu atom_index_iio indexes the 10-entry static atom_iio_len[] with an unvalidated VBIOS opcode byte (OOB read of kernel .data) and the garbage stride drives an unbounded walk past the BIOS image at attach (DF-4338's amdgpu twin)
sys/dev/drm/amd/amdgpu/atom.c:1287 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-5361 Medium 4.6 CISTPL_END MFC reset frees the pf structs but leaks every cfe on their chains (per-insertion kernel heap leak; unbounded with DF-5362)
sys/bus/pccard/pccard_cis.c:635 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2859 Low 4.5 sglist_split() trims `count` entries instead of the surviving remainder — stale/duplicated DMA segments and heap OOB read past the segs array (dead code; identical latent bug in FreeBSD HEAD)
sys/kern/subr_sglist.c:571 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4422 Low 4.5 Pixel-mode cursor draw functions lack the cursor_base < font_height bound the text path enforces: negative font-buffer index and negative video-memory offset
sys/dev/misc/syscons/scvgarndr.c:789 · pass 2 · new
 none untested not_testable untriaged — —
DF-3040 Medium 4.4 Unbounded HAMMER_UNDO_INDEX indexes vol0_undo_array[128] out of bounds — attacker-aimed kernel heap OOB read (up to ~4GB reach) and deterministic panic at mount of a crafted HAMMER1 image
sys/vfs/hammer/hammer_ondisk.c:688 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3271 Medium 4.4 netgraph7 ng_ID_rehash panics INVARIANTS kernels under ordinary node churn (hashdestroy: hash not empty); ng_base.c:996 also passes the wrong mask to hashdestroy (latent OOB read)
sys/netgraph7/netgraph/ng_base.c:973 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-3357 Medium 4.4 udp_send() uses the sendto() destination sockaddr unvalidated: a 2-byte sockaddr yields a 6-byte heap OOB read and the packet is emitted to a destination address/port sourced from uninitialized recycled kernel heap
sys/netinet/udp_usrreq.c:1009 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3745 Medium 4.4 Connector/encoder object-table walks dereference unvalidated VBIOS offsets, accumulate attacker sizes, and over-index ucMuxState[2] — OOB heap reads at connector init
sys/dev/drm/radeon/radeon_atombios.c:537 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3746 Medium 4.4 VoltageObjectInfo walkers trust self-declared sizes — OOB heap reads, v1 stride bug, and ~130 KB unbounded leakage-array indices
sys/dev/drm/radeon/radeon_atombios.c:3382 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5558 Medium 4.4 I2CRDWR copies out IIC_M_RD buffers after a FAILED transfer — uninitialized kernel heap disclosed to userspace
sys/bus/iicbus/iic.c:360 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2809 Low 4.4 "Unreadable program headers" check is warning-only: e_phoff/e_phnum bounds and the bytes-actually-read (nbytes) bound are never enforced → unbounded wild kernel read from firstpage+e_phoff and parsing of uninitialized heap for short files
sys/kern/link_elf.c:489 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3154 Low 4.4 ext2_ei_csum_verify() memcmp over-reads 32 bytes past the 128-byte inode slot — next-inode bytes / kernel heap decide EIO-vs-accept (1-bit oracle)
sys/vfs/ext2fs/ext2_csum.c:565 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3284 Low 4.4 ieee80211_output raw-injection path admits 10-byte frames that ieee80211_classify() parses as 802.3: m_copydata() past end of chain -> KASSERT panic / NULL deref
sys/netproto/802_11/wlan/ieee80211_output.c:715 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3494 Low 4.4 Error-path kernel heap leaks in v1 ng_parse: ng_get_string_token leaks the token buffer on unterminated quote and ng_string_unparse leaks the ng_encode_string buffer on append-ERANGE (both already fixed in the ng7 copy)
sys/netgraph/netgraph/ng_parse.c:727 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3527 Low 4.4 ng_iface (v1): NGM_IFACE_POINT2POINT/NGM_IFACE_BROADCAST early 'return (EBUSY)' leaks the control message — unbounded, persistent M_NETGRAPH kernel-heap leak
sys/netgraph/iface/ng_iface.c:666 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3841 Low 4.4 Firmware-image walks lack bounds: iwi_load_ucode odd-size size_t underflow (1-2 → SIZE_MAX) walks kernel memory past the image under IWI_LOCK until a page fault; iwi_load_firmware command-block walk reads up to 7 bytes past the DMA buffer and emits up to ~2^19 MMIO command blocks from unvalidated len (DF-3573/3591/3631 firmware-trust family)
sys/dev/netif/iwi/if_iwi.c:2446 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4324 Low 4.4 ath_rate_get_static_rix() returns sc_rixmap[ucastrate] without validating the 0xff not-found sentinel — sn->static_rix=255 flows into rt->info[255] out-of-bounds reads (ni_txrate assignment and sample_stats sysctl print)
sys/dev/netif/ath/ath_rate/sample/sample.c:361 · pass 2 · new
 The comment claims the static rate index is only set on successful lookup, but the function returns the raw sc_rixmap value (memset 0xff, only filled for table rates) - a fixed rate matching a node-negotiated rate yet absent from the table yields static_rix=255 untested not_testable untriaged — —
DF-4554 Low 4.4 amdgpu_debugfs: gpr_read VGPR path copies an UNINITIALIZED 4KB kmalloc to userspace when read_wave_vgprs is NULL (gfx_v7/v8) — independent of DF-1692; latent (dead code on DFly)
sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:710 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4557 Low 4.4 atapi_action() indexes softc->atadev[tid] with unbounded CAM target_id in XPT_SCSI_IO and XPT_PATH_INQ — tid=5 deterministically reads state_lock.lk_lockholder (curthread, non-NULL while the lock is held) and dereferences it as struct ata_device *, panicking the kernel
sys/dev/disk/nata/atapi-cam.c:385 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4658 Low 4.4 plip: lpoutput resurrects IFF_RUNNING and drives the port without IFF_UP or ppbus ownership — cross-driver corruption & broken interface state
sys/dev/netif/plip/if_plip.c:602 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5646 Low 4.4 Unvalidated hint IRQ passed to machintr_legacy_intr_cpuid(): deterministic boot-time kernel panic (KKASSERT) from one loader.conf line; OOB ioapic_irqmaps[cpuid][irq] read on non-INVARIANTS kernels
sys/bus/isa/isahint.c:73 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2708 Medium 4.3 DMSG wire msgid discloses the kernel heap address of every kernel-initiated transaction state to the cluster peer (msgid = (uint64_t)(uintptr_t)state)
sys/kern/kern_dmsg.c:1804 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3290 Medium 4.3 mesh_parse_meshgate_action ignores the GANN IE's declared length: OOB read of up to 15 bytes re-broadcast to the mesh
sys/netproto/802_11/wlan/ieee80211_mesh.c:2583 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3203 Low 4.3 krpc_call reply validation is vacuous at chain level and reads rpc accept-status 8 bytes past the validated region — uninitialized kernel-heap read of rp_status, value printed to console and used for control flow
sys/vfs/nfs/krpc_subr.c:366 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3324 Low 4.3 ieee80211_parse_ath heap OOB read: Atheros vendor IE length never validated on the hostap assoc path (SUPERG kernels)
sys/netproto/802_11/wlan/ieee80211_hostap.c:2007 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3329 Low 4.3 verify_mesh_preq_len/verify_mesh_perr_len/verify_mesh_prep_len read IE fields beyond the end of the frame before validating the declared IE length
sys/netproto/802_11/wlan/ieee80211_hwmp.c:317 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3341 Low 4.3 [CROSS-FILE: ieee80211_input.c] parse_beacon accepts TIM IE without length verification; scan_sta consumer reads tim_period past IE end (1-2 byte OOB read)
sys/netproto/802_11/wlan/ieee80211_proto.c:586 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3342 Low 4.3 [CROSS-FILE: ieee80211_sta.c] sta_input pre-dispatch block reads i_addr2/i_seq/i_qos with only frame_min guaranteed — unfiled mirror of DF-3325
sys/netproto/802_11/wlan/ieee80211_proto.c:601 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3416 Low 4.3 adhoc_input pre-dispatch block reads i_addr2/i_seq/i_qos with only frame_min (10 bytes) guaranteed for dir!=NODS frames — unfiled IBSS mirror of DF-3342 (sta_input) / DF-3325
sys/netproto/802_11/wlan/ieee80211_adhoc.c:356 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3489 Low 4.3 HOST_UNIQ tag broadcasts sess_con kernel heap pointer on the wire to unauthenticated LAN peers
sys/netgraph7/pppoe/ng_pppoe.c:1069 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3493 Low 4.3 Raw sess_con kernel heap pointer broadcast on the LAN in PADI HOST_UNIQ / PADO AC_COOKIE tags (DF-3489 twin)
sys/netgraph/pppoe/ng_pppoe.c:829 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3751 Low 4.3 ((struct rt2860_node *)ni)->wcid read from nodes allocated as plain ieee80211_node (missing ic_node_alloc override)
sys/dev/netif/ral/rt2860.c:919 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5032 Low 4.3 ar5212InvalidGainReadback reads rfBuf[4..5] past the 3-word RF bank 7 of 2413/2316/2317/5413/2425/2417 radios (gain-readback OOB read, UB)
sys/dev/netif/ath/ath_hal/ar5212/ar5212_rfgain.c:140 · pass 2 · new
 none untested not_testable untriaged — —
DF-3374 Low 4.2 ieee80211_parse_csaparams consumes the CSA IE without validating its declared length: 2-3 byte read past IE/frame end drives channel-switch decisions on stale mbuf bytes (DF-3341/DF-0582 family)
sys/netproto/802_11/wlan/ieee80211_sta.c:1146 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3454 Low 4.2 amrr never revalidates stale amn_rix against the active rateset: HT→legacy flip gives OOB reads of node memory (incl. ni_chan kernel pointer bytes) disclosed via ni_txrate/rate_stats, and hands drivers an unbounded/negative rate index
sys/netproto/802_11/wlan/ieee80211_amrr.c:208 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4268 Low 4.2 wb_rxeof double-fetch of the device-written RX status word: check/use TOCTOU enabling a ~12KB OOB read copied into received packets (kernel heap info leak)
sys/dev/netif/wb/if_wb.c:983 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4626 Medium 4.1 intel_dsi_vbt: MIPI sequence execution walks the kmemdup'd VBT blob with no end bound — heap OOB read via i2c/spi/delay/gpio elements and the operation loop
sys/dev/drm/i915/intel_dsi_vbt.c:444 · pass 2 · new
 Kernel crash DoS in the panel-enable path (mode_config mutex held); OOB bytes only steer skip offsets - no direct info disclosure untested not_testable untriaged — —
DF-5457 Medium 4.1 ichsmb_bread returns the raw slave-controlled block count (up to 255) while writing at most 32 bytes — /dev/smb SMB_BREAD then copies out up to 223 bytes of uninitialized kernel stack
sys/bus/smbus/ichsmb/ichsmb.c:424 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-4990 Low 4.1 SMB_TRANS copies out driver-updated rcount without re-clamping to SMB_MAXBLOCKSIZE — latent kernel stack OOB read
sys/dev/smbus/smb/smb.c:333 · pass 2 · new
 infoleak untested not_testable untriaged — —
DF-5180 Low 4.1 acpi_PkgStr() heap out-of-bounds read past non-NUL-terminated ACPI_TYPE_BUFFER: strlcpy()'s unbounded 'traverse rest of src' scan walks off the end of the ACPICA allocation for a zero-free firmware buffer
sys/dev/acpica/acpi_package.c:86 · pass 2 · new
 dos untested not_testable untriaged — —
DF-2847 Low 4.0 get_next_valid_apicid() -1 sentinel propagated unvalidated into get_cpuid_from_apicid(-1): OOB read of apic_id_to_cpu_id[-1] whose value is used, plus duplicate leaf member masks on exhaustion
sys/kern/subr_cpu_topology.c:100 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3974 Medium 3.9 Wild OOB kernel read in btc_find_voltage when a VBIOS voltage object has zero LUT entries: entries[0xFFFFFFFF] ≈ +32 GiB past eg_pi (btc twin of DF-3649/3956)
sys/dev/drm/radeon/btc_dpm.c:1293 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5344 Medium 3.9 CPUID brand string assembled into cpu_brand[48] without NUL termination → out-of-bounds read in printcpuinfo() (layout-dependent .bss disclosure into world-readable hw.model; potential overflow of cpu_model[128])
sys/platform/pc64/x86_64/identcpu.c:118 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2793 Low 3.8 rtprio()/lwp_rtprio() omit PRISON_CHECK — jailed root can read any host process's realtime scheduling class and priority (cross-jail info leak)
sys/kern/kern_resource.c:582 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3537 Medium 3.7 VJ decompression OOB read on the vjcomp hook: short compressed frames make the kernel read past m_len into stale mbuf data that persists in rstate[] and is re-emitted inside reconstructed TCP/IP headers (kernel heap info leak)
sys/netgraph/vjc/ng_vjc.c:456 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3538 Medium 3.7 ng7 twin of DF-3537: VJ decompression OOB read on the vjcomp hook leaks stale mbuf bytes via persistent rstate[] into reconstructed TCP/IP headers
sys/netgraph7/vjc/ng_vjc.c:449 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3057 Medium 3.6 dirfs_write clobbers the bread() error and ignores bwrite(): a failed block read is still modified and the whole 16KB block persisted — stale/foreign buffer data written into the target file (readable back) and failures reported as success
sys/vfs/dirfs/dirfs_vnops.c:740 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4592 Medium 3.6 format_config() OOB heap read: vinum_conf.plex[sd->plexno] with plexno==-1 for detached subdisks persists heap bytes into the on-disk config
sys/dev/raid/vinum/vinumio.c:517 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5707 Medium 3.6 Shared MINSTD state broadcast: observer-visible consumers (ipfw O_PROB, dummynet plr, syscons savers) let an unprivileged local user or on-path observer recover the kernel's global PRNG state and predict every other consumer's values (UFS i_gen/NFS file handles, NAT alias ports, CHAP challenges, IPv6 frag-ID base)
sys/libkern/random.c:36 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3066 Low 3.6 ext2_nodealloccg honors unvalidated inode-bitmap content: reserved inode numbers (below first_ino) and tail bits (>= ipg) are allocatable — silent fs aliasing / OOB e2fs_gd[] reads via ino_to_cg
sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3734 Low 3.6 Unchecked requested_clock_mode_index++ in r600 DYNPM downclock (discrete branch) — one-past-end OOB heap read of per-state clock_info
sys/dev/drm/radeon/r600.c:486 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3809 Low 3.6 port_to_transcoder[PORT_F] out-of-bounds read in intel_enable_ddi_hdmi on GEN9_BC DDI-F hardware leads to wild CHICKEN_TRANS MMIO write
sys/dev/drm/i915/intel_ddi.c:3180 · pass 2 · new
 none untested not_testable untriaged — —
DF-4073 Low 3.6 MVDD stash-table wrong-index reads: entries[count] instead of entries[level] (uninitialized voltage to SMU) and cross-table mvdd_voltage_table.entries[vdd_dep_on_mclk index] (true OOB read)
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:459 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4688 Low 3.5 ar2425: numPdGainsUsed==0 (EEPROM xpd_mask==0) — uint32-wrapped [ii-1]/[kk-1] wild reads at array+0x1FFFFFFFE (+8.59 GB) + stale-STATIC Pmin_t2[0] read (twin of DF-4620/4649/4661/4681, with the ar2425 static-storage nuance)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:431 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4689 Low 3.5 ar2425: flat pd-gain curve (all EEPROM deltas 0 — legal) makes sizeCurrVpdTable==0 → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/4650/4662/4682)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:458 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5296 Low 3.5 uhci_pci_attach never validates the device-reported I/O BAR size against the fixed 0x14-byte UHCI register file — every UREAD/UWRITE can touch port-I/O outside the allocated resource window (DF-5268/DF-5282 register-geometry class, UHCI variant)
sys/bus/u4b/controller/uhci.c:97 · pass 2 · new
 silent cross-device port-I/O register corruption (max 12B excursion) untested not_testable untriaged — —
DF-3503 Low 3.4 ng7 ksocket rcvdata trusts foreign m_tag sockaddr with no m_tag_len validation: short tag (e.g. minted by ng_tag with user-configured cookie/type/len) makes stag->sa overlap OOB heap handed to sosend
sys/netgraph7/ksocket/ng_ksocket.c:904 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4238 Low 3.4 sdma_v3_0 reads SDMA firmware sub-header fields (ucode_version @+16, ucode_feature_version @+32, ucode_size_bytes @+24) after only the datasize==size_bytes equality check — heap OOB read on a short root-installed firmware blob (DF-1451/1553/1598 family, v3 variant)
sys/dev/drm/amd/amdgpu/sdma_v3_0.c:312 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4880 Low 3.4 amdgpu_ucode_print_* helpers read version-dispatched sub-header fields (up to +156) with no blob-size check: unconditional heap OOB read on short crafted firmware, distinct sink from DF-1946 that survives its proposed minimum-size fix
sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:54 · pass 2 · new
 infoleak untested not_testable untriaged — —
DF-5336 Low 3.4 db_disasm Grp7 mod==3 dispatch: inner rm-field index OOB-reads past the 2/4/5/7-entry db_Grp7_11_* sub-tables (no REX needed)
sys/cpu/x86_64/misc/db_disasm.c:1275 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2684 Medium 3.3 World-readable sysctl kern.file exports raw kernel heap pointers (kinfo_file.f_file/f_data) and cross-user fd state (types/flags/offsets) to unprivileged users
sys/kern/kern_descrip.c:3464 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2695 Medium 3.3 sys_sendfile() copies out 8 bytes of uninitialized kernel stack (off_t sbytes) on every failing sendfile(2) — unprivileged kernel-pointer leak
sys/kern/uipc_syscalls.c:1594 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2854 Medium 3.3 sysctl_rman (hw.bus.rman) leaks uninitialized kernel stack beyond DF-0092's padding: r_devname/rm_descr bytes after the NUL (up to 31/entry, incl. live kernel pointers) exported to unprivileged readers
sys/kern/subr_rman.c:653 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2972 Medium 3.3 exec_shell_imgact() double-scan TOCTOU on the live first page: kernel reserves one interpreter line and copies another; stale recycled exec-args objcache bytes can be delivered to the interpreter as argv (kernel-heap info leak)
sys/kern/imgact_shell.c:75 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3693 Medium 3.3 hptv2 metadata writeback: 2048-byte write from a 512-byte heap buffer persists ~1.5KB of kernel heap to disk (OOB read -> durable info leak)
sys/dev/disk/nata/ata-raid.c:1903 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-3764 Medium 3.3 r100_packet3_check() reads payload dwords at fixed offsets without validating pkt->count -> OOB read 1 dword past the IB chunk end + kernel-log disclosure (same class as DF-1492/DF-3592)
sys/dev/drm/radeon/r100.c:1961 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-3999 Medium 3.3 Record channels are bound to PLAY hw numbers by the 1-play-channel registration: slot = (num-5)*2 yields -8/-6/-4/-2 and +8/+10 against the 2-entry rec frame, so every EMLDMARD reads kernel memory from BEFORE and PAST the record DMA buffer — unconditional at offset 0 on the FIRST record channel
sys/dev/sound/pci/envy24ht.c:2494 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4181 Medium 3.3 radeon fb creation never validates framebuffer size against the backing GEM object — display engine scans out megabytes past a tiny BO, disclosing adjacent VRAM on the physical display
sys/dev/drm/radeon/radeon_display.c:1294 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-5305 Medium 3.3 strlcpy() from non-NUL-terminated VS_FORMAT_FRAME_BASED bGuidFmt: kernel heap OOB read past the cdesc allocation, disclosed to unprivileged userspace via VIDIOC_ENUM_FMT
sys/bus/u4b/uvc/uvc_drv.c:1888 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2783 Low 3.3 IPC_STAT (and dead SEM_STAT) copy out live kernel heap pointer sem_base to unprivileged users
sys/kern/sysv_sem.c:431 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2796 Low 3.3 World-readable sysctl kern.ipc.msqids dumps raw kernel msqid_ds array: live kernel heap pointers and other users' queue metadata without any permission check
sys/kern/sysv_msg.c:1072 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2838 Low 3.3 sotoxsocket()/ssbtoxsockbuf() never initialize structure padding — net.inet.tcp.pcblist leaks 8 uninitialized kernel-stack bytes per record to unprivileged users (incl. kernel-pointer halves)
sys/kern/uipc_socket2.c:188 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3081 Low 3.3 Ungated /proc/<pid>/file and /exe readlink discloses every process's full executable path (root daemons included) to unprivileged users
sys/vfs/procfs/procfs_vnops.c:147 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3115 Low 3.3 Unconditional kprintf() log flood in mbnambuf_write() from crafted — or merely long-LFN — FAT directories: unbounded kernel console/msgbuf spam from unprivileged directory churn
sys/vfs/msdosfs/msdosfs_conv.c:1035 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-3147 Low 3.3 cd9660_readdir returns uninitialized idp->uio_off as the directory offset: 8 bytes of stale kernel heap disclosed to unprivileged users via lseek(SEEK_CUR) after a short getdents
sys/vfs/isofs/cd9660/cd9660_vnops.c:447 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3415 Low 3.3 in6_pcbconnect() reads sin6_addr before sa_len validation: heap OOB read past the user-copied sockaddr length decides connect()'s errno (DF-3357/DF-3372 read-before-validate family, v6 pcb core)
sys/netinet6/in6_pcb.c:344 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3694 Low 3.3 VIA/JMicron metadata writeback persists low 32 bits of kernel device_t pointers into on-disk metadata
sys/dev/disk/nata/ata-raid.c:2736 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-3731 Low 3.3 XPT_PATH_INQ max_target off-by-one: CAM probes target 15 into the 15-entry ciss_logical rows (recurring OOB read)
sys/dev/raid/ciss/ciss.c:2956 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4021 Low 3.3 mpr_user_btdh off-by-one: target == max_devices passes the range check and reads mapping_table[max_devices] out of bounds (twin of DF-4016)
sys/dev/raid/mpr/mpr_user.c:2240 · pass 2 · new
 mpr_user_btdh off-by-one: 'target > max_devices' (mpr_user.c:2240) lets TargetID==max_devices read mapping_table[max_devices] one 24-byte element past the heap allocation (mpr_mapping.c:2140-2141 allocates exactly max_devices entries), disclosing a garbage u16 dev_handle (byte offset 18 of the element) to the operator-group caller (mpr_user.c:2245-2247, node mpr_user.c:205). Twin of DF-4016 (mps). untested not_testable untriaged — —
DF-4428 Low 3.3 smu10_hwmgr_backend_fini never frees vdd_dep_on_mclk — deterministic kernel heap leak per powerplay fini cycle on Raven APUs
sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:443 · pass 2 · new
 none untested not_testable untriaged — —
DF-4517 Low 3.3 DRM_CLOEXEC silently dropped when creating prime fds: dma_buf_fd() #if 0's the close-on-exec handling, so the validated flags lie to userspace and dma-buf fds leak across execve
sys/dev/drm/drm_prime.c:669 · pass 2 · new
 Exported PRIME fds stay open across execve, contradicting the API contract Mesa/libdrm rely on; combined with DF-4429 (missing radeon verify_access) widens cross-user GPU buffer access untested not_testable untriaged — —
DF-4571 Low 3.3 missed_breadcrumb() forces intel_engine_dump() unconditionally ('|| 1' debug leftover): full engine state dump, including the DF-4246 over-reading ring hexdump path, runs from callout context every hangcheck period on production kernels
sys/dev/drm/i915/intel_breadcrumbs.c:85 · pass 2 · new
 Unthrottled multi-KB engine dumps every ~1.5s per engine on production kernels (console/dmesg flood DoS + repeated DF-4246 over-read path in callout context) untested not_testable untriaged — —
DF-5451 Low 3.3 nexus_get_resource() leftover debug kprintf discloses kernel stack and heap pointers to unprivileged local users via console log
sys/platform/pc64/x86_64/nexus.c:567 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5630 Low 3.3 4-byte OOB read past PT_NOTE segment/page end in bsd_trans_osrel (note_overflow never bounds the descriptor)
sys/cpu/x86_64/misc/elf_machdep.c:66 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5676 Low 3.3 MATCH() preamble memcmp in _prop_object_internalize_context_alloc reads past the NUL sentinel (bounded OOB read; userland crash reproduced, kernel read page-contained on current bcmp)
sys/libprop/prop_object.c:739 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2689 Info 3.3 Leftover DEBUG kprintf in vm_pageout_scan_hold leaks kernel pointer and spams the console on the normal race-recovery path
sys/vm/vm_pageout.c:1932 · pass 2 · new
 none untested not_testable untriaged — —
DF-3036 Info 3.3 ffs_reallocblks reads start_ap[-1] (stack OOB) when a cluster spans direct→indirect blocks — DIAGNOSTIC-only
sys/vfs/ufs/ffs_alloc.c:430 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4358 Info 3.3 DF-added kprintf leaks drm_device/amdgpu_device kernel pointers to dmesg at amdgpu attach
sys/dev/drm/amd/amdgpu/amdgpu_kms.c:185 · pass 2 · new
 none untested not_testable untriaged — —
DF-3400 Low 3.2 nat_del_dispatch never frees nat_state2 entries (free loops commented out): unbounded kernel heap leak on NAT delete/flush
sys/net/ipfw3_nat/ip_fw3_nat.c:806 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2611 Low 3.1 icmp6_redirect_output leaves target-link-layer-address option padding uninitialized (second leak site beyond DF-0329)
sys/netinet6/icmp6.c:2496 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3209 Low 3.1 xdr_string_encode() transmits 1-3 uninitialized kernel-heap bytes (XDR string padding) in every boot mountd MOUNT / NFS LOOKUP request
sys/vfs/nfs/nfs_mountrpc.c:143 · pass 2 · new
 leak untested not_testable untriaged — —
DF-3313 Low 3.1 ieee80211_recv_bar parses BAR control/sequence fields with no frame-length validation — OOB read of up to 10 bytes on short ctl frames
sys/netproto/802_11/wlan/ieee80211_ht.c:994 · pass 2 · new
 none untested not_testable untriaged — —
DF-3375 Info 3.1 MGT path guarantees m_pkthdr.len >= 24 but never m_pullup's; sta_recv_mgmt parses off m_len — chained management frames yield stale-byte reads past the first mbuf (sta.c mirror of DF-0348)
sys/netproto/802_11/wlan/ieee80211_sta.c:878 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4121 Medium 3.0 parse_sdvo_panel_data: unchecked BDB_SDVO_LVDS_OPTIONS panel_type (u8, 0-255) indexes BDB_SDVO_PANEL_DTDS -> OOB read up to ~4.6 KB past the block
sys/dev/drm/i915/intel_bios.c:363 · pass 2 · new
 leak reproduced inconclusive untriaged — —
DF-4122 Medium 3.0 No block-size floor for fixed per-panel-array BDB consumers: parse_edp, parse_psr, parse_lfp_backlight read up to ~350 bytes past short/zero-size blocks
sys/dev/drm/i915/intel_bios.c:309 · pass 2 · new
 leak reproduced inconclusive untriaged — —
DF-3496 Low 3.0 ng_fec_rcvmsg treats msg->data as a NUL-terminated interface name with no arglen validation: ifunit()/kprintf %s walk past the ng_mesg allocation (unbounded heap OOB read)
sys/netgraph7/ng_fec.c:1287 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3512 Low 3.0 ng_bt3c_rcvmsg: NGM_BT3C_NODE_GET_QLEN reads msg->data without arglen validation — heap OOB read
sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:444 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4138 Low 3.0 ppc_pc873xx_detect() static probe index never reset: OOB reads past pc873xx_basetab[] used as x86 I/O port numbers (wild inb/outb)
sys/dev/misc/ppc/ppc.c:435 · pass 2 · new
 none untested not_testable untriaged — —
DF-4624 Low 3.0 ar9285: xpdGain==0 (numXpdGain==0) executes PDADC tail backfill with k==0 — pdadcValues[-1] 1-byte OOB read below the static array replicated into all 128 PHY PDADC values, plus uninitialized minPwrT4[0] stack read
sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:666 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4703 Low 3.0 All fixed-struct VBIOS table reads discard the table size and dereference full structs after checking only frev/crev — OOB read past truncated ATOM data tables
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:61 · pass 2 · new
 Kernel reads past the declared table (potentially past the mapped ROM image): garbage power tables / fault-on-read near the ROM end untested not_testable untriaged — —
DF-2856 Info 3.0 Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors
sys/kern/subr_rman.c:257 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4372 Low 2.9 Unvalidated VBIOS container offsets in r600_parse_extended_power_table: usFanTableOffset and usExtendendedHeaderOffset dereferenced with no zero/bounds check — offset 0 aliases the PowerPlayInfo header as the extended header; out-of-range offsets read past the kmalloc'd BIOS image (sibling of DF-1566: offset provenance, not counts)
sys/dev/drm/radeon/r600_dpm.c:893 · pass 2 · new
 none untested not_testable untriaged — —
DF-5241 Low 2.9 PROBE_INQUIRY_BASIC_DV1/DV2: bcmp() reads SHORT_INQUIRY_LENGTH (36) bytes from a kmalloc(additional_length+5) buffer as small as 6 bytes (device-controlled heap OOB read)
sys/bus/cam/cam_xpt.c:5867 · pass 2 · new
 heap OOB comparison oracle / race-gated UAF / accounting drift untested not_testable untriaged — —
DF-5095 Info 2.9 MFI_DEBUG timeout helpers print kernel heap pointer (cm) and the pmap_kextract() physical address of command data buffers to the world-readable kernel message buffer
sys/dev/raid/mfi/mfi_debug.c:197 · pass 2 · new
 KVA + physical address disclosure to dmesg in debug builds untested not_testable untriaged — —
DF-5284 Medium 2.8 sasetparams transmits 16 bytes of uninitialized kernel heap to the device in MODE SELECT (MTCOMP EINVAL-fallback path)
sys/bus/cam/scsi/scsi_sa.c:2757 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4081 Low 2.8 oce_tso_setup reads ether/IP/TCP headers (incl. th->th_off at offset up to ~74) before its m_pullup — out-of-contract mbuf reads on split-header TSO frames (DF-1373 class, different function)
sys/dev/netif/oce/oce_if.c:1046 · pass 2 · new
 none untested not_testable untriaged — —
DF-4795 Low 2.8 ig_hal VF: uninitialized kernel-stack tail (up to 50 of 60 payload bytes) of the E1000_VF_SET_MULTICAST mailbox message transmitted verbatim to the PF (hypervisor)
sys/dev/netif/ig_hal/e1000_vf.c:403 · pass 2 · new
 none demonstrated at runtime (no SR-IOV VF hardware on guest); source-proven disclosure class: up to 50 of 60 payload bytes of the E1000_VF_SET_MULTICAST mailbox message are uninitialized guest kernel stack, copied verbatim by e1000_write_mbx_vf (e1000_mbx.c:476-477) into E1000_VMBMEM registers read by the host PF driver — guest-kernel-stack residue crosses the guest->host boundary on every multicast update with <30 groups (the common case) untested not_testable untriaged — —
DF-4974 Low 2.8 radeon_crtc_cursor_set2 never validates cursor BO size — display engine scans up to 16 KiB from an arbitrarily small pinned BO (VRAM OOB read to screen)
sys/dev/drm/radeon/radeon_cursor.c:295 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4315 Low 2.6 Device-fed rs_rate through rateCodeToIndex[] 0xFF sentinel indexes sc_hwmap[32] out of bounds in ath_rx_tap/dump/led paths (OOB read exported into radiotap)
sys/dev/netif/ath/ath/if_ath_rx.c:577 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3753 Info 2.6 Unvalidated legacy-rate lookups: rt2860_rates[255] OOB read (tx) and 1<<255 UB (set_basicrates, peer-fed rateset)
sys/dev/netif/ral/rt2860.c:1576 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3049 Medium 2.5 s_desc_size unvalidated without the 64BIT feature — ext2_gd_csum() over-reads the group-descriptor heap allocation; console-printed crc is a kernel-heap disclosure oracle
sys/vfs/ext2fs/ext2_vfsops.c:549 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4903 Medium 2.5 Uninitialised heap read in k8_powernow_setperf tail leaks a heap word into world-readable sysctl machdep.powernow.frequency.current
sys/dev/powermng/powernow/powernow.c:223 · pass 2 · new
 leak untested not_testable untriaged — —
DF-2886 Low 2.5 uiomovez() copyouts unbounded cnt from PAGE_SIZE-sized ZeroPage — OOB kernel heap read into userspace (latent: sole in-tree caller passes UIO_SYSSPACE)
sys/kern/kern_subr.c:241 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2890 Low 2.5 vm_contig_pg_alloc verify/alloc loops lack the vm_page_count bound — oversized size with permissive high reads one element past the end of vm_page_array
sys/vm/vm_contig.c:331 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-3372 Low 2.5 sockaddr address fields read before sa_len validation in tcp_usr_bind/connect/preconnect and tcp6_usr_bind/connect (DF-3357 family): heap read of recycled/uninitialized bytes past the user-copied length (v6: up to 16 bytes past the allocation)
sys/netinet/tcp_usrreq.c:316 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3723 Low 2.5 ixgbe_checksum_ptr_x550/ixgbe_calc_checksum_X550 caller-buffer path: bounds checks ignore the ptr base offset (plus two off-by-ones) — OOB read past the caller's u16 buffer[]
sys/dev/netif/ix/ixgbe_x550.c:3358 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3791 Low 2.5 drm_atomic_helper: missing backport of upstream 022debad063e (drm_atomic_state->duplicated) — drm_atomic_helper_resume() fails after connector unregistered during suspend, leaving all outputs off
sys/dev/drm/drm_atomic_helper.c:325 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3919 Low 2.5 Event element-count walks (SAS topo PHY, PCIe topo Port, IR config Element) never validated against the event frame length
sys/dev/raid/mpr/mpr_mapping.c:2917 · pass 2 · new
 logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919) untested — untriaged — —
DF-4039 Low 2.5 polaris10_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read)
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:396 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4072 Low 2.5 vegam_get_dependency_volt_by_clk reads dep_table->entries[count] one record past the heap allocation in the clock-above-max path
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:614 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4089 Low 2.5 Event element-count walks (SAS topo NumEntries, IR NumElements) never validated against the event frame length (mps twin of DF-3919)
sys/dev/raid/mps/mps_mapping.c:2043 · pass 2 · new
 OOB read (up to ~2KB) of kmalloc'd event frame; garbage feeds mapping engine (kernleak-class, no direct copyout traced) untested not_testable untriaged — —
DF-4166 Low 2.5 get_gpio_i2c_info off-by-one (count < table_index) reads gpio_pin[count] one entry past the GPIO pin LUT
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:369 · pass 2 · new
 none untested not_testable untriaged — —
DF-4213 Low 2.5 16-byte memcpy out of the 4-byte MSG_RAID_ACTION_REPLY.ActionData publishes stale reply-frame bytes as RAID resync progress
sys/dev/disk/mpt/mpt_raid.c:578 · pass 2 · new
 none untested not_testable untriaged — —
DF-4386 Low 2.5 hw.oceN.firmware_version served via unbounded strlen over a possibly non-NUL-terminated device string — adjacent softc bytes (incl. kernel pointers) leak to unprivileged readers
sys/dev/netif/oce/oce_sysctl.c:84 · pass 2 · new
 none untested not_testable untriaged — —
DF-4387 Low 2.5 Device-controlled sc->port_id indexes rxf.port[2]/port[4] unchecked in copy_stats_to_sc_be2/_be3 — OOB read past the stats DMA buffer into world-readable sysctls
sys/dev/netif/oce/oce_sysctl.c:1151 · pass 2 · new
 none untested not_testable untriaged — —
DF-4766 Low 2.5 Non-NUL-terminated arrayname[16] printed with %s: kernel stack overread disclosed through world-readable sysctl hptmv.status
sys/dev/raid/hptmv/hptproc.c:375 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5267 Low 2.5 Five linear rate lookups store MTW_RIDX_MAX (36) on a miss; the stale ridx then indexes rt2860_rates[36] one element out of bounds (mtw_tx/mtw_set_tx_desc/tx_mgt/radiotap wt_rate)
sys/bus/u4b/wlan/if_mtw.c:1720 · pass 2 · new
 none untested not_testable untriaged — —
DF-5307 Low 2.5 Unvalidated descriptor-field reads in the UVC entity/CS parsers: OOB reads up to 253 bytes past malformed descriptors
sys/bus/u4b/uvc/uvc_drv.c:1843 · pass 2 · new
 none untested not_testable untriaged — —
DF-5446 Low 2.5 Unchecked 4-byte logical-ID read on short PNP_TAG_LOGICAL_DEVICE descriptor (≤3-byte overread; worst case past the allocation into uninitialized heap)
sys/bus/isa/pnp.c:444 · pass 2 · new
 none untested not_testable untriaged — —
DF-5700 Low 2.5 libkern/bcmp.c compares with full longword loads that read up to 7 bytes outside [ptr,ptr+len) — by design, page-contained, and latent-only (file not compiled on any DFly platform)
sys/libkern/bcmp.c:53 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5719 Low 2.5 bcd.c lookup tables indexed without bounds: bcd2bin()/bin2bcd()/hex2ascii() macros permit out-of-bounds kernel .rodata reads with device/ioctl-supplied indices
sys/libkern/bcd.c:9 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2671 Info 2.5 extattr syscalls copyin() the 255-byte attribute name without a NUL-termination guarantee (latent stack OOB read)
sys/kern/vfs_syscalls.c:5224 · pass 2 · new
 none untested not_testable untriaged — —
DF-2734 Info 2.5 mapped_ioctl: heap/stack buffer passed to fo_ioctl uninitialized for IOC_NONE-direction ioctls (kmalloc without M_ZERO, no bzero)
sys/kern/sys_generic.c:674 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3413 Info 2.5 tkip_detach() frees tkip_ctx without zeroing derived key material (tx/rx_rc4key, tx/rx_ttak) while the framework memsets the master key — freed-heap key residue
sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:131 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3770 Info 2.5 DFly port deleted the upstream pre-B3 ValleyView PPGTT disable from intel_sanitize_enable_ppgtt: PPGTT enabled on silicon where upstream considers it broken (GPU fault/hang wedge on that hardware)
sys/dev/drm/i915/i915_gem_gtt.c:136 · pass 2 · new
 none untested not_testable untriaged — —
DF-3944 Info 2.5 patch_gamut_packet_checksum reads up to 227 bytes past dc_info_packet.sb[32] (length byte unbounded; dead path — no producer ever sets gamut.valid)
sys/dev/drm/amd/display/dc/core/dc_resource.c:2152 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4642 Info 2.5 dce_virtual_pageflip dereferences crtcs[crtc_id] before the crtc_id bounds check (latent OOB read)
sys/dev/drm/amd/amdgpu/dce_virtual.c:659 · pass 2 · new
 none untested not_testable untriaged — —
DF-5591 Info 2.5 vga_probe_unit() returns success without initializing the caller's video_adapter_t — uninit kernel-stack read programmed into world-readable devinfo resource ranges (structurally unreachable today: both sources gated on one 'optional vga')
sys/bus/isa/vga_isa.c:108 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3627 Low 2.4 Uninitialized stack array consumed as eDP link rates when DP_SUPPORTED_LINK_RATES DPCD read fails
sys/dev/drm/i915/intel_dp.c:3949 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4077 Low 2.4 Reply-frame range check off-by-one in mps_intr_locked accepts a ReplyFrameAddress exactly one frame past the end
sys/dev/raid/mps/mps.c:1541 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5455 Low 2.4 umoscom_cfg_read() returns uninitialized kernel stack on failed/short vendor control-IN; umoscom_cfg_get_status maps bits 4-7 of the stale byte into TIOCMGET modem-status bits disclosed to unprivileged userspace (evil or wedged MCS7703)
sys/bus/u4b/serial/umoscom.c:543 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3199 Medium 2.3 Heap over-read in devfs_rule_create_link() disclosed as world-readable /dev link names
sys/vfs/devfs/devfs_rules.c:243 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3440 Medium 2.3 div_output() reads sin_port and sin_addr from an under-sized sendto() destination sockaddr (offsets 4..8 and 8..12 past a >=4-byte allocation); OOB bytes steer re-inject direction and the ipfw resume rule
sys/netinet/ip_divert.c:344 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5593 Medium 2.3 cam_sim_free() orphans the sim's ccb pool — deterministic kernel heap leak on every controller detach after I/O
sys/bus/cam/cam_sim.c:246 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3033 Low 2.3 Kernel panic via unvalidated on-disk leaf->data_len used as getblk() size in hammer_io_direct_uncache_callback
sys/vfs/hammer/hammer_io.c:1948 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3262 Low 2.3 O_VIA/O_RECV/O_XMIT name[IFNAMSIZ] not required NUL-terminated: kfnmatch() pattern scan runs past the 16-byte field toward/past the rule allocation
sys/net/ipfw/ip_fw2.c:1355 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3279 Low 2.3 struct bridge_ifinfo leaked on every span-port delete (bridge_ioctl_addspan allocates it; bridge_delete_span frees only the bif)
sys/net/bridge/if_bridge.c:1823 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3297 Low 2.3 DIOCGETSRCNODES discloses raw kernel heap pointers (RB-tree links) through read-only /dev/pf
sys/net/pf/pf_ioctl.c:2884 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3338 Low 2.3 pfr_walktree()/PFRW_GET_ASTATS copies 4 uninitialized kernel-stack bytes per entry to userspace via DIOCRGETASTATS
sys/net/pf/pf_table.c:1058 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3386 Low 2.3 CBQ cbq_getqstats() copies out uninitialized kernel stack: stats.handle and stats.red[3] never initialized (DF-0438's twin)
sys/net/altq/altq_cbq.c:469 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3446 Low 2.3 Duplicate table-append leaks the radix entry: unbounded kernel memory exhaustion (48-104 bytes per rejected add)
sys/net/ipfw3_basic/ip_fw3_table.c:168 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-3506 Low 2.3 v1 twin of DF-3496: NGM_FEC_ADD_IFACE/DEL_IFACE treat msg->data as a NUL-terminated interface name with no arglen validation -> ifunit() strcmp and kprintf %s walk past the ng_mesg allocation
sys/netgraph/fec/ng_fec.c:1172 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3558 Low 2.3 ng_hole getstats/clrstats/getclrstats pass msg->data to ng_findhook strcmp without validating the advertised length against what was sent — heap OOB read, deterministic heap-residue match oracle (DF-0610/DF-2600/DF-3496 class on the DF-0534 enabler)
sys/netgraph7/hole/ng_hole.c:163 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3970 Low 2.3 rt2560_set_chan walks the unterminated RT2560_RF5222 channel table with no bound — OOB read across kernel .rodata and garbage RF programming when an admin-installed channel misses the table
sys/dev/netif/ral/rt2560.c:2210 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4061 Low 2.3 Linux-compat ioctl 0xc0046d00 re-reads a 110-byte struct amr_linux_ioctl from the 4-byte IOC buffer: 106 bytes of uninitialized kernel stack become ali.inlen/outlen, opcode, mailbox and passthrough pointers that steer the whole management ioctl
sys/dev/raid/amr/amr.c:765 · pass 2 · new
 Control-flow nondeterminism on a root-only surface: stack-garbage-chosen opcode/mailbox/pointers; no exfiltration (4-byte copy-back returns the user's own inlen). untested not_testable untriaged — —
DF-4229 Low 2.3 cyapawrite returns uninitialized stack `error` on zero-length writes — 32 bits of stale kernel stack leak to userland as the write() result/errno
sys/dev/smbus/cyapa/cyapa.c:791 · pass 2 · new
 none untested not_testable untriaged — —
DF-4659 Low 2.3 plip: sc_ifbuf leaked on every down/up cycle (and on BUS_SETUP_INTR failure) — unbounded kernel heap leak
sys/dev/netif/plip/if_plip.c:306 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4939 Low 2.3 if_ic: every SIOCSIFFLAGS down→up cycle leaks the ic_obuf/ic_ifbuf pair (unbounded M_DEVBUF kernel heap leak)
sys/dev/netif/ic/if_ic.c:179 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4991 Low 2.3 SMB_BREAD passes uninitialized stack byte as the driver's requested count; user's clamped rcount never communicated
sys/dev/smbus/smb/smb.c:217 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-5255 Low 2.3 640KB kernel heap leak per interface down/up cycle: urtwn_stop never frees rx/tx lists while urtwn_init unconditionally re-allocates (plus detach-side leak of queued TX mbufs)
sys/bus/u4b/wlan/if_urtwn.c:5268 · pass 2 · new
 deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257) untested not_testable untriaged — —
DF-5481 Info 2.3 EFIIOC_GET_TABLE hands a kernel DMAP virtual address straight back to userspace: kernel-VA disclosure (root-only) and an ioctl ABI that can never work
sys/platform/pc64/x86_64/efirt.c:481 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2862 Low 2.1 Heap OOB read in vfs_mountroot_try: strncpy(mf, cp, 96) leaves the parse buffer unterminated; ksscanf's strlen() and %80s copy adjacent heap bytes into devname, which kgetdiskbyname() prints to the console
sys/kern/vfs_conf.c:421 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4005 Low 2.1 fiji_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read)
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:406 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3452 Low 2.0 Uninitialized kernel stack transmitted in ipfw3 sync datagrams: ip_fw3_sync_send_state fills 3 of 9 fields of a stack struct and ships all of it over UDP (LATENT — subsystem dead by omission)
sys/net/ipfw3_basic/ip_fw3_sync.c:443 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5360 Low 2.0 Poisoned num_iospace=16/num_memspace=8 persist on the queued cfe after the CFTABLE error-break and propagate via the default-copy
sys/bus/pccard/pccard_cis.c:916 · pass 2 · new
 none untested not_testable untriaged — —
DF-3722 Info 2.0 Uninitialized kernel stack shipped to the NIC: mxge_close's ETHERNET_DOWN cmd (12B), mxge_dummy_rdma (40 of 64 PIO bytes), mxge_load_firmware boot handoff (36 of 64 PIO bytes)
sys/dev/netif/mxge/if_mxge.c:3517 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4146 Medium 1.9 trinity_parse_power_table trusts unvalidated VBIOS u16 table offsets, per-state stride walk, and indexes rdev->pm.power_state[] by StateArray ucNumEntries while it is allocated for pplib ucNumStates — heap OOB reads of the BIOS image and the power_state array
sys/dev/drm/radeon/trinity_dpm.c:1751 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2722 Low 1.9 kstrndup() reads one byte past the maxlen-bounded source when no NUL is present
sys/kern/kern_slaballoc.c:1324 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3052 Low 1.9 nfsm_request_bio early-abort path leaks the kmalloc'd struct nfsm_info and never runs the done() callback
sys/vfs/nfs/nfsm_subs.c:825 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3125 Low 1.9 cs_local/cs_disk charset names copied from mount args without NUL-termination — bounded kernel-stack OOB read in iconv_lookupcs strcmp
sys/vfs/isofs/cd9660/cd9660_vfsops.c:492 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3200 Low 1.9 u_char length truncation in struct devfs_rule: name[-1] heap over-read and cross-mount rule-clear confusion
sys/vfs/devfs/devfs_rules.c:200 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3269 Low 1.9 Uninitialized deflate_state.status read on the deflateInit2_ allocation-failure path: deflateEnd skips all cleanup, leaking every stream allocation
sys/net/zlib.c:785 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3343 Low 1.9 Unclamped ic_txstream*8-1 indexes const ieee80211_htrates[77] in ieee80211_media_setup — OOB read up to ~1.9KB past the array on driver/HAL misconfiguration
sys/netproto/802_11/wlan/ieee80211.c:1620 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3573 Low 1.9 Legacy firmware size-check bypass (err clobbered by later request_firmware success) → heap OOB reads in constant-bounded legacy ucode loaders
sys/dev/drm/radeon/cik.c:2080 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3577 Low 1.9 4-byte heap OOB read in iwn_read_firmware_tlv(): IWN_FW_TLV_PHY_CALIB dereferences *ptr without a len>=4 check
sys/dev/netif/iwn/if_iwn.c:8315 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3583 Low 1.9 RIO1 fast-post loop trusts card-controlled 8-bit rqs_seqno against a 15-element handle array — kernel stack OOB read up to 960 bytes
sys/dev/disk/isp/isp.c:5093 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4105 Low 1.9 Fake-EDID record: kmalloc(128) with memcpy of only ucFakeEDIDLength bytes leaves an uninitialized heap tail that (a) drives an OOB multi-block walk in drm_edid_is_valid via uninit extensions byte and (b) on a ~1/256 checksum pass is exposed to unprivileged users via the EDID ioctl (kernel heap info leak)
sys/dev/drm/amd/amdgpu/atombios_encoders.c:2171 · pass 2 · new
 none untested not_testable untriaged — —
DF-4123 Low 1.9 parse_mipi_sequence: 1-byte heap OOB read of the kmemdup'd sequence blob when MIPI_SEQ_ELEM_END is the final byte
sys/dev/drm/i915/intel_bios.c:1129 · pass 2 · new
 leak reproduced inconclusive untriaged — —
DF-4141 Low 1.9 ar5211GetLowerUpperValues with empty pier list: 2-byte OOB stack read below tempChannelList plus uninitialized stack read -> garbage regulatory edge-power selection (DF-3977 ar5211 twin)
sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c:1818 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4244 Low 1.9 dpt_detect_cache log-page walk bounded by device-fed 16-bit page length (up to 65539) instead of the 512 bytes actually DMA'd — OOB kernel read up to ~64KB past the transfer buffer
sys/dev/raid/dpt/dpt_scsi.c:618 · pass 2 · new
 none demonstrated on guest (no DPT hardware); source-level impact: device-fed bound → OOB kernel read up to ~65KB past the 512-byte DMA buffer at attach (DoS ceiling, no disclosure) untested not_testable untriaged — —
DF-4246 Low 1.9 linux_hexdump() memcmp over-reads up to rowsize-1 bytes past the kmalloc'd ring snapshot on the final partial row (print_request_ring path)
sys/dev/drm/i915/intel_engine_cs.c:1261 · pass 2 · new
 linux_hexdump() memcmp over-reads up to rowsize-1 (31) bytes past the kmalloc'd ring snapshot on the final partial row (print_request_ring path). Bytes never printed; only observable is a 1-bit equality oracle vs the previous row, on debugfs/error-capture paths. untested not_testable untriaged — —
DF-4248 Low 1.9 V1-branch state-array off-by-one: entry_index == ucNumStates passes 'entry_index > ucNumStates' guard
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:937 · pass 2 · new
 none untested not_testable untriaged — —
DF-4249 Low 1.9 Extended-header fields read before/without usSize gating (usPPMTableOffset at +16 read before V5 check; overdrive limits read with no size gate)
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1029 · pass 2 · new
 none untested not_testable untriaged — —
DF-4359 Low 1.9 cik_sdma_init_microcode() ignores amdgpu_ucode_validate() failure for all but the last SDMA instance — invalid firmware accepted (door to the DF-1553 sink that a DF-1553 fix does not close)
sys/dev/drm/amd/amdgpu/cik_sdma.c:141 · pass 2 · new
 none untested not_testable untriaged — —
DF-4585 Low 1.9 mpt_dump_sgl called with offset=0 on interior/stack pointers: bounded SGL walk overshoots the request area and hex-dumps up to ~504 bytes of kernel stack past an 8-byte stack union
sys/dev/disk/mpt/mpt_debug.c:604 · pass 2 · new
 Kernel stack contents (up to ~500 bytes) and adjacent request-area DMA data hex-dumped to console/dmesg - kernel info leak into logs; no write primitive untested not_testable untriaged — —
DF-4641 Low 1.9 radeon: radeon_read_platform_bios maps a fixed 256KB window from the PCI ROM BAR base regardless of the BAR's actual decode size - kernel reads physical memory beyond the device's ROM aperture into rdev->bios (and maps device MMIO write-back cached)
sys/dev/drm/radeon/radeon_bios.c:130 · pass 2 · new
 Kernel-side over-read of adjacent physical space (other devices' MMIO / unclaimed holes) into rdev->bios, parsed by atom/combios; possible read side effects on neighboring devices; no userspace exposure path found untested not_testable untriaged — —
DF-4917 Low 1.9 vf2pf checksum computed over pf2vf_size bytes instead of sizeof(amdgim_vf2pf_info): out-of-bounds read of up to ~3 KB past the 1 KB vf2pf struct and a wrong protocol checksum published to the host
sys/dev/drm/amd/amdgpu/amdgpu_virt.c:383 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2715 Info 1.9 Kernel-internal MSG_FNONBLOCKING/MSG_FBLOCKING state leaks into user-visible msg_flags on every recvmsg(2) from a non-blocking socket
sys/kern/uipc_syscalls.c:996 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3574 Info 1.9 sym_action2 XPT_GET/SET_TRAN_SETTINGS index np->target[]/lunmp[] without the bounds check used by every other sym entry point
sys/dev/disk/sym/sym_hipd.c:8048 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4435 Info 1.9 dce120 TG: CRTC_REG_UPDATE_4/_5 pass pair-count 3 - 4th/5th CRTC register-field updates silently dropped (CRTC_TEST_PATTERN_COLOR_FORMAT / VRES / RAMP0_OFFSET never programmed)
sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:57 · pass 2 · new
 none untested not_testable untriaged — —
DF-4598 Info 1.9 vinum_scandisk() strncpy leaves partname[64] unterminated → stack OOB read in find_drive_by_dev()'s %s copy
sys/dev/raid/vinum/vinumio.c:723 · pass 2 · new
 none untested not_testable untriaged — —
DF-4817 Info 1.9 iwm phy_db: latent heap OOB read in channel_id_to_txp() — entry size never checked before reading txp_chg->max_channel_idx (path currently dead in-tree)
sys/dev/netif/iwm/if_iwm_phy_db.c:382 · pass 2 · new
 none untested not_testable untriaged — —
DF-4869 Info 1.9 mps table layer latent defects: live-but-gated unvalidated NumEntries walk in mps_print_evt_sas, three dead config-page printers, sentinel+1 fallback in mps_describe_table
sys/dev/raid/mps/mps_table.c:63 · pass 2 · new
 none untested not_testable untriaged — —
DF-5435 Info 1.9 uvc_buf_queue_req_bufs signed count handling is undefined behavior: count >= 0x80000000 makes int num negative, skipping the clamp and the allocation loop and reading an uninitialized mem (currently compiled to ENOMEM by the shipping gcc - fragile across toolchains)
sys/bus/u4b/uvc/uvc_buf.c:540 · pass 2 · new
 toolchain-fragile UB, no exploit on the shipping build untested not_testable untriaged — —
DF-5578 Info 1.9 ufm(4): ufm_do_req() loads uninitialized stack buf[0] into *retbuf before the error check — latent DF-1062-class one-byte kernel-stack disclosure via FM_GET_STAT, contained on the current stack
sys/bus/u4b/misc/ufm.c:183 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3960 Low 1.8 ar5416GetGainBoundariesAndPdadcs OOB reads on degenerate EEPROM calibration data (empty xpdGain mask, zero/inverted pier power ranges)
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2371 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5491 Info 1.8 pcfintr slave-transmitter paths transmit an uninitialized kernel stack byte onto the I2C wire (callbacks never fill *buf)
sys/bus/iicbus/pcf/pcf.c:396 · pass 2 · new
 leak untested not_testable untriaged — —
DF-3325 Low 1.7 Pre-dispatch rx-sequence check reads i_seq/i_qos past short TODS/DSTODS frames (>=24-byte length only enforced for the NODS path)
sys/netproto/802_11/wlan/ieee80211_hostap.c:551 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3046 Info 1.7 TAG_OVERLOAD consumed without length validation — zero-length overload option at the end of an options region reads one byte past the region and adopts an arbitrary overload value
sys/vfs/nfs/bootp_subr.c:1283 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3817 Low 1.6 mpr_log_evt_handler(): hexdump() of firmware event data with unvalidated device-controlled length — OOB heap read to console
sys/dev/raid/mpr/mpr.c:2065 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3977 Low 1.6 ar5212GetLowerUpperValues with an empty pier list: uninitialized stack read (lp[0]) and 2-byte OOB stack read (ep[-1]) below tempChannelList, garbage pier selection can program MAX_RATE_POWER
sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2639 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5448 Info 1.6 uvscom_cfg_read_status() returns uninitialized kernel stack on a successful SHORT vendor control-IN (core actlen=NULL zeroization gap) — return value currently has no consumer, latent DF-1062/2342-class hazard
sys/bus/u4b/serial/uvscom.c:719 · pass 2 · new
 none untested not_testable untriaged — —
DF-3458 Info 1.3 radiotap_offset() walks items[] past the end of the table (loop bound 31 vs array size 20) — latent OOB read of kernel rodata with attacker-of-driver arithmetic; plus missing table entries silently disable channel tracking for bits 14-17/20
sys/netproto/802_11/wlan/ieee80211_radiotap.c:369 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5286 Low 1.1 samount parses uninitialized 8192-byte heap as block-limits geometry on short READ BLOCK LIMITS
sys/bus/cam/scsi/scsi_sa.c:1961 · pass 2 · new
 none untested not_testable untriaged — —
DF-3155 Info 1.1 ext2 extent-block checksum verification is dead code — metadata_csum extent blocks are never verified, and the dormant implementation carries a latent eh_max-driven ~768KB OOB read
sys/vfs/ext2fs/ext2_csum.c:375 · pass 2 · new
 none untested not_testable untriaged — —
DF-3567 Info 1.1 BF_set_key dereferences data[0] when len <= 0 (no lower-bound clamp; compiled-in dead code)
sys/crypto/blowfish/bf_skey.c:80 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3568 Info 1.1 rijndael_set_key performs no keyBits validation; invalid bits -> key overread + Nr=0 wild round-key walk
sys/crypto/rijndael/rijndael-api.c:38 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3643 Info 1.1 Unchecked PHY-read return values: EEE decisions and PHY write-backs derived from uninitialized kernel stack
sys/dev/netif/ig_hal/e1000_ich8lan.c:959 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3767 Info 1.1 r100_cs_parse_packet0() off-by-one: '> n' boundary check permits auth[n] read one u32 past the const reg_safe_bm arrays
sys/dev/drm/radeon/r100.c:1392 · pass 2 · new
 4-byte rodata OOB read, decision-only untested — untriaged — —
DF-4480 Info 1.1 ac97mix_setrecsrc() reads codec->mix[AC97_MIXER_SIZE] out of bounds when src==0 (latent OOB read; guard present upstream)
sys/dev/sound/pcm/ac97.c:1069 · pass 2 · new
 Latent intra-object OOB read (mix[25] lands on name[]) + bogus RECSEL write + nonexistent 1<<25 return bit; no userspace disclosure untested not_testable untriaged — —
DF-4540 Info 1.1 cxm_tuner: terminator-less band_codes[3]/assignments[17] walks rely on unenforced min_freq/min_channel data invariants - latent rodata OOB-read hazard (Info hardening)
sys/dev/video/cxm/cxm_tuner.c:725 · pass 2 · new
 none untested not_testable untriaged — —
DF-4885 Info 1.1 check_atom_bios() off-by-one/out-of-bounds heap reads: size==0x49 accepted then bios[0x49] read; memcmp reads up to 4 bytes past the buffer when bios_header_start+4==size
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:52 · pass 2 · new
 none untested not_testable untriaged — —
DF-5300 Info 1.1 usbd_get_iface() computes udev->ifaces + iface_index before bounds-checking iface_index — out-of-bounds/NULL-base pointer arithmetic on every call with an unvalidated index
sys/bus/u4b/usb_device.c:2237 · pass 2 · new
 latent OOB pointer arithmetic untested not_testable untriaged — —
DF-5706 Info 1.1 memcchr.c live longword over-read (proven page-contained and result-filtered) + unreachable goto done at :102
sys/libkern/memcchr.c:83 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4691 Info 1.0 cardbus_cis: decode_tuple_funce validates the LAN-NID length only against sizeof(nid), never against the tuple length — the card's MAC (PCI_IVAR_ETHADDR) is fabricated from stale bytes of previously parsed tuples; fepresent |= 1<<type is a UB shift for type>=32
sys/dev/pccard/cardbus/cardbus_cis.c:278 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5401 Info 1.0 mos_intr_callback() counts every interrupt as an output error and copies 4 bytes regardless of actlen into a never-used local; mos_bulk_write_callback() double-counts opackets
sys/bus/u4b/net/if_mos.c:862 · pass 2 · new
 non-canonical frames up the stack (DF-5400) / skewed interface stats (DF-5401) untested not_testable untriaged — —
DF-3678 Info 0.8 mpt_cam detach/error-path memory leaks: els_cmd_ptrs and tgt_cmd_ptrs never freed; sas_portinfo freed without its phy_info array
sys/dev/disk/mpt/mpt_cam.c:1198 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5063 Info 0.8 Plexno()/Sdno() decode composite plex/sd minors with no bounds checks and propagate the -1 empty-slot sentinel into PLEX[-1].sdnos[] (latent heap OOB read; unreachable on current DragonFly)
sys/dev/raid/vinum/vinumutil.c:261 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-5498 Info 0.8 crom_add_simple_text() includes the 12-byte csrtext header in crc_len: crom_load()/crom_crc() read one quadlet past chunk->data[] (sub-object OOB read for 69..72-char text) and publish a spurious trailing quadlet + IEEE-1212-incorrect length in every broadcast text leaf
sys/bus/firewire/fwcrom.c:459 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5252 Info 0.7 RT5592 TXWI extension: usbd_copy_in reads sizeof(data->desc)+4 bytes from data->desc, a 4-byte out-of-bounds read of desc/ridx/padding into the USB transfer buffer
sys/bus/u4b/wlan/if_run.c:3089 · pass 2 · new
 UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252) untested not_testable untriaged — —
DF-4905 Low 0.5 k8pnow_states() PST walk advances past BIOS_START+BIOS_LEN with no bounds check (kernel OOB read of physical 0x100000+ region)
sys/dev/powermng/powernow/powernow.c:187 · pass 2 · new
 none untested not_testable untriaged — —
DF-2613 Info 0.5 Off-by-one bounds checks in SES config-page walkers allow a 1-byte heap over-read past the 8192-byte sdata allocation
sys/bus/cam/scsi/scsi_ses.c:1311 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2822 Info 0.5 Latent boot-window OOB: csprng_pcpu aliases the single-element csprng_boot while APs are up, and read_random/add_buffer_randomness_src index it with unclamped gd_cpuid
sys/kern/kern_nrandom.c:495 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2887 Info 0.5 uiomove/uiomovez/uiomove_fromphys/ureadc walk the iovec array with no uio_iovcnt guard — OOB iov walk on any inconsistent uio
sys/kern/kern_subr.c:120 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3245 Info 0.5 devfs clone bitmap helpers accept unvalidated unit numbers: negative unit yields OOB bitmap access and UB shifts (latent; one semi-reachable benign instance)
sys/vfs/devfs/devfs_helper.c:141 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3412 Info 0.5 fairq_add_queue()/fairq_class_create() lack a lower-bound check on priority — negative pri is an OOB write below pif_classes[] (DF-0444 twin; currently typed-away by u_int8_t pf_altq.priority)
sys/net/altq/altq_fairq.c:206 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3471 Info 0.5 One-sided bound checks in the ratectl registry: ieee80211_ratectl_register/unregister/set accept negative type (OOB access below the ratectls[] function-pointer table); currently unreachable — all call sites pass constants
sys/netproto/802_11/wlan/ieee80211_ratectl.c:60 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4384 Info 0.5 set_dp_phy_pattern_80bit_custom() ignores param->custom_pattern_size and unconditionally reads pattern[0..9] (latent OOB read for future callers)
sys/dev/drm/amd/display/dc/dcn10/dcn10_link_encoder.c:292 · pass 2 · new
 none untested not_testable untriaged — —
DF-4449 Info 0.5 audio_regs[] defines 6 entries while res_cap.num_audio=7 — the audio_regs[6] global-out-of-bounds fixed upstream in 44035ec2fde1 (KASAN, Cc:stable) is latent in this tree behind resource_construct's pipe_count cap
sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:322 · pass 2 · new
 none untested not_testable untriaged — —
DF-4491 Info 0.5 intel_lvds_init failed-path leaks the DDC EDID buffer when the EDID yields no preferred mode
sys/dev/drm/i915/intel_lvds.c:1001 · pass 2 · new
 One-shot boot/probe-time heap leak (up to EDID size) per driver load; no unpriv trigger, no disclosure, no UAF untested not_testable untriaged — —
DF-4711 Info 0.5 feed_eq_init accepts AFMT_CHANNEL counts beyond the [SND_CHN_MAX] biquad state arrays (missing bound check; sample-driven function-pointer corruption if the invariant ever breaks)
sys/dev/sound/pcm/feeder_eq.c:342 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5034 Info 0.5 acquire_i2c_hw_engine bounds the signed gpio_ddc_line index only above (line < GPIO_DDC_LINE_COUNT): GPIO_DDC_LINE_UNKNOWN(-1) passes and reads i2c_hw_engines[-1] — dce110 twin of DF-2089 (dce80)
sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:98 · pass 2 · new
 none untested not_testable untriaged — —
DF-5036 Info 0.5 Shared family constructor dal_i2caux_dce110_construct indexes callee-static 6-entry hw_ddc_lines[]/hw_aux_lines[] with the caller-supplied num_i2caux_inst — latent OOB read feeding an unbounded engine-array store (DF-4827 pattern-class)
sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:127 · pass 2 · new
 none untested not_testable untriaged — —
DF-5147 Info 0.5 dcons_load_buffer() trusts wire-supplied buffer geometry (sizes, ooffset/ioffset, 24-bit pos) with an overflowable sum-only sanity check — latent arbitrary-displacement OOB read/write primitive in dead-but-exported module code
sys/dev/misc/dcons/dcons.c:158 · pass 2 · new
 none untested not_testable untriaged — —
DF-5237 Info 0.5 cxm_dec_fw: decoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in
sys/dev/video/cxm/cxm_dec_fw.c:3 · pass 2 · new
 latent rodata OOB read DMA'd to card, no userspace read-back untested not_testable untriaged — —
DF-5238 Info 0.5 cxm_enc_fw: encoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in (twin of the dec_fw finding)
sys/dev/video/cxm/cxm_enc_fw.c:3 · pass 2 · new
 latent rodata OOB read DMA'd to card, no userspace read-back untested not_testable untriaged — —
DF-5666 Info 0.5 bios_sigsearch(9) performs no parameter sanity checks: paralen==0 infinite-loops the kernel, negative paralen/sigofs walk outside the BIOS scan window (kernel-API robustness; all in-tree callers pass constants)
sys/platform/pc64/x86_64/bios.c:67 · pass 2 · new
 none untested not_testable untriaged — —
DF-5510 Low 0.4 Length-confused class-token search in ppb_pnp_detect(): OOB stack read past str[PPB_PnP_STRING_SIZE+1] and cross-field PnP class misclassification
sys/bus/ppbus/ppbconf.c:278 · pass 2 · new
 none reproduced fixed untriaged — —
DF-1125 High 9.3 Unvalidated FCP response/sense lengths cause OOB read from kernel stack (24XX FC)
sys/dev/disk/isp/isp.c:5225
 leak inconclusive not_testable untriaged — —
DF-0570 High 8.2 Remote OOB read: inbound port/icmp_id indexed into alias arrays without bounds check
sys/net/ipfw3_nat/ip_fw3_nat.c:204
 leak reproduced fixed untriaged — —
DF-0775 High 8.2 RPC reply verifier-length integer overflow corrupts XDR cursor — wild pointer deref client kernel panic or OOB read
sys/vfs/nfs/nfs_socket.c:1498
 none not_reproduced not_testable untriaged — —
DF-0414 High 8.1 Unchecked ph->length in PPPoE discovery packets: remote heap OOB read via get_tag/scan_tags walk bound
sys/netgraph7/pppoe/ng_pppoe.c:1314
 panic reproduced fixed untriaged — —
DF-0457 High 8.1 Unchecked ph->length in PPPoE discovery: heap OOB read via tag-walk + heap info leak via echoed Relay-Session-Id (v1 twin of DF-0414)
sys/netgraph/pppoe/ng_pppoe.c:925
 leak:65535 reproduced not_testable untriaged — —
DF-1123 High 8.1 iwn_rx_done: missing upper bound on firmware-reported frame length allows OOB read of RX mbuf / kernel heap
sys/dev/netif/iwn/if_iwn.c:3069
 none not_reproduced not_testable untriaged — —
DF-1131 High 8.1 Heap OOB read in bwn_dma_rxeof via dr_rx_bufsize / descriptor bytecnt mismatch
sys/dev/netif/bwn/bwn/if_bwn.c:5486
 leak inconclusive not_testable untriaged — —
DF-1849 Medium 8.1 Missing upper-bound on attacker-controlled stream.len in fwe_as_input causes kernel heap over-read
sys/dev/netif/fwe/if_fwe.c:560
 none inconclusive — untriaged — —
DF-1857 High 7.9 BMP pixel/RLE decoders read data with no bounds check against file size: kernel-memory info leak + DoS
sys/dev/video/fb/bmp/splash_bmp.c:80
 leak:4096 reproduced fixed untriaged — —
DF-0912 High 7.8 fuse_audit_length validates daemon-claimed ohd->len (with integer underflow) instead of actual buffer size, unconditionally passes 3 opcodes
sys/vfs/fuse/fuse_util.c:87
 leak:80 reproduced fixed untriaged — —
DF-1468 High 7.8 VBIOS-supplied indices into clock-info arrays OOB read in processpptables.c
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1101
 panic reproduced fixed untriaged — —
DF-1469 High 7.8 VBIOS-supplied entry count trusted without validation against firmware image bounds
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:383
 panic reproduced fixed untriaged — —
DF-1634 High 7.8 Use of uninitialized heap memory in dm_target_crypt_destroy after failed init
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 panic reproduced fixed untriaged — —
DF-1088 Medium 7.8 No validation/stripping of dangerous user CCB flags allows privileged DMA to arbitrary physical memory and OOB reads
sys/bus/cam/scsi/scsi_pass.c:546
 none reproduced fixed untriaged — —
DF-0349 Medium 7.6 Heap OOB read in PREQ processing when target count is 0: (ndest-1) wraps to SIZE_MAX
sys/netproto/802_11/wlan/ieee80211_hwmp.c:311
 none inconclusive not_testable untriaged — —
DF-1292 Medium 7.4 Multi-segment RX reads overwritten descriptor length inflating m_len past cluster for heap OOB read
sys/dev/netif/age/if_age.c:2025
 none not_reproduced not_testable untriaged — —
DF-1211 High 7.3 OOB read+write in NCQ error recovery: device-controlled log-page tag indexes ap_ccbs without bounds check
sys/dev/disk/ahci/ahci.c:3488
 none not_reproduced not_testable untriaged — —
DF-0812 High 7.1 Unvalidated redo_data_bytes in HAMMER REDO recovery leaks kernel memory / panics on mount of crafted image
sys/vfs/hammer/hammer_recover.c:1296
 panic reproduced fixed untriaged — —
DF-0857 High 7.1 Missing ab_busycnt validation in hpfs_hpbmap allows OOB heap read via crafted fnode/alsec
sys/vfs/hpfs/hpfs_alsubr.c:74
 panic reproduced fixed untriaged — —
DF-0878 High 7.1 Missing SUSP entry-length bounds check in cd9660_rrip_loop enables OOB heap read and kernel memory info leak
sys/vfs/isofs/cd9660/cd9660_rrip.c:509
 leak:250 reproduced fixed untriaged — —
DF-0914 High 7.1 ufs_bmaparray OOB read of indirect block buffer via unvalidated fs_nindir
sys/vfs/ufs/ufs_bmap.c:221
 panic reproduced fixed untriaged — —
DF-0927 High 7.1 hpfs_genlookupbyname walks attacker dirent chain with no buffer bound, no reclen validation, and no DE_DOWN cycle guard
sys/vfs/hpfs/hpfs_lookup.c:73
 panic reproduced fixed untriaged — —
DF-1257 High 7.1 Integer overflow in offset+size bounds check in amdgpu_vm_bo_map enables OOB read in amdgpu_vm_bo_split_mapping
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:2509
 none not_reproduced not_testable untriaged — —
DF-1286 High 7.1 SPROM rev4/5/8 TXPID parser reads kernel heap at negative array indices (unported offset constants)
sys/dev/netif/bwn/siba/siba_core.c:1591
 leak:32 reproduced not_testable untriaged — —
DF-1333 High 7.1 OOB kernel-heap read in rv7xx_parse_power_table via unchecked VBIOS offsets and indices
sys/dev/drm/radeon/rv770_dpm.c:2284
 none inconclusive not_testable untriaged — —
DF-1401 High 7.1 Missing bounds check on nonClockInfoIndex causes OOB read past NonClockInfoArray
sys/dev/drm/radeon/trinity_dpm.c:1774
 dos reproduced not_testable untriaged — —
DF-1402 High 7.1 Missing bounds check on vce_states[].clk_idx causes OOB read past ClockInfoArray
sys/dev/drm/radeon/trinity_dpm.c:1809
 dos reproduced not_testable untriaged — —
DF-1510 High 7.1 Unbounded autosense bcopy leaks kernel heap and corrupts the CCB
sys/dev/disk/advansys/adwcam.c:383
 leak:heap reproduced not_testable untriaged — —
1084 Medium 7.1 crom_init_context() trusts attacker-controlled info_len, allowing root-directory pointer to land past the csrrom buffer
sys/bus/firewire/fwcrom.c:67
 leak:1024bytes reproduced fixed untriaged — —
DF-0286 Medium 7.1 Missing length validation in mesh action frame handler: OOB read of stale data
sys/netproto/802_11/wlan/ieee80211_mesh.c:2548
 none inconclusive not_testable untriaged — —
DF-0458 Medium 7.1 Heap over-read / info-leak / panic in L2CA_Ping: missing echo-data length validation
sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c:1306
 leak:65531bytes reproduced not_testable untriaged — —
DF-0554 Medium 7.1 Missing min frame-length check + unsigned STEPBY underflow: kernel heap OOB read in LMI parser
sys/netgraph/lmi/ng_lmi.c:552
 leak:3 reproduced fixed untriaged — —
DF-1181 Medium 7.1 Heap OOB read via unbounded vddInd/vddciInd/mvddInd into 4-8 entry voltage lookup tables
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:635
 none not_reproduced not_testable untriaged — —
DF-1607 Medium 7.1 Off-by-one out-of-bounds read in CMI enum-value loop
sys/dev/acpica/acpi_hp/acpi_hp.c:931
 panic reproduced fixed untriaged — —
DF-0327 Low 7.1 ieee80211_ies_expand walks IE blob with no length validation: OOB read
sys/netproto/802_11/wlan/ieee80211_node.c:982
 none reproduced fixed untriaged — —
DF-0249 Low 7.0 Driver b_resid>b_bcount underflows iolen to huge size_t: oversized copyout leaks kernel heap
sys/kern/kern_physio.c:112
 leak reproduced fixed untriaged — —
DF-1157 High 6.8 wpi_rx_done reads tail and sets m_len from unbounded firmware head->len (OOB read / heap info-leak)
sys/dev/netif/wpi/if_wpi.c:1959
 none not_reproduced not_testable untriaged — —
DF-1124 Medium 6.8 iwn5000_rx_calib_results: signed integer underflow on firmware length and unbounded heap copy from RX buffer
sys/dev/netif/iwn/if_iwn.c:3353
 leak:12288 reproduced not_testable untriaged — —
DF-1369 Medium 6.8 Unvalidated SMID in reply descriptors allows NULL-deref panic and heap OOB write
sys/dev/raid/mps/mps.c:1515
 none inconclusive — untriaged — —
DF-1439 Medium 6.8 Wild OOB read in sumo_get_valid_engine_clock when num_max_dpm_entries==0
sys/dev/drm/radeon/sumo_dpm.c:1037
 none inconclusive — untriaged — —
DF-1478 Medium 6.8 my_rxeof trusts 12-bit NIC-reported FLNG as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/my/if_my.c:1105
 none inconclusive — untriaged — —
DF-1490 Medium 6.8 epic_rx_done trusts 16-bit NIC-reported rxlength as m_len with no MCLBYTES bound: large OOB heap read past RX mbuf cluster (16-bit field)
sys/dev/netif/tx/if_tx.c:557
 none inconclusive — untriaged — —
DF-1517 Medium 6.8 Missing MCLBYTES upper-bound check on rs->rs_datalen allows kernel heap OOB read via crafted wifi frames
sys/dev/netif/ath/ath/if_ath_rx.c:730
 none inconclusive — untriaged — —
DF-1519 Medium 6.8 lge_rxeof trusts 16-bit NIC-reported LGE_RXBYTES as m_len / m_devget copy length without jumbo-buffer bound: up to 56519-byte OOB heap read
sys/dev/netif/lge/if_lge.c:870
 none inconclusive — untriaged — —
DF-1554 Medium 6.8 Malformed _CST leaving cst_cx_count==0 causes heap OOB read in set_lowest_oncpu and NULL-deref panic in idle
sys/dev/acpica/acpi_cpu_cstate.c:530
 none inconclusive — untriaged — —
DF-1562 Medium 6.8 pcn_rxeof trusts 16-bit NIC-reported pcn_rxlen as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/pcn/if_pcn.c:798
 none inconclusive — untriaged — —
DF-1566 Medium 6.8 VBIOS-controlled VCE/UVD clock-info index and table entry counts are not bounds-checked against the BIOS allocation
sys/dev/drm/radeon/r600_dpm.c:1104
 none inconclusive — untriaged — —
DF-2005 Medium 6.8 Missing VBIOS PowerPlay table size validation allows heap out-of-bounds read
sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c:64
 none inconclusive fixed untriaged — —
DF-1528 Medium 6.6 Missing bounds validation of firmware-provided RAID map fields enables out-of-bounds kernel reads on every IO
sys/dev/raid/mrsas/mrsas_fp.c:1428
 none inconclusive — untriaged — —
DF-2055 Medium 6.6 Integer underflow in drm_gem_fb_create_with_funcs accepts undersized GEM buffers (size check bypass via (height-1) wraparound)
sys/dev/drm/drm_gem_framebuffer_helper.c:161
 panic reproduced fixed untriaged — —
DF-0494 High 6.5 Remote unauthenticated kernel heap+stack memory disclosure via ARP reply using attacker-controlled ar_hln/ar_pln
sys/netinet/if_ether.c:1182
 leak:190bytes reproduced fixed untriaged — —
DF-0542 High 6.5 inquiry_result: unbounded variable-length loop reads past mbuf end -> remote kernel panic
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:380
 none not_reproduced not_testable untriaged — —
DF-0207 Medium 6.5 Memory leak in clist_alloc_cblocks: old c_data never freed on resize
sys/kern/tty_subr.c:61
 leak reproduced fixed untriaged — —
DF-0560 Medium 6.5 hci_event_command_compl: reads status byte beyond asserted length -> short-event remote kernel panic
sys/netbt/hci_event.c:299
 panic not_reproduced not_testable untriaged — —
DF-0562 Medium 6.5 STEPBY unsigned underflow via missing minimum length check (LMI_MIN_LENGTH defined never used) — ng7 twin of DF-0554
sys/netgraph7/lmi/ng_lmi.c:88
 leak:3 not_reproduced not_testable untriaged — —
DF-0611 Medium 6.5 Missing IP-length / ip_hl validation in ng_nat_rcvdata allows OOB access of mbuf trailing area
sys/netgraph7/ng_nat.c:690
 none not_reproduced not_testable untriaged — —
DF-0625 Medium 6.5 Missing arglen check in L2CA_Ping path causes kernel heap OOB read leaked to remote Bluetooth peer
sys/netgraph7/bluetooth/l2cap/ng_l2cap_main.c:438
 none not_reproduced not_testable untriaged — —
DF-2538 Medium 6.5 Unbounded loop in inquiry_result causes kernel panic from malformed HCI Inquiry Result event
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:387
 none not_reproduced not_testable untriaged — —
DF-2539 Medium 6.5 Unbounded loop in num_compl_pkts causes kernel panic from malformed Number Of Completed Packets event
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:891
 panic reproduced not_testable untriaged — —
DF-2577 Low 6.5 ICMP PULLUP_TO(hlen+4) reads icmp_id at hlen+4..hlen+5: 2-byte mbuf backing-store over-read on crafted short ICMP packets
sys/net/ipfw3/ip_fw3.c:400
 none reproduced not_testable untriaged — —
DF-1071 Medium 6.4 pnp_create_devices mis-tracks scanning, causing heap OOB reads (and possible bogus device creation) from crafted PnP resource data
sys/bus/isa/pnp.c:378
 none not_reproduced not_testable untriaged — —
DF-1228 Medium 6.4 Untrusted SMID used directly as sc->commands[] index in mpr_intr_locked (OOB array access)
sys/dev/raid/mpr/mpr.c:2336
 none not_reproduced not_testable untriaged — —
DF-2323 Medium 6.4 VPD error-cleanup loops use NULL sentinel without guaranteed terminator after krealloc shrink - OOB read and kfree of garbage pointers
sys/bus/pci/pci.c:1225
 corruption reproduced not_testable untriaged — —
DF-2413 Low 6.4 Unbounded ccb_index from firmware LRAM into ccb_infos[] heap OOB read + attacker-influenced pointer deref
sys/dev/disk/advansys/advansys.c:1106
 panic reproduced not_testable untriaged — —
DF-0546 High 6.3 OOB read of lut[] in netmap_mem_ofstophys: page-padding offset maps garbage physical page into userspace
sys/net/netmap/netmap_mem2.c:165
 none not_reproduced not_testable untriaged — —
DF-0799 Medium 6.3 VREG read np->n_size TOCTOU race — concurrent stat syncs n_size down causing uint64 underflow + OOB heap leak via uiomovebp
sys/vfs/nfs/nfs_bio.c:224
 leak:24576 reproduced fixed untriaged — —
DF-1138 Medium 6.3 OOB read in si_parse_power_table VCE state fill-in: clk_idx never bounds-checked against ucNumEntries
sys/dev/drm/radeon/si_dpm.c:6882
 leak:1008 reproduced fixed untriaged — —
DF-1287 Medium 6.3 siba_pci_sprom dispatches rev-4/5/8 parsers without validating buffer size -> heap OOB read past 64-word buffer
sys/dev/netif/bwn/siba/siba_core.c:1398
 none inconclusive not_testable untriaged — —
DF-1362 Medium 6.3 Integer overflow in mps_diag_read_buffer bounds check enables OOB read of fw_diag_buffer
sys/dev/raid/mps/mps_user.c:1583
 none inconclusive — untriaged — —
DF-1418 Medium 6.3 OOB read of vddc_dependency_on_sclk via clock_info_index clamped to wrong bound
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1350
 none inconclusive — untriaged — —
DF-0880 High 6.1 Heap over-read in udf_vget via unbounded file-entry l_ea/l_ad
sys/vfs/udf/udf_vfsops.c:514
 panic reproduced fixed untriaged — —
DF-1210 High 6.1 OOB read in DHRS error path: device-controlled CCS slot index dereferenced before bounds check
sys/dev/disk/ahci/ahci.c:2843
 none not_reproduced not_testable untriaged — —
DF-1725 High 6.1 radeon_cs: heap OOB read in radeon_cs_packet_next_reloc via non-4-aligned relocs length_dw
sys/dev/drm/radeon/radeon_cs.c:89
 leak reproduced fixed untriaged — —
DF-2083 High 6.1 Heap OOB read in amdgpu_dm_set_degamma_lut via unvalidated blob size before __is_lut_linear
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:259
 none not_reproduced not_testable untriaged — —
DF-0744 Medium 6.1 udp6_output corrupts sticky socket options and leaks per-call options memory when ip6_setpktoptions fails
sys/netinet6/udp6_output.c:134
 leak:20bytes/iter+silent-sticky-state-corruption reproduced fixed untriaged — —
DF-0830 Medium 6.1 hpfs_readdir dep-walk unbounded against 2KB bread buffer — panic/heap-leak/infinite-loop via crafted dirblk
sys/vfs/hpfs/hpfs_vnops.c:825
 panic reproduced fixed untriaged — —
DF-0863 Medium 6.1 hpfs_cpload OOB read of cpdsec via unchecked d_cpcnt past fixed d_cpdblk[3] array
sys/vfs/hpfs/hpfs_subr.c:228
 panic reproduced fixed untriaged — —
DF-0864 Medium 6.1 hpfs_toupper indexes hpm_cpdblk[cp] with unchecked on-disk de_cpid OOB read on every name lookup
sys/vfs/hpfs/hpfs_subr.c:55
 leak:34813 reproduced fixed untriaged — —
DF-0865 Medium 6.1 hpfs_validateparent walks directory entries by attacker-controlled de_reclen with no buffer-bound check OOB read
sys/vfs/hpfs/hpfs_subr.c:567
 panic reproduced fixed untriaged — —
DF-0881 Medium 6.1 Heap OOB read in sparing-table scan rt_l unbounded by st_size
sys/vfs/udf/udf_vfsops.c:662
 panic reproduced fixed untriaged — —
DF-0997 Medium 6.1 RX mbuf m_len set from device-controlled RX descriptor flags with no bound -> heap OOB read
sys/bus/u4b/wlan/if_rum.c:1146
 none not_reproduced not_testable untriaged — —
DF-1182 Medium 6.1 Heap OOB read via unbounded state-record clock indices into VBIOS dep tables
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2970
 none not_reproduced not_testable untriaged — —
DF-1200 Medium 6.1 Unvalidated BIOS-supplied array indices in power table parsing cause OOB heap reads
sys/dev/drm/radeon/radeon_atombios.c:606
 none not_reproduced not_testable untriaged — —
DF-1253 Medium 6.1 uint32 underflow in vega20_apply_clocks_adjust_rules: count-1 wraps to UINT32_MAX causing ~4B-iteration heap OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:3035
 none inconclusive not_testable untriaged — —
DF-1330 Medium 6.1 mixer_setrecsrc uses bitmask as array index causing OOB kernel read into envy24ht_mixmap[25]
sys/dev/sound/pci/envy24ht.c:1953
 leak reproduced fixed untriaged — —
DF-1347 Medium 6.1 amd_Reselect indexes target arrays with -1 via ffs(0)-1 on malicious reselect ID
sys/dev/disk/amd/amd.c:1829
 panic reproduced fixed untriaged — —
DF-1388 Medium 6.1 Integer overflow in find_section block-size check lets crafted MIPI block bypass bounds for OOB read
sys/dev/drm/i915/intel_bios.c:96
 none inconclusive — untriaged — —
DF-1389 Medium 6.1 get_lvds_dvo_timing uses unvalidated VBT offsets for pointer arithmetic -> OOB read of LVDS timing
sys/dev/drm/i915/intel_bios.c:169
 none inconclusive — untriaged — —
DF-1390 Medium 6.1 parse_mipi_config indexes config[6]/pps[6] with panel_type 0-15 -> OOB read
sys/dev/drm/i915/intel_bios.c:808
 none inconclusive — untriaged — —
DF-1576 Medium 6.1 Unbounded VBIOS USHORT offsets and VCE state indices cause OOB reads from BIOS image
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:283
 none inconclusive — untriaged — —
DF-1810 Medium 6.1 cardbus_cis: unbounded CIS tuple-chain offset allows OOB read past BAR mapping (panic / MAC info leak)
sys/dev/pccard/cardbus/cardbus_cis.c:451
 none inconclusive — untriaged — —
DF-2061 Medium 6.1 Unprivileged heap OOB read / wild MMIO read via HAL_DIAG_REGS: ath_hal_getregdump indexes input without consulting its length
sys/dev/netif/ath/ath/if_ath_ioctl.c:189
 panic reproduced not_testable untriaged — —
DF-2497 Medium 6.1 Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang
sys/dev/disk/nata/ata-raid.c:348
 dos reproduced fixed untriaged — —
DF-2498 Medium 6.1 Intel MatrixRAID heap OOB read via untrusted disk_idx and unvalidated map pointer
sys/dev/disk/nata/ata-raid.c:2132
 none reproduced fixed untriaged — —
DF-1135 Low 6.1 Heap OOB read in hdaa_eld_dump: computed length never bounds field/SAD access
sys/dev/sound/pci/hda/hdaa.c:644
 panic reproduced fixed untriaged — —
DF-1168 Low 6.1 Heap OOB read: unvalidated VBIOS clock indices into SCLK/MCLK dependency tables
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3179
 panic reproduced fixed untriaged — —
DF-1250 High 6.0 Hardcoded EDID parser over-reads rdev->bios by up to 32KB, disclosing kernel heap via EDID ioctl
sys/dev/drm/radeon/radeon_combios.c:373
 none not_reproduced not_testable untriaged — —
DF-0739 Medium 6.0 Heap over-read / kernel memory disclosure in ip_fw3_ctl_set_get — bcopy sopt_valsize bytes from 4-byte ctx->sets
sys/net/ipfw3/ip_fw3_set.c:213
 leak reproduced fixed untriaged — —
DF-1164 Medium 6.0 CP/MEC/RLC firmware loaders OOB read via untrusted ucode_size_bytes
sys/dev/drm/amd/amdgpu/gfx_v7_0.c:2447
 leak:unbounded reproduced not_testable untriaged — —
DF-1408 Medium 6.0 Integer underflow / unbounded num_indices in multiple ATOM table parsers yields OOB read
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:106
 none inconclusive — untriaged — —
DF-1895 Medium 6.0 parse_csr_fw never validates fw->datasize before indexing fw->data: multiple OOB-read paths
sys/dev/drm/i915/intel_csr.c:297
 none inconclusive — untriaged — —
DF-0742 Medium 5.9 gre_input2 and gre_mobile_input dereference header fields at offset 20+ without m_pullup — OOB read on chained mbufs
sys/netinet/ip_gre.c:133
 panic reproduced fixed untriaged — —
DF-0825 Medium 5.9 nfs_getnickauth post-increment bug: auth_str points 4 bytes into 8-byte kmalloc — OOB heap read into RPC request + kfree of non-base pointer
sys/vfs/nfs/nfs_syscalls.c:1115
 leak:4bytes+panic reproduced fixed untriaged — —
DF-1336 Low 5.9 Multi-fragment RX frame truncation when total_len is exact multiple of MCLBYTES
sys/dev/netif/re/if_re.c:1209
 none reproduced fixed untriaged — —
DF-2537 Low 5.9 ABTS RX_ID bound check uses IOC mpt_max_tgtcmds instead of actual tgt_cmd_ptrs array size (OOB read in FC target mode)
sys/dev/disk/mpt/mpt_cam.c:3004
 none reproduced not_testable untriaged — —
DF-2436 High 5.8 Use of uninitialized heap memory in dm_target_crypt_destroy on partial init failure
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 panic reproduced fixed untriaged — —
DF-0328 Low 5.8 node_getmimoinfo loops on untrusted ni_mimo_chains without clamping to array size
sys/netproto/802_11/wlan/ieee80211_node.c:1164
 none reproduced fixed untriaged — —
DF-0986 Low 5.8 mt7601_set_chan unbounded linear search over mt7601_rf_chan[14] reads OOB for chan outside 1..14
sys/bus/u4b/wlan/if_mtw.c:3693
 none reproduced fixed untriaged — —
DF-0035 Medium 5.7 Integer underflow in sysctl_kern_msgbuf causes kernel heap OOB read via copyout
sys/kern/subr_prf.c:1177
 panic reproduced fixed untriaged — —
DF-0989 Medium 5.7 cdreaddvdstructure integer underflow in length math leaks kernel heap to userspace
sys/bus/cam/scsi/scsi_cd.c:4288
 none not_reproduced not_testable untriaged — —
DF-1214 Medium 5.7 Unchecked rxcd->len vs cluster size yields mbuf OOB read (guest kernel heap info leak) on RX
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2216
 none inconclusive not_testable untriaged — —
DF-1396 Medium 5.7 Firmware-controlled desc_count/desc_len in oce_get_profile_config/oce_get_func_config walks OOB past DMA buffer
sys/dev/netif/oce/oce_mbox.c:2013
 none inconclusive — untriaged — —
DF-1784 Medium 5.7 radeon_bios: OOB read in radeon_get_bios - attacker-controlled BIOS offsets index into potentially tiny BIOS buffer
sys/dev/drm/radeon/radeon_bios.c:752
 none inconclusive — untriaged — —
DF-0404 Low 5.7 Potential OOB ring access in netmap_bwrap_register for NICs with asymmetric TX/RX ring counts
sys/net/netmap/netmap_vale.c:1699
 dos reproduced fixed untriaged — —
DF-1248 Low 5.7 SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths
sys/dev/netif/dc/if_dc.c:1744
 none reproduced not_testable untriaged — —
DF-2485 Low 5.7 Unbounded NumPhysDisks/NumActiveVolumes loop counts read past IOC config-page trailing arrays
sys/dev/disk/mpt/mpt_raid.c:1149
 limited_write reproduced fixed untriaged — —
DF-0534 Medium 5.6 Heap OOB read in ngc_send: ng_mesg buffer under-allocated, header fields read out of bounds
sys/netgraph7/socket/ng_socket.c:254
 leak reproduced fixed untriaged — —
DF-0844 Medium 5.6 Heap OOB read when parsing crafted directory entries near buffer tail — missing d_reclen >= DIRSIZ validation
sys/vfs/ufs/ufs_dirhash.c:200
 leak:255 reproduced fixed untriaged — —
DF-1399 Medium 5.6 vol->plex[] set to -1 by kw_prefer logic bug causing PLEX[-1] OOB read
sys/dev/raid/vinum/vinumconfig.c:1537
 none inconclusive — untriaged — —
DF-2172 Medium 5.6 radeon_ucode_validate performs no minimum-size, NULL, or sub-field validation -- OOB reads and NULL deref in validator and all print functions
sys/dev/drm/radeon/radeon_ucode.c:156
 panic reproduced fixed untriaged — —
DF-0261 Low 5.6 act_ofs copied from user input without validation against cmd_len -> heap OOB read
sys/net/ipfw/ip_fw2.c:4515
 none reproduced fixed untriaged — —
DF-0876 High 5.5 ext2_gd_csum OOB heap read via unvalidated on-disk group descriptor size
sys/vfs/ext2fs/ext2_csum.c:684
 leak reproduced fixed untriaged — —
DF-0877 High 5.5 ext2_dx_csum OOB heap read via unvalidated htree entry count
sys/vfs/ext2fs/ext2_csum.c:253
 leak reproduced fixed untriaged — —
DF-1199 High 5.5 Integer underflow in radeon_atombios_get_asic_ss_info causes 1.4-billion-iteration OOB heap read
sys/dev/drm/radeon/radeon_atombios.c:1555
 panic reproduced not_testable untriaged — —
DF-1327 High 5.5 Kernel heap info leak in mpr_user_pass_thru: copyout uses user-controlled ReplySize with no upper bound
sys/dev/raid/mpr/mpr_user.c:857
 none inconclusive not_testable untriaged — —
DF-1328 High 5.5 Kernel heap info leak in mpr_user_event_report: copyout of user-supplied Size from fixed-size recorded_events[40000]
sys/dev/raid/mpr/mpr_user.c:2069
 none inconclusive not_testable untriaged — —
DF-1360 High 5.5 Kernel heap memory disclosure via mps_user_event_report copyout with attacker-controlled length
sys/dev/raid/mps/mps_user.c:1856
 none inconclusive not_testable untriaged — —
DF-1661 High 5.5 ipmi: size_t underflow in IPMICTL_RECEIVE_MSG_TRUNC copies unbounded kernel heap to user
sys/dev/misc/ipmi/ipmi.c:448
 leak reproduced not_testable untriaged — —
DF-1727 High 5.5 ttm_bo_vm: uninitialized kernel pages returned to userspace via TTM BO mmap fault
sys/dev/drm/ttm/ttm_bo_vm.c:690
 leak reproduced fixed untriaged — —
DF-0075 Medium 5.5 DIOCGSLICEINFO leaks kernel pointers (KASLR bypass) via raw struct diskslices copyout
sys/kern/subr_diskslice.c:556
 leak:24bytes reproduced fixed untriaged — —
DF-0107 Medium 5.5 dkcksum32 OOB read via DIOCSDINFO ioctl with crafted d_npartitions
sys/kern/subr_disklabel32.c:264
 panic reproduced fixed untriaged — —
DF-0585 Medium 5.5 TAPSIFINFO leaks the ifnet serializer on type mismatch (local DoS / kernel wedge)
sys/net/tap/if_tap.c:738
 dos reproduced fixed untriaged — —
DF-0748 Medium 5.5 Unchecked uint16_t index into 10-element log_if_table — OOB read + kernel panic on matching packet
sys/net/ipfw3_basic/ip_fw3_log.c:114
 panic reproduced fixed untriaged — —
DF-0810 Medium 5.5 nfs_getcookie() OOB array index via int truncation of 64-bit directory offset — local panic
sys/vfs/nfs/nfs_subs.c:1341
 panic reproduced fixed untriaged — —
DF-0850 Medium 5.5 Missing interior-node limit validation in ext2_htree_find_leaf — OOB heap read/panic from crafted ext2 htree image
sys/vfs/ext2fs/ext2_htree.c:308
 panic reproduced fixed untriaged — —
DF-0929 Medium 5.5 Unvalidated data_len in hammer_ioc_dedup causes kernel OOB read via crafted image
sys/vfs/hammer/hammer_dedup.c:92
 panic reproduced fixed untriaged — —
DF-1028 Medium 5.5 OOB heap read in READ ELEMENT STATUS response parsing (device-controlled desclen/avail/flags)
sys/bus/cam/scsi/scsi_ch.c:1118
 none not_reproduced not_testable untriaged — —
DF-1029 Medium 5.5 OOB heap read via unchecked blk_desc_len in MODE SENSE parsing (chdone/chgetparams)
sys/bus/cam/scsi/scsi_ch.c:494
 none not_reproduced not_testable untriaged — —
DF-1048 Medium 5.5 Kernel panic / divide-by-zero in umcs7840_calc_baudrate when c_ospeed == 0 (B0) via tcsetattr
sys/bus/u4b/serial/umcs.c:1056
 panic reproduced fixed untriaged — —
DF-1167 Medium 5.5 NULL deref / heap OOB read: cac_leakage_table indexed by unrelated SCLK count without bounds
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:673
 panic reproduced not_testable untriaged — —
DF-1175 Medium 5.5 Intel and nVidia parsers: unbounded config_size in checksum loop causes kernel OOB read / panic
sys/dev/disk/nata/ata-raid.c:2151
 leak:64000+3584 reproduced not_testable untriaged — —
DF-1183 Medium 5.5 Heap OOB read in vega10_get_soc_index_for_max_uclk: hardcoded entries[3] without count check
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:3444
 none not_reproduced not_testable untriaged — —
DF-1332 Medium 5.5 amdgpu_fill_buffer uint32_t truncation skips VRAM clear for nodes>=4GiB (cross-user VRAM info leak)
sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2183
 leak reproduced fixed untriaged — —
DF-1361 Medium 5.5 OOB kernel read via unbounded ReplySize in mps_user_pass_thru copyout
sys/dev/raid/mps/mps_user.c:858
 leak reproduced fixed untriaged — —
DF-1403 Medium 5.5 Unprivileged OOB read / kernel memory leak in cik_get_register_value via attacker-controlled SE/SH index
sys/dev/drm/amd/amdgpu/cik.c:1026
 none inconclusive — untriaged — —
DF-1467 Medium 5.5 vi_get_register_value OOB read of gfx.config.rb_config[se][sh] via AMDGPU_INFO_READ_MMR_REG (DF-1403 twin)
sys/dev/drm/amd/amdgpu/vi.c:550
 none inconclusive — untriaged — —
DF-1494 Medium 5.5 midistat_read OOB kernel heap read via unchecked negative uio_offset
sys/dev/sound/midi/midi.c:1038
 none inconclusive — untriaged — —
DF-1774 Medium 5.5 mpt_user: uninitialized kernel-heap memory leak via MPTIO_READ_CFG_PAGE / READ_EXT_CFG_PAGE
sys/dev/disk/mpt/mpt_user.c:186
 none inconclusive — untriaged — —
DF-1789 Medium 5.5 ar2316: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> kernel OOB read (mirrors DF-1766)
sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:384
 none inconclusive — untriaged — —
DF-1951 Medium 5.5 Kernel heap info leak: uninitialized BIOS buffer exposed to unprivileged userspace via AMDGPU_INFO_VBIOS_IMAGE ioctl on ATRM path
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:338
 none inconclusive — untriaged — —
DF-1954 Medium 5.5 OOB kernel heap info leak in sndstat_read via signed/unsigned truncation in min() length math
sys/dev/sound/pcm/sndstat.c:206
 none inconclusive — untriaged — —
DF-2075 Medium 5.5 drm_vm_info leaks struct_mutex permanently on SYSCTL_OUT failure (local DoS)
sys/dev/drm/drm_sysctl.c:175
 dos reproduced fixed untriaged — —
DF-2177 Medium 5.5 acpi_PkgStr NULL-pointer dereference via firmware-supplied zero-length String/Buffer (kernel DoS)
sys/dev/acpica/acpi_package.c:76
 panic reproduced fixed untriaged — —
DF-2472 Medium 5.5 ISP_FC_GETDINFO ioctl missing channel bounds check -> kernel heap OOB read / info leak
sys/dev/disk/isp/isp_freebsd.c:471
 none not_reproduced not_testable untriaged — —
DF-2486 Medium 5.5 Kernel heap info leak via uninitialized DMA buffer in MPTIO_READ_CFG_PAGE / MPTIO_READ_EXT_CFG_PAGE
sys/dev/disk/mpt/mpt_user.c:203
 none not_reproduced not_testable untriaged — —
DF-2503 Medium 5.5 TOCTOU info leak in CDIOCREADSUBCHANNEL via double-fetch of args->data_len
sys/dev/disk/nata/atapi-cd.c:502
 none not_reproduced not_testable untriaged — —
DF-2505 Medium 5.5 Drive-controlled / TOCTOU OOB kernel heap read in DVD_STRUCT_BCA and DVD_STRUCT_MANUFACT
sys/dev/disk/nata/atapi-cd.c:1537
 leak reproduced fixed untriaged — —
DF-2535 Medium 5.5 OOB read / deterministic panic in mpt_disable_lun via wildcard LUN (loop indexes trt[lun] not trt[i])
sys/dev/disk/mpt/mpt_cam.c:4334
 none not_reproduced not_testable untriaged — —
DF-0644 Low 5.5 check_from_lookup / check_to_lookup OOB read via unvalidated table index cmd->arg1
sys/net/ipfw3_basic/ip_fw3_basic.c:311
 panic reproduced fixed untriaged — —
DF-1584 Low 5.5 mfi_build_and_issue_cmd leaks Thunderbolt command slot on mfi_tbolt_build_io failure
sys/dev/raid/mfi/mfi_tbolt.c:1097
 leak reproduced fixed untriaged — —
1086 Medium 5.4 crom_parse_text() CROM_END check treats crc_len as bytes instead of quadlets, allowing OOB read past csrrom
sys/bus/firewire/fwcrom.c:207
 leak:60bytes reproduced fixed untriaged — —
DF-0526 Medium 5.4 ng_fec_choose_port dereferences ether/IP headers without mbuf length validation: OOB read
sys/netgraph/fec/ng_fec.c:897
 none not_reproduced not_testable untriaged — —
DF-1239 Medium 5.4 iwi_frame_intr frame->len bound too loose: up to 28-byte OOB read past mbuf cluster
sys/dev/netif/iwi/if_iwi.c:1248
 none not_reproduced not_testable untriaged — —
DF-0288 Low 5.4 OOB read in mesh peering action: peer_linkid/peer_rcode decoded before length check
sys/netproto/802_11/wlan/ieee80211_mesh.c:2174
 none reproduced fixed untriaged — —
DF-0363 Low 5.4 ieee80211_dump_pkt reads WEP/QoS/4-addr fields without bounds-checking against frame length: OOB read when debug enabled
sys/netproto/802_11/wlan/ieee80211_proto.c:591
 none reproduced fixed untriaged — —
DF-0583 Low 5.4 ieee80211_parse_ath heap over-read via short Atheros vendor IE
sys/netproto/802_11/wlan/ieee80211_superg.c:198
 leak reproduced fixed untriaged — —
DF-1145 High 5.3 Unbounded firmware-supplied MPDU length in RX paths causes kernel heap OOB read
sys/dev/netif/iwm/if_iwm.c:3221
 none inconclusive not_testable untriaged — —
DF-1254 Medium 5.3 OD8 capability/settings arrays indexed by constants but allocated to VBIOS-supplied length -> heap OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:894
 none inconclusive not_testable untriaged — —
DF-1299 Medium 5.3 OOB kernel-heap reads from VBIOS-controlled flex-array counts across table walks
sys/dev/drm/amd/display/dc/bios/bios_parser.c:175
 leak reproduced fixed untriaged — —
DF-1306 Medium 5.3 Unbounded nonClockInfoIndex causes heap OOB read in kv_parse_power_table
sys/dev/drm/radeon/kv_dpm.c:2668
 leak reproduced fixed untriaged — —
DF-1307 Medium 5.3 Unbounded VCE clk_idx causes heap OOB read in kv_parse_power_table
sys/dev/drm/radeon/kv_dpm.c:2703
 leak reproduced fixed untriaged — —
DF-1484 Medium 5.3 Missing size validation for AMDGPU_CHUNK_ID_IB allows OOB read of drm_amdgpu_cs_chunk_ib fields
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:166
 none inconclusive — untriaged — —
DF-1672 Medium 5.3 cik_sdma: integer overflow in cik_copy_dma size computation -> silent data corruption on >=4GB moves
sys/dev/drm/radeon/cik_sdma.c:586
 panic reproduced fixed untriaged — —
DF-1693 Medium 5.3 amdgpu_debugfs: PCIE/DIDT/SMC register handlers perform no upper-bound validation on user-supplied register offset
sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:229
 panic reproduced fixed untriaged — —
DF-1953 Medium 5.3 Unmasked ioread32(vaddr+head+4) reads 4 bytes past ring-buffer mapping in semaphore_waits_for
sys/dev/drm/i915/intel_hangcheck.c:103
 none inconclusive — untriaged — —
DF-2091 Medium 5.3 Integer overflow in si_copy_dma size computation truncates DMA copy for BOs >= 4GB
sys/dev/drm/radeon/si_dma.c:240
 dos reproduced fixed untriaged — —
DF-2196 Medium 5.3 task_struct allocated in kthread_run() is never freed and td_linux_task is never cleared, leaking memory and leaving dangling back-pointer in struct thread
sys/dev/drm/linux_kthread.c:54
 none reproduced fixed untriaged — —
DF-2271 Medium 5.3 Device-controlled avail in chgetelemstatus walks desc past data buffer -> kernel heap info leak via copyout
sys/bus/cam/scsi/scsi_ch.c:1159
 none not_reproduced not_testable untriaged — —
DF-2589 Medium 5.3 Unchecked AcpiEvaluateObject return in acpi_panasonic_sinf causes NULL-deref panic and heap OOB read
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:277
 none not_reproduced not_testable untriaged — —
DF-0469 Low 5.3 ip6_get_prevhdr dereferences ip6e without validating len against m_len: fragile implicit contract
sys/netinet6/ip6_input.c:1418
 none reproduced fixed untriaged — —
DF-0520 Low 5.3 icmp_reflect reflects source-route/RR/TS IP options into echo reply: info leak + source-route revival
sys/netinet/ip_icmp.c:1025
 leak reproduced fixed untriaged — —
DF-0747 Low 5.3 check_established reads TCP th_flags from non-first IP fragments without pullup — OOB read + firewall misclassification
sys/net/ipfw3_layer4/ip_fw3_layer4.c:173
 leak:0 reproduced fixed untriaged — —
DF-0750 Low 5.3 strncpy on binary MAC bytes silently truncates at 0x00 byte — radix key collision rule bypass
sys/net/ipfw3_layer2/ip_fw3_layer2.c:127
 none reproduced not_testable untriaged — —
DF-1140 Low 5.3 OOB read in si_parse_power_table: nonClockInfoIndex taken from VBIOS without bounds check
sys/dev/drm/radeon/si_dpm.c:6848
 panic reproduced fixed untriaged — —
DF-1144 Low 5.3 Unbounded VBIOS-supplied indices into nonClockInfo[]/clockInfo[] arrays in ci_parse_power_table
sys/dev/drm/amd/amdgpu/ci_dpm.c:5688
 panic reproduced fixed untriaged — —
DF-1196 Low 5.3 Unchecked power_state index increment in DYNPM downclock path causes kernel OOB read
sys/dev/drm/radeon/r600.c:360
 panic reproduced fixed untriaged — —
DF-1608 Low 5.3 Unchecked ACPI buffer length when reading WMI command result
sys/dev/acpica/acpi_hp/acpi_hp.c:847
 panic reproduced fixed untriaged — —
DF-1665 Low 5.3 twa: OOB read of tw_cli_severity_string_table[severity] via firmware-controlled severity bits
sys/dev/raid/twa/tw_cl_misc.c:55
 leak:0 reproduced fixed untriaged — —
DF-2016 Low 5.3 Unguarded data_ptr dereference in INQUIRY rewrite path of mfip_done (local DoS / 1-byte heap OOB)
sys/dev/raid/mfi/mfi_cam.c:339
 none reproduced not_testable untriaged — —
DF-2301 Low 5.3 Off-by-one OOB read in print_db iterates one past the DMA descriptor array
sys/bus/firewire/fwohci.c:2347
 leak reproduced fixed untriaged — —
DF-2384 Low 5.3 Missing Buffer.Length check in acpi_hp_exec_wmi_command (heap OOB read of result[1]/result[2])
sys/dev/acpica/acpi_hp/acpi_hp.c:838
 leak reproduced not_testable untriaged — —
DF-0920 Info 5.3 Kernel heap pointer leaked to msgbuf via unconditional kprintf on NFS reply re-queue
sys/vfs/nfs/nfs_iod.c:134
 leak:0bytes reproduced fixed untriaged — —
DF-1165 Medium 5.2 Heap OOB read in drm_parse_tiled_block via undersized DisplayID tiled block
sys/dev/drm/drm_edid.c:5103
 leak:16 reproduced not_testable untriaged — —
DF-1415 Medium 5.2 Unchecked gpio pin count from u16 structuresize indexes fixed gpio_pin[8] array
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:353
 none inconclusive — untriaged — —
DF-1498 Medium 5.2 Unvalidated VBIOS USHORT offsets and UCHAR counts in atomctrl_get_leakage_vddc_base_on_leakage allow OOB read of BIOS image
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1498
 none inconclusive — untriaged — —
DF-2320 Medium 5.2 Unbounded tuple.ptr from attacker-controlled longlink/MFC addresses drives bus_space_read out of the mapped CIS window
sys/bus/pccard/pccard_cis.c:212
 panic reproduced fixed untriaged — —
DF-0138 Low 5.2 Cross-jail USER varsym namespace sharing (per-UID not per-jail)
sys/kern/kern_varsym.c:259
 none reproduced fixed untriaged — —
DF-1370 Low 5.2 Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame
sys/dev/raid/mps/mps.c:1269
 none reproduced fixed untriaged — —
DF-1591 Low 5.2 Firmware-controlled AEN severity indexes tws_sev_str[5] out of bounds via strcpy
sys/dev/raid/tws/tws_cam.c:52
 panic reproduced fixed untriaged — —
DF-1862 Low 5.2 ixgbe_dcb_config_pfc_82599 uses unbounded u8 map[] to size PFC loop: OOB read + OOB MMIO write (latent)
sys/dev/netif/ix/ixgbe_dcb_82599.c:321
 panic reproduced fixed untriaged — —
DF-2096 Low 5.2 amdgpu_ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> OOB read of firmware buffer and unbounded SMC SRAM write
sys/dev/drm/amd/amdgpu/ci_smc.c:208
 dos reproduced fixed untriaged — —
DF-2328 Low 5.2 Missing NUL-termination of PnP string enables OOB stack read in search_token()
sys/bus/ppbus/ppbconf.c:219
 panic reproduced fixed untriaged — —
DF-0070 Medium 5.1 Heap OOB read in elf_getnote: untrusted n_namesz advances offset past note buffer with no bounds check
sys/kern/kern_checkpoint.c:313
 panic reproduced fixed untriaged — —
DF-0619 Medium 5.1 Heap OOB read in rip6_send via unvalidated sockaddr length
sys/netinet6/raw_ip6.c:743
 leak:26 reproduced fixed untriaged — —
DF-0634 Medium 5.1 Heap out-of-bounds read in ng_tag_rcvdata() mbuf-tag matching
sys/netgraph7/ng_tag.c:525
 leak:65535 reproduced not_testable untriaged — —
DF-1127 Medium 5.1 Missing bounds checks on BIOS-supplied array indices in si_parse_power_table (nonClockInfoIndex and VCE clk_idx)
sys/dev/drm/amd/amdgpu/si_dpm.c:7253
 leak reproduced not_testable untriaged — —
DF-1130 Medium 5.1 Firmware header OOB heap read in si_mc/si_cp/si_rlc microcode loaders via unchecked offset/size fields
sys/dev/drm/radeon/si.c:1574
 panic reproduced fixed untriaged — —
DF-1252 Medium 5.1 Unvalidated 16-bit BIOS offsets dereferenced in LVDS mode-table and GPIO voltage-table parsing (OOB read up to 64KB)
sys/dev/drm/radeon/radeon_combios.c:1246
 none inconclusive not_testable untriaged — —
DF-1530 Medium 5.1 hpt_get_channel_info uses caller-controlled bus with no bounds check (OOB read + kernel pointer leak / panic)
sys/dev/raid/hptmv/gui_lib.c:446
 none inconclusive — untriaged — —
DF-2027 Medium 5.1 All VBIOS table parsers dereference attacker-controlled offsets without bounds validation -- OOB heap read
sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:42
 none inconclusive not_testable untriaged — —
DF-2316 Medium 5.1 pnp_parse_desc reads fixed descriptor offsets without validating declared length causing heap OOB reads up to 17 bytes
sys/bus/isa/pnpparse.c:95
 panic reproduced fixed untriaged — —
DF-0040 Low 5.1 Section-header index not bounds-checked against e_shnum in link_elf_obj_load_file (heap OOB read)
sys/kern/link_elf_obj.c:551
 none reproduced fixed untriaged — —
DF-0041 Low 5.1 Unbounded st_name / sh_name offsets into symbol/section string tables (heap OOB read via strcmp)
sys/kern/link_elf_obj.c:304
 none reproduced fixed untriaged — —
DF-0057 Low 5.1 Missing e_shentsize validation causes heap OOB read on shdr[] array
sys/kern/link_elf.c:590
 none reproduced fixed untriaged — —
DF-0058 Low 5.1 Unbounded sh_link to symstrindex causes heap OOB read (DF-0040 analogue, worse: no check at all)
sys/kern/link_elf.c:601
 none reproduced fixed untriaged — —
DF-0060 Low 5.1 DT_HASH d_ptr dereferenced without bounds validation - wild kernel read in parse_dynamic
sys/kern/link_elf.c:240
 none reproduced fixed untriaged — —
DF-0062 Low 5.1 Unbounded st_name offsets into strtab (DF-0041 analogue, heap OOB read via strcmp)
sys/kern/link_elf.c:698
 none reproduced fixed untriaged — —
DF-0532 Low 5.1 bt3c_download_firmware: unvalidated block_size causes heap OOB read of msg->data
sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:1121
 panic reproduced fixed untriaged — —
DF-0610 Low 5.1 Heap OOB read in NGM_NAT_PROXY_RULE via non-NUL-terminated user string
sys/netgraph7/ng_nat.c:643
 none not_reproduced not_testable untriaged — —
DF-0899 Low 5.1 Cross-object heap over-read in devfs_rule_clear via non-NUL-terminated mntpoint
sys/vfs/devfs/devfs_rules.c:194
 panic reproduced not_testable untriaged — —
DF-1740 Low 5.1 vinumioctl: VINUM_GETFREELIST signed fe allows negative free-list index -> 16-byte OOB heap read
sys/dev/raid/vinum/vinumioctl.c:76
 panic reproduced fixed untriaged — —
DF-2247 Low 5.1 Translation table size never validated: heap OOB read and NULL-deref panic via undersized/NULL d_table
sys/libiconv/iconv_xlat.c:61
 leak reproduced fixed untriaged — —
DF-2260 Low 5.1 XPT_DEV_MATCH reads num_patterns without bounding by pattern_buf_len: kernel heap OOB read
sys/bus/cam/cam_xpt.c:3291
 panic reproduced fixed untriaged — —
DF-1931 Low 5.0 Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE
sys/dev/netif/ath/ath_rate/amrr/amrr.c:246
 panic reproduced fixed untriaged — —
DF-1948 Low 5.0 Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE (sibling of DF-1931)
sys/dev/netif/ath/ath_rate/onoe/onoe.c:220
 panic reproduced fixed untriaged — —
DF-0260 Low 4.8 tcpopts_match/ipopts_match read options beyond m_pullup-guaranteed contiguous region
sys/net/ipfw/ip_fw2.c:1296
 none reproduced fixed untriaged — —
DF-0651 Low 4.8 IP_MINTTL (GTSM) bypassed for all raw sockets except the last in rip_input delivery list
sys/netinet/raw_ip.c:164
 leak reproduced fixed untriaged — —
DF-0408 Info 4.8 ip_optcopy validates IP-option lengths only with KASSERT (no-op on production): latent OOB read
sys/netinet/ip_output.c:1018
 none reproduced not_testable untriaged — —
DF-0784 High 4.7 ext2_readlink truncates i_size (uint64) to signed int — unbounded kernel heap disclosure via uiomove (ext2 analog of DF-0778)
sys/vfs/ext2fs/ext2_vnops.c:1345
 leak:4078 reproduced fixed untriaged — —
DF-1139 Medium 4.7 OOB read / kernel panic in si_get_std_voltage_value when cac_leakage_table.count==0
sys/dev/drm/radeon/si_dpm.c:4158
 panic reproduced fixed untriaged — —
DF-1391 Medium 4.7 VBIOS power-table parsing dereferences attacker-controlled offsets with no bounds checks
sys/dev/drm/radeon/rv6xx_dpm.c:1889
 none inconclusive — untriaged — —
DF-1424 Medium 4.7 TOCTOU race: interrupt completion re-reads unchecked user buffer sizes from ioctl ucmd
sys/dev/raid/iir/iir.c:1600
 none inconclusive — untriaged — —
DF-1581 Medium 4.7 Off-by-one SMID bounds check in mfi_tbolt_complete_cmd allows OOB read of mfi_cmd_pool_tbolt[]
sys/dev/raid/mfi/mfi_tbolt.c:666
 none inconclusive — untriaged — —
DF-1796 Medium 4.7 ar2413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> deterministic kernel OOB read panic (mirrors DF-1766/DF-1789)
sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:353
 none inconclusive — untriaged — —
DF-1806 Medium 4.7 ar2317: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:363
 none inconclusive — untriaged — —
DF-1815 Medium 4.7 ppatomfwctrl: voltage-object VBIOS walk uses attacker-controlled structuresize/object_size -> OOB read + infinite-loop DoS
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:33
 none inconclusive — untriaged — —
DF-2025 Medium 4.7 Missing upper-bound on BMC-supplied response byte count causes kernel stack OOB read into userspace reply
sys/dev/misc/ipmi/ipmi_ssif.c:183
 none inconclusive not_testable untriaged — —
DF-2198 Medium 4.7 Divide-by-zero in ar5416IQCalibration when IQ cal measurements are small-but-nonzero
sys/dev/netif/ath/ath_hal/ar5416/ar5416_cal_iq.c:95
 panic reproduced fixed untriaged — —
DF-2269 Medium 4.7 Kernel heap OOB read in cdreaddvdstructure() default case via short-transfer underflow
sys/bus/cam/scsi/scsi_cd.c:4288
 leak reproduced fixed untriaged — —
DF-1316 Low 4.7 Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads
sys/dev/drm/radeon/ni.c:769
 none reproduced fixed untriaged — —
DF-1420 Low 4.7 OOB read of vddc_dependency_on_sclk in smu8_read_sensor GFX_SCLK (index vs table->count)
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1688
 none reproduced fixed untriaged — —
DF-1430 Low 4.7 OOB array read in twe_format_aen: TWE_AEN_UNIT(aen) up to 255 indexes twe_drive[16]
sys/dev/raid/twe/twe.c:1808
 none reproduced fixed untriaged — —
DF-1451 Low 4.7 SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read
sys/dev/drm/amd/amdgpu/sdma_v4_0.c:918
 none reproduced fixed untriaged — —
DF-1569 Low 4.7 Hauppauge EEPROM block-parse reads block_2/block_3 via attacker-influenced offsets without bounds checks (kernel stack OOB read / panic on probe)
sys/dev/video/bktr/bktr_card.c:1001
 panic reproduced fixed untriaged — —
DF-1573 Low 4.7 Firmware upgrade path reads out of bounds on attacker-shaped firmware image
sys/dev/netif/oce/oce_sysctl.c:257
 panic reproduced fixed untriaged — —
DF-1839 Low 4.7 Unsigned underflow in psp_v3_1_compare_sram_data ucode_size loop: OOB read and MMIO storm (latent - caller inside #if 0)
sys/dev/drm/amd/amdgpu/psp_v3_1.c:553
 panic reproduced fixed untriaged — —
DF-1876 Low 4.7 Integer underflow in psp_v11_0_compare_sram_data loop causes OOB read of ucode buffer — variant of DF-1839
sys/dev/drm/amd/amdgpu/psp_v11_0.c:498
 panic reproduced fixed untriaged — —
DF-2006 Low 4.7 Heap OOB read in aibs_attach_sif when ACPI ?SIF returns a zero-element package
sys/dev/acpica/aibs/atk0110.c:169
 none reproduced not_testable untriaged — —
DF-2155 Low 4.7 Unguarded division by zero panics the kernel in bw_frc_to_fixed / bw_floor2 / bw_ceil2
sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:69
 panic reproduced fixed untriaged — —
DF-2385 Low 4.7 Package helpers index Elements[idx] with no bounds check; the apparent NULL guard is dead code (heap OOB read / info leak)
sys/dev/acpica/acpi_package.c:48
 leak reproduced not_testable untriaged — —
DF-2412 Low 4.7 Unbounded queue-number index into sense_buffers[] heap OOB read / kernel heap info leak
sys/dev/disk/advansys/advansys.c:1185
 none reproduced not_testable untriaged — —
DF-1106 Medium 4.6 Unbounded XHCI extended-capability pointer walk allows OOB MMIO read/write and kernel DoS from malicious PCI controller
sys/bus/u4b/controller/xhci_pci.c:398
 none not_reproduced not_testable untriaged — —
DF-1240 Medium 4.6 iwi_checkforqos unbounded notif->len allows up to 292-byte OOB read past RX mbuf on crafted ASSOC RESP
sys/dev/netif/iwi/if_iwi.c:1368
 none not_reproduced not_testable untriaged — —
DF-1269 Medium 4.6 Missing bounds checks on VBIOS-supplied indices in kv_parse_power_table (OOB reads)
sys/dev/drm/amd/amdgpu/kv_dpm.c:2745
 none inconclusive not_testable untriaged — —
DF-1414 Medium 4.6 Unchecked VBIOS number_of_path (u8) indexes fixed display_path[8] at 6 call sites
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:162
 none inconclusive — untriaged — —
DF-1452 Medium 4.6 ae_rxeof lacks upper-bound check on NIC-controlled rxd->len allowing OOB heap read via m_devget
sys/dev/netif/ae/if_ae.c:609
 none inconclusive — untriaged — —
DF-1809 Medium 4.6 ar2425: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796/1806)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:264
 none inconclusive — untriaged — —
DF-2290 Medium 4.6 Unchecked info_len in crom_init_context enables OOB heap reads up to ~1000 bytes past csrrom[] buffer
sys/bus/firewire/fwcrom.c:59
 leak reproduced fixed untriaged — —
DF-1041 Low 4.6 Unbounded out-of-bounds read loops in CISTPL_CFTABLE_ENTRY power and misc-extension parsing
sys/bus/pccard/pccard_cis.c:984
 panic reproduced fixed untriaged — —
DF-1205 Low 4.6 Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach
sys/dev/netif/de/if_de.c:2072
 none reproduced not_testable untriaged — —
DF-1308 Low 4.6 OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2108
 none reproduced not_testable untriaged — —
DF-1883 Low 4.6 Divide-by-zero in ad_attach/ad_describe via crafted IDENTIFY geometry (heads=0 or sectors=0)
sys/dev/disk/nata/ata-disk.c:147
 panic reproduced fixed untriaged — —
DF-2093 Low 4.6 NULL pointer dereference in PLX attach path when local I/O resource allocation fails
sys/dev/netif/wi/if_wi_pci.c:177
 dos reproduced fixed untriaged — —
DF-2321 Low 4.6 Unbounded idx extension loops in CISTPL_CFTABLE_ENTRY read past the declared tuple body
sys/bus/pccard/pccard_cis.c:995
 dos reproduced not_testable untriaged — —
DF-2202 Medium 4.5 Unvalidated 4-bit register field indexes 9-element lookup table (OOB read)
sys/dev/drm/amd/amdgpu/df_v1_7.c:50
 panic reproduced fixed untriaged — —
DF-1339 Low 4.5 Unvalidated NCQ error tag allows OOB read on ap_ccbs via malicious device log page
sys/dev/disk/sili/sili.c:2138
 none reproduced fixed untriaged — —
DF-0354 Medium 4.4 nd6_sysctl_prlist stack buffer over-read leaks kernel memory when router count exceeds buffer capacity
sys/netinet6/nd6.c:2238
 leak:728bytes reproduced fixed untriaged — —
DF-0495 Medium 4.4 rn_delete integer underflow: klen-head_off wraps to huge size_t when key sa_len < tree offset -> kernel panic
sys/net/radix.c:884
 none not_reproduced not_testable untriaged — —
DF-0749 Medium 4.4 Unbounded table-id index in MAC-table lookup matchers — heap OOB read before eh-NULL gate (same DF-0668 pattern)
sys/net/ipfw3_layer2/ip_fw3_layer2.c:118
 panic reproduced fixed untriaged — —
DF-0832 Medium 4.4 Off-by-one OOB read in udf_bmap_internal ICB iteration — ad_offset > l_ad should be + sizeof(ad)
sys/vfs/udf/udf_vnops.c:1104
 leak:8 reproduced fixed untriaged — —
DF-1234 Medium 4.4 Kernel heap info leak via u_int16_t truncation in ASR_fillMessage on user-controlled reply size
sys/dev/raid/asr/asr.c:486
 none not_reproduced not_testable untriaged — —
DF-1364 Medium 4.4 Unchecked fd_formb_nsecs in FD_FORMAT causes OOB heap read via DMA/bcopy
sys/dev/disk/fd/fd.c:2272
 none inconclusive — untriaged — —
DF-1474 Medium 4.4 Topology/IR-config/PCIe-config change list loops trust firmware NumEntries/NumElements without bounding to allocation (heap OOB read)
sys/dev/raid/mpr/mpr_sas_lsi.c:216
 none inconclusive — untriaged — —
DF-1480 Medium 4.4 Signed integer underflow in P-state sysctl readers leaks kernel stack to unprivileged users
sys/dev/acpica/acpi_cpu_pstate.c:1255
 none inconclusive — untriaged — —
DF-1614 Medium 4.4 sln_rx mishandles RX ring wraparound: dead-code bounds check + missing modulo cause OOB reads (info leak / DoS)
sys/dev/netif/sln/if_sln.c:850
 panic reproduced fixed untriaged — —
DF-1697 Medium 4.4 mps_sas_lsi: SAS topology and IR config change loops trust firmware NumEntries/NumElements without bounding to allocation size (heap OOB read)
sys/dev/raid/mps/mps_sas_lsi.c:208
 panic reproduced fixed untriaged — —
DF-1798 Medium 4.4 smu_helper: heap OOB read in phm_get_sclk_for_voltage_evv via unvalidated vddInd from VBIOS
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:468
 none inconclusive — untriaged — —
DF-2056 Medium 4.4 iwm_fill_paging_mem copies paging sections with no length/NULL validation -> kernel OOB read or NULL-deref panic from malformed firmware
sys/dev/netif/iwm/if_iwm_fw.c:170
 panic reproduced fixed untriaged — —
DF-2107 Medium 4.4 Unbounded, unchecked SMBIOS structure-table walk causes OOB read and kernel panic
sys/dev/misc/ipmi/ipmi_smbios.c:147
 panic reproduced fixed untriaged — —
DF-2333 Medium 4.4 UAC2.0 Feature Unit descriptor accepted too short causing OOB read of bmaControls[0]
sys/bus/u4b/audio/uaudio.c:4000
 none not_reproduced not_testable untriaged — —
DF-0020 Low 4.4 ELF ABI-note descriptor read out of bounds (note_overflow ignores n_descsz)
sys/kern/imgact_elf.c:1700
 panic reproduced fixed untriaged — —
DF-0157 Low 4.4 xio_uio_copy missing upper-bound check; KKASSERT(bytes>=0) is tautology on unsigned size_t
sys/kern/kern_xio.c:196
 none reproduced fixed untriaged — —
DF-0424 Low 4.4 Unvalidated mf6cc_parent stored in MFC: OOB read in ip6_mdq debug path when parent >= MAXMIFS(64)
sys/netinet6/ip6_mroute.c:751
 none reproduced fixed untriaged — —
DF-0607 Low 4.4 BPF write to ng_iface reads uninitialized sa_data, can KASSERT-panic the kernel
sys/netgraph7/iface/ng_iface.c:428
 none not_reproduced not_testable untriaged — —
DF-1006 Low 4.4 print_db reads DMA descriptor array OOB (off-by-one loop bound <= max plus db[i+1])
sys/bus/firewire/fwohci.c:2347
 none reproduced fixed untriaged — —
DF-1669 Low 4.4 if_vke: uninitialized struct tapinfo stack read leaks via ifconfig ifp->if_mtu/if_baudrate
sys/dev/virtual/vkernel/net/if_vke.c:771
 leak:0 reproduced fixed untriaged — —
DF-1852 Low 4.4 Unchecked copyin return + no M_ZERO in hptmv ioctl lets stale kernel heap leak via copyout
sys/dev/raid/hptmv/hptproc.c:297
 panic reproduced fixed untriaged — —
DF-1872 Low 4.4 Divide-by-zero panic via sysctl kern.dcons.poll_hz=0
sys/dev/misc/dcons/dcons_os.c:353
 panic reproduced fixed untriaged — —
DF-1885 Low 4.4 initsd computes size=0 for init_blocksize in [1,511]: OOB read / NULL-deref panic via bcmp
sys/dev/raid/vinum/vinumrevive.c:511
 panic reproduced fixed untriaged — —
DF-1898 Low 4.4 Firmware-controlled lengths in iwm_phy_db_set_section never validated against RX packet size: heap OOB read / kernel panic
sys/dev/netif/iwm/if_iwm_phy_db.c:268
 panic reproduced fixed untriaged — —
DF-2368 Low 4.4 Key-size validation is no-op KASSERT invalid keyBits silently yields Nr=0 and runaway loop / OOB read
sys/crypto/rijndael/rijndael-alg-fst.c:734
 panic reproduced not_testable untriaged — —
DF-2502 Low 4.4 Signed int len assigned from u_int32_t dxfer_len signedness overflow in INQUIRY bzero and odd-length kmalloc/bcopy
sys/dev/disk/nata/atapi-cam.c:353
 corruption reproduced fixed untriaged — —
DF-2308 Info 4.4 I2CREAD ioctl leaks uninitialized kernel heap memory to userspace
sys/bus/iicbus/iic.c:343
 none not_reproduced not_testable untriaged — —
DF-0454 Medium 4.3 Uninitialized kernel stack info leak in RPN response: param_mask never initialized for 1-byte RPN command
sys/netbt/rfcomm_session.c:1227
 leak:2bytes reproduced not_testable untriaged — —
DF-0540 Medium 4.3 Uninitialized cmd.ident sent in Command Reject: remote 1-byte kernel stack info leak
sys/netbt/l2cap_signal.c:70
 none not_reproduced not_testable untriaged — —
DF-0270 Low 4.3 OOB read in PAP ACK/NAK debug: wrong bound len+4 should be len-4
sys/net/sppp/if_spppsubr.c:4390
 none reproduced fixed untriaged — —
DF-0284 Low 4.3 Missing per-command payload bounds checks in MCC handlers (OOB read)
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521
 none reproduced fixed untriaged — —
DF-0346 Low 4.3 Uninitialized stack read of rsnparms on WPS/TSN assoc path bypasses HT-cipher downgrade protection
sys/netproto/802_11/wlan/ieee80211_hostap.c:1934
 none reproduced fixed untriaged — —
DF-2152 Low 4.3 ath_led_event indexes sc_hwmap[32] with unchecked rate index from received frame (OOB read)
sys/dev/netif/ath/ath/if_ath_led.c:189
 corruption reproduced fixed untriaged — —
DF-1481 Medium 4.2 vr_rxeof trusts 11-bit NIC-reported RX length as m_devget copy size without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/vr/if_vr.c:1005
 none inconclusive — untriaged — —
DF-1514 Medium 4.2 ste_rxeof trusts 13-bit NIC-reported FRAMELEN as m_len without MCLBYTES bound: large OOB heap read past RX mbuf cluster
sys/dev/netif/ste/if_ste.c:678
 none inconclusive — untriaged — —
DF-0582 Low 4.2 ieee80211_parse_beacon FHPARMS/DSPARMS field reads exceed declared IE length: OOB read
sys/netproto/802_11/wlan/ieee80211_input.c:571
 panic reproduced fixed untriaged — —
DF-1598 Low 4.2 Firmware header fields read without size check after amdgpu_ucode_validate
sys/dev/drm/amd/amdgpu/sdma_v2_4.c:154
 panic reproduced fixed untriaged — —
DF-2095 Low 4.2 u8 loop-variable underflow + signed shift UB in intel_dp_aux_set_pwm_freq (DoS via malicious eDP panel)
sys/dev/drm/i915/intel_dp_aux_backlight.c:114
 dos reproduced fixed untriaged — —
DF-2369 Low 4.2 Multi-block CFB1 never advances input/outBuffer leaking plaintext and stale output as ciphertext for blocks > 1
sys/crypto/rijndael/rijndael-api-fst.c:153
 none reproduced not_testable untriaged — —
DF-0595 Info 4.2 Michael MIC verification uses non-constant-time memcmp (defense-in-depth)
sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:359
 leak:timing reproduced fixed untriaged — —
DF-0304 Low 4.1 CARP shared secret key material not zeroed before kfree
sys/netinet/ip_carp.c:307
 leak reproduced fixed untriaged — —
DF-0496 Low 4.1 rn_walktree_from dereferences caller-supplied mask without NULL check
sys/net/radix.c:1098
 leak reproduced fixed untriaged — —
DF-1050 Low 4.1 NULL-deref kernel panic in usb_detach when usb_proc_create failed during usb_attach_sub
sys/bus/u4b/controller/usb_controller.c:180
 none reproduced fixed untriaged — —
DF-1207 Low 4.1 alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12-bit) and nsegs (4-bit) without bounds validation
sys/dev/netif/alc/if_alc.c:3304
 none reproduced fixed untriaged — —
DF-1457 Low 4.1 MC firmware header fields trusted without bounds validation causing heap OOB read
sys/dev/drm/amd/amdgpu/gmc_v8_0.c:314
 none reproduced fixed untriaged — —
DF-1538 Low 4.1 gmc_v7_0_mc_load_microcode trusts MC firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457 v7 twin)
sys/dev/drm/amd/amdgpu/gmc_v7_0.c:189
 panic reproduced fixed untriaged — —
DF-1553 Low 4.1 cik_sdma_load_microcode trusts SDMA firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457/DF-1538 SDMA twin)
sys/dev/drm/amd/amdgpu/cik_sdma.c:539
 panic reproduced fixed untriaged — —
DF-1766 Low 4.1 ar5413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers causes OOB read and index wrap
sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:302
 panic reproduced fixed untriaged — —
DF-1845 Low 4.1 gpio_unregister calls devfs_clone_bitmap_get instead of _put, panicking kernel after repeated attach/detach
sys/dev/misc/gpio/gpio.c:596
 leak reproduced fixed untriaged — —
DF-2151 Low 4.1 Kernel panic on device attach error path: bus_release_resource uses wrong rid for io resource
sys/dev/raid/dpt/dpt_pci.c:174
 none reproduced fixed untriaged — —
DF-0065 Info 4.1 OOB read of thread struct before panic in lwkt_reltoken assertion path (console-only, no userspace leak)
sys/kern/lwkt_token.c:841
 none reproduced not_testable untriaged — —
DF-0333 Low 4.0 Kernel pointer leak to unprivileged users via in_pcblist_range xinpcb dump
sys/netinet/in_pcb.c:2409
 leak reproduced fixed untriaged — —
DF-0389 Low 4.0 Sockaddr padding not zeroed in rt_msg_buffer/rt_msg_mbuf: 1-7 bytes kernel memory leak per sockaddr
sys/net/rtsock.c:1140
 leak reproduced fixed untriaged — —
DF-1000 Low 4.0 Unbounded linear scan in rum_set_chan over rfprog channel table (defense-in-depth)
sys/bus/u4b/wlan/if_rum.c:2083
 none reproduced fixed untriaged — —
DF-1632 Info 4.0 Boot-time kernel pointer leak via dev_info %p of fence cpu_addr
sys/dev/drm/radeon/radeon_fence.c:861
 none reproduced not_testable untriaged — —
DF-1689 Medium 3.9 vega20_processpptables: VBIOS powerplay table size not validated against structure footprint -> OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:636
 panic reproduced fixed untriaged — —
DF-1690 Medium 3.9 vega20_processpptables: append_vbios_pptable dereferences smc_dpm_info VBIOS table without validating its size
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:714
 panic reproduced fixed untriaged — —
DF-0096 Low 3.9 sglist_join has reversed bcopy arguments - joins produce stale/garbage segments (dead code, identical to upstream FreeBSD)
sys/kern/subr_sglist.c:583
 none reproduced fixed untriaged — —
DF-0321 Low 3.9 Uninitialized stack read of maxunequalmcs when HTC_TXUNEQUAL set but ic_txstream<2
sys/netproto/802_11/wlan/ieee80211_ht.c:1643
 none reproduced fixed untriaged — —
DF-0798 Low 3.9 Missing bounds check on B-Tree node in-buffer offset — OOB heap read during CRC validation
sys/vfs/hammer/hammer_ondisk.c:1306
 panic reproduced fixed untriaged — —
DF-0827 Low 3.9 FAT12 1-byte OOB read in pcbmap via crafted cluster chain on small-FAT images
sys/vfs/msdosfs/msdosfs_fat.c:187
 leak:1 reproduced fixed untriaged — —
DF-1888 Low 3.9 Buffer over-read + u16 length underflow in e1000_mng_host_if_write_generic on misaligned offset with short length
sys/dev/netif/ig_hal/e1000_manage.c:237
 panic reproduced fixed untriaged — —
DF-1926 Low 3.9 tws_init_connect leaks sole internal-request slot on poll failure permanently disabling controller init/reset
sys/dev/raid/tws/tws_hdm.c:188
 leak reproduced fixed untriaged — —
DF-1958 Low 3.9 Unclamped csio->cdb_len and csio->sense_len allow OOB read of cdb_bytes and OOB write of sense_data in vpo_intr
sys/dev/disk/vpo/vpo.c:220
 panic reproduced fixed untriaged — —
DF-0036 Info 3.9 %n format specifier enabled in kernel printf engine with zero in-tree consumers
sys/kern/subr_prf.c:688
 none reproduced fixed untriaged — —
DF-0357 Info 3.9 nd6_cache_lladdr ignores lladdrlen parameter, uses ifp->if_addrlen for bcopy
sys/netinet6/nd6.c:1768
 none reproduced fixed untriaged — —
DF-0136 Medium 3.8 Jail isolation breach: varsym_list(VARSYM_SYS) leaks host varsyms to jailed processes
sys/kern/kern_varsym.c:263
 leak reproduced fixed untriaged — —
DF-0344 Low 3.7 No re-validation of m_len>=hlen after pfil hook rewrite/dummynet re-entry
sys/netinet/ip_input.c:631
 dos reproduced fixed untriaged — —
DF-0514 Low 3.7 REJECT_RST copies full 20-byte tcphdr after PULLUP_TO guaranteed only 14: stale mbuf buffer leak in RST
sys/net/ip6fw/ip6_fw.c:629
 none not_reproduced — untriaged — —
DF-0693 Low 3.7 ICV verification reads past mbuf data when ICV straddles mbuf boundary
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:477
 leak reproduced fixed untriaged — —
DF-0714 Low 3.7 One-byte OOB read in TCP option parser correct_mss when olen==1 after consuming NOPs
sys/netgraph7/tcpmss/ng_tcpmss.c:426
 none reproduced fixed untriaged — —
DF-1188 Low 3.7 OOB read in em_rxeof when NIC reports desc_len=0 on error descriptor
sys/dev/netif/em/if_em.c:3692
 panic reproduced fixed untriaged — —
DF-1960 Medium 3.6 Uninitialized heap memory leaked to any local user via sysctl when BIOS PSB has no matching PST
sys/dev/powermng/powernow/powernow.c:366
 none inconclusive — untriaged — —
DF-0151 Low 3.6 Fixed-size reads in preload_modinfo_value ignore field length
sys/kern/subr_module.c:374
 none reproduced fixed untriaged — —
DF-0152 Low 3.6 preload_dump_internal termination check weaker than other walkers; huge len advances pointer
sys/kern/subr_module.c:410
 none reproduced fixed untriaged — —
DF-0312 Low 3.6 Unchecked ifindex2ifnet[] indexing from embedded address scope-id on loopback output
sys/netinet6/ip6_output.c:577
 none reproduced fixed untriaged — —
DF-0407 Low 3.6 setsockopt(IP_OPTIONS) overwrites copyin error: parses stale mbuf data as IP options on copyin failure
sys/netinet/ip_output.c:1097
 none reproduced fixed untriaged — —
DF-0504 Low 3.6 ng_fec_choose_port dereferences ether/ip/ip6 headers with no mbuf length validation
sys/netgraph7/ng_fec.c:1018
 panic reproduced fixed untriaged — —
DF-1351 Low 3.6 nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1
sys/dev/netif/nfe/if_nfe.c:1072
 none reproduced not_testable untriaged — —
DF-1373 Low 3.6 oce_check_ipv6_ext_hdr parses IPv6 ext header without m_pullup (OOB read on short TX mbuf)
sys/dev/netif/oce/oce_if.c:2167
 none reproduced not_testable untriaged — —
DF-1458 Low 3.6 OOB stack read in cyapa_raw_input via unbounded device-reported finger count
sys/dev/smbus/cyapa/cyapa.c:1262
 none reproduced fixed untriaged — —
DF-1589 Low 3.6 Unbounded ucNumEntries-1 read in init_over_drive_limits reads patom_record_v2[-1] when ucNumEntries==0
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:269
 panic reproduced fixed untriaged — —
DF-1638 Low 3.6 u_int16_t truncation of buffer size in ess_dmasetup/ess_dmapos causes busy-loop stall and kernel heap info leak when buffersize=65536
sys/dev/sound/pci/solo.c:769
 dos reproduced fixed untriaged — —
DF-1765 Low 3.6 amdgpu_dm_debugfs: uninitialized stack read of param[] in dp_link_settings_write / dp_phy_settings_write
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:155
 none inconclusive — untriaged — —
DF-1782 Low 3.6 ata-siliconimage: OOB read in ata_sii_setmode PIO timing lookup (piotimings[mode&0x0f] on 5-element array with index 8..12)
sys/dev/disk/nata/chipsets/ata-siliconimage.c:366
 none reproduced fixed untriaged — —
DF-2223 Low 3.6 pcie_capability_read_dword leaves *dst uninitialized on register-not-implemented path diverging from LinuxKPI contract
sys/dev/drm/linux_pci.c:35
 denial_of_service reproduced fixed untriaged — —
DF-2387 Low 3.6 Unchecked SINF package index yields heap out-of-bounds read for short/malformed firmware packages
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:280
 leak reproduced not_testable untriaged — —
DF-1523 Info 3.6 ar5212GetNfAdjust sentinel-terminator bug: OOB read when channel == 0
sys/dev/netif/ath/ath_hal/ar5212/ar5212_misc.c:769
 none reproduced not_testable untriaged — —
DF-0266 Medium 3.5 Uninitialized inflate window: kernel heap info leak via stale window data
sys/net/zlib.c:3706
 leak not_reproduced not_testable untriaged — —
DF-0973 Low 3.5 PROBE_MODE_SENSE OOB read via device-controlled blk_desc_len in mode header
sys/bus/cam/cam_xpt.c:6234
 none reproduced fixed untriaged — —
DF-1730 Low 3.5 atombios_dp: unvalidated DP lane count from malicious sink causes OOB stack reads during link training
sys/dev/drm/radeon/atombios_dp.c:312
 panic reproduced fixed untriaged — —
DF-0860 Medium 3.4 ngc_send does not validate ng_mesg length or arglen causing heap OOB read (FreeBSD CVE-2008-5736 never ported)
sys/netgraph/socket/ng_socket.c:248
 leak:128 reproduced fixed untriaged — —
DF-1091 Medium 3.4 Slave-controlled block-read count drives OOB MMIO reads and inflates returned byte count (amdsmb_bread)
sys/bus/smbus/amdsmb/amdsmb.c:517
 none not_reproduced fixed untriaged — —
DF-1222 Low 3.4 RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow)
sys/dev/virtual/amazon/ena/ena.c:1457
 none reproduced fixed untriaged — —
DF-1409 Low 3.4 OOB read of fixed-size ucMuxState[2] via BIOS-controlled enum_id in router-record parsing
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:431
 none reproduced fixed untriaged — —
DF-1597 Low 3.4 Signed/unsigned confusion in tpm_tis12_write causes stack buffer over-read on zero-length write
sys/dev/crypto/tpm/tpm.c:821
 panic reproduced fixed untriaged — —
DF-2239 Low 3.4 Before-buffer OOB read and conditional OOB write on CTRL(n) down-arrow at end of history
sys/ddb/db_input.c:236
 none reproduced fixed untriaged — —
DF-0185 Medium 3.3 Uninitialized kernel stack memory leaked via acl_get_file/acl_get_fd
sys/kern/kern_acl.c:92
 none not_reproduced fixed untriaged — —
DF-0337 Medium 3.3 tcp_pcblist sysctl raw-copies entire inpcb and tcpcb with kernel pointers to unprivileged users
sys/netinet/tcp_subr.c:1284
 leak:113ptrs reproduced fixed untriaged — —
DF-0650 Medium 3.3 Heap OOB read in rip_send via unvalidated sockaddr length (IPv4 twin of DF-0619)
sys/netinet/raw_ip.c:632
 leak:4 reproduced fixed untriaged — —
DF-0922 Medium 3.3 Kernel heap pointer leaked to userspace via %p of vm_object in /proc/<pid>/map
sys/vfs/procfs/procfs_map.c:208
 leak reproduced fixed untriaged — —
DF-0938 Medium 3.3 Uninitialized kernel stack leaked via /proc/<pid>/fpregs read
sys/vfs/procfs/procfs_fpregs.c:54
 leak:~300 reproduced fixed untriaged — —
DF-0993 Medium 3.3 fill_dbregs leaves dr[8]-dr[15] uninitialized - 64-byte kernel stack leak via /proc/<pid>/dbregs and PT_GETDBREGS
sys/platform/pc64/x86_64/machdep.c:3104
 leak:64 reproduced fixed untriaged — —
DF-1056 Medium 3.3 fill_fpregs leaks ~404 bytes of uninitialized kernel stack via PT_GETFPREGS / /proc/pid/fpregs
sys/platform/vkernel64/x86_64/cpu_regs.c:711
 leak:404 reproduced fixed untriaged — —
DF-1353 Medium 3.3 vega12_force_clock_level OOB read of dpm_levels[16] via user-controlled mask
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1798
 leak reproduced fixed untriaged — —
DF-1641 Medium 3.3 Kernel pointer leak via non-NUL-terminated dm_dev UUID returned through info/deps ioctls
sys/dev/disk/dm/dm_ioctl.c:409
 panic reproduced fixed untriaged — —
DF-1712 Medium 3.3 intel_fbdev: stolen-memory framebuffer exposed unzeroed on DragonFly (info leak)
sys/dev/drm/i915/intel_fbdev.c:276
 none inconclusive — untriaged — —
DF-2449 Medium 3.3 dm_table_load_ioctl: uninitialized heap start/length in dm_table_entry_t leak to userspace via status ioctl
sys/dev/disk/dm/dm_ioctl.c:743
 leak:16 reproduced fixed untriaged — —
DF-2558 Medium 3.3 Kernel stack info leak via unp_pcblist sysctl (net.local.{dgram stream seqpacket}.pcblist)
sys/kern/uipc_usrreq.c:1465
 leak:~510 reproduced fixed untriaged — —
DF-0006 Low 3.3 kern.ttys sysctl leaks kernel function/heap pointers to unprivileged users
sys/kern/tty.c:2891
 leak:102ptrs reproduced fixed untriaged — —
DF-0009 Low 3.3 VFS_CONF (vfs.generic) sysctl leaks kernel pointers (vfc_vfsops, vfc_next) to unprivileged users
sys/kern/vfs_subr.c:1839
 leak:21bytes(11 vfc_vfsops + 10 vfc_next kernel pointers/run; KASLR-defeat) reproduced fixed untriaged — —
DF-0010 Low 3.3 Uninitialized struct cmsgcred leaks kernel stack via synthesized SCM_CREDS (SO_PASSCRED)
sys/kern/uipc_usrreq.c:683
 leak:62 reproduced fixed untriaged — —
DF-0016 Low 3.3 kinfo_proc (kern.proc.*) exports unredacted kernel pointers (KASLR defeat)
sys/kern/kern_proc.c:1603
 leak:69 reproduced fixed untriaged — —
DF-0027 Low 3.3 wait4/wait6 leak uninitialized kernel stack via status, rusage/wrusage and siginfo on WNOHANG/WCONTINUED return paths
sys/kern/kern_exit.c:913
 leak:148 reproduced fixed untriaged — —
DF-0034 Low 3.3 Uninitialized st_padding1 leaked to userspace via every stat syscall
sys/kern/vfs_vnops.c:852
 leak:2bytes reproduced fixed untriaged — —
DF-0050 Low 3.3 msgctl(IPC_STAT) leaks kernel heap pointers (msg_first/msg_last) and uninitialized padding to any local user
sys/kern/sysv_msg.c:324
 leak:8 reproduced fixed untriaged — —
DF-0077 Low 3.3 Uninitialized kernel stack bytes leaked via kern.ntp_pll.gettime sysctl (struct ntptimeval trailing padding)
sys/kern/kern_ntptime.c:205
 leak:4 reproduced fixed untriaged — —
DF-0093 Low 3.3 Kernel heap pointer leaked to userspace via shmctl(IPC_STAT) shm_internal field + struct padding
sys/kern/sysv_shm.c:420
 leak:8 reproduced fixed untriaged — —
DF-0101 Low 3.3 struct ktr_header written to trace file leaks kernel pointer (ktr_buf) and uninitialized padding
sys/kern/kern_ktrace.c:611
 leak:8 reproduced fixed untriaged — —
DF-0102 Low 3.3 Uninitialized payload fields (ktr_sysret.ktr_eosys, ktr_syscall padding) written to trace file
sys/kern/kern_ktrace.c:139
 leak:2 reproduced fixed untriaged — —
DF-0179 Low 3.3 Unconditional kernel address leak via kern.proc sysctl (KASLR bypass)
sys/kern/kern_kinfo.c:128
 none reproduced fixed untriaged — —
DF-0224 Low 3.3 ksched_getparam leaves sched_priority uninitialized for non-RT procs -> kernel stack info leak
sys/kern/kern_sched.c:142
 none reproduced fixed untriaged — —
DF-0256 Low 3.3 Kernel pointer info leak via kern.file sysctl (f_file, f_data) to unprivileged users
sys/kern/subr_kcore.c:67 · 📝
 leak reproduced fixed disputed — —
DF-0307 Low 3.3 Kernel heap/code pointer leak via SYSCTL_OPAQUE of mfctable and viftable to unprivileged users
sys/net/ip_mroute/ip_mroute.c:90
 leak reproduced fixed untriaged — —
DF-0435 Low 3.3 bpf_movein IEEE80211_RADIO path: ibp_len from user packet drives link-header copy without proper mbuf bounds check
sys/net/bpf.c:264
 none reproduced fixed untriaged — —
DF-0840 Low 3.3 hammer_ioc_get_data uses signed comparison on user-supplied size — negative size yields SIZE_MAX copyout (EFAULT on x86-64)
sys/vfs/hammer/hammer_ioctl.c:1080
 leak reproduced not_testable untriaged — —
DF-0866 Low 3.3 cd9660_readdir leaks kernel heap bytes via uninitialized struct dirent padding (d_unused1/d_unused2/d_name pad)
sys/vfs/isofs/cd9660/cd9660_vnops.c:447
 leak:7bytes reproduced fixed untriaged — —
DF-0882 Low 3.3 OOB read in partition-map walk n_pm unbounded by descriptor size
sys/vfs/udf/udf_vfsops.c:635
 none reproduced not_testable untriaged — —
DF-0954 Low 3.3 do_vmmeter_pcpu leaks kernel pointer v_lock_addr and token identifier to unprivileged users via vm.cpuN.vmmeter
sys/vm/vm_meter.c:428
 leak reproduced not_testable untriaged — —
DF-1032 Low 3.3 db_Grp7_11 OOB read when disassembling swapgs/rdtscp (6-entry array indexed by f_reg returning 7)
sys/cpu/x86_64/misc/db_disasm.c:204
 none reproduced fixed untriaged — —
DF-1062 Low 3.3 Uninitialized kernel stack leaks to userspace via short vendor control-IN responses from malicious CH341 device
sys/bus/u4b/serial/uchcom.c:417
 none reproduced fixed untriaged — —
DF-1087 Low 3.3 Kernel heap pointers leaked to userspace via full-CCB copyout in CAMIOCOMMAND/CAMGETPASSTHRU
sys/bus/cam/scsi/scsi_pass.c:546
 leak reproduced fixed untriaged — —
DF-1265 Low 3.3 Sideband reply parsers memcpy attacker-controlled num_bytes without bounds check (OOB read past msg_rx)
sys/dev/drm/drm_dp_mst_topology.c:441
 none reproduced fixed untriaged — —
DF-1522 Low 3.3 Off-by-one OOB read in ath_hal_EepromDataRead (off == ATH_DATA_EEPROM_SIZE allowed)
sys/dev/netif/ath/ath_hal/ah.c:1402
 leak:2 reproduced fixed untriaged — —
DF-1577 Low 3.3 Off-by-one in get_powerplay_table_entry_v1_0 allows OOB read of one state entry
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310
 panic reproduced fixed untriaged — —
DF-1594 Low 3.3 Uninitialized rv515_watermark.sclk read writes garbage to display priority MMIO
sys/dev/drm/radeon/rv515.c:946
 panic reproduced fixed untriaged — —
DF-1636 Low 3.3 Memory leak of priv struct on early error paths before dm_table_init_target
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 leak reproduced fixed untriaged — —
DF-1656 Low 3.3 radeon_uvd: missing radeon_bo_kunmap in error paths leaks kernel BO mapping
sys/dev/drm/radeon/radeon_uvd.c:489
 none reproduced fixed untriaged — —
DF-1762 Low 3.3 immio: off-by-one OOB heap read in OUTSTR path for odd blen
sys/dev/disk/vpo/immio.c:739
 leak:1 reproduced fixed untriaged — —
DF-1764 Low 3.3 amdgpu_dm_debugfs: memory leak on put_user failure in dp_link_settings_read / dp_phy_settings_read
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:89
 none inconclusive — untriaged — —
DF-1860 Low 3.3 apple_smc_mb_sysctl_fanid leaks kernel stack via unbounded strlen in sysctl_handle_string
sys/dev/apple/smc/smc_sysctl.c:51
 leak reproduced fixed untriaged — —
DF-1910 Low 3.3 i2s_pdata never freed: per-attach memory leak in all error paths of acp_hw_init
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:242
 leak reproduced fixed untriaged — —
DF-1936 Low 3.3 Unconditional kprintf on every VM retry fault: local kernel-log DoS
sys/dev/drm/amd/amdgpu/vega10_ih.c:288
 dos reproduced fixed untriaged — —
DF-2042 Low 3.3 Broken error path in i915_gem_prime_import leaks dma_buf_attachment
sys/dev/drm/i915/i915_gem_dmabuf.c:305
 leak reproduced fixed untriaged — —
DF-2080 Low 3.3 Uninitialized kernel heap memory disclosure via ATH_DIAG_DYN on non-output spectral control commands
sys/dev/netif/ath/ath/if_ath_spectral.c:218
 leak reproduced fixed untriaged — —
DF-2131 Low 3.3 Off-by-one OOB read of timings[] in ata_ite_8213_setmode at UDMA6
sys/dev/disk/nata/chipsets/ata-ite.c:158
 panic reproduced fixed untriaged — —
DF-2286 Low 3.3 Kernel pointer leak via targreturnccb copyout of ccb_hdr.cbfcnp and ccb_hdr.path
sys/bus/cam/scsi/scsi_target.c:967
 leak reproduced fixed untriaged — —
DF-2334 Low 3.3 UAC2.0 Mixer Unit verifier reads d1->bNrChannels one byte past the validated length
sys/bus/u4b/audio/uaudio.c:3976
 none reproduced not_testable untriaged — —
DF-2543 Low 3.3 Unprivileged kernel-pointer leak via hw.bus.devices sysctl (dv_handle/dv_parent)
sys/kern/subr_bus.c:3890
 leak:219 reproduced fixed untriaged — —
DF-2598 Low 3.3 NGM_SOURCE_GET_COUNTER reads msg->data without arglen validation heap OOB read
sys/netgraph7/ng_source.c:479
 none reproduced not_testable untriaged — —
DF-2600 Low 3.3 SETIFACE passes non-NUL-terminated msg->data to ifunit bounded heap OOB read
sys/netgraph7/ng_source.c:407
 none reproduced not_testable untriaged — —
DF-2608 Low 3.3 Uninitialized kernel stack memory leaked to userspace via USB FIFO in packet reassembly
sys/bus/u4b/input/uep.c:200
 none not_reproduced not_testable untriaged — —
DF-0092 Info 3.3 sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trailing padding
sys/kern/subr_rman.c:700
 none reproduced fixed untriaged — —
DF-1841 Info 3.3 Sense-data over-copy in amr_cam_complete leaks stale cross-command SCSI sense bytes
sys/dev/raid/amr/amr_cam.c:451
 none reproduced not_testable untriaged — —
DF-2008 Info 3.3 Debugfs amdgpu_sa_info leaks kernel GPU virtual address and fence metadata to unprivileged users
sys/dev/drm/amd/amdgpu/amdgpu_sa.c:380
 leak reproduced fixed untriaged — —
DF-2306 Info 3.3 Unconditional PCI vendor/device ID disclosure to console in probe routine
sys/bus/firewire/fwohci_pci.c:190
 leak reproduced not_testable untriaged — —
DF-0329 Low 3.1 icmp6_redirect_output leaks uninitialized mbuf heap bytes in padded redirected-header option
sys/netinet6/icmp6.c:2560
 leak reproduced fixed untriaged — —
DF-0544 Low 3.1 hardware_error and data_buffer_overflow: missing NG_HCI_M_PULLUP + length check on 1-byte body
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:826
 panic reproduced fixed untriaged — —
DF-2516 Low 3.1 Missing payload length validation in sbp_recv1 allows stale/uninitialized heap data to drive control flow and leak to userspace
sys/dev/disk/sbp/sbp.c:1572
 none not_reproduced not_testable untriaged — —
DF-0902 Info 3.1 setfs() leaves path buffer non-null-terminated after strncpy (latent OOB-read in strlen)
sys/vfs/nfs/nfs_mountrpc.c:347
 none reproduced fixed untriaged — —
DF-1873 Info 3.1 dcons DMA buffer allocated without M_ZERO: stale kernel memory leaked to FireWire peer
sys/dev/misc/dcons/dcons_os.c:462
 none reproduced fixed untriaged — —
DF-1994 Info 3.1 Missing payload-length validation in iwm_rx_time_event_notif firmware notification handler
sys/dev/netif/iwm/if_iwm_time_event.c:207
 panic reproduced fixed untriaged — —
DF-0274 Low 3.0 SIOCADDMULTI trusts user sa_len for heap alloc and bcopy without bounds check
sys/net/if.c:2327
 leak reproduced fixed untriaged — —
DF-0316 Low 3.0 OOB read: wg_output dereferences 4 bytes from mbuf without length check in BPF AF_UNSPEC path
sys/net/wg/if_wg.c:2289
 none reproduced fixed untriaged — —
DF-0971 Low 3.0 rc4_init reads key[0] before bounds check when keylen==0 (OOB read / NULL deref)
sys/crypto/rc4/rc4.c:72
 leak reproduced not_testable untriaged — —
DF-1027 Low 3.0 inittodr reads daysinmonth[12] OOB via unvalidated RTC month -> system clock corruption
sys/platform/pc64/isa/clock.c:1112
 none reproduced fixed untriaged — —
DF-1230 Low 3.0 mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128
sys/dev/raid/mpr/mpr.c:2458
 none reproduced fixed untriaged — —
DF-1256 Low 3.0 Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with missing release_firmware
sys/dev/drm/amd/amdgpu/amdgpu_device.c:757
 none reproduced fixed untriaged — —
DF-1432 Low 3.0 Heap OOB read in radeon_print_display_setup via BIOS-controlled encoder_id indexing encoder_names[38]
sys/dev/drm/radeon/radeon_display.c:714
 none reproduced fixed untriaged — —
DF-1922 Low 3.0 aac_print_fib iterates controller-supplied SgCount without bounding against FIB data size (debug-only)
sys/dev/raid/aac/aac_debug.c:240
 panic reproduced fixed untriaged — —
DF-2330 Low 3.0 amdsmb_bread uses unbounded hardware byte-count for register indexing and out-param
sys/bus/smbus/amdsmb/amdsmb.c:533
 none reproduced not_testable untriaged — —
DF-2542 Low 3.0 mfc entries kmalloc without M_ZERO only [0 numvifs) of mfc_ttls/mfc_flags initialized later add_vif exposes uninitialized heap bytes via forwarding decisions
sys/net/ip_mroute/ip_mroute.c:1055
 none not_reproduced not_testable untriaged — —
DF-0123 Info 3.0 kernenv_next unbounded walk of bootloader static env
sys/kern/kern_environment.c:510
 none reproduced not_testable untriaged — —
DF-1952 Info 3.0 Unbounded loop over displays[] in phm_store_dal_configuration_data (latent OOB read)
sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:294
 none reproduced not_testable untriaged — —
DF-0084 Low 2.9 Off-by-one OOB read in get_next_valid_apicid: array indexed before bound check in while condition
sys/kern/subr_cpu_topology.c:91
 none reproduced fixed untriaged — —
DF-0541 Low 2.9 Uninitialized cp.data[0] in Command Reject MTU_EXCEEDED sets link MTU to stack garbage
sys/netbt/l2cap_signal.c:91
 leak reproduced fixed untriaged — —
DF-1406 Low 2.9 OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data upper nibble>=8
sys/dev/disk/advansys/advlib.c:1073
 none reproduced fixed untriaged — —
DF-1552 Low 2.9 chip_ids[15] indexed by (rev>>4)&0xF is a 1-element OOB read at probe/attach when chip reports rev with high nibble 0xF
sys/dev/netif/sn/if_sn.c:140
 panic reproduced fixed untriaged — —
DF-0197 Info 2.9 sysctl_devstat copies full struct devstat including unset fields and padding
sys/kern/subr_devstat.c:289
 none reproduced not_testable untriaged — —
DF-0643 Low 2.7 check_forward heap OOB read via unvalidated cmd->arg3 destination count
sys/net/ipfw3_basic/ip_fw3_basic.c:213
 panic reproduced fixed untriaged — —
DF-0771 Medium 2.5 Missing data_len validation on inode load — crafted image heap OOB read via struct copy past buffer end
sys/vfs/hammer/hammer_inode.c:524
 leak:128 reproduced fixed untriaged — —
DF-0031 Low 2.5 pipe->open_count underflow on pipe_create partial failure leaks kernel KVA and pipe struct
sys/kern/sys_pipe.c:433
 none not_reproduced not_testable untriaged — —
DF-0111 Low 2.5 CT_CHAR (%c) non-suppress bcopy reads width bytes without checking inr -> OOB read
sys/kern/subr_scanf.c:307
 none reproduced fixed untriaged — —
DF-0167 Low 2.5 syscap_get INPARENT: no same-uid/same-prison authorization: info leak of capability config
sys/kern/kern_caps.c:95
 none reproduced fixed untriaged — —
DF-0433 Low 2.5 bpf_mtap_hdr submits partially-initialized stack mbuf: bpf_mtap reads uninitialized m_pkthdr.rcvif
sys/net/bpf.c:1347
 dos reproduced fixed untriaged — —
DF-0437 Low 2.5 Receive-path filter dereferences mbuf data without m_pullup: OOB read within mbuf cluster on short first mbuf
sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:474
 none reproduced fixed untriaged — —
DF-0967 Low 2.5 AES raw key material left unzeroized on kernel stack in rijndael_makeKey
sys/crypto/rijndael/rijndael-api-fst.c:36
 leak reproduced not_testable untriaged — —
DF-0995 Low 2.5 sardpos leaks uninitialized kernel stack via MTIOCRDSPOS/MTIOCRDHPOS when device returns short READ POSITION data
sys/bus/cam/scsi/scsi_sa.c:3247
 none reproduced fixed untriaged — —
DF-1160 Low 2.5 OOB read in HDMI IRQ handler: afmt_status indexed before bounds check
sys/dev/drm/radeon/evergreen.c:4803
 panic reproduced fixed untriaged — —
DF-1224 Low 2.5 Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header
sys/dev/raid/mpr/mpr_sas.c:2766
 none reproduced fixed untriaged — —
DF-1335 Low 2.5 Off-by-one OOB read of vddc_table[MAX_NO_VREG_STEPS=32] in rv770_populate_smc_vddc_table
sys/dev/drm/radeon/rv770_dpm.c:1124
 none reproduced fixed untriaged — —
DF-1436 Low 2.5 Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger
sys/dev/disk/sdhci/sdhci.c:1735
 none reproduced fixed untriaged — —
DF-1486 Low 2.5 Out-of-bounds stack read of fclks.data[-1] when SMU reports a single FCLK level
sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1368
 leak:8 reproduced fixed untriaged — —
DF-1518 Low 2.5 ar5416ChainTxDesc indexes ah_keytype[] unconditionally, causing OOB read when keyIx == HAL_TXKEYIX_INVALID
sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c:583
 panic reproduced fixed untriaged — —
DF-1588 Low 2.5 Off-by-one out-of-bounds read in vega10_get_powerplay_table_entry state-array index check
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1308
 panic reproduced fixed untriaged — —
DF-1620 Low 2.5 mrsas_startio leaks allocated mrsas_mpt_cmd on every build-failure path
sys/dev/raid/mrsas/mrsas_cam.c:481
 leak reproduced fixed untriaged — —
DF-1660 Low 2.5 ar5212_ani: HAL_DIAG_ANI_PARAMS allows setting maxLevel > array dim -> wild OOB read in ar5212AniControl
sys/dev/netif/ath/ath_hal/ar5212/ar5212_ani.c:181
 panic reproduced fixed untriaged — —
DF-1718 Low 2.5 ar5112: ar5112GetChannelMaxMinPower returns AH_TRUE on no-match without initializing *minPow -> stale stack leak via 802.11h PowerCapability
sys/dev/netif/ath/ath_hal/ar5212/ar5112.c:765
 leak:7 reproduced fixed untriaged — —
DF-1763 Low 2.5 immio: missing clen bound allows OOB read of csio struct in CDB-send loop
sys/dev/disk/vpo/immio.c:702
 leak:240 reproduced fixed untriaged — —
DF-1861 Low 2.5 dma_fence reference leak in amdgpu_pasid_free_delayed when fence-array allocation fails
sys/dev/drm/amd/amdgpu/amdgpu_ids.c:135
 leak reproduced fixed untriaged — —
DF-1914 Low 2.5 drm_agp_info_ioctl copies uninitialized trailing struct padding back to userspace
sys/dev/drm/drm_agpsupport.c:62
 leak reproduced fixed untriaged — —
DF-1984 Low 2.5 Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer (amdgpu)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:213
 none reproduced not_testable untriaged — —
DF-2021 Low 2.5 Signed table_id bounds check allows negative-index OOB on smu_tables.entry[]
sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c:41
 none reproduced not_testable untriaged — —
DF-2045 Low 2.5 extra_history_size pool leaks on failed history realloc; function falsely returns success
sys/dev/misc/syscons/schistory.c:122
 leak reproduced fixed untriaged — —
DF-2071 Low 2.5 kbdsw dispatch functions dereference kbdsw[kb_index] without bounds/NULL checks unlike kbd_intr
sys/dev/misc/kbd/kbdsw.c:80
 none reproduced fixed untriaged — —
DF-2295 Low 2.5 fw_read copies iso stream packet by attacker-controlled stream.len without bounding to psize (DMA buffer over-read)
sys/bus/firewire/fwdev.c:321
 leak reproduced fixed untriaged — —
DF-2296 Low 2.5 FW_ASYREQ send-path bcopy over-reads ioctl heap buffer when req.len exceeds data[] capacity
sys/bus/firewire/fwdev.c:529
 leak reproduced fixed untriaged — —
DF-2363 Low 2.5 Sensitive key material left on kernel stack across multiple paths
sys/crypto/chachapoly.c:52
 none not_reproduced not_testable untriaged — —
DF-2394 Low 2.5 Ignored acpi_PkgInt32 return values leak uninitialized kernel stack via sysctl read
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442
 leak reproduced not_testable untriaged — —
DF-2403 Low 2.5 Uninitialized kernel-stack info leak via fanid sysctl on MMIO/T2 backend
sys/dev/apple/smc/smc_sysctl.c:51
 leak reproduced not_testable untriaged — —
DF-2422 Low 2.5 Missing cdb_len validation in DISK I/O path allows OOB read on short CDB pointer
sys/dev/disk/ahci/ahci_cam.c:1089
 panic reproduced not_testable untriaged — —
DF-0007 Info 2.5 Uninitialized struct sigaction trailing padding leaked to userspace via oact copyout
sys/kern/kern_sig.c:260
 leak:4bytes reproduced fixed untriaged — —
DF-0963 Info 2.5 Unvalidated keyBits/Nr in production kernels causes infinite loop walking rk off the end of the key schedule (latent)
sys/crypto/rijndael/rijndael-alg-fst.c:734
 none reproduced fixed untriaged — —
DF-1148 Info 2.5 RX return-ring buffer index validated only by KKASSERT (compiled out without INVARIANTS)
sys/dev/netif/bnx/if_bnx.c:2812
 none reproduced not_testable untriaged — —
DF-1901 Info 2.5 Stubbed get_local_mem_info returns uninitialized output structure: latent info-leak if KFD wired up (CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354
 none reproduced not_testable untriaged — —
DF-1971 Info 2.5 Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer
sys/dev/drm/radeon/radeon_fb.c:224
 leak reproduced fixed untriaged — —
DF-2011 Info 2.5 hdspe_intr leaks sc->lock (lockmgr LK_EXCLUSIVE) on device_get_children error path
sys/dev/sound/pci/hdspe.c:96
 leak reproduced fixed untriaged — —
DF-2211 Info 2.5 Uninitialized res.clock field returned by value from amdgpu_afmt_acr()
sys/dev/drm/amd/amdgpu/amdgpu_afmt.c:90
 — not_reproduced not_testable untriaged — —
DF-2402 Info 2.5 Partial MMIO key read returns success without zeroing unfilled buffer tail enabling uninitialized-stack leak through sysctl
sys/dev/apple/smc/smc_mmio.c:75
 leak not_reproduced not_testable untriaged — —
DF-2291 Medium 2.4 crom_parse_text bounds check missing sizeof(u_int32_t) multiplier allows OOB heap read past ROM buffer
sys/bus/firewire/fwcrom.c:207
 leak reproduced fixed untriaged — —
DF-0972 Low 2.4 PROBE_SERIAL_NUM_1 heap OOB read via device-controlled length in VPD unit serial number response
sys/bus/cam/cam_xpt.c:6309
 leak reproduced not_testable untriaged — —
DF-0984 Low 2.4 OOB read of ridx2rate[] in urtwn_rx_frame for legacy rates >= 12
sys/bus/u4b/wlan/if_urtwn.c:1069
 none reproduced fixed untriaged — —
DF-1099 Low 2.4 Parent DMA tag sc->fc.dmat never destroyed in detach
sys/bus/firewire/fwohci_pci.c:300
 leak reproduced fixed untriaged — —
DF-1103 Low 2.4 Uninitialized kernel stack bytes leaked to userspace via short USB interrupt transfers in packet reassembly
sys/bus/u4b/input/uep.c:225
 leak reproduced fixed untriaged — —
DF-1281 Low 2.4 Unbounded EventDataLength loop in mpt_core_event reads past reply frame leaking kernel memory to console
sys/dev/disk/mpt/mpt.c:559
 none reproduced fixed untriaged — —
DF-1447 Low 2.4 OOB read of static wordsForPdgains[] when EEPROM xpd_mask has no set bits (numPdGains=0)
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:763
 none reproduced fixed untriaged — —
DF-1715 Low 2.4 adwlib: adw_find_period reads one element past adw_syncrates[] on unrecognized mc_sdtr, leaking 1 byte of adjacent rodata
sys/dev/disk/advansys/adwlib.c:825
 leak:4 reproduced fixed untriaged — —
DF-1776 Low 2.4 radeon_dp_mst: uninitialized kernel stack byte read in radeon_dp_mst_probe when AUX transfer fails
sys/dev/drm/radeon/radeon_dp_mst.c:676
 leak:1 reproduced fixed untriaged — —
DF-2092 Low 2.4 OOB stack read in Hauppauge EEPROM parser leaks kernel stack bytes to dmesg
sys/dev/video/cxm/cxm_eeprom.c:145
 leak reproduced fixed untriaged — —
DF-2337 Low 2.4 Uninitialized kernel-stack bytes leaked to userspace via uep FIFO during short-transfer packet reassembly
sys/bus/u4b/input/uep.c:225
 leak reproduced not_testable untriaged — —
DF-2529 Low 2.4 1-byte heap OOB read in OUT-data transfer path of imm_do_scsi
sys/dev/disk/vpo/immio.c:739
 leak reproduced fixed untriaged — —
DF-2588 Low 2.4 Signed/unsigned comparison in RX aggregation loop permits heap OOB read of RX descriptor
sys/bus/u4b/wlan/if_urtwn.c:984
 none not_reproduced not_testable untriaged — —
DF-1063 Info 2.4 USB_GET_GPIO returns 1 byte of uninitialized kernel stack on a short control-IN response
sys/bus/u4b/serial/uslcom.c:622
 none reproduced fixed untriaged — —
DF-1104 Info 2.4 One-byte out-of-bounds stack read in get_pkt_len when parsing DIAG header at end of buffer
sys/bus/u4b/input/uep.c:127
 none reproduced not_testable untriaged — —
DF-0451 Medium 2.3 OOB read in ng_fixedstring_unparse: known bufSize ignored, delegates to unbounded strlen
sys/netgraph/netgraph/ng_parse.c:785
 leak:7 reproduced fixed untriaged — —
DF-0670 Medium 2.3 Missing sopt_valsize validation -> heap OOB read of ioc_table fields, info leak via table LIST
sys/net/ipfw3_basic/ip_fw3_table.c:92
 none reproduced fixed untriaged — —
DF-1357 Medium 2.3 Kernel heap info leak via unchecked request-sense length in Linux-compat ioctl
sys/dev/raid/amr/amr.c:583
 leak:223 reproduced fixed untriaged — —
DF-0293 Low 2.3 OOB heap read in setwparsnie during WPA/RSN app-IE split
sys/netproto/802_11/wlan/ieee80211_ioctl.c:2319
 none reproduced fixed untriaged — —
DF-0297 Low 2.3 1-byte heap OOB read in ng_name_node name-length validation
sys/netgraph7/netgraph/ng_base.c:817
 none reproduced fixed untriaged — —
DF-0379 Low 2.3 NGM_BINARY2ASCII heap OOB read via ng_unparse: arglen not validated against mesgType/respType struct size
sys/netgraph/netgraph/ng_base.c:1505
 leak reproduced fixed untriaged — —
DF-0412 Low 2.3 Kernel heap OOB read in ng_string_unparse via unbounded strlen on binary data without NUL terminator
sys/netgraph7/netgraph/ng_parse.c:747
 leak reproduced fixed untriaged — —
DF-0438 Low 2.3 Kernel stack info-leak via uninitialized redstats[3] array in hfsc_getqstats copyout
sys/net/altq/altq_hfsc.c:293
 leak reproduced fixed untriaged — —
DF-0603 Low 2.3 Kernel pointer leak via DIOCIGETIFACES wholesale copyout of struct pfi_kif
sys/net/pf/pf_if.c:763
 leak:224bytes reproduced fixed untriaged — —
DF-0652 Low 2.3 cbq_getqstats leaks uninitialized kernel stack to userspace via class_stats_t
sys/net/altq/altq_cbq.c:473
 leak reproduced fixed untriaged — —
DF-0658 Low 2.3 Uninitialized kernel stack leaked via priq_getqstats copyout of struct priq_classstats
sys/net/altq/altq_priq.c:221
 leak reproduced fixed untriaged — —
DF-0665 Low 2.3 Kernel address disclosed to netgraph peer via ngdioctl datap->p = addr
sys/netgraph/ng_device.c:476
 leak reproduced fixed untriaged — —
DF-0756 Low 2.3 Missing m_len bound check in discoutput AF_UNSPEC (BPF write) path corrupts obytes counter
sys/net/disc/if_disc.c:117
 none reproduced not_testable untriaged — —
DF-1013 Low 2.3 SESIOC_GETOBJMAP leaks 2 bytes uninitialized kernel stack per object (struct padding)
sys/bus/cam/scsi/scsi_ses.c:503
 none reproduced fixed untriaged — —
DF-1030 Low 2.3 Unbounded strlen on possibly non-NUL-terminated user cv_volid in chsetvoltag
sys/bus/cam/scsi/scsi_ch.c:1300
 none reproduced fixed untriaged — —
DF-1067 Low 2.3 PCIOCGETCONF_OLD leaks uninitialized kernel stack padding to userspace
sys/bus/pci/pci_user.c:316
 none reproduced fixed untriaged — —
DF-1110 Low 2.3 Memory leak of usrbufs array on I2CRDWR copyin-failure path
sys/bus/iicbus/iic.c:352
 leak reproduced fixed untriaged — —
DF-1111 Low 2.3 Ignored copyin/copyout return values in I2CRDWR leak uninitialized kernel heap to I2C bus
sys/bus/iicbus/iic.c:360
 leak reproduced fixed untriaged — —
DF-1156 Low 2.3 ISP_FC_GETDINFO ioctl missing bounds check on ifc->chan -> OOB fcparam read
sys/dev/disk/isp/isp_freebsd.c:479
 panic reproduced fixed untriaged — —
DF-1504 Low 2.3 genkbd_get_fkeystr off-by-one bound (> instead of >=) permits one-element OOB read
sys/dev/misc/kbd/kbd.c:1119
 none reproduced fixed untriaged — —
DF-1532 Low 2.3 Kernel stack info leak via TW_CL_IOCTL_GET_COMPATIBILITY_INFO
sys/dev/raid/twa/tw_cl_io.c:656
 leak:0 reproduced fixed untriaged — —
DF-1541 Low 2.3 Out-of-bounds read in NGM_TEXT_CONFIG via strcmp/kprintf on non-NUL-terminated user string
sys/dev/netif/mn/if_mn.c:360
 leak:0 reproduced fixed untriaged — —
DF-1691 Low 2.3 viapm: viasmb_bread reports untrusted hardware length as bytes-written, leaking kernel stack
sys/dev/powermng/viapm/viapm.c:852
 leak:0 reproduced fixed untriaged — —
DF-1711 Low 2.3 intpm: intsmb_bread discards SMBus block-read bytes; leaks uninitialized kernel stack via /dev/smb* SMB_BREAD
sys/dev/powermng/intpm/intpm.c:836
 leak:32 reproduced fixed untriaged — —
DF-1844 Low 2.3 GPIOINFO ioctl leaks kernel cdev pointer to userspace (KASLR bypass for root)
sys/dev/misc/gpio/gpio.c:466
 leak reproduced fixed untriaged — —
DF-2032 Low 2.3 Kernel stack info leak via TWS_IOCTL_GET_COMPATIBILITY_INFO (uninitialized driver_version tail)
sys/dev/raid/tws/tws_user.c:267
 leak:19 reproduced not_testable untriaged — —
DF-2266 Low 2.3 CAMGETPASSTHRU leaks stale kernel pointers and prior I/O data via whole-CCB bcopy
sys/bus/cam/cam_periph.c:888
 leak reproduced fixed untriaged — —
DF-2277 Low 2.3 Kernel pointer leak to userspace via unconditional bcopy of full union ccb on CAMIOCOMMAND completion
sys/bus/cam/scsi/scsi_pass.c:610
 leak reproduced fixed untriaged — —
DF-2280 Low 2.3 SESIOC_GETOBJMAP leaks 2 bytes of uninitialized kernel stack per object via ses_object struct padding
sys/bus/cam/scsi/scsi_ses.c:559
 leak reproduced fixed untriaged — —
DF-2546 Low 2.3 Missing arglen validation in NGM_SOURCE_GET_COUNTER allows uninitialized heap read
sys/netgraph7/ng_source.c:481
 none reproduced not_testable untriaged — —
DF-0447 Info 2.3 AF_ARP output case is dead code carrying latent uninitialized-read/OOB-read: mtod returns ether_header not arphdr after M_PREPEND
sys/net/if_ethersubr.c:237
 none reproduced not_testable untriaged — —
DF-1219 Info 2.3 ACPIIO_DO_MCALL leaks kernel heap pointers via PACKAGE results (incomplete pointer fixup)
sys/dev/acpica/acpi.c:3364
 none reproduced not_testable untriaged — —
DF-1742 Info 2.3 vinumioctl: VINUM_*CONFIG bcopy entire struct including kernel pointers vp/dev to userland
sys/dev/raid/vinum/vinumioctl.c:127
 leak reproduced fixed untriaged — —
DF-1786 Info 2.3 fb: FBIO_ADPINFO leaks kernel framebuffer addresses to userspace
sys/dev/video/fb/fb.c:682
 leak reproduced fixed untriaged — —
DF-2123 Info 2.3 vinum_meminfo discloses the kernel address of the malloced[] debug table to userspace
sys/dev/raid/vinum/vinummemory.c:184
 leak reproduced fixed untriaged — —
DF-1567 Low 2.1 Unvalidated lane_count causes OOB read of link_status[] in DP link-training helpers
sys/dev/drm/drm_dp_helper.c:46
 panic reproduced fixed untriaged — —
DF-2342 Low 2.1 Uninitialized kernel stack read via short/malformed CH341 control responses
sys/bus/u4b/serial/uchcom.c:417
 leak reproduced not_testable untriaged — —
DF-1098 Low 2.0 Missing resource cleanup when bus_dma_tag_create fails in fwohci_pci_attach
sys/bus/firewire/fwohci_pci.c:320
 leak reproduced fixed untriaged — —
DF-0150 Low 1.9 Unbounded strlen/strcmp on TLV string fields ignores declared length
sys/kern/subr_module.c:69
 none reproduced fixed untriaged — —
DF-0182 Low 1.9 Uninitialized kernel stack memory disclosed via vm.resident sysctl
sys/kern/imgact_resident.c:82
 none reproduced fixed untriaged — —
DF-0277 Low 1.9 Kernel pointer leak via DIOCGETRULE: bcopy of pf_rule exposes kif/anchor/rpool.cur/skip[].ptr
sys/net/pf/pf_ioctl.c:1336
 leak reproduced fixed untriaged — —
DF-0278 Low 1.9 Kernel pointer leak via DIOCGETADDR: bcopy of pf_pooladdr exposes pfi_kif*
sys/net/pf/pf_ioctl.c:2220
 leak reproduced fixed untriaged — —
DF-0279 Low 1.9 Kernel pointer leak via DIOCGETALTQ: bcopy of pf_altq exposes altq_disc
sys/net/pf/pf_ioctl.c:2088
 leak reproduced fixed untriaged — —
DF-0400 Low 1.9 rt_fixchange indexes mask bytes by key length without verifying mask size: latent OOB read
sys/net/route.c:1130
 none reproduced fixed untriaged — —
DF-0425 Low 1.9 MRT6 setsockopt handlers cast mtod() without verifying m_len against struct size: reads uninitialized mbuf data
sys/netinet6/ip6_mroute.c:277
 leak reproduced fixed untriaged — —
DF-0515 Low 1.9 add_entry6 null-terminates fw_in_if.name but not fw_out_if.name: kfnmatch bounded over-read
sys/net/ip6fw/ip6_fw.c:851
 leak reproduced fixed untriaged — —
DF-0574 Low 1.9 Uninitialized kernel stack read as alias IPs via count mismatch in copyin
sys/net/ipfw3_nat/ip_fw3_nat.c:756
 panic reproduced fixed untriaged — —
DF-0655 Low 1.9 Expanded AES key schedule (containing raw 128-bit key) not zeroed before ccmp_ctx freed
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:119
 leak reproduced fixed untriaged — —
DF-0966 Low 1.9 Raw key words me_key[4]/mo_key[4] left unzeroed on kernel stack after twofish_set_key returns
sys/crypto/twofish/twofish.c:427
 leak reproduced not_testable untriaged — —
DF-1052 Low 1.9 SG_IO sense-data copyout reads past csio->sense_data when sense_resid exceeds mx_sb_len
sys/bus/cam/scsi/scsi_sg.c:570
 none reproduced fixed untriaged — —
DF-1247 Low 1.9 Out-of-bounds read in bwn_phy_g_dc_lookup_init via hardcoded loop bound (64 vs 63 valid pairs)
sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:2599
 none reproduced fixed untriaged — —
DF-1291 Low 1.9 Sense copyout over-reads 64-byte command packet in mly_user_command
sys/dev/raid/mly/mly.c:2922
 none reproduced fixed untriaged — —
DF-1349 Low 1.9 EE_SPEED EEPROM byte used unbounded as index into eeprom_period[8]
sys/dev/disk/amd/amd.c:2342
 none reproduced not_testable untriaged — —
DF-1512 Low 1.9 vga_switcheroo_lock_ddc leaks mux_hw_lk on the no-handler / no-switch_ddc error path
sys/dev/video/vga/vga_switcheroo.c:557
 leak reproduced fixed untriaged — —
DF-1564 Low 1.9 Kernel stack info leak via uninitialized bytesReturned copyout
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1260
 leak reproduced fixed untriaged — —
DF-1565 Low 1.9 Kernel heap info leak via unbounded copyout of oversized outbuffer
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1289
 leak reproduced fixed untriaged — —
DF-1579 Low 1.9 Kernel stack info leak via uninitialized bytesReturned copyout
sys/dev/raid/hptrr/hptrr_osm_bsd.c:1236
 leak reproduced fixed untriaged — —
DF-1580 Low 1.9 Kernel heap info leak via oversized copyout of unzeroed outbuffer
sys/dev/raid/hptrr/hptrr_osm_bsd.c:1266
 leak reproduced fixed untriaged — —
DF-1629 Low 1.9 OpRegion KVA mappings leak on every suspend/resume: pmap_mapbios mappings invisible to DRM iounmap()
sys/dev/drm/i915/intel_opregion.c:987
 leak reproduced fixed untriaged — —
DF-1673 Low 1.9 cik_sdma: firmware header offset/size fields not bounds-checked in cik_sdma_load_microcode
sys/dev/drm/radeon/cik_sdma.c:471
 panic reproduced fixed untriaged — —
DF-1674 Low 1.9 amdgpu_dpm: VBIOS power-table parsing reads heap OOB via unchecked offsets and indices
sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:282
 panic reproduced fixed untriaged — —
DF-1817 Low 1.9 ppatomfwctrl: voltage LUT iteration bounds destination not source -> OOB read of VBIOS heap when gpio_entry_num exceeds actual LUT extent
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:110
 none reproduced not_testable untriaged — —
DF-1835 Low 1.9 alpm_bread leaks uninitialized kernel stack via unchecked SMBus block-read length (variant of DF-1833)
sys/dev/powermng/alpm/alpm.c:606
 none reproduced not_testable untriaged — —
DF-1887 Low 1.9 revive_block leaks rangelock when read returns B_ERROR: permanent I/O hang on affected stripe
sys/dev/raid/vinum/vinumrevive.c:137
 leak reproduced fixed untriaged — —
DF-2106 Low 1.9 Unbounded sg_count drives OOB read in mfi_print_sgl / mfi_validate_sg debug helpers (MFI_DEBUG builds only)
sys/dev/raid/mfi/mfi_debug.c:66
 none reproduced fixed untriaged — —
DF-2111 Low 1.9 Uninitialized kernel-stack bytes leaked to the console splash screen when bpsl < width (or compressed stream is short)
sys/dev/video/fb/pcx/splash_pcx.c:176
 none reproduced fixed untriaged — —
DF-2310 Low 1.9 I2CRDWR: unchecked copyin return value sends uninitialized kernel heap to I2C device
sys/bus/iicbus/iic.c:360
 leak reproduced fixed untriaged — —
DF-2373 Low 1.9 Kernel heap address leak via incomplete pointer fix-up in ACPIIO_DO_MCALL Package results
sys/dev/acpica/acpi.c:3380
 leak reproduced not_testable untriaged — —
DF-2395 Low 1.9 Heap OOB read via zero-element ACPI SIF package - no count check before o[0]
sys/dev/acpica/aibs/atk0110.c:169
 corruption inconclusive not_testable untriaged — —
DF-2531 Low 1.9 Unclamped cdb_len over-reads 16-byte inline cdb_bytes and leaks kernel memory out parallel port
sys/dev/disk/vpo/vpo.c:220
 leak reproduced not_testable untriaged — —
DF-2593 Low 1.9 Missing sopt_valsize validation causes OOB heap read in every set-mutation handler
sys/net/ipfw3/ip_fw3_set.c:105
 none reproduced not_testable untriaged — —
DF-2603 Low 1.9 Missing minimum-length check + u_short packetlen underflow in LMI packet parser kernel heap OOB read
sys/netgraph7/lmi/ng_lmi.c:88
 none reproduced not_testable untriaged — —
DF-0066 Info 1.9 Undefined behavior: shift by sysctl-controlled token_window_shift in backoff spin
sys/kern/lwkt_token.c:398
 none reproduced fixed untriaged — —
DF-0164 Info 1.9 sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
sys/kern/kern_module.c:348
 none reproduced fixed untriaged — —
DF-0180 Info 1.9 Fragile zeroing contract for fill_kinfo_lwp aggregation (+=)
sys/kern/kern_kinfo.c:219
 none reproduced fixed untriaged — —
DF-0405 Info 1.9 Missing null-termination of bdg_basename when namelen==IFNAMSIZ: OOB read in debug format strings
sys/net/netmap/netmap_vale.c:331
 none reproduced fixed untriaged — —
DF-0500 Info 1.9 Response handlers trust count/size fields without checking pcb->msg arglen: defense-in-depth gap
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917
 none reproduced not_testable untriaged — —
DF-0854 Info 1.9 User-controlled iconv charset names copied without null-termination — bounded kernel-stack OOB read via kprintf/strcasecmp
sys/vfs/msdosfs/msdosfs_vfsops.c:116
 none reproduced fixed untriaged — —
DF-1033 Info 1.9 REX.R prefix causes OOB read across all Group/FPU escape tables (f_reg returns 8..15 into 8-entry arrays)
sys/cpu/x86_64/misc/db_disasm.c:908
 none reproduced not_testable untriaged — —
DF-1037 Info 1.9 Negative hw.ioapic.msi_start loader tunable causes OOB array index in MSI allocation
sys/platform/pc64/apic/ioapic_abi.c:753
 none reproduced not_testable untriaged — —
DF-1460 Info 1.9 init_device discards product-ID mismatch error and reads uninitialized cap on smbus failure
sys/dev/smbus/cyapa/cyapa.c:360
 none reproduced not_testable untriaged — —
DF-2094 Info 1.9 Resource leak in ata_ali_sata_allocate error path: io released with wrong device and rid
sys/dev/disk/nata/chipsets/ata-acerlabs.c:152
 none reproduced fixed untriaged — —
DF-2193 Info 1.9 Off-by-one OOB read in fire fade loop at bottom-right corner (buf[64320])
sys/dev/misc/syscons/fire/fire_saver.c:56
 panic reproduced fixed untriaged — —
DF-2405 Info 1.9 Harvested RDRAND output left unzeroed on the kernel stack
sys/dev/crypto/rdrand/rdrand.c:163
 leak reproduced not_testable untriaged — —
DF-2445 Info 1.9 strncpy of uuid without guaranteed NUL termination
sys/dev/disk/dm/dm_dev.c:365
 leak reproduced not_testable untriaged — —
DF-0324 Info 1.7 HT cap/info IE parsers perform no own length validation (caller-trust fragile)
sys/netproto/802_11/wlan/ieee80211_ht.c:1418
 none reproduced not_testable untriaged — —
DF-1793 Info 1.6 puc: IRQ resource leak when BUS_SETUP_INTR fails during attach
sys/dev/misc/puc/puc.c:229
 leak reproduced fixed untriaged — —
DF-1600 Low 1.1 Out-of-bounds read on carrier_detect_main[max1] when no positive carrier detected (max1 stays -1)
sys/dev/video/bktr/msp34xx.c:744
 panic reproduced fixed untriaged — —
DF-0602 Info 1.1 NGM_SOURCE_GET_COUNTER dereferences msg->data without arglen check (latent: file is orphaned and non-compiling)
sys/netgraph7/ng_source.c:479
 none not_reproduced not_testable untriaged — —
DF-2023 Info 1.1 evdev_hid2key indexes static scancode table with unbounded signed int no bounds check
sys/dev/misc/evdev/evdev_utils.c:217
 panic reproduced fixed untriaged — —
DF-2178 Info 1.1 Dead obj==NULL checks give false impression of bounds safety across all package helpers
sys/dev/acpica/acpi_package.c:48
 none reproduced fixed untriaged — —
DF-0073 Info 0.8 Pointless cfi++ causes 1-element OOB read in DEBUG builds (elf_getfiles)
sys/kern/kern_checkpoint.c:667
 none reproduced not_testable untriaged — —
DF-0444 Info 0.8 rmc_newclass does not reject negative priority: only checks upper bound, latent negative array index
sys/net/altq/altq_rmclass.c:201
 none reproduced fixed untriaged — —
DF-1683 Info 0.8 hptmv: default ioctl dispatch reads struct fields from lpInBuffer before validating nInBufferSize (heap OOB read)
sys/dev/raid/hptmv/ioctl.c:337
 panic reproduced fixed untriaged — —
DF-2273 Info 0.8 Unbounded strlen() on user-supplied cv_volid in chsetvoltag can read past the 33-byte field
sys/bus/cam/scsi/scsi_ch.c:1300
 none reproduced not_testable untriaged — —
DF-0982 Info 0.6 uaudio20_mixer_verify_desc FEATURE case under-validates bLength, allowing 1-3 byte OOB read in uaudio20_mixer_add_feature (defense-in-depth)
sys/bus/u4b/audio/uaudio.c:4000
 none reproduced not_testable untriaged — —
DF-0098 Info 0.5 sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defense-in-depth, dead code)
sys/kern/subr_sglist.c:402
 none reproduced fixed untriaged — —
DF-0667 Info 0.5 ieee80211_compute_duration reads rt->info[rix] without bounding rix against IEEE80211_RATE_TABLE_SIZE (latent OOB read)
sys/netproto/802_11/wlan/ieee80211_phy.c:506
 none reproduced not_testable untriaged — —
DF-1102 Info 0.5 msi_setup/msi_map perform no bounds validation on intr/cpuid before indexing fixed-size arrays and programming the IDT
sys/platform/pc64/x86_64/msi.c:430
 none reproduced not_testable untriaged — —
DF-1107 Info 0.5 Incomplete index validation in camq_remove; none in camq_change_priority
sys/bus/cam/cam_queue.c:174
 none reproduced fixed untriaged — —
DF-1445 Info 0.5 ttm_mem_type_from_place omits upper-bound check vs TTM_NUM_MEM_TYPES before indexing bdev->man[8]
sys/dev/drm/ttm/ttm_bo.c:62
 none reproduced not_testable untriaged — —
DF-1622 Info 0.5 Unbounded loop in cxm_saa7115_configure reads past saa7115_scalings[]/saa7115_audio_clock[] (missing i< before NUM_ELEMENTS)
sys/dev/video/cxm/cxm_saa7115.c:825
 none reproduced fixed untriaged — —
DF-2033 Info 0.5 Wrong sizeof in smb_attach bzero() zeroes only first pointer-sized bytes of softc
sys/dev/smbus/smb/smb.c:129
 leak reproduced fixed untriaged — —
DF-2089 Info 0.5 Missing lower-bound check on signed gpio_ddc_line index in acquire_i2c_hw_engine allows negative-index array read
sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c:122
 dos reproduced fixed untriaged — —
DF-2102 Info 0.5 Resource leak in wbsio_attach on child-add / set-resource / probe-and-attach failure paths
sys/dev/powermng/wbsio/wbsio.c:256
 none reproduced fixed untriaged — —
DF-2604 Info 0.5 Dead empty-body bounds check on DLCI in nglmi_rcvdata case 6 protected only by nglmi_checkdata
sys/netgraph7/lmi/ng_lmi.c:689
 — reproduced not_testable untriaged — —
DF-0265 High — Missing distance bounds validation in inflate: heap OOB read when windowBits<15
sys/net/zlib.c:4824
 heap OOB read (info-leak/panic); LATENT in-kernel (netgraph7_deflate not in X86_64_GENERIC); demonstrated deterministically via userspace harness linking the verbatim audited sys/net/zlib.c reproduced fixed untriaged — —
DF-2548 Medium — sysctl kern.ttys leaks raw kernel pointers (function + heap) to unprivileged users
sys/kern/tty.c:2911
 leak:102ptrs reproduced fixed untriaged — —

Base system — kernel core (kern) 302

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5831 High 7.5 nlookup() retry path NULL-dereferences nd->nl_basench for nlookup_init_raw()/_root()-initialized nd — every NFS-server name lookup that hits a retry (concurrent rename, ESTALE, destroyed parent) panics the kernel in nfsd
sys/kern/vfs_nlookup.c:1380
 panic reproduced fixed untriaged — —
DF-5837 Low 6.3 cluster_wbuild installs the pbuf KVA window before validating it, with the first component exempt from the page guard and the window outside the bkvareset() protocol
sys/kern/vfs_cluster.c:1606
 none untested not_testable untriaged — —
DF-5839 Medium 5.7 lwkt_alloc_thread() gd_freetd rebirth wipes live td_refs: foreign-cpu lwkt_hold() in the lwkt_exit() publication window turns a stale lwkt_rele() into refcount write-after-reuse and permanent exit livelock
sys/kern/lwkt_thread.c:365
 panic reproduced fixed untriaged — —
DF-5787 Low 5.7 Stale b_bio1.bio_flags survive buffer-cache recycling: vfs_bio.c performs no BIO_DONE/BIO_WANT hygiene when a buffer header is released and reacquired, so one forgetful/abandoning completion path permanently poisons the header — next bread() panics at vn_strategy's KKASSERT, or (without that guard) biowait() returns before device DMA completes
sys/kern/vfs_bio.c:747
 panic reproduced fixed untriaged — —
DF-5806 Medium 5.5 soreceive() zero-progress restart with MSG_PEEK: recv() on a zero-byte AF_UNIX record spins forever in kernel mode — unprivileged, unkillable, permanent whole-system DoS
sys/kern/uipc_socket.c:1596
 dos reproduced fixed untriaged — —
DF-5830 Medium 5.5 sys_sendmsg() leaks the MT_CONTROL mbuf when kern_sendmsg() early-returns at holdsock() failure — unprivileged, unbounded, permanent kernel mbuf-pool exhaustion (reboot-only local DoS)
sys/kern/uipc_syscalls.c:799
 dos reproduced fixed untriaged — —
DF-5838 Low 4.7 cluster_collectbufs collects buffers matched against last_bp->b_bcount instead of blksize, breaking the documented size contract feeding VOP_REALLOCBLKS
sys/kern/vfs_cluster.c:1737
 none untested not_testable untriaged — —
DF-5828 Info 4.3 Received-message CRCs (hdr_crc, aux_crc) are never validated
sys/kern/kern_dmsg.c:339
 undetected message tampering by on-path attacker untested not_testable untriaged — —
DF-5789 Medium 4.1 devclass_delete_driver() is non-transactional: the first detach veto irreversibly kills every already-detached unit of the driver while the module unload wedges (in-file root of the DF-5544/5562/5635 detach-veto family)
sys/kern/subr_bus.c:888
 dos reproduced fixed untriaged — —
DF-5795 Low 3.9 m_move_pkthdr() never clears M_PKTHDR on the source mbuf — live stale packet-header (stale len/rcvif/csum/pf) glued mid-chain on every M_MOVE_PKTHDR, contradicting its documented contract
sys/kern/uipc_mbuf.c:2551
 none reproduced not_testable untriaged — —
DF-5793 Low 3.3 kern_dup() dup2/dup3 onto an in-flight reserved descriptor: unbounded uninterruptible retry loop + unrate-limited kprintf console/msgbuf flood
sys/kern/kern_descrip.c:1143
 dos reproduced fixed untriaged — —
DF-5794 Low 3.3 ttyflush(FREAD|FWRITE) queues the IXOFF resume character via ttyunblock() and then discards it with the trailing output flush — the peer that honoured XOFF is permanently stopped while the kernel believes it is unblocked
sys/kern/tty.c:1453
 dos reproduced fixed untriaged — —
DF-5842 Low 3.3 select/pselect/ppoll pass unvalidated (negative/unnormalized) timeouts into kern_kevent — POSIX EINVAL missing, ~146-year sleeps collapse to immediate or arbitrary-short returns
sys/kern/sys_generic.c:807
 dos reproduced not_testable untriaged — —
DF-5827 Low 3.1 freerd_state allocation prologue runs unlocked and is reachable from two threads concurrently — orphaned kdmsg_state leak
sys/kern/kern_dmsg.c:788
 slow kernel-memory leak per lost race untested not_testable untriaged — —
DF-5832 Medium 2.5 NCF_WXOK cached-traversal flag resurrection race: chmod revocation of directory search permission can be undone by a concurrent in-flight naccess() and the stale grant is then honored indefinitely
sys/kern/vfs_nlookup.c:1616
 none not_reproduced not_testable untriaged — —
DF-5790 Low 2.5 device_delete_child() on a probed-but-unattached (DS_ALIVE) device leaks the driver softc: device_detach()'s state short-circuit skips device_set_driver(dev, NULL) and kobj_delete frees only the device object
sys/kern/subr_bus.c:1306
 leak reproduced fixed untriaged — —
DF-5834 Info 2.3 pps_fetch_timeout(): normalized finite sub-tick timeout inverts into an unbounded sleep (tstohz_low()==0 -> tsleep with no timeout armed)
sys/kern/kern_clock.c:1616
 none reproduced not_testable untriaged — —
DF-5840 Info 2.3 lwkt_rele() never wakes the td_refs drain pollers (tdreap/lwpwait2) — teardown latency and needless scheduler churn only
sys/kern/lwkt_thread.c:502
 none untested not_testable untriaged — —
DF-5824 Low 1.9 inferior() strands one PHOLD on proc0 per returning-0 call — unprivileged setpgid grows proc0's p_lock without bound, overflowing the PLOCK flag word (demonstrated: PLOCK_WAITRES bit set live)
sys/kern/kern_proc.c:477
 none reproduced not_testable untriaged — —
DF-5805 Info 1.1 kern_sigtimedwait() violates the lwp_delsig()/lwp_sigmask locking contract (unlocked mask writes; lwp_delsig fromproc=1 without p->p_token)
sys/kern/kern_sig.c:1764
 signal-delivery semantics races (POSIX correctness) untested not_testable untriaged — —
DF-5804 Low 0.8 gsignal() leaks the pgfind() reference — permanent pgrp/session leak if ever called
sys/kern/kern_sig.c:898
 latent pgrp leak (no in-tree callers) untested not_testable untriaged — —
DF-2878 Low 7.9 l32_setdisklabel installs partition tables with no slice-bounds validation — DIOCSDINFO32/DIOCWDINFO32 partition devices read/write OUTSIDE the slice (label64 twin validates the same fields)
sys/kern/subr_disklabel32.c:306 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2747 High 7.8 Journal memfifo reservation protocol is not MP-safe: concurrent VOPs on a journaled mount overlap reservations and corrupt the raw record chain (unprivileged reproducible panic; release-kernel OOB-read/livelock)
sys/kern/vfs_journal.c:527 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2851 High 7.8 netmsg_so_notify abort path derives lock, list and reply identity from nm_so, which soaccept_predicate mutates mid-flight on a foreign CPU: unserialized abort → wrong-list TAILQ_REMOVE, illegal pool-token release, double reply
sys/kern/uipc_msg.c:744 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2779 High 7.0 mq_send1 re-reads mq_sig_notify.sigev_signo after releasing mq_mtx: concurrent mq_notify re-registration (SIGEV_NONE bypasses signo validation) smuggles an attacker-chosen int into ksignal — panic on INVARIANTS, OOB atomic sigset write on production kernels
sys/kern/sys_mqueue.c:877 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2710 Medium 6.5 Peer-freezable iocom reader: writer parked in fp_write with KDMSG_STATE_INTERLOCK set turns the 'dmrace' 1s-sleep loop into an indefinite cluster-link stall
sys/kern/kern_dmsg.c:1636 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3515 Medium 6.5 kern_timeout _callout_cancel_or_stop returns 0 for inline-completed stops (violating the documented contract) -> netgraph7 ng_uncallout misreports every successful cancellation; ng_callout/ng_uncallout also leak callout items + node references (HCI command-complete machine permanently wedged)
sys/kern/kern_timeout.c:888 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2789 Low 6.3 Dead terminator guard in blst_meta_free/blst_meta_fill checks parent's bm_bighint instead of child's scan[i] — out-of-range free/fill walks uninitialized terminator slots and can index past bl_rootblks
sys/kern/subr_blist.c:660 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-2798 Low 6.3 Out-of-domain free discipline: production kernels silently accept a full-child free beyond bl_blocks (unbounded full-cover branch) and poison parent meta bits to ALL-FREE; the likewise-unbounded direct-allocation path then returns block numbers >= bl_blocks (wild PHYS_TO_VM_PAGE precursor); bl_root allocated without M_ZERO
sys/kern/subr_alist.c:286 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5848 Low 5.9 kernel nfsd panics under pipelined TCP load - m_dup_data MT_DATA assert via nfs_realign nfsrv_rcv
sys/kern/uipc_mbuf.c:1806 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2709 Low 5.7 hammer2_volconf_update() uses iocom->conn_state unlocked across a peer-driven drop (TOCTOU): kdmsg_lnk_conn_reply mutates conn_state without msglk
sys/kern/kern_dmsg.c:231 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5766 High 5.6 BSP's Fortuna state permanently stops reseeding: first-boot ratecheck() stores garbage getmicrouptime() (~1.8e11 s) into last_reseed; all later deltas negative → csprng_reseed() never runs again on that CPU for the whole uptime despite eligible pools
sys/kern/subr_csprng.c:134 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2714 Medium 5.5 sendfile(2) marshals hdtr headers into an unbounded M_WAITOK mbuf chain before any socket validation — attacker-chosen kernel memory exhaustion and uninterruptible full mbuf-pool wedge (unkillable, reboot required)
sys/kern/uipc_syscalls.c:1617 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2753 Medium 5.5 fork1() publishes the embryonic SIDL child to the pid hash/allproc list before p_pgrp/p_ucred initialization; pfind()/allproc_scan() don't filter SIDL — unprivileged NULL-pointer-deref kernel panic via kill(-1), sched_*(pid), getsid(pid), ptrace/sysctl
sys/kern/kern_fork.c:491 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2781 Medium 5.5 No system-wide or per-user POSIX mqueue accounting: queues and their queued messages persist after the last close with no enumeration — unprivileged, unbounded, permanent-until-reboot kernel heap exhaustion
sys/kern/sys_mqueue.c:391 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2785 Medium 5.5 Reachable panic("semop - can't undo undos") in sys_semop SEM_UNDO rollback via same-process thread race — unprivileged local kernel DoS
sys/kern/sysv_sem.c:998 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2813 Medium 5.5 objcache_get() M_WAITOK lost wakeup: objects stranded in remote CPUs' partially-filled magazines cause a permanent, unkillable sleep
sys/kern/kern_objcache.c:547 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2839 Medium 5.5 /dev/lpmap fault races lwp teardown: orphaned lpmap allocation leaks 4KB M_UPMAP kernel heap per hit (unprivileged kmem exhaustion)
sys/kern/kern_memio.c:801 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2870 Medium 5.5 taskqueue_free() terminate lost-wakeup: worker parks without re-checking TQ_FLAGS_ACTIVE → permanent deadlock with in-flight task
sys/kern/subr_taskqueue.c:141 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2926 Medium 5.5 Unbounded user plist × unconditional per-call leak in sys_vquotactl → kmalloc-type-limit panic: guaranteed unprivileged kernel panic (DF-0146 escalation)
sys/kern/vfs_quota.c:345 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5846 Medium 5.5 Unguarded NULL nc_parent dereference in nlookup dotdot walk on topology-disconnected cwd - unprivileged reliable local DoS
sys/kern/vfs_nlookup.c:756 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2827 Low 5.5 ckpt_thaw_proc(): e_phnum == 0 makes kmalloc(0) return ZERO_LENGTH_PTR; phdr->p_filesz reads kernel VA 0x18 (unconditional fatal kernel page fault)
sys/kern/kern_checkpoint.c:232 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2677 Medium 5.3 SysV shmat() vs IPC_RMID TOCTOU: attach counted after blocking ops, RMID terminates a still-referenced VM object (vm_object_terminate2 panic)
sys/kern/sysv_shm.c:1025 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-2903 Medium 5.3 Ontrack (DOSPTYP_ONTRACK 0x54) re-read path releases a getpbuf_mem() pbuf via brelse() — guaranteed kernel panic from one crafted MBR sector (INVARIANTS) / cross-subsystem pbuf corruption + leak and latent infinite re-read wedge holding ds_token (production)
sys/kern/subr_diskmbr.c:174 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2924 Medium 5.3 cmd_get_usage_all walks accounting RB trees without ac_spin → RB_NEXT traversal cycle (unkillable kernel spin) and torn 64-bit reads
sys/kern/vfs_quota.c:183 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2906 Low 5.3 Unchecked mbuf allocations in mb_init/mb_reserve/mb_put_mem/md_init — NULL-pointer kernel panic under allocation failure
sys/kern/libmchain/subr_mchain.c:75 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-2917 Medium 5.1 sleepq_wait/sleepq_wait_sig/sleepq_timedwait/sleepq_timedwait_sig NEVER sleep: _sleepq_wait_begin() drops the PDOMAIN_FBSD domain from the tsleep() flags, so tsleep's interlock validation always mismatches and returns immediately
sys/kern/subr_sleepqueue.c:275 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2776 Low 5.1 unregister_int dereferences the caller-supplied (possibly stale/freed) cookie before and after validation → freed-heap read and arbitrary-pointer %s print
sys/kern/kern_intr.c:425 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2975 Low 5.1 Accept-filter registry has no refcount: kldunload under unloadable=1 deregisters a filter still attached to live listeners — next connection dispatches a NULL (or freed-module-text) accf_callback, guaranteed fatal trap; reload also strands stale accf_create/accf_destroy
sys/kern/uipc_accf.c:59 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2683 Medium 4.7 fsetown() publishes an uninitialized sigio into the owner list — exit1()/pgdelete() teardown consumes the half-born entry: NULL-page fault or wrong-list SLIST_REMOVE walk-off (plus funsetownlst livelock variant)
sys/kern/kern_descrip.c:1351 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2712 Medium 4.7 bsd4_kick_helper issues IPIs/wakeups while holding the global bsd4_spin: FIFO-full liveloop enables same-cpu schedclock recursion into the spinlock (whole-system wedge), unprivileged-triggerable when usched_bsd4 is active
sys/kern/usched_bsd4.c:1590 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2721 Medium 4.7 Lost-wakeup race in slab remote-free z_RSignal interlock permanently strands whole zones — unbounded kernel KVA + wired-page leak (local DoS)
sys/kern/kern_slaballoc.c:1508 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2782 Medium 4.7 sys_mq_open race-gated NULL-pointer lockmgr panic: the under-lock EMFILE branch jumps to the shared exit label while mq is still NULL, releasing a lock on a NULL-derived address
sys/kern/sys_mqueue.c:577 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2873 Medium 4.7 taskqueue_run() wakeup(task) outside TQ_LOCK vs drain's check-then-ssleep: lost wakeup parks taskqueue_drain forever
sys/kern/subr_taskqueue.c:411 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2693 Low 4.7 postsig() KASSERT panic: unlocked ps_sigact[] read races concurrent sigaction(SIG_IGN) from another LWP
sys/kern/kern_sig.c:2281 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2797 Low 4.7 alist API performs no release-kernel domain validation: alist_alloc(count==0) silently wipes whole 32-block leaves or spins forever with the caller's lock held; alist_create/init with blocks>2^29 radix-wraps into an infinite loop; count==bl_radix full-capacity allocation off-by-one on leaf-root alists
sys/kern/subr_alist.c:250 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2849 Low 4.7 taskqgroup_detach() unsynchronized lifecycle tail: gt_taskqueue=NULL window panics racing enqueuers; unlocked TASK_NOENQUEUE clear can lose the TASK_ENQUEUED bit and corrupt the queue list
sys/kern/subr_gtaskqueue.c:746 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2980 Medium 4.5 addupc_task() calls stopprofclock() without p->p_token: non-atomic p->p_flags RMW race annihilating concurrent token-held flag updates (P_TRACED/P_SUGID security gates)
sys/kern/subr_prof.c:145 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2803 Medium 4.4 Unbounded udev event queue growth behind a slow/stalled initiated reader (no udev_evqlen cap, no backpressure)
sys/kern/kern_udev.c:515 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5686 Medium 4.4 udev_getdevs_ioctl() leaks the cdevs prop_array — and permanently pins every cdev's si_dict — on each UDEVPROP getdevs ioctl (devd triggers it on default systems)
sys/kern/kern_udev.c:1004 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2681 Low 4.4 bus_generic_delete_resource() dispatches BUS_DELETE_RESOURCE on itself instead of dev->parent: unbounded kernel recursion/livelock for any driver using the shipped generic default
sys/kern/subr_bus.c:3145 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2772 Low 4.4 REL/RELA sh_info accepted unvalidated → findbase()==0 → panic("lost base for reltab/relatab") on crafted module (also via the boot preload path)
sys/kern/link_elf_obj.c:775 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2773 Low 4.4 link_elf_obj_unload_file NULL-derefs reltab/relatab when load aborts between the scan and the table allocation (e.g. 'file has no contents')
sys/kern/link_elf_obj.c:887 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2810 Low 4.4 parse_dynamic accepts DT_REL/DT_RELA/DT_JMPREL/DT_HASH without DT_SYMTAB/DT_STRTAB → NULL-base wild reads in symbol_name()/elf_lookup()/link_elf_lookup_symbol()
sys/kern/link_elf.c:232 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2816 Low 4.4 boot()/shutdown_cleanup_proc() tears down the live reboot(2)-calling process (all fds closed, fd_ncdir/fd_nrdir/fd_njdir nchandles NULLed, entire user vmspace removed) while its sibling threads still run on other CPUs → sibling path lookups dereference NULL ncp in naccess() → kernel panic and hard machine wedge
sys/kern/kern_shutdown.c:291 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2833 Low 4.4 kern.syncdelay=SYNCER_MAXDELAY (32) accepted by sysctl → same-slot requeue livelock/deadlock of the syncer under sc_token (also kern.retrydelay<=0)
sys/kern/vfs_sync.c:133 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-2877 Low 4.4 kdmsg_iocom_reconnect() kill-wait deadlocks the DIOCRECLUSTER caller unkillably when the old peer socket is idle-but-open (no fp_shutdown escape, unlike iocom_uninit)
sys/kern/subr_diskiocom.c:141 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2928 Low 4.4 Dead spin_lock_test_mode: debug.spin_lock_test=1 wedges a CPU in a critical section for 60s then panics INVARIANTS kernels (test-mode escape never fires)
sys/kern/kern_spinlock.c:88 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2754 Info 4.4 sysctl kern.stackgap_random accepts unbounded negative values: ALIGN(-gap) up to 2GB silently places every exec's stack contents outside the stack mapping — system-wide exec SIGSEGV from a single root sysctl (validation gap)
sys/kern/kern_exec.c:159 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2711 Low 4.3 Unbounded peer-driven kdmsg_state allocation: no quota on transactions a peer may open (kernel memory exhaustion)
sys/kern/kern_dmsg.c:898 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2728 Low 4.1 lwkt_preempt() KKASSERT(gd->gd_processing_ipiq == 0) contradicts the designed preemption-from-framed-IPI path of lwkt_schedule_remote() — INVARIANTS kernels panic
sys/kern/lwkt_thread.c:1026 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2729 Low 4.1 _lwkt_schedule() KKASSERT(TDF_MIGRATING == 0) contradicts _lwkt_enqueue()'s by-design TDF_MIGRATING swallow during push/pull migration windows — INVARIANTS kernels panic
sys/kern/lwkt_thread.c:1293 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2752 Low 4.1 pipe_size sysctl lacks power-of-two validation: non-pow2 buffer size silently aliases FIFO slots (in-bounds cross-process data corruption) on misconfigured systems
sys/kern/sys_pipe.c:125 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-2777 Low 4.1 register_int check-then-create windows span blocking allocations: NULL info->i_thread dereference and re-arm of an already-armed emergency systimer under concurrent registration
sys/kern/kern_intr.c:308 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2871 Low 4.1 taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c)
sys/kern/subr_taskqueue.c:594 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2899 Low 4.1 fp_mmap maps VCHR vnodes without the revoked-device (v_rdev == NULL) guard its sibling kern_mmap has: NULL-deref panic in vm_mmap
sys/kern/kern_fp.c:473 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-2967 Low 4.1 wdog_disable() self-deadlocks/livelocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC)
sys/kern/kern_wdog.c:96 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-5729 Low 4.1 lwkt_tokref published before initialization — DDB ps token walk (db_dump_td_tokens) can dereference a stale/NULL tr_tok (snapshot race)
sys/kern/lwkt_token.c:660 · pass 2 · new
 none untested not_testable untriaged — —
DF-2727 Info 4.1 cluster_callback() panics on residual/short cluster I/O instead of propagating an error to components
sys/kern/vfs_cluster.c:1127 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2780 Medium 3.3 p_mqueue_cnt accounting broken across fork(): decrement runs in the last-reference closer (not the opener) while fork zeroes the child's counter — u_int underflow defeats the '== mq_open_max' check, and the open-existing path has no check at all
sys/kern/sys_mqueue.c:384 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2925 Medium 3.3 Uninitialized kernel stack stored into accounting state and disclosed via "get usage all" (ac_limit/ac_bytes/space)
sys/kern/vfs_quota.c:249 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2669 Low 3.3 kern_truncate()/kern_ftruncate() execute VFS_ACCOUNT() even when VOP_SETATTR failed — quota accounting corruption on failed truncates
sys/kern/vfs_syscalls.c:4044 · pass 2 · new
 none untested not_testable untriaged — —
DF-2670 Low 3.3 sys_fchown() performs VFS_ACCOUNT() ownership-transfer accounting against the cwd's mount instead of the chowned file's mount
sys/kern/vfs_syscalls.c:3637 · pass 2 · new
 none untested not_testable untriaged — —
DF-2705 Low 3.3 vop_write quota accounting skips unlinked-open files (va_nlink==0) → complete quota enforcement bypass when vfs.quota_enabled=1; concurrent-writer delta TOCTOU
sys/kern/vfs_vopops.c:476 · pass 2 · new
 none untested not_testable untriaged — —
DF-2733 Low 3.3 poll() silently truncates nfds to kern.maxfilesperproc*2 — ready descriptors beyond the clamp are dropped without error
sys/kern/sys_generic.c:1639 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2756 Low 3.3 vn_read has no VDIR gate: read() on a directory fd is dispatched to VOP_READ, and ffs_read explicitly accepts VDIR, exposing raw directory blocks (deleted-entry residue) instead of returning EISDIR
sys/kern/vfs_vnops.c:749 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2764 Low 3.3 journal_setextattr journals the post-VOP, fully consumed uio: the extended-attribute VALUE is never recorded in the REDO stream
sys/kern/vfs_jops.c:1027 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2765 Low 3.3 journal_nrename records both path leaves after cache_rename mutated the namecache: PATH1==PATH2==target and the source path is never journaled
sys/kern/vfs_jops.c:1318 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2784 Low 3.3 Missing SEMAEM enforcement: un_adjval (short) signed overflow in semundo_adjust flips semexit's clamp branch — deterministic wrong undo application
sys/kern/sysv_sem.c:244 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2823 Low 3.3 F_UNLCK of caller's own locks fails with ENOLCK when the uid POSIX-lock limit is reached (POSIX violation, lock-shedding wedge)
sys/kern/kern_lockf.c:510 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2836 Low 3.3 sonewconn_faddr() inherits the listener's entire so_state — accepted connections born half-shut (SS_CANTSENDMORE/SS_CANTRCVMORE/SS_ASYNC) after listener shutdown
sys/kern/uipc_socket2.c:383 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2846 Low 3.3 CPU topology sysctl strings rendered while ncpus==1: hw.cpu_topology.members and per-cpu physical/core siblings are wrong on every SMP system; fix_amd_topology cpusync reaches only the BSP
sys/kern/subr_cpu_topology.c:563 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2883 Low 3.3 kvsscanf 'x'-pushback under-advance at exact end-of-input: stale byte re-consumed (parse divergence from userland scanf, double-counted nread)
sys/kern/subr_scanf.c:487 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2825 Info 3.3 Negative l_len rejected with EINVAL instead of the POSIX [l_start+l_len, l_start-1] semantics
sys/kern/kern_lockf.c:230 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2895 Info 3.3 sys_kenv KENV_SET ignores ksetenv() failure — variables rejected at limit boundaries (name/value of exactly KENV_M*LEN, full table) silently appear 'set'
sys/kern/kern_environment.c:164 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2957 Info 3.3 fattime2timespec accepts out-of-range month (0, 13-15) and hour>23/minute>59 fields from crafted FAT images — no bounds validation (garbage dates, index safely masked)
sys/kern/subr_fattime.c:226 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2863 Low 3.2 vfs_mountroot_try ignores the ';' candidate bound when copying into mf: every root-mount candidate except the last gets a device name contaminated with the ';<tail>' of later candidates — fallback lists silently degenerate (valid candidates skipped; boot panic or wrong-device-as-root)
sys/kern/vfs_conf.c:423 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2911 Low 3.0 l64_setdisklabel accepts internally inconsistent label geometry: d_pbase/d_pstop/d_bbase unvalidated, partitions may overlap the label+boot area, and d_bbase directly becomes ds_reserved (0 disables the label-area EROFS guard)
sys/kern/subr_disklabel64.c:278 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2736 Low 2.5 vop_compat_* '[diagnostic] EAGAIN on ncp %p %s' prints leak kernel namecache heap pointer and full pathname into the world-readable msgbuf
sys/kern/vfs_default.c:200 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2750 Low 2.5 lockmgr_release() multi-count blind decrement loses the grant/wakeup transition under concurrent LK_KERNTHREAD release (lost wakeup: waiter sleeps on a free lock)
sys/kern/kern_lock.c:874 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2758 Low 2.5 FOFFSETLOCK acquisition sleeps uninterruptibly ('fpoff', no PCATCH): a thread wedged forever inside VOP_READ while holding the offset lock makes every other thread sharing the file descriptor permanently unkillable
sys/kern/vfs_vnops.c:569 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2821 Low 2.5 rand_thread_loop feeds generator output back into the entropy pools, so the MIN_POOL_SIZE reseed gate can be satisfied with zero external entropy
sys/kern/kern_nrandom.c:886 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2858 Low 2.5 shmfork() bcopy's transient shmmap_s reservation state: fork landing in shmat's blocked window permanently burns a SHMSEG slot in the child (and gives it an un-accounted, un-shmdt-able mapping)
sys/kern/sysv_shm.c:646 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2868 Low 2.5 ktrcanset dereferences targetp->p_ucred with no token and no crhold — freed-cred read / stale-cred TOCTOU racing cratom_proc (distinct from DF-0103's p_tracenode scope)
sys/kern/kern_ktrace.c:668 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2909 Low 2.5 sys_varsym_set replace is a non-atomic remove-then-insert: concurrent same-name sets create duplicate shadowed varsym entries; invalid level values silently return success
sys/kern/kern_varsym.c:152 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-2944 Low 2.5 acct_process() leaks 9 bytes of uninitialized kernel stack into every accounting record (struct acct alignment padding)
sys/kern/kern_acct.c:198 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2958 Low 2.5 vkernel64: sys_umtx_sleep() calls blocking uservtophys() inside a critical section — LWKT lock-protocol violation
sys/kern/kern_umtx.c:199 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-2976 Low 2.5 Unprivileged SO_ACCEPTFILTER duplicate-attach race: two M_WAITOK allocations inside the check-then-store window of do_setopt_accept_filter() let concurrent setsockopt on a shared listener orphan struct so_accf chunks permanently — unbounded kernel heap exhaustion
sys/kern/uipc_socket.c:1999 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5685 Low 2.5 Unchecked copyin() return in sys_vquotactl feeds an uninitialized stack plistref to _prop_object_copyin
sys/kern/vfs_quota.c:345 · pass 2 · new
 see summary untested not_testable untriaged — —
DF-2730 Info 2.5 lwkt_acquire() spins forever on a wedged owner cpu with no watchdog recovery (wedge-family hardening)
sys/kern/lwkt_thread.c:1394 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2762 Info 2.5 sys_setgroups publishes the COW credential before mutating it: mid-copyin window exposes mixed old/new group sets to other threads, and a failing copyin leaves the credential partially mutated despite the error return
sys/kern/kern_prot.c:682 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2824 Info 2.5 POSIX EDEADLK not detected for F_SETLKW deadlock cycles spanning two (or more) files
sys/kern/kern_lockf.c:406 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2884 Info 2.5 kvsscanf silently accepts unknown conversion specifiers, desynchronizing the varargument list
sys/kern/subr_scanf.c:148 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2804 Medium 2.3 Permanent kernel memory leak of undelivered udev event dictionaries on last-reader close (reap/abandon without prop_object_release)
sys/kern/kern_udev.c:534 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2699 Low 2.3 vfs_setpublicfs() leaks nfs_pub.np_index when MNT_EXPUBLIC is re-exported on the same mount without MNT_DELEXPORT
sys/kern/vfs_subr.c:2246 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2766 Low 2.3 journal_remove_all_journals never detaches: mnt_jbitmap (1024 bytes, M_JOURNAL) leaks on every journaled unmount
sys/kern/vfs_jops.c:423 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2788 Low 2.3 callout_stop/stop_async/cancel/drain return 0 after dequeuing a pending callout: sync fast path never reads CALLOUT_PREVENTED it just caused to be set
sys/kern/kern_timeout.c:888 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2801 Low 2.3 Namecache-reference leak on failed jail(2): pr_root handle never dropped on kern_jail error paths (deterministic via jail path = regular file)
sys/kern/kern_jail.c:206 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2812 Low 2.3 elf_lookup() STB_LOCAL branch returns the resolved address as the int error code and never writes *result → relocations against defined local symbols always fail (or write an uninitialized stack value)
sys/kern/link_elf.c:1003 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2897 Low 2.3 Mute-interaction bookkeeping leak: cnclose()'s muted early-return never clears cn_is_open/cn_phys_is_open, so un-muting re-opens the physical console device with a stale flags snapshot for a /dev/console that is no longer open
sys/kern/tty_cons.c:403 · pass 2 · new
 none untested not_testable untriaged — —
DF-2916 Low 2.3 sleepq timeout API is broken: documented sleepq_set_timeout() macro cannot compile (undefined tick_sbt/C_HARDCLOCK), sbt-vs-ticks unit confusion, and int64->int truncation into tsleep()
sys/kern/subr_sleepqueue.c:300 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-2615 Info 2.3 kdmsg_iocom_uninit leaks the queued LNK_PING when iocom threads are gone (one kdmsg_msg per hammer2 unmount)
sys/kern/kern_dmsg.c:264 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2749 Info 2.3 journal_wthread pad-skip accounting bug: total_acked += bytes counts all pending bytes instead of the pad size, inflating bytessent (MOUNTCTL_STATUS)
sys/kern/vfs_journal.c:220 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2912 Info 2.3 l64_makevirginlabel unsigned underflow on tiny slices: d_abase = d_total_size - ressize (and derived d_pstop) wrap to ~2^64 when the slice is smaller than the reserved area
sys/kern/subr_disklabel64.c:465 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2696 Low 1.9 sorecvtcp(): MSG_OOB + sio path is missing 'm = m_free(m)' — repeated sbappend of the same mbuf corrupts the caller's sockbuf (latent, currently unreachable)
sys/kern/uipc_socket.c:1648 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2703 Low 1.9 vop_mountctl/vop_markatime/vop_allocate dispatch with partially-uninitialized stack argument structs (a_vp pointer never set)
sys/kern/vfs_vopops.c:1300 · pass 2 · new
 none untested not_testable untriaged — —
DF-2720 Low 1.9 load_section truncated-file check bypassed by 64-bit wrap of (off_t)filsz + offset
sys/kern/imgact_elf.c:274 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2732 Low 1.9 readv/writev/extpreadv/extpwritev accept iovcnt==0 — POSIX EINVAL missing; uninitialized stack iovec pointer plumbed into fo_read/fo_write
sys/kern/sys_generic.c:195 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2792 Low 1.9 sys_ioprio_get(PRIO_PGRP) compares p_nice but assigns p_ionice — wrong (order-dependent) result and possible spurious ESRCH
sys/kern/kern_resource.c:366 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2850 Low 1.9 _gtaskqueue_start_threads() reports total thread-creation failure as success; queue teardown lifecycle is stubbed, so a half-born queue silently hangs all future drainers
sys/kern/subr_gtaskqueue.c:455 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2945 Low 1.9 acctwatch() ignores VFS_STATFS failure (decides suspend/resume on uninitialized stack statfs) and races vgone(): NULL v_mount dereference panic
sys/kern/kern_acct.c:332 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-2971 Low 1.9 No common lock between linesw[] mutation and dispatch — register/deregister swap entries under tty_token while TIOCSETD (t_token+p_token) and driver read/write/ioctl paths read the table under unrelated locks, permitting torn multi-pointer swaps
sys/kern/tty_conf.c:97 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2724 Info 1.9 NTP PLL discipline state is mutated by hardclock/pps interrupt paths with no lock excluded from sys_ntp_adjtime's ntp_lock — interleaved PLL transitions
sys/kern/kern_clock.c:749 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2757 Info 1.9 vn_stat's MNT_NOSYMFOLLOW symlink-mode adjustment is dead code and reads sb->st_mode before it is ever initialized
sys/kern/vfs_vnops.c:882 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2770 Info 1.9 ptcread TIOCPKT_IOCTL path ignores uiomove error: EFAULT swallowed, read() returns 0 (EOF-like) with control byte consumed
sys/kern/tty_pty.c:718 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2787 Info 1.9 mtx_notlocked_ex() returns the exact opposite of its documented contract (inverted exclusive-lock test in shipped header)
sys/kern/kern_mutex.c:436 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2933 Info 1.9 xio_init_kbuf: size_t→int truncation of kbytes at kern_xio.c:121 corrupts xio_bytes negative while returning success
sys/kern/kern_xio.c:119 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2962 Info 1.9 kobj API robustness gaps: double kobj_init() silently leaks a permanent class reference (pins KLD class+ops forever), kobj_delete() on an uninitialized/deleted object NULL-derefs obj->ops->cls, and cyclic baseclass graphs recurse without bound
sys/kern/subr_kobj.c:137 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2978 Info 1.9 do_setopt_accept_filter() saves the filter NAME as so_accept_filter_str instead of the user's af_arg — getsockopt(SO_ACCEPTFILTER) returns the name as the argument; latent divergence from FreeBSD (functional, dead in-tree)
sys/kern/uipc_socket.c:2043 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2986 Info 1.9 cv_destroy performs no waiters/queued-state validation — destroy-with-waiter goes undiagnosed, leaving a stale wchan in td_wchan (divergence from FreeBSD INVARIANTS probe)
sys/kern/kern_condvar.c:14 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2989 Info 1.9 RB tree engine has zero INVARIANTS-mode structural validation, and scan_info_done walks the inprog list without a termination guard
sys/kern/subr_rbtree.c:460 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2723 Info 1.1 pps_fetch_timeout() feeds user-supplied unnormalized tv_nsec into tstohz_low(), whose int truncation yields an attacker-chosen (possibly negative) sleep tick count
sys/kern/kern_clock.c:1609 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2700 Info 0.8 vfs_hang_addrlist() returns through 'out' while still holding NE_LOCK(nep) on the rn_inithead-failure and unsupported-sa_family paths
sys/kern/vfs_subr.c:2085 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2767 Info 0.8 journal_status_vfs_journal index filter over-returns: requesting status for index k returns journals 0..k instead of only k
sys/kern/vfs_jops.c:476 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2806 Info 0.8 udev_event_attach returns stale ENOMEM on the success path when the device dict already exists
sys/kern/kern_udev.c:589 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2807 Info 0.8 Short-buffer read() on /dev/udev silently drops the event and reports ENOMEM
sys/kern/kern_udev.c:846 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-2837 Info 0.8 sysctl_handle_sb_max() maintains u_long sb_max through sizeof(int) transfers — 8-byte writes silently truncated by 4 GiB, sb_max can never represent its declared type
sys/kern/uipc_socket2.c:686 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2930 Info 0.8 _systimer_init_periodic(): SYSTF_100KHZSYNC phase-sync branch is dead code (missing else-if)
sys/kern/kern_systimer.c:268 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2937 Info 0.8 sched_setscheduler returns success (0) for invalid policies — POSIX-required EINVAL missing; silent no-op leaves processes at real-time priority
sys/kern/kern_p1003_1b.c:265 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2974 Info 0.8 EVENTHANDLER_FAST_DEREGISTER macro is syntactically broken (missing underscore in list symbol) and the entire FAST handler API is dead code
sys/kern/subr_eventhandler.c:95 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2761 Info 0.5 sys_setlogin mutates s_login while holding p_token SHARED — data race with concurrent setlogin/getlogin produces torn login names
sys/kern/kern_prot.c:1290 · pass 2 · new
 — reproduced not_testable untriaged — —
DF-2818 Info 0.5 lwkt_token_init() on a live token silently drops a held exclusive; lwkt_token_uninit() performs no quiescence check
sys/kern/lwkt_token.c:914 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2860 Info 0.5 sglist_consume_uio() swallows all errors and unconditionally returns 0 — EFBIG/EFAULT indistinguishable from full success (dead code; upstream parity)
sys/kern/subr_sglist.c:417 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2861 Info 0.5 _sglist_append_buf() ignores pmap_extract() failure — unmapped user addresses become physical-page-0 DMA segments instead of EFAULT (dead paths; upstream parity)
sys/kern/subr_sglist.c:125 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2914 Info 0.5 dev_is_good() tests a sentinel that is never installed: dead_dev_ops is assigned to no cdev, making every dead-device fence in the kernel dead code
sys/kern/kern_conf.c:127 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2934 Info 0.5 m_tag_alloc silently truncates int len/type into uint16_t m_tag_len/m_tag_id (allocation sized from untruncated len)
sys/kern/uipc_mbuf2.c:260 · pass 2 · new
 none untested — untriaged — —
DF-2941 Info 0.5 _sysref_put accepts count==0 double-releases with no put-side floor guard; the only barrier is the debug-only KKASSERT whose flags read races the final-release sequence
sys/kern/kern_sysref.c:303 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2943 Info 0.5 Dead sysref machinery retained and exported: sysref_init (no callers) can produce objects whose final put objcache_puts non-objcache memory on production builds; allocsysid, SRC_MANAGEDINIT and SRF_SYSIDUSED are entirely unused
sys/kern/kern_sysref.c:105 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2964 Info 0.5 gptinit() accepts any CRC-self-consistent LBA1 block as a GPT header: hdr_sig ("EFI PART"), hdr_revision, and the partition-array CRC (hdr_crc_table) are never validated
sys/kern/subr_diskgpt.c:108 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2968 Info 0.5 Kernel threads leak one td_ucred reference per exit: crhold at creation is never crfreed on the LWKT teardown path
sys/kern/kern_kthread.c:62 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2981 Info 0.5 bus_dmamem_coherent reports success when the underlying bus_dmamap_load fails (error swallowed in callback), yielding dmem_busaddr==0
sys/kern/subr_busdma.c:46 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2731 Medium — sys_extpread/sys_extpwrite/sys_extpreadv/sys_extpwritev accept negative offsets — unprivileged kernel panic on ext2 (INVARIANTS), POSIX EINVAL missing
sys/kern/sys_generic.c:153 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-0139 Medium 7.8 SLEEPQ_HASH misplaced mask causes massive OOB index into sleepq_chains array
sys/kern/subr_sleepqueue.c:82
 none reproduced not_testable untriaged — —
DF-0220 High 7.5 Predictable RNG: /dev/urandom+getrandom+kern.random return deterministic ChaCha20 keystream (zero key) before first reseed
sys/kern/subr_csprng.c:84
 none not_reproduced not_testable untriaged — —
DF-0243 High 7.1 size_t underflow in exec_shell_imgact when argv[0] longer than interpreter+fname -> kernel panic
sys/kern/imgact_shell.c:117
 none not_reproduced not_testable untriaged — —
DF-0198 Low 6.7 tag_types[tag_type] indexed without bounds check
sys/kern/subr_devstat.c:211
 none reproduced fixed untriaged — —
DF-0032 Medium 6.5 fdcopy() failure in fork1() permanently leaks the child proc, nprocs, and the per-uid proc-count (system-wide fork DoS)
sys/kern/kern_fork.c:491
 dos reproduced fixed untriaged — —
DF-0149 Medium 6.0 Signed-integer truncation in TLV walk size math allows backward/OOB pointer movement
sys/kern/subr_module.c:79
 none reproduced not_testable untriaged — —
DF-0181 Medium 6.0 sysctl_hostname leaks XLOCK on EPERM: jailed root deadlocks host sysctl subsystem
sys/kern/kern_mib.c:217
 dos reproduced fixed untriaged — —
DF-0134 Medium 5.9 Missing structural validation in l64_readdisklabel: crafted partition fields accepted without bounds checks
sys/kern/subr_disklabel64.c:176
 none reproduced fixed untriaged — —
DF-0018 Low 5.9 Duplicate DELETE for same DMSG msgid triggers KKASSERT panic (DoS)
sys/kern/kern_dmsg.c:1076
 panic reproduced fixed untriaged — —
DF-0142 High 5.5 Sleeping allocation (M_WAITOK kmalloc) while holding ac_spin -> panic/deadlock
sys/kern/vfs_quota.c:158
 panic reproduced fixed untriaged — —
DF-0079 Medium 5.5 Unprivileged local DoS via u_int truncation of iov_len in /dev/null and /dev/zero write (infinite kernel loop)
sys/kern/kern_memio.c:292
 dos reproduced fixed untriaged — —
DF-2550 Medium 5.5 setfown() leaks vnode exclusive lock and reference on VOP_GETATTR failure causing permanent file DoS
sys/kern/vfs_syscalls.c:3541
 panic reproduced fixed untriaged — —
DF-2556 Medium 5.5 clist_alloc_cblocks leaks previous c_data buffer on every reallocation
sys/kern/tty_subr.c:48
 dos reproduced fixed untriaged — —
DF-0038 Low 5.5 journal_putpages UNDO records btoc(a_count) pages instead of a_count bytes (silent rollback corruption)
sys/kern/vfs_jops.c:955
 none reproduced fixed untriaged — —
DF-0144 Medium 5.3 copyin return value silently discarded before prop_dictionary_copyin
sys/kern/vfs_quota.c:345
 panic reproduced fixed untriaged — —
DF-0233 Low 5.3 Lockless SLIST traversal of domains list races with crit_enter-only writer
sys/kern/uipc_domain.c:137
 none reproduced not_testable untriaged — —
DF-0004 Info 5.3 devaddq error path leaks data buffer due to wrong variable checked (loc instead of data)
sys/kern/subr_bus.c:615
 none reproduced fixed untriaged — —
DF-0196 Low 5.1 STAILQ_REMOVE in devstat_remove_entry derefs NULL if node already absent
sys/kern/subr_devstat.c:139
 none reproduced fixed untriaged — —
DF-0014 Medium 4.7 enterpgrp() lwkt_reltoken on an un-acquired token -> race-triggered kernel panic
sys/kern/kern_proc.c:763
 none not_reproduced — untriaged — —
DF-0039 Medium 4.7 ptsopen check-then-use TOCTOU on dev->si_drv1 -> NULL-deref kernel panic (local DoS)
sys/kern/tty_pty.c:313
 none not_reproduced — untriaged — —
DF-0047 Medium 4.7 mtx_wait_link lock-leak race: chain can grant lock during mtx_delete_link window, caller returns error despite holding the lock (permanent deadlock)
sys/kern/kern_mutex.c:1002
 none not_reproduced not_testable untriaged — —
DF-0001 Low 4.7 Reachable KASSERT panic in kern_truncate()/kern_ftruncate() when VOP_GETATTR fails under quotas
sys/kern/vfs_syscalls.c:4036
 panic reproduced fixed untriaged — —
DF-0011 Low 4.7 Missing NULL check on sbcreatecontrol() in SO_PASSCRED path -> kernel NULL-deref panic
sys/kern/uipc_usrreq.c:694
 panic reproduced fixed untriaged — —
DF-2559 Low 4.7 Local NULL-deref panic when sbcreatecontrol fails in SO_PASSCRED path
sys/kern/uipc_usrreq.c:694
 panic reproduced not_testable untriaged — —
DF-0187 Low 4.5 vacl_get_acl/aclcheck call VOPs without vnode lock, inconsistent with set/delete
sys/kern/kern_acl.c:88
 none reproduced fixed untriaged — —
DF-0234 Medium 4.4 Signed-integer overflow in callout timer calc (min_period*hz/2) -> self-perpetuating CPU-burn or watchdog defeat
sys/kern/kern_wdog.c:94
 dos not_reproduced not_testable untriaged — —
DF-0236 Medium 4.4 Driver callbacks (wdog_fn) invoked under global spinlock with interrupts disabled
sys/kern/kern_wdog.c:84
 dos not_reproduced not_testable untriaged — —
DF-0239 Medium 4.4 Missing resume_kproc implementation: suspend permanently freezes kernel daemons
sys/kern/kern_kthread.c:216
 dos reproduced fixed untriaged — —
DF-0019 Low 4.4 usched_bsd4.queue_checks accepts <=0 causing NULL-deref/panic in cache-coherent chooseproc
sys/kern/usched_bsd4.c:1483
 panic reproduced fixed untriaged — —
DF-0026 Low 4.4 Root-writable bioq_reorder_minor_interval used as modulus divisor without validation -> divide-by-zero panic
sys/kern/subr_disk.c:1325
 panic reproduced fixed untriaged — —
DF-0029 Low 4.4 Unchecked copyin() in jrecord_data leaves stale kernel data in the journal stream
sys/kern/vfs_journal.c:1093
 none reproduced fixed untriaged — —
DF-0046 Low 4.4 Missing SEMVMX upper-bound in semop/semexit allows semval overflow, wrap, spurious wakeups, and rollback corruption
sys/kern/sysv_sem.c:848
 dos reproduced fixed untriaged — —
DF-0063 Low 4.4 Hash-chain cycle in link_elf_lookup_symbol causes kernel infinite-loop DoS
sys/kern/link_elf.c:812
 none reproduced fixed untriaged — —
DF-0071 Low 4.4 Missing sign/upper-bound validation on vpcount before heap alloc + file read (negative->huge kmalloc M_WAITOK DoS)
sys/kern/kern_checkpoint.c:561
 none reproduced fixed untriaged — —
DF-0158 Low 4.4 Signed uoffset/bytes in copy routines let negative values bypass EFAULT guard
sys/kern/kern_xio.c:235
 none reproduced fixed untriaged — —
DF-0173 Low 4.4 Divide-by-zero panic via kern.hz=0 loader tunable
sys/kern/subr_param.c:200
 none reproduced fixed untriaged — —
DF-0191 Low 4.4 Divide-by-zero panic via log_wakeups_per_second=0 sysctl
sys/kern/subr_log.c:87
 none reproduced fixed untriaged — —
DF-0228 Low 4.4 hdr_lba_table (uint64) read via le32toh() -> silent 64-to-32 truncation
sys/kern/subr_diskgpt.c:133
 none reproduced fixed untriaged — —
DF-0089 Low 4.2 Resource merge in release path ignores address contiguity - creates false spans across unmanaged gaps
sys/kern/subr_rman.c:560
 none reproduced fixed untriaged — —
DF-0241 Low 4.1 kproc_start dereferences thread pointer before checking kthread_create error
sys/kern/kern_kthread.c:176
 none reproduced fixed untriaged — —
DF-0247 Info 4.1 cpuid bounds check is KASSERT-only — compiled out in production kernels
sys/kern/subr_cpuhelper.c:45
 none reproduced not_testable untriaged — —
DF-0090 Low 4.0 rman_reserve_resource has no count==0 guard - unsigned underflow in range math corrupts resource list
sys/kern/subr_rman.c:205
 none reproduced fixed untriaged — —
DF-2545 Info 4.0 devaddq() error path frees wrong variable leaking 1024 bytes of M_BUS on allocation pressure
sys/kern/subr_bus.c:585
 — reproduced not_testable untriaged — —
DF-0250 Info 3.9 Dead page-alignment computation: iolen computed but never applied
sys/kern/kern_physio.c:88
 none reproduced not_testable untriaged — —
DF-0113 Low 3.6 PT_DETACH reparents tracee to recycled p_oppid PID
sys/kern/sys_process.c:350
 none reproduced fixed untriaged — —
DF-0156 Low 3.6 be_uuid_dec decodes time_mid with wrong byte order (le16dec instead of be16dec)
sys/kern/kern_uuid.c:361
 none reproduced fixed untriaged — —
DF-0166 Low 3.6 syscap_set INPARENT: uid/prison checked without p_token before capability mutation
sys/kern/kern_caps.c:164
 none reproduced fixed untriaged — —
DF-0203 Low 3.6 Sentinel -1 collision: fuwordadd32 fault indistinguishable from mutex value -1
sys/kern/kern_umtx.c:146
 none reproduced fixed untriaged — —
DF-0212 Low 3.6 lwkt_serialize_handler_try omits post-acquire re-check of handler-enabled bit
sys/kern/lwkt_serialize.c:189
 none reproduced fixed untriaged — —
DF-0210 Info 3.6 clist_catq infinite loop on aliasing (cls==cld)
sys/kern/tty_subr.c:294
 none reproduced fixed untriaged — —
DF-0118 Low 3.5 Memory leak of dios_io/dios_open on kdmsg state teardown (no destructor for state->any.any)
sys/kern/subr_diskiocom.c:637
 none reproduced fixed untriaged — —
DF-0174 Low 3.4 Integer overflow in ncallout via unbounded kern.maxfiles
sys/kern/subr_param.c:282
 none reproduced fixed untriaged — —
DF-0235 Low 3.4 No bounds validation on watchdog period (negative/>period_max accepted)
sys/kern/kern_wdog.c:114
 none reproduced fixed untriaged — —
DF-0143 Medium 3.3 nlookupdata leaked on nlookup failure (missing nlookup_done)
sys/kern/vfs_quota.c:354
 dos reproduced fixed untriaged — —
DF-0145 Medium 3.3 vq_done stub leaks all quota RB-trees on unmount
sys/kern/vfs_quota.c:142
 dos reproduced fixed untriaged — —
DF-0202 Medium 3.3 Unthrottled kprintf log-flood DoS via umtx_sleep/wakeup on unmapped address
sys/kern/kern_umtx.c:150
 dos reproduced fixed untriaged — —
DF-2560 Medium 3.3 File refcount / unp_rights leak when ssb_appendcontrol fails on SOCK_STREAM SCM_RIGHTS
sys/kern/uipc_usrreq.c:766
 leak reproduced not_testable untriaged — —
DF-0054 Low 3.3 Truncated prison-id sysctl node name in prison_sysctl_create (off-by-one in ksnprintf size)
sys/kern/kern_jail.c:993
 none reproduced fixed untriaged — —
DF-0133 Low 3.3 Algorithmic-complexity DoS in EBR recursion (tetranacci explosion)
sys/kern/subr_diskmbr.c:427
 none reproduced fixed untriaged — —
DF-0146 Low 3.3 prop_dictionary/prop_array leaks on several sys_vquotactl paths
sys/kern/vfs_quota.c:374
 none reproduced fixed untriaged — —
DF-0186 Low 3.3 vacl_delete silently ignores user-supplied ACL type, always deletes ACL_TYPE_DEFAULT
sys/kern/kern_acl.c:107
 none reproduced fixed untriaged — —
DF-0199 Low 3.3 Day-of-month 0 causes unsigned underflow in fattime2timespec (crafted FAT image)
sys/kern/subr_fattime.c:233
 none reproduced fixed untriaged — —
DF-0204 Low 3.3 umtx_wakeup ignores count argument: over-wakeup / cross-process thundering herd
sys/kern/kern_umtx.c:297
 none reproduced fixed untriaged — —
DF-0229 Low 3.3 uint32 wraparound in table_lba+table_blocks location bounds-check
sys/kern/subr_diskgpt.c:139
 none reproduced fixed untriaged — —
DF-0132 Low 3.0 Unvalidated sensor type as array index: OOB write in sensor_attach/detach
sys/kern/kern_sensors.c:143
 none reproduced fixed untriaged — —
DF-0189 Low 3.0 TOCTOU race in /dev/klog single-open enforcement
sys/kern/subr_log.c:98
 none reproduced fixed untriaged — —
DF-0193 Low 3.0 vfs_vptofh reads vp->v_mount twice without snapshot/NULL-check
sys/kern/vfs_vfsops.c:266
 none reproduced fixed untriaged — —
DF-0049 Info 3.0 IPI ring/serial indices are signed int, incremented without wraparound handling (overflow after ~2^31 messages)
sys/kern/lwkt_ipiq.c:218
 none reproduced not_testable untriaged — —
DF-0244 Info 3.0 ldisc_deregister missing lower-bound check: negative index OOB write into linesw[]
sys/kern/tty_conf.c:122
 none reproduced fixed untriaged — —
DF-0030 Low 2.5 jrecord_write_path goto again can spin indefinitely under concurrent rename (local DoS)
sys/kern/vfs_journal.c:1251
 none reproduced fixed untriaged — —
DF-0052 Low 2.5 alst_leaf_alloc corrupts bm_bighint hint by mutating start before the bighint-decision comparison
sys/kern/subr_alist.c:443
 none reproduced fixed untriaged — —
DF-0067 Low 2.5 add_buffer_randomness_src passes full remaining length (bytes) instead of chunk size (n), defeating cross-CPU entropy splitting
sys/kern/kern_nrandom.c:650
 none reproduced fixed untriaged — —
DF-0097 Low 2.5 sglist_consume_uio truncates iov_len (size_t) to int - signedness confusion / data drop (dead code)
sys/kern/subr_sglist.c:383
 none reproduced fixed untriaged — —
DF-0128 Low 2.5 fp_vpopen NULL deref on td->td_proc when called from pure thread context
sys/kern/kern_fp.c:165
 none reproduced fixed untriaged — —
DF-0129 Low 2.5 fp_mmap dereferences fp->f_data without NULL check after f_type check
sys/kern/kern_fp.c:472
 none reproduced fixed untriaged — —
DF-0130 Low 2.5 fp_read all=1 mode can spin indefinitely on persistent EINTR/ERESTART
sys/kern/kern_fp.c:271
 none reproduced fixed untriaged — —
DF-0148 Low 2.5 TOCTOU: vq_write_ok check and vfs_stdaccount commit are separate critical sections
sys/kern/vfs_quota.c:443
 none reproduced fixed untriaged — —
DF-0161 Low 2.5 m_tag_copy_chain reverses tag order: tprev=t misplaced inside else branch
sys/kern/uipc_mbuf2.c:376
 none reproduced fixed untriaged — —
DF-0178 Low 2.5 cttyvp() snapshot read of s_ttyvp unsynchronized vs proc_token-held writers
sys/kern/tty_tty.c:74
 none reproduced fixed untriaged — —
DF-0200 Low 2.5 Negative tv_sec bypasses 1980-truncate guard in timespec2fattime
sys/kern/subr_fattime.c:150
 none reproduced fixed untriaged — —
DF-0208 Low 2.5 No validation of negative length in clist_qtob/btoq/ndflush
sys/kern/tty_subr.c:127
 none reproduced fixed untriaged — —
DF-0217 Low 2.5 sysctl reads kcollect_ary outside lock racing collection thread
sys/kern/kern_collect.c:233
 none reproduced fixed untriaged — —
DF-0223 Low 2.5 Missing sched_priority bounds check in SCHED_OTHER + signed-overflow UB in p4prio_to_rtpprio
sys/kern/kern_sched.c:181
 none reproduced fixed untriaged — —
DF-0232 Low 2.5 SIOCSPGRP invokes fsetown(-INT_MIN) -> signed-overflow UB on attacker-controlled value
sys/kern/sys_socket.c:164
 none reproduced fixed untriaged — —
DF-0012 Info 2.5 vop_nremove quota-accounting glue: latent NULL-deref on nc_vp, nlink TOCTOU, wrong mount for PFS overlays
sys/kern/vfs_vopops.c:1660
 none reproduced fixed untriaged — —
DF-0048 Info 2.5 CALLOUT_PREVENTED set on wrong structure (verifier/cc) vs read from backend _callout -> wrong callout_stop/cancel/drain return
sys/kern/kern_timeout.c:600
 none reproduced fixed untriaged — —
DF-0051 Info 2.5 msgsnd lacks explicit MSGMAX upper-bound check; msg_ts (u_short) silently truncates when MSGMNB compiled > 65535 (latent panic)
sys/kern/sysv_msg.c:50
 none reproduced not_testable untriaged — —
DF-0086 Info 2.5 dev_dopen dereferences inner *a_fpp without NULL check (latent panic, no current trigger)
sys/kern/kern_device.c:151
 none reproduced fixed untriaged — —
DF-0091 Info 2.5 Lock-order inversion between sysctl_rman and rman_fini creates ABBA deadlock potential (rman_fini dead code)
sys/kern/subr_rman.c:155
 none reproduced not_testable untriaged — —
DF-0116 Info 2.5 copyin/copyout/uiomove_nofault clear TDF_NOFAULT unconditionally instead of save/restore
sys/kern/kern_subr.c:60
 none reproduced not_testable untriaged — —
DF-0121 Info 2.5 Signed/unsigned confusion defeats length clamp in KENV_GET
sys/kern/kern_environment.c:141
 none reproduced fixed untriaged — —
DF-0122 Info 2.5 kgetenv_quad signed-shift overflow on magnitude-suffixed values
sys/kern/kern_environment.c:436
 none reproduced not_testable untriaged — —
DF-0168 Info 2.5 Lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
sys/kern/kern_sysref.c:142
 none reproduced not_testable untriaged — —
DF-0238 Low 2.3 Callout overwrites sysctl-visible wdog_auto_period with driver-reported min
sys/kern/kern_wdog.c:108
 none reproduced fixed untriaged — —
DF-0240 Low 2.3 suspend_kproc swallows timeout: always returns 0 even when daemon did not stop
sys/kern/kern_kthread.c:195
 none reproduced fixed untriaged — —
DF-0255 Info 2.3 Non-atomic RMW on global synth_synced counter (race)
sys/kern/vfs_synth.c:49
 none reproduced not_testable untriaged — —
DF-2551 Medium 1.9 sys_fhopen() returns success (error=0) without valid file descriptor when regular file vnode lacks VM object
sys/kern/vfs_syscalls.c:4933
 panic reproduced not_testable untriaged — —
DF-0124 Low 1.9 Unsynchronized open-mode bookkeeping in cnopen/cnclose (D_MPSAFE)
sys/kern/tty_cons.c:368
 none reproduced fixed untriaged — —
DF-0125 Low 1.9 sysctl_kern_consmute races cnread/cnwrite/cnioctl forwarding (no lock)
sys/kern/tty_cons.c:257
 none reproduced fixed untriaged — —
DF-0163 Low 1.9 module_register_init runs lookup/register/MOD_EVENT without mod_token
sys/kern/kern_module.c:89
 none reproduced fixed untriaged — —
DF-0170 Low 1.9 Ignored copyin return feeds uninitialized stack sched_param into ksched
sys/kern/kern_p1003_1b.c:202
 none reproduced fixed untriaged — —
DF-0237 Low 1.9 TOCTOU on wdog_auto_enable in wdog_ioctl
sys/kern/kern_wdog.c:191
 none reproduced fixed untriaged — —
DF-0253 Low 1.9 Namecache lock+ref leaked on nc_vp==NULL error path (missing nlookup_done)
sys/kern/vfs_synth.c:82
 none reproduced fixed untriaged — —
DF-0254 Low 1.9 Namecache reference leaked on every successful call (cache_drop never called)
sys/kern/vfs_synth.c:86
 none reproduced fixed untriaged — —
DF-0023 Info 1.9 Missing return after EINVAL in sys_read/sys_write/sys_extpwrite bypasses nbyte>SSIZE_MAX guard
sys/kern/sys_generic.c:130
 dos reproduced fixed untriaged — —
DF-0068 Info 1.9 IBAA-only RNG mode (rand_mode==1) has no seeding-readiness gate before first output
sys/kern/kern_nrandom.c:700
 none reproduced not_testable untriaged — —
DF-0078 Info 1.9 pps_shift/pps_shiftmax sysctl lack range validation allowing UB shift counts in hardpps (root self-DoS)
sys/kern/kern_ntptime.c:265
 none reproduced fixed untriaged — —
DF-0109 Info 1.9 l32_fixlabel partition loop lacks internal d_npartitions cap
sys/kern/subr_disklabel32.c:592
 none reproduced not_testable untriaged — —
DF-0114 Info 1.9 PT_IO trusts user piod_len without bounds check; narrows size_t into ssize_t uio_resid
sys/kern/sys_process.c:429
 none reproduced fixed untriaged — —
DF-0115 Info 1.9 sys_ptrace discards copyout error returning PT_IO descriptor
sys/kern/sys_process.c:112
 none reproduced fixed untriaged — —
DF-0155 Info 1.9 Division by unvalidated freq<=0 -> kernel divide-by-zero panic
sys/kern/kern_systimer.c:269
 none reproduced fixed untriaged — —
DF-0159 Info 1.9 xio_init_pages accepts negative npages; only upper bound asserted
sys/kern/kern_xio.c:142
 none reproduced fixed untriaged — —
DF-0172 Info 1.9 mpipe_free reads/writes mpipe->pending outside the lwkt_token
sys/kern/kern_mpipe.c:344
 none reproduced not_testable untriaged — —
DF-0175 Info 1.9 Integer overflow in NPROC macro via unbounded kern.maxusers
sys/kern/subr_param.c:56
 none reproduced not_testable untriaged — —
DF-0201 Info 1.9 dhp computed from raw tv_sec instead of UTC-adjusted t1
sys/kern/subr_fattime.c:150
 none reproduced fixed untriaged — —
DF-0205 Info 1.9 Timeout conversion uses 32-bit int arithmetic that can overflow
sys/kern/kern_umtx.c:188
 none reproduced not_testable untriaged — —
DF-0206 Info 1.9 Dead code: offset computed and never used in both syscalls
sys/kern/kern_umtx.c:114
 none reproduced not_testable untriaged — —
DF-0211 Info 1.9 No negative-size guard on ccmax in clist_alloc_cblocks
sys/kern/tty_subr.c:61
 none reproduced fixed untriaged — —
DF-0213 Info 1.9 last_td tracking field uses non-atomic plain load/store racy on SMP
sys/kern/lwkt_serialize.c:112
 none reproduced not_testable untriaged — —
DF-0214 Info 1.9 handler_disable discards in-flight indicator from atomic_intr_handler_disable
sys/kern/lwkt_serialize.c:149
 none reproduced not_testable untriaged — —
DF-0218 Info 1.9 kcollect_setvalue divides by kcollect_samples without guard
sys/kern/kern_collect.c:128
 none reproduced not_testable untriaged — —
DF-0219 Info 1.9 kcollect_setscale/setvalue mutate shared state without kcollect_lock
sys/kern/kern_collect.c:124
 none reproduced not_testable untriaged — —
DF-0222 Info 1.9 csprng_get_random byte count signed int: huge u_int requests silently truncate to 0
sys/kern/subr_csprng.c:127
 none reproduced fixed untriaged — —
DF-0242 Info 1.9 TOCTOU: td_proc NULL check without holding kpsus_token
sys/kern/kern_kthread.c:190
 none reproduced not_testable untriaged — —
DF-0064 Info 1.1 Unsynchronized data race on desc->total_objects (statistics-only, no security impact)
sys/kern/kern_objcache.c:357
 none reproduced fixed untriaged — —
DF-0069 Info 1.1 Signed integer overflow (C UB) in lock range end calculation (caught by guard, no corruption reachable)
sys/kern/kern_lockf.c:227
 none reproduced fixed untriaged — —
DF-0231 Info 1.1 Buffer-size safety depends solely on KKASSERT debug assertions
sys/kern/subr_diskgpt.c:93
 none reproduced not_testable untriaged — —
DF-0252 Info 1.1 Theoretical cross-field torn-read between sys_profil multi-field update and addupc
sys/kern/subr_prof.c:68
 none reproduced not_testable untriaged — —
DF-0221 Low 0.5 Signed 1<<31 overflow disables Fortuna pool 31 from reseed schedule
sys/kern/subr_csprng.c:203
 none reproduced fixed untriaged — —
DF-0002 Info 0.5 sys_fhopen returns spurious success (fd 0) on VREG-without-VM-object invariant violation
sys/kern/vfs_syscalls.c:4933
 none reproduced fixed untriaged — —
DF-0043 Info 0.5 SYSCTL_INT declared for long counters (auxrecovervnodes1/2) - type/size mismatch
sys/kern/vfs_lock.c:109
 none reproduced fixed untriaged — —
DF-0100 Info 0.5 Missing NULL check on vfsconf_find_by_name("devfs") before dereference in vfs_mountroot_devfs
sys/kern/vfs_conf.c:300
 none reproduced fixed untriaged — —
DF-0104 Info 0.5 Boot-time ktr_buf/ktr_entries_mask publication relies on TSO (no explicit read-side barrier, x86-only safe)
sys/kern/kern_ktr.c:231
 none reproduced not_testable untriaged — —
DF-0127 Info 0.5 cndbctl uses unlocked static refcount
sys/kern/tty_cons.c:570
 none reproduced not_testable untriaged — —
DF-0131 Info 0.5 fp_mmap size arithmetic can wrap past SSIZE_MAX after signedness check
sys/kern/kern_fp.c:409
 none reproduced not_testable untriaged — —
DF-0171 Info 0.5 Ignored copyout return in sys_sched_getparam
sys/kern/kern_p1003_1b.c:245
 none reproduced fixed untriaged — —
DF-0184 Info 0.5 Lockless read of exec_res_id counter mutated under list lock
sys/kern/imgact_resident.c:138
 none reproduced not_testable untriaged — —
DF-0192 Info 0.5 Concurrent writer/reader cursor updates on msg_bufl unsynchronized
sys/kern/subr_log.c:153
 none reproduced not_testable untriaged — —
DF-0194 Info 0.5 vfs_mount caches mnt_cred with unlocked check-then-set
sys/kern/vfs_vfsops.c:89
 none reproduced not_testable untriaged — —
DF-0225 Info 0.5 Implicit undocumented locking contract on lwp_rtprio writes
sys/kern/kern_sched.c:175
 none reproduced not_testable untriaged — —

Base system — virtual memory 47

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5829 Medium 5.5 vm_object_page_clean() partial-range clean is a silent no-op — msync(MS_SYNC) performs no writeback for any partial range on UFS and for EVERY range on hammer2 (default fs)
sys/vm/vm_object.c:981
 dos reproduced fixed untriaged — —
DF-5802 Low 5.1 vm_fault_unwire() UKSMAP fictitious asymmetry: munlock/exit-unwire of mlock()ed /dev/upmap or /dev/mem UKSMAP ranges runs vm_page_unwire() on never-wired pages and an unchecked PHYS_TO_VM_PAGE() array index
sys/vm/vm_fault.c:2614
 panic reproduced fixed untriaged — —
DF-5815 Low 4.4 vm.max_launder sysctl accepts negative values: per-queue launder budget goes negative, dirty-page laundering is silently and permanently disabled, and any unprivileged memory workload then livelocks the pagedaemon (deterministic whole-machine freeze until power-cycle)
sys/vm/vm_pageout.c:828
 dos reproduced not_testable untriaged — —
DF-5813 Info 2.5 Four more raw vm_page_t-pointer kprintfs on attacker-triggerable pagedaemon race-recovery paths (rebusy A/B/C and the scan_cache find/busy warning) disclose kernel heap addresses into the world-readable msgbuf
sys/vm/vm_pageout.c:1340
 none not_reproduced not_testable untriaged — —
DF-5800 Info 1.1 vm_map_delete() no-predecessor branch sets freehint hole_start=vm_map_max, silently disabling the freehint update for bottom-of-map holes (correctness defect, no reachable security impact)
sys/vm/vm_map.c:3257
 none not_reproduced not_testable untriaged — —
DF-2685 High 7.1 mlock()/mlockall()/wiring faults zero-fill non-resident (swapped-out) pages instead of paging them in — silent memory destruction in privileged processes
sys/vm/vm_fault.c:383 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2672 Medium 6.5 vm_object reference leak on fork() of wired (mlock'd) map entries — permanent swap/kernel-memory exhaustion by unprivileged users
sys/vm/vm_map.c:3627 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2843 Low 5.5 vnode_pager_generic_putpages() undirties pages on short writes — silent stale-data substitution (write-side DF-2663 family)
sys/vm/vnode_pager.c:771 · pass 2 · new
 none untested not_testable untriaged — —
DF-2686 Medium 4.7 vm_fault_object() pager-error tail wakes the wrong object's PIP: double-decrement on the terminal object (u_int wrap) and permanent +1 leak on fs->first_ba->object — unkillable D-state hang in vm_object_terminate
sys/vm/vm_fault.c:2241 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2866 Low 4.7 pagertab[] has 7 slots but enum obj_type has 8 values — an OBJT_MARKER (7) object dispatched to any pager op indexes one struct pagerops* past the array (latent uncontrolled indirect call; DF-0944 family)
sys/vm/vm_pager.c:152 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2939 Low 4.7 dev_pager_dealloc runs cdev_pg_dtor before unlinking the object from dev_pager_object_list (and outside dev_pager_mtx): racing cdev_pager_allocate for the same handle clobbers the fresh object's si_object, making the later old_dev_pager_dtor KKASSERT(dev->si_object) a reachable panic
sys/vm/device_pager.c:211 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-2844 Info 4.7 vnode_pager_haspage() divides by mnt_stat.f_iosize without a zero guard (autofs leaves f_iosize=0)
sys/vm/vnode_pager.c:259 · pass 2 · new
 none untested not_testable untriaged — —
DF-2879 Medium 4.4 swaponvp() stripe round-up registers up to 63 phantom swap pages per device beyond the real device end, wedging the pageout daemon in an unbounded EINVAL retry loop
sys/vm/vm_swap.c:365 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2673 Low 4.4 Recursive vm_map_lock in vm_map_growstack() MAP_WIREFUTURE path — deterministic kernel panic (mlockall(MCL_FUTURE) + stack growth)
sys/vm/vm_map.c:4274 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2983 Low 4.4 phys_pager_putpages() panics: vm_fault wiring path creates queue-managed pages in OBJT_PHYS objects (SysV shm + mlock + memory pressure → kernel panic)
sys/vm/phys_pager.c:99 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2676 Low 4.1 vm_page_grab() NULL-pointer dereference when the page exists but is busy and VM_ALLOC_RETRY is not set
sys/vm/vm_page.c:3841 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2880 Low 4.1 sp->sw_nblks is a 32-bit int but swaponvp() stores a 64-bit block count — swap devices >= 2^31 pages (8 TiB) truncate to negative/garbage bounds while vm_swap_size still counts the full size
sys/vm/vm_swap.c:344 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-2829 Medium 4.0 Uninitialized vm_zone->znalloc discloses stale kernel heap memory to unprivileged users via sysctl vm.zone (REQUESTS column)
sys/vm/vm_zone.c:453 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2674 Low 3.6 vm_map_growstack() maps grown stack pages VM_PROT_ALL (RWX), silently making the grown stack executable (W^X bypass)
sys/vm/vm_map.c:4246 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2889 Low 3.3 vm_contig_pg_clean color-queue validation is provably wrong: reclaims only color-0 pages, skipping 1023/1024 page queues — contigmalloc reclaim flush is ~99.9% ineffective
sys/vm/vm_contig.c:194 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-2881 Low 3.0 Duplicate-swap-device check compares vnodes, not devices — the same cdev swapped on twice via distinct devfs alias vnodes interleaves two swap stripes over the same physical blocks
sys/vm/vm_swap.c:281 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-2865 Low 2.5 pbuf reservation counters (pfreecnt): unsynchronized check-then-decrement in getpbuf*/trypbuf* drives counters negative and past their caps
sys/vm/vm_pager.c:418 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2840 Low 2.3 vm.swapcache.* tunables accept unbounded/negative values, wedging the swapcache daemon state machine and burst accounting
sys/vm/vm_swapcache.c:120 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-2678 Low 1.9 vm_page_free_contig() can leak PG_FICTITIOUS DMA-reserve pages when vm_low_phys_reserved has been lowered below the freed block
sys/vm/vm_page.c:2868 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-2835 Info 1.1 sys_vmspace_create violates its own ABI contract: accepts id==NULL and silently ignores type/data instead of rejecting them
sys/vm/vm_vmspace.c:146 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2888 Info 1.1 vcnt()/vcnt_intr() accumulate u_int per-CPU counters into signed int, wrapping vm.stats.* exports negative after 2^31 aggregate events
sys/vm/vm_meter.c:245 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2965 Info 1.1 brk/sbrk mappings are created RWX (VM_PROT_ALL as both prot and max_protection) — executable heap defeats future W^X policy
sys/vm/vm_unix.c:137 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2892 Info 0.8 alignment==0 passes the power-of-two check but means 'physical address 0' — guaranteed allocation failure after three full page-queue flush passes; plus copy-paste panic string in contigfree
sys/vm/vm_contig.c:268 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2841 Info 0.5 vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors
sys/vm/vm_swapcache.c:608 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2891 Info 0.5 contigmalloc_map silently ignores its map argument — kmap always allocates from kernel_map; a caller freeing via its own map corrupts the wrong vm_map
sys/vm/vm_contig.c:527 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-0946 Medium 6.5 swp_pager_meta_build while-loop can free a swap block assigned by a concurrent meta_build for the same pindex
sys/vm/swap_pager.c:2385
 none not_reproduced not_testable untriaged — —
DF-0940 Medium 5.5 Integer truncation in vm_map_growstack grow_amount enables unbounded kernel-memory-growth local DoS
sys/vm/vm_map.c:4110
 none not_reproduced not_testable untriaged — —
DF-0952 Medium 5.5 sys_vmspace_destroy leaks ve->refs on EBUSY, causing kernel panic in rb_vmspace_delete at proc exit
sys/vm/vm_vmspace.c:222
 none not_reproduced not_testable untriaged — —
DF-0955 Medium 4.7 Race-induced kernel panic in vm_contig_pg_alloc when first iteration of alloc loop fails (vm_contig_pg_free called with size=0)
sys/vm/vm_contig.c:398
 none not_reproduced not_testable untriaged — —
DF-0944 Low 4.7 NULL vm_page dereference when OBJT_MGTDEVICE pager returns VM_PAGER_FAIL (latent; no in-tree driver triggers it)
sys/vm/vm_fault.c:2033
 panic reproduced not_testable untriaged — —
DF-0941 Low 4.4 Kernel divide-by-zero panic in vm_get_pg_color via writable CPU topology sysctls (CTLFLAG_RW)
sys/vm/vm_page.c:1225
 panic reproduced fixed untriaged — —
DF-0958 Low 3.3 Double vm_object reference in cdev_pager_allocate leaks device pager objects forever
sys/vm/device_pager.c:131
 dos reproduced not_testable untriaged — —
DF-0961 Low 3.3 sys_sbrk does not enforce RLIMIT_VMEM (address-space limit), unlike sys_obreak
sys/vm/vm_unix.c:107
 none reproduced not_testable untriaged — —
DF-0943 Info 3.0 vm_page_alloc_contig silently ignores alignment, boundary, and low address constraints
sys/vm/vm_page.c:2764
 none reproduced not_testable untriaged — —
DF-0953 Low 2.5 Missed wakeup in relpbuf: pbuf pool sleepers not woken on first available buffer (I/O latency DoS)
sys/vm/vm_pager.c:645
 dos reproduced not_testable untriaged — —
DF-0960 Info 2.5 old_dev_pager_ctor truncates page count to unsigned int, skipping validation for huge sizes
sys/vm/device_pager.c:316
 none reproduced not_testable untriaged — —
DF-0947 Low 2.3 swap_pager_reserve leaks unused tail of last bulk allocation
sys/vm/swap_pager.c:764
 dos reproduced not_testable untriaged — —
DF-0950 Low 2.3 sys_mlockall done block unconditionally unwires, making MCL_CURRENT a silent no-op and undoing prior mlock() wiring
sys/vm/vm_mmap.c:1089
 dos reproduced not_testable untriaged — —
DF-0956 Low 2.3 kmem_alloc_attr leaks KVA, kernel_object ref, and wired pages on partial vm_page_alloc_contig failure
sys/vm/vm_kern.c:437
 dos reproduced not_testable untriaged — —
DF-0942 Info 1.9 vm_page_set_invalid dereferences m->object without NULL check (latent; no in-tree caller triggers it)
sys/vm/vm_page.c:4101
 none reproduced fixed untriaged — —
DF-0948 Info 1.9 swap_pager_putpages stripe-boundary trim is off-by-one, invoking freeswapspace with npages=0
sys/vm/swap_pager.c:1713
 none reproduced fixed untriaged — —
DF-0962 Info 1.1 Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-exploitable)
sys/vm/vm_unix.c:86
 none reproduced fixed untriaged — —

Base system — filesystems 171

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-3044 Medium 8.8 BOOTP/DHCP reply acceptance has zero origin validation and a fully deterministic transaction XID — spoofed reply gives same-L2 attacker total control of the diskless client (root/swap NFS server, hostname, default route)
sys/vfs/nfs/bootp_subr.c:595 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3062 High 8.4 ext2_nodealloccg INODE_UNINIT: memset(b_data, 0, ipg/8 - 1) underflows size_t for mount-legal ipg < 8 — unbounded kernel-heap memset on first create
sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3139 High 7.8 hpfs_hpbmap treats al_len==0 alleaf as an infinite extent: unprivileged arbitrary raw-device sector read/write via ordinary pread/pwrite
sys/vfs/hpfs/hpfs_alsubr.c:118 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2993 High 7.5 NFS READDIR/READDIRPLUS with count=0 from the wire infinite-loops the nfsd kernel thread (remote DoS, host starvation)
sys/vfs/nfs/nfs_serv.c:2977 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3205 Medium 7.5 krpc_call has zero-entropy transaction IDs and no reply-source filtering: deterministic xid (0xFFFFFF00+n), deterministic reserved-port sweep, and an unconnected socket whose from-address is discarded — any LAN host can blindly forge boot-critical RPC replies and become the diskless client's NFS/portmap authority
sys/vfs/nfs/krpc_subr.c:201 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3175 Medium 7.3 ftruncate()/unlink on special-file inodes (FIFO/device/socket) runs the ext2 truncate engine over their i_db[] overlay — kernel panic or silent free of live blocks (cross-file aliasing)
sys/vfs/ext2fs/ext2_inode.c:458 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3082 High 7.1 ext2 create in an htree-indexed directory truncates the directory mid-tree — mass silent data loss on valid Linux-created images, then kernel panic
sys/vfs/ext2fs/ext2_lookup.c:377 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3063 Medium 7.1 ext2_zero_inode_table computes all_blks from the RAW s_inode_size field — REV0 (which also bypasses the feature gate) zeroes up to ~512MB of device blocks past the inode table on first create
sys/vfs/ext2fs/ext2_alloc.c:1251 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3030 Medium 6.5 fuse_vop_nrename leaks a kmalloc'd M_TEMP buffer on every effective rename — unprivileged unbounded kernel heap exhaustion
sys/vfs/fuse/fuse_vnops.c:1219 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3158 Medium 6.5 deget() publishes the denode in the global hash before taking its reference (refcnt store outside the token): SMP TOCTOU permits duplicate denodes for one directory entry
sys/vfs/msdosfs/msdosfs_denode.c:308 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3000 Medium 6.3 hammer_vop_write UIO_NOCOPY (putpages/msync) path: bqrelse(bp) followed by bread(&bp) makes breadnx reuse the RELEASED buffer; write-out then runs on an unlocked free-queued buffer (guaranteed panic('buffer is not busy') + buffer-recycle race window); identical pattern in hammer2
sys/vfs/hammer/hammer_vnops.c:690 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3093 Medium 6.3 MSDOSFS_LOCK_MP expands to nothing: the free-cluster allocator (clusteralloc/chainalloc/usemap_alloc + pm_inusemap scan) is unsynchronized on SMP — double-allocation/cross-linked files (release) or KASSERT panic (INVARIANTS)
sys/vfs/msdosfs/msdosfs_fat.c:340 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3116 Medium 6.3 msdosfs_rename() restores stale de_fndoffset/de_fndcnt after dropping the target-directory lock — createde() blindly overwrites a concurrently-created dirent (TOCTOU)
sys/vfs/msdosfs/msdosfs_lookup.c:314 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3131 Low 6.3 msdosfs_mount() ignores the copyinstr(fspec) return and uses the then-uninitialized size as both offset and length in memset(f_mntfromname + size, 0, MNAMELEN - size) — garbage-indexed OOB write if the fspec string is raced out between nlookup and the copyin
sys/vfs/msdosfs/msdosfs_vfsops.c:281 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-3133 Medium 6.1 dirfs_node_chsize destroys the guest buffer cache/pager BEFORE the host truncate() is known to succeed — failed truncates (EFAULT on unlinked/over-length paths, EPERM by non-owner) silently discard acknowledged writes and desync the VM object; absolute_path NULL return never checked
sys/vfs/dirfs/dirfs_subr.c:778 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3152 Low 6.0 volume-add trusts ioc->vol_size with no device-size validation; KKASSERT error paths and unconditional-success error overwrite → deterministic kernel panic (INVARIANTS) or silent half-added volume (production)
sys/vfs/hammer/hammer_volume.c:117 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2994 Medium 5.9 WebNFS public-filehandle LOOKUP with configured-but-missing index file: vput() on an unlocked vnode → guaranteed kernel panic
sys/vfs/nfs/nfs_serv.c:565 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3148 Medium 5.9 HAMMER1 mirror-write: unvalidated wire leaf.base.btype panics hammer_btree_insert (and defers panics to every later delete-through)
sys/vfs/hammer/hammer_mirror.c:575 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3149 Medium 5.9 HAMMER1 mirror-write: wire delete_tid == create_tid panics hammer_delete_at_cursor via hammer_mirror_update (duplicate-record state on production kernels)
sys/vfs/hammer/hammer_mirror.c:777 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2995 Low 5.9 nfsrv_writegather leaks a reply mbuf chain per malformed-fh v3 WRITE when vfs.nfs.gatherdelay_v3 > 0 (remote mbuf exhaustion)
sys/vfs/nfs/nfs_serv.c:1263 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3253 Medium 5.8 hpfs_hphashvget hands out half-initialized H_INVAL hpfsnodes published by hpfs_vget's error paths — unprivileged race returns vnodes the kernel itself rejected (utimes()=0 successes on always-rejected fnodes) and leaves the mount un-unmountable ('panic: unmount: dangling vnode'); DF-3251 ext2 twin
sys/vfs/hpfs/hpfs_hash.c:116 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3153 Low 5.7 volume-del on a volume hosting UNDO-zone big-blocks: bare KKASSERT(0) panics INVARIANTS kernels; on production kernels the case falls through and bzero()s live undo FIFO entries (silent crash-recovery corruption)
sys/vfs/hammer/hammer_volume.c:554 · pass 2 · new
 none untested — untriaged — —
DF-3022 Medium 5.6 devfs lock-order inversion: VOP_NRESOLVE holds ncp across devfs_lock while destroy path holds devfs_lock across cache_inval_vp/cache_zap of the same ncp → unprivileged whole-system deadlock
sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3029 Medium 5.6 fuse_io_thread lost-wakeup window (no tsleep interlock between empty-queue check and sleep) can strand a bio indefinitely
sys/vfs/fuse/fuse_vnops.c:1682 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3023 Medium 5.5 tmpfs_write accepts negative pwrite offsets: unsigned-wrap of the EFBIG/RLIMIT/growth checks drives tmpfs_reg_resize(negative) → unprivileged kernel panic
sys/vfs/tmpfs/tmpfs_vnops.c:691 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3050 Medium 5.5 s_blocks_count never checked against the device size — crafted superblock drives a ~256GB M_WAITOK kmalloc before any group-descriptor read, wedging the whole system
sys/vfs/ext2fs/ext2_vfsops.c:591 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3056 Medium 5.5 dirfs_nrename never updates dn_parent on cross-directory rename — every subsequent path-based operation acts on the WRONG host file while fd I/O keeps hitting the original inode
sys/vfs/dirfs/dirfs_vnops.c:907 · pass 2 · new
 integrity reproduced not_testable untriaged — —
DF-3064 Medium 5.5 ext2_valloc EEXIST path leaks the ext2_ihashget() vnode lock+vref — crafted bitmap makes the mount un-unmountable with uninterruptible D-state processes
sys/vfs/ext2fs/ext2_alloc.c:423 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3083 Medium 5.5 ext2_dirbad panic()s a writable-mounted ext2 on any mangled directory entry — one flipped byte = reboot-loopable local DoS
sys/vfs/ext2fs/ext2_lookup.c:701 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3117 Medium 5.5 Racing file creates against cross-parent msdosfs directory renames leaks mount/vnode references: umount(2) hangs forever and the system wedges (unprivileged local DoS)
sys/vfs/msdosfs/msdosfs_lookup.c:822 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3143 Medium 5.5 hpfs_validateparent: no depth bound / cycle guard on the DE_DOWNLSN dive — unkillable kernel livelock and system-wide wedge via cyclic dirblk down-pointers
sys/vfs/hpfs/hpfs_subr.c:552 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3179 Medium 5.5 tmpfs dirent zone keeps the default malloc limit (RAM/10) and tmpfs_alloc_dirent allocates without M_NULLOK: unprivileged link(2) flood on the default /tmp panics the kernel ("tmpfs dirent: malloc limit exceeded")
sys/vfs/tmpfs/tmpfs_vfsops.c:200 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3182 Medium 5.5 tmpfs usermount memory cap is attacker-declared: size_max is never clamped to pages_limit for non-root mounts (vfs.usermount=1 → unbounded tm_pages_max/tm_nodes_max)
sys/vfs/tmpfs/tmpfs_vfsops.c:157 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3225 Medium 5.5 procfs ATTACH lacks ptrace's tracer-cycle check: two unprivileged processes build a p_pptr cycle; ptrace(PT_ATTACH)'s ancestor walk then spins forever in-kernel holding the target's p_token — permanent progressive kernel livelock
sys/vfs/procfs/procfs_ctl.c:134 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3230 Medium 5.5 Post-unmount fstatfs(2) on a still-open fd NULL-derefs in fuse_statfs: unguarded VFSTOFUSE(mp) after fuse_unmount clears mnt_data feeds fuse_ipc_get(NULL) -> fetch-add at 0x160 -> fatal trap 12 (deterministic panic)
sys/vfs/fuse/fuse_ipc.c:100 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2997 Medium 5.3 nfs_lookup/nfs_mkdir error paths vrele() vnodes that nfs_nget returned LK_EXCLUSIVE-locked — permanent vnode-lock leak, mount wedge / vnode exhaustion DoS from malformed server replies
sys/vfs/nfs/nfs_vnops.c:1270 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3013 Low 5.3 _hammer_ip_reseek() KKASSERTs on an EDEADLK-capable seek: INVARIANTS panic (or silent early iteration-EOF on release builds) when the btree re-seek deadlocks
sys/vfs/hammer/hammer_object.c:1443 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3014 Low 5.3 hammer_ip_sync_record_cursor() error path frees the bulk record's data reservation on retryable EDEADLK and ignores hammer_blockmap_finalize() failure — double-finalize / blockmap accounting corruption on the flush retry
sys/vfs/hammer/hammer_object.c:1256 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3108 Medium 5.0 ufs_dirbad panic()s a RW-mounted UFS on any mangled directory entry — one flipped byte = reboot-loopable kernel panic (UFS instance of ext2's DF-3083)
sys/vfs/ufs/ufs_lookup.c:601 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3178 Medium 4.8 hpfs_mountfs performs no super/spareblock census validation: unvalidated on-disk su_btotal panics the kernel at mount (bmind-list bread > MAXBSIZE), wires attacker-chosen kernel heap (32 MiB demonstrated per mount), and is echoed verbatim into statfs f_blocks
sys/vfs/hpfs/hpfs_vfsops.c:282 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3101 High 4.7 Unbounded recursion in hpfs_truncatealblk via crafted AB_NODES AlSec chain: kernel stack exhaustion (guard-page double fault) from unprivileged ftruncate
sys/vfs/hpfs/hpfs_vnops.c:559 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3096 Medium 4.7 mount -u ronly→rw transition: RW internal state, FWRITE device opens, and recovered-volume-header media writes are not rolled back when stage2 recovery fails
sys/vfs/hammer/hammer_vfsops.c:478 · pass 2 · new
 none untested not_testable untriaged — —
DF-3140 Medium 4.7 Error-path buffer leaks: missing brelse in hpfs_addextent children-reparenting loop (:498-500) and hpfs_truncatealblk sibling read (:798-801) — deterministic kernel panic (lockmgr locking against myself) + B_BUSY buffer accumulation DoS
sys/vfs/hpfs/hpfs_alsubr.c:498 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3194 Medium 4.7 nfs_nget/nfs_nget_nonblock race-loser paths vx_put() a never-connected VNON vnode — vx_put forces VREF_FINALIZE for VNON, vnode_terminate runs VOP_INACTIVE, and nfs_inactive dereferences v_data == NULL at nfs_node.c:393 → guaranteed kernel panic whenever the duplicate-validation branch executes (unprivileged local race on any NFS mount)
sys/vfs/nfs/nfs_node.c:194 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-3208 Medium 4.7 cd9660 ihash publish-before-validate: vget_internal leaves the half-initialized iso_node in the hash on every post-publish error path; a concurrent cd9660_ihashget blocked in vget wakes with the orphaned VNON vnode (i_mnt == NULL, i_devvp == NULL) and returns it as SUCCESS — NULL-deref panic in cd9660_getattr/read on first use
sys/vfs/isofs/cd9660/cd9660_node.c:118 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3004 Low 4.7 Unconditional nlinks decrement on unlink wraps a crafted nlinks=0 inode to UINT64_MAX — KKASSERT((int64_t)nlinks >= 0) panic in hammer_sync_inode (INVARIANTS) / poisoned link count persisted to media
sys/vfs/hammer/hammer_inode.c:2980 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-3020 Low 4.7 devfs_allocv failure ignored: devfs_spec_open and devfs_vop_nlookupdotdot use the vp unconditionally → vn_unlock(NULL)/NULL-fp panic under vnode exhaustion
sys/vfs/devfs/devfs_vnops.c:535 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3021 Low 4.7 devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has → NULL-deref panic when the device node was torn down under an open fd
sys/vfs/devfs/devfs_vnops.c:1432 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3025 Low 4.7 tmpfs_nlink LINK_MAX check-then-increment race across different directories can push tn_links past LINK_MAX → KKASSERT panic (INVARIANTS) / nlink contract breach
sys/vfs/tmpfs/tmpfs_vnops.c:1209 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3068 Low 4.7 Undo-walk desync via tail_size/hdr_size inconsistency drives bytes negative — deterministic KKASSERT(error || bytes == 0) panic in hammer_recover_stage1 (INVARIANTS) / silent mis-recovery on production kernels
sys/vfs/hammer/hammer_recover.c:393 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3094 Low 4.7 extendfile panics on FAT I/O error mid-extend (bread failure of the FAT block hits a KKASSERT instead of returning the error)
sys/vfs/msdosfs/msdosfs_fat.c:400 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3231 Low 4.7 Transaction starters ignore hammer_get_root_volume failure — trans->rootvol==NULL flows into ~25 ondisk derefs and hammer_rel_volume(NULL): kernel NULL-deref panic when root-volume-header reload I/O fails (KKASSERT is the only guard)
sys/vfs/hammer/hammer_transaction.c:53 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-3251 Medium 4.5 ext2 publish-before-validate (DF-3208 twin): all three post-ext2_ihashins error branches hand concurrent ext2_ihashget waiters half- or fully-initialized VBAD/VNON inodes, bypassing ext2_vinit's 'only unallocated inodes should be VNON' validation
sys/vfs/ext2fs/ext2_ihash.c:1358 · pass 2 · new
 none untested not_testable untriaged — —
DF-3067 Medium 4.4 PAD-only undo FIFO makes hammer_recover_stage1's seqno backscan (and stage2's extended-range scan) unbounded — mount never terminates, unkillable CPU-burning kernel thread (livelock DoS)
sys/vfs/hammer/hammer_recover.c:257 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3165 Medium 4.4 Unchecked on-disk lengths rootdir_icb.len and pms->st_size flow into bread/getblk: deterministic 'size > MAXBSIZE' panic at mount of a crafted image
sys/vfs/udf/udf_vfsops.c:373 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3201 Medium 4.4 Unbounded rule-application recursion via self-matching LINK rules: kernel stack exhaustion (double fault)
sys/vfs/devfs/devfs_rules.c:331 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3202 Medium 4.4 wildCaseCmp() recurses once per '*': star-heavy rule names exhaust the devfs core thread stack
sys/vfs/devfs/devfs_rules.c:306 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3002 Low 4.4 Forged btree leaf with data_offset==0: hammer_btree_extract returns cursor->data==NULL with error==0 (CRC skipped) → NULL-deref kernel panics in readdir/readlink/nresolve/dounlink/strategy_read sinks on crafted HAMMER images
sys/vfs/hammer/hammer_vnops.c:1254 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3087 Low 4.4 nfssvc(NFSSVC_AUTHIN) resume of an ENEEDAUTH'd nfsd re-enters the reply loop with nd == NULL — deterministic kernel NULL-deref panic (:671), plus nfsd_nd leak/dangle
sys/vfs/nfs/nfs_syscalls.c:448 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3124 Low 4.4 iso_mountfs ignores iconv_open() failure: NULL im_d2l/im_l2d handles panic the kernel on the first lookup under a kiconv mount (convchr(NULL) NULL-deref)
sys/vfs/isofs/cd9660/cd9660_vfsops.c:494 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3132 Low 4.4 FAT32 active-FAT number pm_curfat (bpbExtFlags & FATNUM, 0..15) never validated against pm_FATs — crafted BPB relocates every FAT read AND write outside the FAT region (fatblock adds curfat*FATsecs), kernel-mediated disk corruption on a RW mount of a crafted image
sys/vfs/msdosfs/msdosfs_vfsops.c:409 · pass 2 · new
 corruption reproduced not_testable untriaged — —
DF-3144 Low 4.4 hpfs_cpinit mount-time livelock: 'while (cpicnt > 0)' never terminates when every cpisec carries s_cpicnt == 0 and s_next chains (self-loop)
sys/vfs/hpfs/hpfs_subr.c:282 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3236 Low 4.4 devfs_inode_to_vnode() executes vn_lock() on the core worker's NULL result before the caller's NULL check can run — deterministic NULL-deref kernel panic from a crafted-but-root-gated devfs file handle (fhopen/fhstat/fhstatfs), and unauthenticated-remote if a devfs is exported over NFS (VFS_VGET wire path)
sys/vfs/devfs/devfs_vfsops.c:214 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3241 Low 4.4 ufs_check_export/ufs_fhtovp (via ffs_fhtovp) reachable with mnt_data==NULL in the dounmount fsid window: vfs_getvfs() hands out mounts that VFS_UNMOUNT already tore down — deterministic NULL-deref kernel panic (fatal trap 12 @ 0x18 in ffs_fhtovp), unauthenticated via nfsrv_fhtovp on exported UFS, root-gated via fhstat/fhopen
sys/vfs/ufs/ufs_vfsops.c:242 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3211 Low 4.3 md_lookup_swap() reads only the low 32 bits of the 64-bit NFSv3 file size into a signed int — swap files in the 2-4 GiB window produce negative swap_nblks (negative swap vnode size, ~2^64-block swaponvp claim); >=4 GiB sizes silently wrap
sys/vfs/nfs/nfs_mountrpc.c:286 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3069 Low 4.1 Unbounded rterm/rte allocation during stage2 extended-range TERM collection — attacker-controlled kernel-heap exhaustion at mount ('This must fit in memory!' is not enforced)
sys/vfs/hammer/hammer_recover.c:611 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3113 Low 4.1 hammer_ioc_add_snapshot / hammer_ioc_del_snapshot return with hmp->snapshot_lock held when hammer_init_cursor fails — permanent snapshot-subsystem lockup on production kernels
sys/vfs/hammer/hammer_ioctl.c:727 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3181 Low 4.1 Failed non-forced umount of tmpfs has already truncated every regular file (destructive pre-vflush pass leaves a live mount with destroyed data)
sys/vfs/tmpfs/tmpfs_vfsops.c:284 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3075 Info 3.9 nfs_statfs/nfs_statvfs apply server-claimed filesystem geometry unvalidated: v3 f_blocks/f_bfree/f_bavail cast (long)(u_quad/1024) can go negative, v2 f_bsize is an arbitrary server int, statvfs 64-bit fields unclamped
sys/vfs/nfs/nfs_vfsops.c:357 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3088 Low 3.7 nfssvc_nfsd() socket-zap race after the pipelined dorec leaks the request's mbuf chain and client address (:576-579 frees only the descriptor)
sys/vfs/nfs/nfs_syscalls.c:575 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3150 Low 3.7 HAMMER1 mirror-write: HAMMER_MREC_TYPE_REC_NODATA case is dead code (mask strips the NODATA bit) — NODATA records installed as holes instead of skipped
sys/vfs/hammer/hammer_mirror.c:429 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3038 Low 3.6 Crafted FAT32 root-alias directory entry (startCluster == pm_rootdirblk): rmdir() frees the live mount's root-directory cluster chain; rename() clobbers root entry 1 and creates a namespace cycle
sys/vfs/msdosfs/msdosfs_vnops.c:1230 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3076 Low 3.6 Unvalidated on-disk B-Tree leaf data_len consumed as `bytes` by hammer_blockmap_free/dedup/finalize with INVARIANTS-only bounds — deterministic panic from unprivileged unlink on crafted nohistory HAMMER; production: int32 layer2 bytes_free wrap and force-free of a still-referenced big-block
sys/vfs/hammer/hammer_blockmap.c:785 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3234 Low 3.6 ext2_balloc's four newb > UINT_MAX EFBIG returns leak the just-allocated block and leave ip->i_blocks inflated — permanent unprivileged-triggerable space/accounting corruption on 64BIT filesystems
sys/vfs/ext2fs/ext2_balloc.c:135 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3252 Low 3.6 ffs_vget publishes the inode into the ihash before validating it: bread-failure branch hands concurrent ufs_ihashget waiters a VBAD zeroed-inode vnode as a successful VFS_VGET result (DF-3208 ufs twin)
sys/vfs/ufs/ufs_ihash.c:1120 · pass 2 · new
 none untested not_testable untriaged — —
DF-3043 Low 3.5 nm_bioqlen async-bio accounting leaks on every nfs_startio early-exit and underflows on commit→write reissue — permanent mount-wide loss of NFS read-ahead from a malicious/oversized-server attribute claim (and loss of the async throttle)
sys/vfs/nfs/nfs_bio.c:922 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3026 Low 3.3 tmpfs_write never re-checks APPEND/IMMUTABLE per write — flags set after open are defeated by pre-existing writable fds (UFS enforces APPEND per-write)
sys/vfs/tmpfs/tmpfs_vnops.c:268 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3059 Low 3.3 dirfs_setattr chtimes ignores the requested va_atime/va_mtime entirely — lutimes(path, NULL) always stamps 'now' (utimensat/UTIME_OMIT semantics unimplemented)
sys/vfs/dirfs/dirfs_vnops.c:556 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3079 Low 3.3 procfs Pmem exclusive-open latch: plain write-open+close permanently denies O_EXCL opens of /proc/<pid>/mem (EBUSY until vnode reclaim)
sys/vfs/procfs/procfs_vnops.c:186 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3085 Low 3.3 htree lookup misses existing entries whose hash sorts below the first dx entry (dx count/limit overlay used as an entry) — existing files unopenable/undeletable on valid indexed dirs
sys/vfs/ext2fs/ext2_lookup.c:380 · pass 2 · new · 📝
 none reproduced not_testable disputed — —
DF-3126 Low 3.3 cd9660_vptofh truncates ino_t into int ifid_ino; cd9660_vget_internal's int lbn truncation makes the volume-space bounds check bypassable — NFS file-handle inode aliasing and negative-offset bread on crafted/large images
sys/vfs/isofs/cd9660/cd9660_vfsops.c:774 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3135 Low 3.3 dirfs_open_helper tests the vnode type with a bitwise AND ('dnp->dn_type & VDIR') instead of equality — VBLK/VSOCK/VFIFO nodes are always opened with O_DIRECTORY and can never be opened at all; VLNK/VCHR take the plain-file path
sys/vfs/dirfs/dirfs_subr.c:583 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3162 Low 3.3 revoke(2) on a FIFO silently does nothing (DTYPE_VNODE vs DTYPE_FIFO mismatch)
sys/vfs/fifofs/fifo_vnops.c:442 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3174 Low 3.3 Trigger retry dedup re-acquires already-done requests: concurrent waiters burn their retry budget on stale errors and never re-notify automountd
sys/vfs/autofs/autofs.c:324 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3228 Low 3.3 /dev/fuse open/close without mounting leaks struct fuse_mount — cdevpriv dtor skips the free on the ENODEV path
sys/vfs/fuse/fuse_device.c:38 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3136 Info 3.3 dirfs_node_stat computes nanosecond timestamp fields as tv_sec * 1000000000 (wrong field, int32 overflow) — guest-visible garbage nanoseconds on every dirfs stat
sys/vfs/dirfs/dirfs_subr.c:357 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3163 Info 3.3 FIONREAD on an O_RDWR fifo descriptor always returns 0 (write-socket pass clobbers the answer)
sys/vfs/fifofs/fifo_vnops.c:442 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3217 Info 3.3 EXT2F_INCOMPAT_EXTENTS advertised as supported (EXT2F_INCOMPAT_SUPP) but the entire extents I/O path is EINVAL stubs — every extents-flagged inode (any real ext4 filesystem) fails read/write/truncate after a successful mount, and unlink of extents inodes leaks their blocks
sys/vfs/ext2fs/ext2_bmap.c:84 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3031 Low 3.1 ext2_readdir never corrects the caller's cookie count — missing '*' deref leaves stale uninitialized kernel heap in the over-reported tail (VOP contract violation, latent NFS-facing heap disclosure)
sys/vfs/ext2fs/ext2_vnops.c:262 · pass 2 · new
 none untested not_testable untriaged — —
DF-3097 Low 3.1 HAMMER1 NFS file handles carry zero entropy and fhtovp honors an attacker-chosen as-of TID: forged handles yield historical-version reads and cross-PFS reach on exported mounts
sys/vfs/hammer/hammer_vfsops.c:1083 · pass 2 · new
 none untested not_testable untriaged — —
DF-2991 Low 2.5 handle_workitem_freeblocks: indir_trunc errors silently swallowed — '== 0' dead store makes allerror unreachable, I/O errors during indirect-block deallocation unreported
sys/vfs/ufs/ffs_softdep.c:2168 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3032 Low 2.5 ext2_rename strands IN_RENAME on the source directory inode when the step-3 relookup race resolves the from-name to a different inode — directory permanently unrenameable (EINVAL) until reclaim
sys/vfs/ext2fs/ext2_vnops.c:1025 · pass 2 · new
 none untested not_testable untriaged — —
DF-3053 Low 2.5 nfsm_mbuftouio ignores copyout() fault — NFS read() reports full success with stale destination bytes
sys/vfs/nfs/nfsm_subs.c:1071 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3058 Low 2.5 dirfs_fsync returns 0 unconditionally — host fsync() failures are swallowed (and the double-fsync retry stores -1, not errno)
sys/vfs/dirfs/dirfs_vnops.c:588 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3077 Low 2.5 Zone-end wrap check uses exact equality while unvalidated layer2->append_off / blockmap next_offset / hint can push next_offset past the zone boundary — allocations returned outside the requested zone on production kernels
sys/vfs/hammer/hammer_blockmap.c:137 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3104 Low 2.5 Unvalidated timestamp month indexes mon_lens out of bounds — kernel static .data past the 2x12 array observable via stat() mtime differences
sys/vfs/udf/udf_vnops.c:220 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3105 Low 2.5 64-bit file-offset truncation family beyond DF-0833: udf_read's int offset, and udf_strategy/udf_bmap passing off_t bio_offset/loffset into udf_bmap_internal's uint32_t parameter
sys/vfs/udf/udf_vnops.c:399 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3110 Low 2.5 hammer_cursor_moved_element() again2 parent-cursor leaf fixup indexes the PARENT's element array with the CHILD's index (oindex instead of pindex) — cursor->leaf left stale inside a node the cursor no longer references during rebalance
sys/vfs/hammer/hammer_cursor.c:1054 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3129 Low 2.5 msdosfs_sync() never initializes scaninfo.waitfor — uninitialized kernel-stack read gates metadata flushing: sync(2)/umount can silently skip fsync of dirty denodes depending on stack garbage's MNT_LAZY bit (DF-specific regression; NetBSD sets ctx.waitfor, FreeBSD passes waitfor directly)
sys/vfs/msdosfs/msdosfs_vfsops.c:787 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3142 Low 2.5 hpfs_bmlookup off-by-one ('lsn > su_btotal' admits lsn == su_btotal): step-1 probe reads exactly one word past the hpm_bitmap kmalloc on exact-band volumes
sys/vfs/hpfs/hpfs_subr.c:340 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3160 Low 2.5 Lost-wakeup window in fifo_open() FIFO rendezvous (uninterlocked check-then-sleep, no re-check loop)
sys/vfs/fifofs/fifo_vnops.c:295 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3186 Low 2.5 hammer_upgrade_undo_4 never terminates on UNDO_ALIGN-incongruent alloc_offset in a crafted volume header — unkillable kernel thread under finalize_lock+sync_lock, mount hang and buffer-cache deadlock
sys/vfs/hammer/hammer_undo.c:381 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3006 Low 2.3 nlinks double-decrement on DEVFS_RULE_RESET of a rule-created link underflows size_t and permanently leaks the target devfs node (silent, leak_count-balanced)
sys/vfs/devfs/devfs_core.c:526 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3130 Low 2.3 update_mp() re-executed on every remount with fspec re-opens all four iconv handles without closing the previous ones — unbounded kernel-heap handle leak via mount -u loop (partial-failure remounts leak the replaced handles too)
sys/vfs/msdosfs/msdosfs_vfsops.c:115 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3145 Low 2.3 hpfs_cpinit error paths leak the hpm_cpdblk allocation (mount-failure memory exhaustion)
sys/vfs/hpfs/hpfs_subr.c:276 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3161 Low 2.3 umount -f force-close never passes FREAD: fifo fifoinfo + connected socket pair leak permanently
sys/vfs/fifofs/fifo_vnops.c:610 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3166 Low 2.3 Memory leaks on udf_mountfs/udf_vget error paths: s_table freed only in udf_unmount, unode->fentry leaked when udf_allocv fails
sys/vfs/udf/udf_vfsops.c:393 · pass 2 · new
 leak not_reproduced not_testable untriaged — —
DF-3189 Low 2.3 hammer_ioc_set_pseudofs clobbers hammer_load_pseudofs's error with copyin's result — every load failure (not just the intended ENOENT) is silently ignored and the PFS is created/saved anyway
sys/vfs/hammer/hammer_pfs.c:117 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3221 Info 2.3 dirfs_statfs/dirfs_statvfs bcopy the host statfs/statvfs over mnt_stat, clobbering the per-mount f_fsid assigned by vfs_getnewfsid — all dirfs mounts over one host filesystem share a fsid
sys/vfs/dirfs/dirfs_vfsops.c:156 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3244 Info 2.3 ufs_quotactl returns success (0) without performing the operation when vfs_busy(mp, LK_NOWAIT) fails — Q_QUOTAON/Q_SETQUOTA/Q_QUOTAOFF silently no-op during unmount contention, a security-control fail-open
sys/vfs/ufs/ufs_vfsops.c:141 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3019 Low 1.9 devfs_spec_open clone path: EPERM/EBUSY early returns after securelevel/mounted-RW checks leak the cloned vp exclusively locked and referenced forever
sys/vfs/devfs/devfs_vnops.c:1006 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3121 Info 1.9 ufs_dqsync drops DQ_MOD on write failure — quota record silently never written, permanent under-accounting after I/O errors
sys/vfs/ufs/ufs_quota.c:887 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3176 Info 1.9 ext2_update clears IN_MODIFIED/IN_LAZYMOD/IN_LAZYACCESS before attempting the write — dirty inode state silently lost on I/O error
sys/vfs/ext2fs/ext2_inode.c:79 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3257 Info 1.9 cd9660_ioctl's catch-all ENOTTY hides FIOSEEKDATA/FIOSEEKHOLE from cd9660 (lseek SEEK_DATA returns EINVAL) and leaves cd9660_bmap's alignment-only contract one wiring away from an unprivileged INVARIANTS panic
sys/vfs/isofs/cd9660/cd9660_bmap.c:76 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3070 Low 1.1 tmpfs_reg_resize shrink path: 'aobj->size = osize;' self-assignment dead store — swap-object size never reduced after truncate (intended aobj->size = nsize), live upstream
sys/vfs/tmpfs/tmpfs_subr.c:1055 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3246 Info 1.1 isofncmp ';version' parse: signed int overflow (UB) enables false-positive filename matches via modular wrap
sys/vfs/isofs/cd9660/cd9660_util.c:118 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3247 Info 1.1 KICONV mounts: invalid-charset input yields 0-rune without consuming input, so isofncmp returns 0 (match) for non-equal names
sys/vfs/isofs/cd9660/cd9660_util.c:110 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3249 Info 1.1 ext2_clusteracct computes a negative shift count (1 << (start % NBBY) with start=-1) when freeing/accounting cg-relative bit 0 — C99 undefined behavior, no observable effect on x86
sys/vfs/ext2fs/ext2_subr.c:175 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3119 Low 0.8 flush_group refcount asymmetry: critical-error unmount decrements flg->refs for inodes that never incremented it
sys/vfs/hammer/hammer_flusher.c:423 · pass 2 · new
 corruption not_reproduced not_testable untriaged — —
DF-3007 Info 0.8 devfs_uninit passes NULL to devfs_msg_send — two stores through address 0 (latent; SYSUNINIT path dead on stock configs)
sys/vfs/devfs/devfs_core.c:1112 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3042 Info 0.8 Volume-header CRC (vol_crc) is never verified — hammer_crc_test_volume has zero callers; all mount-time header consumption is integrity-unchecked
sys/vfs/hammer/hammer_ondisk.c:180 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3034 Info 0.5 KKASSERT is the only bounds check before bcopy/hammer_datacrc in hammer_indirect_callback (defense-in-depth gap on non-INVARIANTS kernels)
sys/vfs/hammer/hammer_io.c:1658 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3039 Info 0.5 msdosfs_mkdir truncates cntobn() block number to int — new-directory metadata written at wrong device offset on FAT volumes >1 TiB
sys/vfs/msdosfs/msdosfs_vnops.c:1332 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3151 Info 0.5 HAMMER1 mirror ioctls: mirror->size unchecked in mirror_read and mirror->count unchecked in both paths — wrap-around bypasses the ubuf bounds guards (hardening)
sys/vfs/hammer/hammer_mirror.c:156 · pass 2 · new
 none untested not_testable untriaged — —
DF-3256 Info 0.5 at_exit(procfs_exit) registration races on an unsynchronized vfc_refcount==1 gate: two concurrent procfs mounts can both skip registration, leaving every exited process's pfsnode unmarked (PFS_DEAD never set)
sys/vfs/procfs/procfs_vfsops.c:73 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3037 Medium — msdosfs doscheckpath() unbounded ".." ancestor walk — rename(2) kernel livelock wedging the whole system (crafted FAT ".." cycle)
sys/vfs/msdosfs/msdosfs_vnops.c:1045 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3054 Medium — dirfs_findfd() NULL return on over-length relative path is dereferenced by dirfs_getattr/dirfs_readlink/dirfs_alloc_file — vkernel panic from a deep path (unprivileged DoS)
sys/vfs/dirfs/dirfs_vnops.c:389 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3055 Medium — dirfs_nsymlink/dirfs_nmkdir execute the success path when dirfs_alloc_file() fails: dirfs_knote(*vpp==NULL) SIGSEGV, negative-cache of an existing name, and the real error clobbered by stale errno
sys/vfs/dirfs/dirfs_vnops.c:1067 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-0779 Medium 6.5 tmpfs_readdir cookie generation panics on attacker-supplied bogus NFS cookie — KKASSERT/RB_NEXT(NULL)
sys/vfs/tmpfs/tmpfs_vnops.c:1697
 panic reproduced fixed untriaged — —
DF-0802 Medium 6.5 Panic on malformed BOOTP/DHCP options from unauthenticated network reply during diskless boot — pre-auth remote DoS
sys/vfs/nfs/bootp_subr.c:1390
 panic reproduced not_testable untriaged — —
DF-0893 High 6.3 hammer_enter_undo_history mutates RB tree/TAILQ without lock racing concurrent frontends
sys/vfs/hammer/hammer_undo.c:125
 panic reproduced fixed untriaged — —
DF-0886 Medium 6.1 autofs_node_vn loses a create race panicking kernel on concurrent first-lookup
sys/vfs/autofs/autofs_vnops.c:569
 panic reproduced fixed untriaged — —
DF-0841 Medium 5.9 NULL deref in ISDOTDOT lookup path — VTODE(*vpp) on unassigned *vpp=NUL via missing assignment
sys/vfs/msdosfs/msdosfs_lookup.c:557
 panic reproduced fixed untriaged — —
DF-0858 High 5.5 Unbounded dive depth in hpfs_hpbmap allows infinite kernel loop via cyclic alsec pointers
sys/vfs/hpfs/hpfs_alsubr.c:78
 dos reproduced fixed untriaged — —
DF-0770 Medium 5.5 Record sync error silently dropped in hammer_sync_inode — variable name typo tmp_error=-error should be -tmp_error
sys/vfs/hammer/hammer_inode.c:3066
 data-integrity (silent error-drop; not memory corruption) reproduced fixed untriaged — —
DF-0808 Medium 5.5 dirfs_nrename NULL deref panic on over-length or unlinked rename paths
sys/vfs/dirfs/dirfs_vnops.c:977
 none not_reproduced not_testable untriaged — —
DF-0834 Medium 5.5 ufs_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang (UFS analog of DF-0824)
sys/vfs/ufs/ufs_lookup.c:1130
 dos reproduced fixed untriaged — —
DF-0839 Medium 5.5 hammer_ioc_set_version leaks sync_lock and finalize_lock on undo-upgrade error — deadlocks or panics filesystem
sys/vfs/hammer/hammer_ioctl.c:638
 dos reproduced fixed untriaged — —
DF-0855 Medium 5.5 dirfs_findfd KKASSERT panic / NULL deref on unlinked dirfs nodes
sys/vfs/dirfs/dirfs_subr.c:479
 panic reproduced fixed untriaged — —
DF-0879 Medium 5.5 Unbounded CE continuation chain in cd9660_rrip_loop allows infinite kernel loop via crafted ISO
sys/vfs/isofs/cd9660/cd9660_rrip.c:503
 dos reproduced fixed untriaged — —
DF-0883 Medium 5.5 Unvalidated logical block size lb_size enables divide-by-zero and UB shifts
sys/vfs/udf/udf_vfsops.c:306
 panic reproduced fixed untriaged — —
DF-0910 Medium 5.5 Divide-by-zero kernel panic via HAMMER_IOC_PRUNE with mod_tid=0
sys/vfs/hammer/hammer_prune.c:305
 panic reproduced fixed untriaged — —
DF-0911 Medium 5.5 procfs ATTACH skips saving p_oppid for already-owned children; DETACH reparents victim to proc0 leaking permanent zombies
sys/vfs/procfs/procfs_ctl.c:153
 logic_orphan reproduced fixed untriaged — —
DF-0765 Low 5.5 Wrong semaphore released in newblk_lookup race-avoided path — pagedep_in_progress instead of newblk_in_progress
sys/vfs/ufs/ffs_softdep.c:1017
 none reproduced not_testable untriaged — —
DF-0794 Low 5.5 Divide-by-zero panic when fs_ncg==0 — unvalidated superblock geometry mounts successfully then traps on first allocation
sys/vfs/ufs/ffs_alloc.c:676
 panic reproduced fixed untriaged — —
DF-0928 Medium 5.3 UFS inode-hash has no lock; concurrent ffs_vget() inserts orphan an inode and panic on reclaim (dual-vnode on production)
sys/vfs/ufs/ufs_ihash.c:78
 none not_reproduced not_testable untriaged — —
DF-0900 Low 5.3 Signed integer overflow in RPC reply verifier length allows mbuf length corruption
sys/vfs/nfs/krpc_subr.c:425
 dos reproduced fixed untriaged — —
DF-0824 Medium 5.0 ext2_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang
sys/vfs/ext2fs/ext2_lookup.c:1212
 dos reproduced fixed untriaged — —
DF-0819 Medium 4.7 blkmap_lock leaked on hammer_bnew error paths — goto failed jumps past hammer_unlock permanently deadlocking HAMMER filesystem
sys/vfs/hammer/hammer_blockmap.c:285
 dos reproduced fixed untriaged — —
DF-0847 Medium 4.7 Global dquot hash/free-list manipulated with no lock - concurrent ufs_dqget cache-miss corrupts lists and panics
sys/vfs/ufs/ufs_quota.c:769
 none not_reproduced not_testable untriaged — —
DF-0889 Medium 4.7 hpmp leaked in hpfs_mountfs failed-mount path (memory exhaustion DoS)
sys/vfs/hpfs/hpfs_vfsops.c:262
 dos reproduced fixed untriaged — —
DF-0918 Medium 4.7 NULL-deref panic via dead/replied race in fuse_ipc_wait early-return paths
sys/vfs/fuse/fuse_ipc.c:163
 panic reproduced fixed untriaged — —
DF-0892 Low 4.7 tmpfs_root dereferences *vpp without checking tmpfs_alloc_vp error
sys/vfs/tmpfs/tmpfs_vfsops.c:424
 panic reproduced not_testable untriaged — —
DF-0913 Info 4.7 fuse_audit_length / fuse_get_ops panic kernel on unknown opcode
sys/vfs/fuse/fuse_util.c:229
 none reproduced not_testable untriaged — —
DF-0773 Medium 4.4 NULL deref in devfs_inode_to_vnode — vn_lock called on NULL vp when inode not found
sys/vfs/devfs/devfs_core.c:959
 panic reproduced fixed untriaged — —
DF-0867 Medium 4.4 Kernel panic via unvalidated rec_type in mirror_write_rec path
sys/vfs/hammer/hammer_mirror.c:575
 dos reproduced fixed untriaged — —
DF-0898 Medium 4.4 NULL pointer deref when DEVFS_RULE_LINK is used without DEVFS_RULE_NAME
sys/vfs/devfs/devfs_rules.c:113
 panic reproduced fixed untriaged — —
DF-0838 Low 4.4 Crafted image triggers kernel panic via unimplemented directory hash algorithm (ALG2/ALG3)
sys/vfs/hammer/hammer_subs.c:953
 panic reproduced fixed untriaged — —
DF-0852 Low 4.4 Unvalidated user ssector causes signed-integer overflow in volume descriptor loop and volume_space_size
sys/vfs/isofs/cd9660/cd9660_vfsops.c:326
 dos reproduced fixed untriaged — —
DF-0868 Low 4.4 Missing error check on hammer_init_cursor in mirror_write allows use of invalid cursor
sys/vfs/hammer/hammer_mirror.c:362
 panic reproduced not_testable untriaged — —
DF-0792 Low 4.1 NULL deref in direct I/O paths when hammer_get_volume fails — hammer_rel_volume(NULL) unconditional
sys/vfs/hammer/hammer_io.c:1487
 panic reproduced fixed untriaged — —
DF-0845 Low 4.1 Integer overflow in nslots computation with very large directories and elevated dirhash_maxmem — infinite loop hang
sys/vfs/ufs/ufs_dirhash.c:132
 dos reproduced not_testable untriaged — —
DF-0890 Low 3.6 hpfsnode h_gid initialized from hpm_uid (copy/paste typo) wrong group on all files
sys/vfs/hpfs/hpfs_vfsops.c:510
 none reproduced not_testable untriaged — —
DF-0856 Low 3.3 dirfs_alloc_file openat error path leaks dirfs node and parent refcount
sys/vfs/dirfs/dirfs_subr.c:182
 none reproduced not_testable untriaged — —
DF-0924 Low 3.3 Attacker-controlled kernel heap allocation size via read() resid
sys/vfs/procfs/procfs_map.c:61
 dos reproduced fixed untriaged — —
DF-0809 Low 2.5 dirfs_getattr returns 0 unconditionally even when dirfs_node_stat fails — stale/uninitialized attributes
sys/vfs/dirfs/dirfs_vnops.c:368
 none reproduced not_testable untriaged — —
DF-0833 Low 2.5 Integer truncation of uint64_t inf_len to int in udf_read and udf_readdir — files >2GB truncated
sys/vfs/udf/udf_vnops.c:391
 dos reproduced not_testable untriaged — —
DF-0937 Info 2.5 Write-path SSTOP check diverges from LSSTOP check used by fpregs/dbregs siblings
sys/vfs/procfs/procfs_regs.c:68
 none reproduced not_testable untriaged — —
DF-0896 Low 2.3 Resource leak on mount error paths leaks credential fuse_node and refcount
sys/vfs/fuse/fuse_vfsops.c:185
 dos reproduced not_testable untriaged — —
DF-0909 Info 2.3 Memory leak of dirfs_mount structure on mount-time stat failure
sys/vfs/dirfs/dirfs_vfsops.c:148
 none reproduced fixed untriaged — —
DF-0828 Info 1.9 Buffer leak in markvoldirty_upgrade on bread error (dead code path)
sys/vfs/msdosfs/msdosfs_fat.c:1154
 none reproduced fixed untriaged — —

Base system — network stack 374

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-3422 High 9.1 gre(4) decapsulation keeps the outer packet's M_LENCHECKED and computes the GRE header length from attacker flag bits with no presence check (m_len/m_pkthdr.len int underflow) — one unauthenticated GRE packet panics the default INVARIANTS kernel; lying-length/negative-m_len state flows on production kernels (DF-3321's fix covered gif+mpls+ip_mroute but missed gre)
sys/net/gre/if_gre.c:148 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3323 Medium 8.3 Shared-key 802.11 auth accepts cleartext challenge response: full authentication bypass without the WEP key
sys/netproto/802_11/wlan/ieee80211_hostap.c:851 · pass 2 · new
 auth_bypass (remote RF-adjacent, no key: authorized+associated, AID, EAPOL passthrough; cleartext data when DROPUNENC off) reproduced fixed untriaged — —
DF-3326 Medium 7.6 hostap association granted without completed authentication (assoc gate tests node-table existence, and a single auth REQUEST creates the node)
sys/netproto/802_11/wlan/ieee80211_hostap.c:1953 · pass 2 · new
 auth_bypass (association without authentication: AID assignment, powersave eligibility, EAPOL passthrough, assoc-flood DoS) reproduced fixed untriaged — —
DF-3293 High 7.5 tcp_input(): TCP data offset (th_off) validated only by KASSERT — one-packet unauthenticated remote panic on default INVARIANTS kernels; negative-tlen protocol-state corruption on production kernels
sys/netinet/tcp_input.c:764 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3340 High 7.5 pf synproxy PROXY:DST state purge emits spoofed RST from non-netisr context (purge thread / pfctl ioctls / module unload) -> guaranteed ip_output ASSERT_NETISR_NCPUS panic; default-config, remotely unauthenticated trigger
sys/net/pf/pf.c:1487 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3268 Medium 7.5 pf state-table hard limit (PFSTATE_HIWAT / `set limit states`) is never enforced — unbounded state growth, remote memory-exhaustion DoS
sys/net/pf/pf.c:278 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3295 Medium 7.5 Signed sr_ssid[i].len in ieee80211_scanreq passes the >NWID_LEN check; -1 reaches memcpy as (size_t)-1 → unbounded kernel-heap copy through the vap (fatal write fault)
sys/netproto/802_11/wlan/ieee80211_ioctl.c:2496 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3361 Medium 7.5 pf fragment pools have no enforced limit: unbounded kernel memory growth under fragment flood (remote DoS)
sys/net/pf/pf_norm.c:118 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3377 Medium 7.5 PIM6 REGISTER decap panics: fake multicast_register_if is never if_attach()ed — if_simloop() writes through NULL if_data_pcpu (3 stacked NULL derefs: if_simloop stats, in6_ifawithifp if_addrheads, in6_addr2zoneid scope6)
sys/netinet6/ip6_mroute.c:585 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3362 Low 7.5 pf_fragcache overlap-chop path: INVARIANTS KASSERT panics on multi-mbuf fragments (m_adj tail-trim leaves zero-length mbufs chained)
sys/net/pf/pf_norm.c:661 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3337 High 7.4 pfr_insert_kentry() mutates the table radix tree (rn_addroute + pfrkt_cnt++) on the packet path, which holds pf_token only SHARED: multi-CPU overload floods race and corrupt the tree
sys/net/pf/pf_table.c:861 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5734 High 7.4 Num_Compl_Pkts completion credit wedges hci_acl_complete() in a no-progress infinite loop: NETISR thread (holding the mplock) spins forever -> total system hang from one 8-byte event
sys/netbt/hci_event.c:380 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5739 High 7.4 Expiry-callout teardown race: hci_acl_timeout() (softclock) frees refcnt-0 links concurrently with event-context hci_link_free()/hci_acl_recv() (netisr) - dead callout_active() deferral lets two hci_link_free() bodies interleave: double kfree demonstrated ('memchunk already freed' panic)
sys/netbt/hci_link.c:191 · pass 2 · new
 panic reproduced inconclusive untriaged — —
DF-5735 Medium 7.4 READ_BUFFER_SIZE completion with max_acl_size=0 poisons the unit ACL MTU (DF-5733 lens): hci_acl_send() fragmentation loop is structurally infinite and drains the global mbuf pool; link tx blackholed
sys/netbt/hci_event.c:884 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3459 Medium 7.1 rssadapt_rate returns/stores rix=-1 (fresh node RSSI=0 or converged thresholds): rs_rates[-1] read, iwm_setrates KASSERT panic on INVARIANTS kernels, and u_int-indexed ~+8GiB wild read+write in rssadapt_lower_rate — the negative-side residual of DF-0730
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:253 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3462 Medium 6.7 IP_FW_SET_TOGGLE/IP_FW_SET_GET operate only on CPU0's per-CPU sets bitmap — ipfw3 set enable/disable silently ineffective for all flows hashed to CPUs 1..N-1 (deterministic per-flow firewall policy divergence on SMP)
sys/net/ipfw3/ip_fw3_set.c:192 · pass 2 · new
 firewall-policy divergence: IP_FW_SET_TOGGLE flips only CPU0's per-CPU sets bitmap, so ipfw3 set disable/enable is silently ineffective for every flow hashed to CPUs 1..N-1 (deny/allow/count/skipto rules in the toggled set keep their old state on 5/6 of traffic on a 6-CPU box, while `ipfw3 set show` reports the operator-facing state as changed) reproduced fixed untriaged — —
DF-3287 High 6.5 Remote kernel panic via AE=01 unicast mesh data frame: route for addr4 never ensured, KASSERT/NULL-deref in to_fwrd/to_me
sys/netproto/802_11/wlan/ieee80211_mesh.c:1441 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3327 High 6.5 Remote kernel panic: hwmp_send_action KASSERT/NULL-deref when a proactive/propagated/intermediate PREP is sent along a never-validated zero nexthop
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1090 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3331 High 6.5 nd6: ND6_LLINFO_NOSTATE neighbor-cache entries are never garbage-collected — unauthenticated peer pins unbounded kernel memory (~444 B per ND packet) on gif-class outputs
sys/netinet6/nd6.c:496 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3524 High 6.5 ng_l2cap untimeout misreads cancelled-armed timers as ETIMEDOUT (DF-3515): every LP_ConnectCfm/DisconInd/signaling response is discarded -> L2CAP permanently broken, stuck-timeout con, deterministic teardown panic
sys/netgraph7/bluetooth/l2cap/ng_l2cap_llpi.c:180 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3273 Medium 6.5 One-frame remote kernel panic: CONF-NAK/CONF-REJ with h->len < 4 reaches RCN handlers that kmalloc() a negative (size_t-wrapped) length
sys/net/sppp/if_spppsubr.c:1541 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3288 Medium 6.5 ms_known_gates gate entries are never freed: unauthenticated GANN spam exhausts kernel heap and leaks across vap destroy
sys/netproto/802_11/wlan/ieee80211_mesh.c:646 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3312 Medium 6.5 ieee80211_ht_wds_init never assigns tap->txa_ni: guaranteed NULL-deref panic in addba_timeout/ampdu_tx_stop/bar_timeout for legacy WDS nodes with HT
sys/netproto/802_11/wlan/ieee80211_ht.c:1206 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3466 Medium 6.5 ieee80211_ageq_append trusts non-monotonic caller ages: attacker-controlled (re)association listen-interval drives the relative age negative — KASSERT panic on INVARIANTS kernels ('panic: age -781' reproduced)
sys/netproto/802_11/wlan/ieee80211_ageq.c:114 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3468 Medium 6.5 mpls_forward() permanently leaks the packet mbuf+cluster on every AF_MPLS route miss — unauthenticated on-link memory-exhaustion DoS on options-MPLS kernels
sys/netproto/mpls/mpls_input.c:200 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5762 Low 6.3 RFCOMM_CHANNEL() mask 0x2f is missing bit 4: inbound server channels 16..30 remap onto 0..14 — incoming connections match the WRONG listening service and channel 16 is permanently unreachable
sys/netbt/rfcomm.h:217 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3354 Medium 6.0 config_pipe accepts negative bandwidth: TAILQ_LAST NULL-deref write in ready_event_wfq (delay=0) or t==0 wfq_ready_heap self-loop netisr wedge (delay>0) — DF-3350 family confirmed in v3
sys/net/dummynet3/ip_dummynet3.c:641 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3408 Medium 6.0 tunwrite() leaks one mbuf per EFAULTing write: spare MGET allocated before the loop recheck is never freed (tap DF-3406 twin) — verified, deterministic
sys/net/tun/if_tun.c:875 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3474 Medium 6.0 netgraph7 item+message leak: NG_FREE_ITEM() only sets a flag, so ng_address_hook/path/ID() error paths permanently leak the queue item and its entire control message; ~4096 leaked items permanently exhaust the netgraph objcache and wedge the system (objcache_get M_WAITOK sleeps forever)
sys/netgraph7/netgraph/ng_base.c:3062 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3456 High 5.9 Global pf_anchor_stack[64] shared by concurrent shared-pf_token rule walkers: cross-CPU anchor-walk frame tearing silently skips rules and bypasses pf block rules
sys/net/pf/pf.c:143 · pass 2 · new
 pf-policy-bypass reproduced fixed untriaged — —
DF-3317 Medium 5.9 tcp6_ctlinput dispatches ICMPv6 Packet-Too-Big to tcp_mtudisc with no sequence validation and no IPv6 minimum-MTU floor: blind off-path t_maxseg corruption up to a kernel divide-by-zero panic
sys/netinet/tcp_subr.c:1584 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3480 Medium 5.9 so_rcv mutation from the SWI task without the sockbuf token: ng_btsocket_l2cap_data_input's sbappendrecord() races soreceive's ssb_token-protected unlink surgery (lost wakeups / torn record chains / potential freed-mbuf write)
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1455 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3482 Medium 5.9 ng_ppp_mp_strategy uses the file-scope global compareLatencies as kqsort comparator state and clears it to NULL on exit — the DF-0330 twin is LIVE in v1 wherever unfuneled transmit contexts exist (ng_iface output): NULL-index kernel panic
sys/netgraph/ppp/ng_ppp.c:363 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3301 Low 5.9 CARP HMAC key used raw — no KDF on SIOCSVH, stock ifconfig stores zero-padded ASCII passphrase as the SHA1-HMAC key
sys/netinet/ip_carp.c:2476 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3310 Medium 5.7 Port change on a running wg interface re-runs lockinit() on the live so_lock and closes/swaps the UDP sockets without holding it
sys/net/wg/if_wg.c:974 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3429 Medium 5.7 DWDS discovery frames staged on ic_stageq are leaked forever on age-out: ieee80211_node_timeout discards the mbuf list returned by ieee80211_ageq_age (remote kernel memory-exhaustion DoS)
sys/netproto/802_11/wlan/ieee80211_wds.c:321 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5733 Medium 5.7 Remote kernel panic via RFCOMM PN response with MTU=0: missing lower bound poisons dlc->rd_mtu, divide-by-zero in rfcomm_dlc_start
sys/netbt/rfcomm_session.c:1374 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3332 Medium 5.5 Unbounded kernel loop in netmap_grab_packets via unvalidated ring->reserved: unkillable thread + console flood + mbuf-exhaustion DoS (DF-0358 sign error escalated)
sys/net/netmap/netmap.c:740 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3369 Medium 5.5 bdg_netmap_rxsync: uint32 wrap of (reserved + avail) defeats the only sanity check on ring->reserved — k escapes the ring index space and the release loop never terminates while holding the kring q_lock exclusively
sys/net/netmap/netmap_vale.c:1502 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5757 Medium 5.5 l2cap_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — unprivileged permanent mbuf-pool exhaustion DoS (l2cap sibling of DF-0709; not the DF-0682 panic path)
sys/netbt/l2cap_socket.c:120 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5758 Medium 5.5 rfcomm_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — unprivileged permanent mbuf-pool exhaustion DoS (rfcomm sibling of DF-0709/5757; not the DF-0680 panic path)
sys/netbt/rfcomm_socket.c:117 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3396 Low 5.5 netmap_mem_rings_create cleanup path leaks every allocated packet buffer: repeated failing ring creation permanently drains the global buffer pool (latent — module does not build on DFly)
sys/net/netmap/netmap_mem2.c:987 · pass 2 · new
 none build_failed not_testable untriaged — —
DF-5760 Medium 5.4 RFCOMM PN-command direction-validation hole in rfcomm_dlc_newconn: peer fabricates DLCs in the local stack's DLCI space, permanently locking local outbound connects (EBUSY)
sys/netbt/rfcomm_session.c:1322 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3404 Low 5.4 parse_beacon VENDOR branch stores pre-draft HT-info IE into scan->htcap instead of scan->htinfo (copy-paste typo)
sys/netproto/802_11/wlan/ieee80211_input.c:652 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2977 Low 5.3 accf_http soparsehttpvers() restarts its scan at ssb_mb on every data arrival with no retained parse state — O(n^2) per connection, all on the netisr protocol thread; unauthenticated remote CPU/netisr exhaustion for any httpready-configured listener
sys/net/accf_http/accf_http.c:237 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3265 Low 5.3 Recursive exclusive lockmgr panic ('locking against myself') in pf_state_key_attach under pf_state_item allocation failure
sys/net/pf/pf.c:915 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-3275 Low 5.3 Non-constant-time authentication compares: PAP password and CHAP response checked with early-exit bcmp
sys/net/sppp/if_spppsubr.c:4077 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3434 Low 5.3 ipfw3 keep-state limit rules skip the duplicate check: one leaked state + one kprintf('oops') console line per packet (RB_INSERT duplicate never freed)
sys/net/ipfw3_basic/ip_fw3_state.c:296 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3536 Medium 5.1 ng7 ng_cisco: disconnecting the downstream hook with the armed keepalive ng_callout leaks the timer ng_item + node reference (DF-3531's ng_tty twin)
sys/netgraph7/cisco/ng_cisco.c:219 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3263 Medium 4.9 RDR reversed translation port range → kernel divide-by-zero panic (unauthenticated packet trigger)
sys/net/pf/pf.c:3306 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3267 Low 4.9 pf_map_addr()/pf_set_rt_ifp() dereference rpool->cur without NULL guard — reachable as a remote packet-path panic once a translation pool is emptied
sys/net/pf/pf.c:2693 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3476 Medium 4.8 DLC teardown deadlock: untimeout() called under pcb->pcb_lock races the DLC timeout callback blocking on pcb_lock - DragonFly's synchronous callout_stop() turns the overlap into a permanent non-interruptible AB-BA wedge (softclock thread + task/user thread halted)
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3554 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3365 Low 4.8 sta_entry lifetime: three additional unlocked-use windows beyond DF-0395/0396 — PICK1ST match_bss after TABLE_UNLOCK, select_bss result used/joined after unlock, roam/assoc sta_lookup uses
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:397 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-5736 Medium 4.7 Inquiry/RSSI result handlers allocate hci_memo records without bound (lookup-lazy reclamation): remotely-seedable kernel memory exhaustion
sys/netbt/hci_event.c:463 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3435 Low 4.7 check_keep_state dereferences an unchecked kmalloc(..., M_NULLOK) result - NULL-page write panic when the M_IPFW3_STATE type limit is reached
sys/net/ipfw3_basic/ip_fw3_state.c:319 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5759 Low 4.7 rfcomm_ssend violates the pru_send mbuf-ownership contract: m_copym-failure (ENOMEM) path leaks the caller's entire mbuf chain; l2cap_ssend/sco_ssend comply, rfcomm does not
sys/netbt/rfcomm_socket.c:443 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3276 Medium 4.5 Span-port mirror path dereferences NULL softc: bridge_enqueue_handler passes span ifp's NULL if_bridge to bridge_handoff — deterministic kernel panic on first mirrored packet
sys/net/bridge/if_bridge.c:3279 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3387 Medium 4.5 [CROSS-FILE: if_lagg.c via ether_reinput_oncpu] lagg_input() reinputs a consumed NULL mbuf under IFF_MONITOR: deterministic first-packet NULL-deref panic (write to 0xa0) on any IFF_UP|IFF_MONITOR lagg
sys/net/if_ethersubr.c:1303 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3282 Medium 4.4 ieee80211_beacon_update: first app-IE install does pointer arithmetic on NULL bo->bo_appie and memcpy's the IE to near-NULL kernel address (guaranteed panic)
sys/netproto/802_11/wlan/ieee80211_output.c:3215 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3296 Medium 4.4 DIOCCHANGEADDR removal of a pool's last address NULL-derefs the kernel (pfioctl + pf_map_addr), deterministic panic
sys/net/pf/pf_ioctl.c:2313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3352 Medium 4.4 config_pipe accepts negative flowset weight: pipe->sum driven to exactly 0 → integer divide-by-zero panic in ready_event_wfq (missed by both v1 and v3 pass-1)
sys/net/dummynet3/ip_dummynet3.c:574 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3353 Medium 4.4 fs->backlogged never reset when pipe deletion purges child flowsets: stale counter double-subtracted from p->sum on flowset delete → sum==0 divide-by-zero panic (DF-3351 family confirmed in v3)
sys/net/dummynet3/ip_dummynet3.c:574 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3355 Medium 4.4 red_drops divides by fs->lookup_step taken verbatim from config: lookup_step==0 → kernel divide-by-zero panic on first packet to an idle RED flow (DF-0375 family confirmed in v3, missed by pass 1)
sys/net/dummynet3/ip_dummynet3.c:904 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3379 Medium 4.4 pfsync sync engine is dead code: pfsyncif never initialized, RX dispatch never compiled, bulk updater never scheduled — silent total loss of pf HA state synchronization
sys/net/pf/if_pfsync.c:90 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3385 Medium 4.4 HFSC init_vf() NULL-pointer dereference: curve-less intermediate class panics kernel on first packet to any descendant
sys/net/altq/altq_hfsc.c:1003 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3436 Medium 4.4 ipfw3_basic MOD_UNLOAD is unguarded and unsynchronized: refused unload still tears down state/table contexts, and table fini rn_flush()es never-initialized (NULL) radix heads - deterministic kernel panic
sys/net/ipfw3_basic/ip_fw3_state.c:542 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3450 Medium 4.4 encap4_input's ipip_input hook: unlocked double-read test-then-call races ip_mroute KLD unload (which performs no netisr drain) — NULL-call and execute-after-unmap panics
sys/netinet/ip_encap.c:231 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3499 Medium 4.4 ng_fec_get_unit: bcopy(NULL, newarray, 0) makes the compiler elide the explicit NULL guard -> unconditional kfree(NULL): deterministic kernel panic on the FIRST fec node creation
sys/netgraph/fec/ng_fec.c:276 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3500 Medium 4.4 ng_fec control plane violates the ifnet locking contract everywhere: constructor runs if_attach/ifnet_lock in netisr; rmnode->ng_fec_stop does an unbalanced ifnet_deserialize_all; delport calls member if_ioctl unserialized — three distinct INVARIANTS panics
sys/netgraph/fec/ng_fec.c:454 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3516 Medium 4.4 v1 ng_socket: ngc_send/ng_connect_cntl deref pcbp->sockdata with no NULL check after node shutdown — deterministic kernel panic via connect() on a still-open control socket
sys/netgraph/socket/ng_socket.c:257 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3521 Medium 4.4 ng_pptpgre timer-accounting leak: callout_stop() contract violation (DF-3515) makes every cancelled rack/sack timer permanently leak its argument, a node reference, priv->timers, and finally priv and the node itself
sys/netgraph/pptpgre/ng_pptpgre.c:786 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3541 Medium 4.4 ng_eiface_rcvdata returns ENETDOWN without freeing the mbuf — permanent 1:1 mbuf+cluster leak per packet delivered to a DOWN interface (unbounded kernel heap exhaustion)
sys/netgraph/eiface/ng_eiface.c:514 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3266 Low 4.4 pf_get_sport() infinite loop (netisr hang) when the NAT pool port range includes port 0 and all candidate ports are occupied
sys/net/pf/pf.c:3033 · pass 2 · new
 denial_of_service not_reproduced not_testable untriaged — —
DF-3305 Low 4.4 del_vif() leaves tbf_reprocess_q_ch armed with the dying vif — v_tbf NULL dereference panic in tbf_update_tokens()
sys/net/ip_mroute/ip_mroute.c:1792 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3322 Low 4.4 ip_input() dereferences m_pkthdr.rcvif without NULL check on the 127/8 martian test — NULL-deref panic reachable via netgraph ng_ip_input(4) which queues user mbufs with rcvif unset
sys/netinet/ip_input.c:544 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3367 Low 4.4 RTM_CHANGE with gateway==destination permanently leaks the rtentry (key chunk + ifa ref) and desynchronizes per-CPU routing tables; subsequent re-ADD of the same destination panics the kernel
sys/net/route.c:1193 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3370 Low 4.4 ip_output: NULL rtentry dereference in the DF/EMSGSIZE path when the packet was routed without a route entry (multicast via IP_MULTICAST_IF) — deterministic kernel panic
sys/netinet/ip_output.c:712 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3395 Low 4.4 Interface rename (SIOCSIFNAME) fires ifnet_detach_event: silently and permanently unconfigures every vlan on the renamed parent (config-wipe DoS)
sys/net/if.c:2206 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3406 Low 4.4 tapwrite() leaks one mbuf per EFAULTing write: spare MGET allocated before loop-condition recheck is never freed
sys/net/tap/if_tap.c:955 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3511 Low 4.4 ngc_send MKPEER autoload: `goto done` bypasses every free — msg + path + mbuf leaked per sendto; module autoload via AF_NETGRAPH always ENXIO
sys/netgraph7/socket/ng_socket.c:285 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3540 Low 4.4 ng_bpf SET_PROGRAM accepts cyclic match/nomatch forwarding destinations (incl. ifMatch == thisHook); ng7's unbounded synchronous forwarding recurses until the LWKT token array overflows — deterministic kernel panic
sys/netgraph7/bpf/ng_bpf.c:584 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3553 Low 4.4 ng7 ng_tee: two cross-connected tees plus a left2right entry hook form a constructible pure-topology forwarding cycle; one injected byte recurses through ng7's unbounded synchronous forwarding until the LWKT token array overflows — deterministic kernel panic (DF-3540 class, tee instance)
sys/netgraph7/tee/ng_tee.c:293 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3554 Low 4.4 v1 ng_tee: same constructible tee/tee cycle with left2right entry edge; v1's unbounded synchronous ng_send_data recursion (plus per-hop m_dup churn) deterministically hard-wedges the whole machine — unrecoverable DoS with no panic banner or dump (DF-3546 class, tee instance)
sys/netgraph/tee/ng_tee.c:277 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3557 Low 4.4 ng7 ng_UI FLOW-cookie relay in a closed UI<->UI hook cycle: unbounded synchronous control-message forwarding overflows the LWKT token array — deterministic kernel panic (DF-3540 class, ng_UI instance)
sys/netgraph7/UI/ng_UI.c:145 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3559 Low 4.4 ng7 ng_hub: two cross-wired hubs plus one entry hook form a config-free forwarding cycle — with the entry hook created last, one injected byte makes the hub's single synchronous NG_FWD_ITEM_HOOK recurse unbounded until the LWKT token array overflows: deterministic kernel panic (DF-3540 class, purest instance; natural hook order instead yields a 10.5k pkt/s packet-multiplication storm from one byte)
sys/netgraph7/hub/ng_hub.c:61 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3291 Low 4.3 GANN propagation gate uses && where || is required: TTL-exhausted GANNs re-broadcast with TTL wrapping 0 to 255
sys/netproto/802_11/wlan/ieee80211_mesh.c:2690 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3328 Low 4.3 One byte of uninitialized kernel heap broadcast over the air in every forwarded HWMP PERR (pperr->perr_ttl never initialized)
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1743 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3384 Medium 4.1 BIOCFLUSH racing an in-flight bpfread() breaks the buffer-slot invariants: unconditional bd_fbuf = bd_hbuf after uiomove() loses the hold-buffer pointer (leak) and later leaves bd_sbuf == NULL so catchpacket() writes the bpf header through NULL
sys/net/bpf.c:439 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3346 Low 4.1 SIOCSLAGG sets sc_proto before ti_attach: a failed protocol attach leaves sc_proto set with NULL/dead callbacks, next SIOCSLAGG calls a NULL sc_detach
sys/net/lagg/if_lagg.c:1086 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3347 Low 4.1 lagg_lacp_attach ignores lacp_port_create failure: ports left with NULL lp_psc are dereferenced by every later LACP operation
sys/net/lagg/if_lagg.c:2085 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3351 Low 4.1 fs->backlogged never reset when pipe deletion purges child flowsets: p->sum accounting drift can reach exactly 0 → divide-by-zero panic in WF2Q drain
sys/net/dummynet/ip_dummynet.c:555 · pass 2 · new
 panic untested not_testable untriaged — —
DF-3403 Low 4.1 slstart dereferences tp->t_slsc and the softc before acquiring any token (races slclose/SLIOCSUNIT)
sys/net/sl/if_sl.c:531 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3409 Low 4.1 tuncreate() error path publishes a half-built softc via dev->si_drv1 (no rollback on if_alloc failure) — poisoned device node leads to later NULL-deref panic
sys/net/tun/if_tun.c:213 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3437 Low 4.1 Unlocked ss_ops dispatch TOCTOU: ieee80211_scan_timeout/iterate/flush check-then-call ss->ss_ops with no com lock while ieee80211_scan_vdetach's scan_detach kfrees ss->ss_priv (never cleared) - scan_age on freed table
sys/netproto/802_11/wlan/ieee80211_scan.c:586 · pass 2 · new
 none untested not_testable untriaged — —
DF-3445 Low 4.1 table_append_dispatch strands its netmsg on kmalloc failure: netisr0 blocks forever in lwkt_waitmsg (permanent kernel-networking hang)
sys/net/ipfw3_basic/ip_fw3_table.c:157 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-3488 Low 4.1 pppoe_ticker NULL deref: queued callout item races ng_pppoe_disconnect freeing the session
sys/netgraph7/pppoe/ng_pppoe.c:1788 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3498 Low 4.1 ng_fec_addport has no cross-bundle exclusivity: a second fec node can re-enslave an already-bundled interface, saving fec_if_input=ng_fec_input and clobbering IFP2NG — after either node's teardown the member is left with if_input=ng_fec_input over a NULL/freed IFP2NG (permanent RX blackhole or freed-node deref on every frame)
sys/netgraph7/ng_fec.c:384 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5847 Low 4.1 nd6_timer panics under full-rate SIOCDIFADDR_IN6 cycling - neighbor-cache rt_llinfo invariant corruption
sys/netinet6/nd6_nbr.c · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3421 Low 3.9 DDB 802.11 pretty-printers dump raw wlan key material (wk_key bytes) to the console — WEP/TKIP-temporal/CCM keys and RSC/TSC exposed in serial-console captures and crash-dump sessions
sys/netproto/802_11/wlan/ieee80211_ddb.c:810 · pass 2 · new
 none untested — untriaged — —
DF-5718 Info 3.9 kernel strcpy() invoked on overlapping src/dst by the netgraph text parser — restrict-contract violation whose correctness silently depends on strcpy.c's byte-forward implementation
sys/netgraph/netgraph/ng_parse.c:1572 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3294 Low 3.7 No rate limiting on ACKs sent in response to out-of-window segments (CVE-2016-5696 challenge-ACK family)
sys/netinet/tcp_input.c:1782 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-3390 Info 3.7 Handshake replay timestamp compare uses non-constant-time memcmp (OpenBSD hardened this to fixedtime_bcmp)
sys/net/wg/wg_noise.c:1143 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3339 Low 3.4 pfr_add_tables() allocates the ktable and bumps rs->tables BEFORE the duplicate check of a DIOCRADDTABLES batch: duplicate element leaks the table and permanently desynchronizes the ruleset count (DIOCRGETTABLES -> ENOTTY until reboot)
sys/net/pf/pf_table.c:1170 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3507 Low 3.4 v1 twin of DF-3498: no cross-bundle exclusivity (second bundle re-enslaves a member, clobbering ac_netgraph which ng_ether(4) also owns), plus addport accepts the bundle's own/another fec ifnet -> choose_port TX recursion
sys/netgraph/fec/ng_fec.c:362 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-3534 Medium 3.3 ng7 ng_tty: ngt_shutdown() never drops the constructor node reference — every ng_tty node ever created leaks
sys/netgraph7/tty/ng_tty.c:553 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5743 Low 3.3 netbt uses IFF_LINK0 (0x1000) as an mbuf direction tag, colliding with the core mbuf flag M_LASTFRAG — spurious flag propagation and spoofable SCM_HCI_DIRECTION metadata
sys/netbt/hci_socket.c:991 · pass 2 · new
 none untested not_testable untriaged — —
DF-5751 Low 3.3 l2cap_connect() failure paths after l2cap_cid_alloc() leak the CID and leave the half-open channel on l2cap_active_list: socket bricked with EISCONN until close, CID space consumed
sys/netbt/l2cap_upper.c:166 · pass 2 · new
 CID-space exhaustion + bricked sockets on connect-failure untested not_testable untriaged — —
DF-5747 Info 3.3 rfcomm_bind() has no DLC state check: a live listening (or connecting) DLC can be re-bound in place, mutating its advertised channel/PSM underneath the session (NetBSD upstream added the check; DF never took it)
sys/netbt/rfcomm_upper.c:104 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5750 Info 3.3 l2cap_bind() has no channel-state check: a live LISTENING channel can be re-bound in place, mutating its advertised PSM under the sorted listener list (DF-5747 parity; no duplicate-PSM listener rejection either)
sys/netbt/l2cap_upper.c:106 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3300 Low 3.2 SIOCSVH accepts advbase=0 (missing lower-bound validation): advertisement interval collapses to tick rate, master-down timeout to zero
sys/netinet/ip_carp.c:2463 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3289 Low 3.1 Uninitialized stack args[1] transmitted in mesh peer-timeout CLOSE action frames
sys/netproto/802_11/wlan/ieee80211_mesh.c:3107 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-3399 Low 3.0 Unreplied cross-CPU netmsg in NAT state-add path leaks the kmalloc'd message when dispatch CPU diverges from hash CPU
sys/net/ipfw3_nat/ip_fw3_nat.c:385 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3447 Low 3.0 BPF_LD|BPF_H|BPF_ABS kernel mbuf path ignores m_xhalf() failure: out-of-range halfword load yields A=0 and the filter keeps running (fail-open) instead of rejecting the packet
sys/net/bpf_filter.c:238 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3330 Low 2.9 hwmp_send_action takes two node references for broadcast HWMP frames (DragonFly-specific divergence): iv_bss refcount leak per broadcast PREQ/PERR/RANN
sys/netproto/802_11/wlan/ieee80211_hwmp.c:616 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5764 Low 2.5 l2cap_start() increments lc_pending before the fallible hci_acl_send(): any failure permanently wedges the channel TX path and disables graceful disconnect, and the phantom count compounds on every retry
sys/netbt/l2cap_lower.c:203 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3261 Low 2.3 rule->set byte unvalidated at install (expected 0..31): 1 << f->set undefined behavior and broken set-disable/move semantics for sets >= 32
sys/net/ipfw/ip_fw2.c:4518 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-3356 Low 2.3 Negative qsize survives set_fs_parms clamping: u_int-vs-int queue-limit compare in dummynet_io never fires → unbounded queue growth / kernel memory exhaustion (DF-0376 family confirmed in v3, missed by pass 1)
sys/net/dummynet3/ip_dummynet3.c:1100 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3378 Low 2.3 MRT6_INIT length gate uses sizeof(int *) (8) instead of sizeof(int) (4): IPv6 multicast routing cannot be enabled by any conforming daemon on 64-bit DragonFly
sys/netinet6/ip6_mroute.c:426 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3410 Low 2.3 TUNSIFMODE ORs the raw unmasked user value into ifp->if_flags — validated value is the masked switch, injected value is the full word
sys/net/tun/if_tun.c:731 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3418 Low 2.3 rtentry reference leak in in6_ifdetach_dispatch: rtpurelookup() reference never dropped when the ff02::1 lookup matches a route owned by another interface — permanent rtentry pinning and kernel memory leak on route churn
sys/netinet6/in6_ifattach.c:844 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3448 Low 2.3 sysctl_ip6_tempvltime() restores the wrong variable on rejection: failed net.inet6.ip6.tempvltime writes persist the invalid value AND clobber ip6_temp_preferred_lifetime
sys/netinet6/in6_proto.c:437 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3465 Low 2.3 ipfw3 log-if subsystem is dead code wired to a signature-broken event handler: 'log' actions never log, log_if_lock is never initialized, and the ifnet_detach_event registration mis-invokes ip_fw3_log_clone_destroy with the cloner context as its ifp
sys/net/ipfw3_basic/ip_fw3_log.c:213 · pass 2 · new
 none reproduced — untriaged — —
DF-3485 Low 2.3 ng_iface (v1): first node creation panics in kfree(NULL) - bcopy() UB makes GCC drop the NULL guard on ng_iface_units
sys/netgraph/iface/ng_iface.c:290 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3486 Low 2.3 v1 netgraph ng_eiface (and ng_iface): node constructors call if_attach()/ether_ifattach() from netisr control path - deterministic panic (self-deadlock on non-INVARIANTS)
sys/netgraph/eiface/ng_eiface.c:356 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3497 Low 2.3 ng_fec_delport (NGM_FEC_DEL_IFACE) frees the portlist entry without releasing the port's multicast list: M_DEVBUF ng_fec_mc structs and ifmultiaddr memberships leak on every add/del cycle
sys/netgraph7/ng_fec.c:514 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3526 Low 2.3 ng7 ng_iface: first node creation panics in kfree(NULL) — bcopy() UB makes GCC drop the NULL guard on ng_iface_units (DF-3485's ng7 twin)
sys/netgraph7/iface/ng_iface.c:296 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3532 Low 2.3 ng7 ng_tty: ngt_open() error path leaks sc when ng_name_node() fails
sys/netgraph7/tty/ng_tty.c:212 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3285 Info 2.3 ieee80211_beacon_update writes the Quiet IE in place at bo_quiet even when no Quiet IE was constructed - corrupts the beacon IE chain in-bounds (malformed beacons on air)
sys/netproto/802_11/wlan/ieee80211_output.c:3172 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3391 Info 2.3 ip_fw3_ctl discards ip_fw3_ctl_x() error in the IP_FW_X case: nested opcode failures are reported as success to the firewall operator
sys/net/ipfw3/ip_fw3.c:1058 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3543 Info 2.3 Per-link stats unreachable for links 1..63: linkNum == 0 typo in GET/CLR_STATS link selection
sys/netgraph/one2many/ng_one2many.c:339 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3490 Low 2.1 sc_isoc_in_buffer mbuf leaked on device detach: unfreed SCO reassembly buffer enables repeatable mbuf exhaustion
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:683 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3430 Low 1.9 ieee80211_create_wds leaks the find_node_locked reference in the 'station in use' branch: permanent node refcount inflation, un-reclaimable station table entries
sys/netproto/802_11/wlan/ieee80211_wds.c:163 · pass 2 · new
 none untested not_testable untriaged — —
DF-3442 Low 1.9 iface_match(): kfnmatch() on a rule-supplied, not-guaranteed-NUL-terminated via/xmit/recv interface name reads past the instruction/rule allocation
sys/net/ipfw3_basic/ip_fw3_basic.c:134 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3455 Low 1.9 NOL/CAC timeout arithmetic is signed-overflow and tick-wrap unsafe: sysctl ints multiplied by 1000 overflow (UB) and dfs_timeout adds NOL_TIMEOUT before the wrap-aware compare — radar'd channels can be released from the NOL immediately
sys/netproto/802_11/wlan/ieee80211_dfs.c:57 · pass 2 · new
 denial_of_service reproduced fixed untriaged — —
DF-3505 Low 1.9 NGM_KSOCKET_INTERNAL_UPCALL is spoofable by any netgraph control-plane sender: out-of-band forced upcall invocation, widening the known DF-0511 teardown race into a hammerable window
sys/netgraph/ksocket/ng_ksocket.c:848 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3528 Low 1.9 ng_car SHAPE timer leaks ng_item + node ref + hook ref on every armed-cancel (DF-3523 twin) - latent: module does not build on DragonFly
sys/netgraph7/ng_car.c:539 · pass 2 · new
 none build_failed not_testable untriaged — —
DF-3533 Low 1.9 v1 ng_tty: ngt_open() error path leaves tp->t_sc dangling after synchronously freeing sc
sys/netgraph/tty/ng_tty.c:225 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3548 Low 1.9 Lost-wakeup race in ngdread: NGDF_RWAIT armed after the empty-queue check
sys/netgraph7/ng_device.c:419 · pass 2 · new
 none untested not_testable untriaged — —
DF-3309 Info 1.9 ip6_getmoptions(): IPV6_MULTICAST_LOOP default echoes the hop-limit default instead of the loop default
sys/netinet6/ip6_output.c:2511 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3336 Info 1.9 netmap kqfilter stub: f_event always returns 0 and no knlist bookkeeping — kevent() on netmap fds sleeps forever
sys/net/netmap/netmap.c:1516 · pass 2 · new
 none untested not_testable untriaged — —
DF-3475 Info 1.9 ng_callout() discards the previously-armed callout item (oitem) - re-arming a pending ng_callout leaks the item and permanently pins the node reference (unfreeable node, unloadable type)
sys/netgraph7/netgraph/ng_base.c:3266 · pass 2 · new
 none untested not_testable untriaged — —
DF-5748 Info 1.9 rfcomm_detach()'s callout_active()/RFCOMM_DLC_DETACH deferred-free machinery is dead code under DragonFly's callout implementation — the documented callout-vs-detach lifetime 'safety net' never engages (misleading guard over the DF-0724 race)
sys/netbt/rfcomm_upper.c:289 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3451 Info 1.1 mld6_stop_listening mutates the shared MLD link-local templates without mld6_token — torn if_index embedding mis-addresses MLD DONE and mis-classifies the all-nodes comparison
sys/netinet6/mld6.c:163 · pass 2 · new
 none untested not_testable untriaged — —
DF-3522 Info 0.8 ng_bridge constructor leaks priv->tab on ng_make_node_common failure
sys/netgraph/bridge/ng_bridge.c:310 · pass 2 · new
 none untested not_testable untriaged — —
DF-3545 Info 0.8 downstream_hook.dlci never initialized to -1: downstream traffic misrouted into the DLCI branch and reflected back out the downstream hook; decode/demux branch is dead code
sys/netgraph7/ng_sample.c:232 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3549 Info 0.8 sys/netgraph7/ng_device.c is non-compilable, unwired FreeBSD-port rot (all defects latent)
sys/netgraph7/ng_device.c:107 · pass 2 · new
 none untested not_testable untriaged — —
DF-3335 Info 0.5 netmap_sw_to_nic() double-increments k1: skipped TX rings and latent kring array OOB (currently dead code — no d_poll wired)
sys/net/netmap/netmap.c:798 · pass 2 · new
 none untested not_testable untriaged — —
DF-3461 Info 0.5 in6_cksum() sanity check bypassable via u32 wrap of off+len — intended panic becomes uncontrolled NULL-mbuf deref (defense-in-depth)
sys/netinet6/in6_cksum.c:116 · pass 2 · new
 none untested — untriaged — —
DF-3464 Info 0.5 Action registry index validation is one-sided: ieee80211_{send,recv}_action_register() accept negative act (OOB write below the function-pointer tables) and the send dispatch accepts negative act (OOB function-pointer read + indirect call)
sys/netproto/802_11/wlan/ieee80211_action.c:83 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3550 Info 0.5 downstream_hook.dlci never initialized to -1 (v1 twin of DF-3545): downstream traffic misrouted into the DLCI branch and reflected back out the same downstream hook; decode/demux branch is dead code
sys/netgraph/ng_sample.c:155 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3552 Info 0.5 ng_xxx_newhook bookkeeping defects: free-slot search missing break makes every DLCI hook fail ENOBUFS; sizeof/strlen off-by-one rejects single-digit names; parsed dlci never stored; debughook stale after disconnect
sys/netgraph/ng_sample.c:210 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5711 Info 0.5 netmap_vale: bridge-name clamp off-by-one (IFNAMSIZ not IFNAMSIZ-1) leaves bdg_basename[IFNAMSIZ] unterminated
sys/net/netmap/netmap_vale.c:331 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-0428 High 9.6 pfsync_input has no source/peer authentication: any on-link host can inject/modify/destroy pf state
sys/net/pf/if_pfsync.c:462
 none not_reproduced not_testable untriaged — —
DF-0430 High 9.3 Unauthenticated PFSYNC_ACT_CLR/DEL/DEL_C let attacker mass-destroy arbitrary pf state across all CPUs
sys/net/pf/if_pfsync.c:542
 none not_reproduced not_testable untriaged — —
DF-0704 Medium 9.1 No length validation on received sync datagram — type field and struct casts read without bounds check
sys/net/ipfw3_basic/ip_fw3_sync.c:208
 none not_reproduced not_testable untriaged — —
DF-0429 High 8.2 Unauthenticated PFSYNC_ACT_UREQ forces victim to multicast entire pf state table: info disclosure + amplification DoS
sys/net/pf/if_pfsync.c:900
 none not_reproduced not_testable untriaged — —
DF-0632 Medium 8.2 Per-CPU state counters never decremented: permanent state-table exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_state.c:317
 dos reproduced fixed untriaged — —
DF-0351 High 8.1 uint32 metric accumulation overflow enables route poisoning / route hijacking
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1089
 dos reproduced fixed untriaged — —
DF-0630 High 7.5 udp6_ctlinput returns without lwkt_replymsg, deadlocking the netisr on a single crafted ICMPv6 packet
sys/netinet6/udp6_usrreq.c:434
 dos reproduced fixed untriaged — —
DF-0703 High 7.5 Unauthenticated remote mbuf leak in edge socket handler — kernel memory exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_sync.c:203
 none not_reproduced not_testable untriaged — —
DF-0571 Medium 7.5 kernel panic on any non-TCP/UDP/ICMP packet hitting NAT rule
sys/net/ipfw3_nat/ip_fw3_nat.c:219
 panic reproduced fixed untriaged — —
DF-0710 Medium 7.5 sco_input uses while-loop (not if) for receive buffer check — oversized SCO packet hangs protocol thread in infinite loop
sys/netbt/sco_socket.c:221
 dos reproduced not_testable untriaged — —
DF-0743 Medium 7.5 struct greip/mobip_h overlay assumes ip_hl==5 — IP options make all GRE/mobile header reads use wrong offset compounds DF-0740
sys/netinet/ip_gre.c:133
 misparse/dos reproduced fixed untriaged — —
DF-0564 Low 7.4 DLCI array access lacks local bounds check — ng7 twin of DF-0556
sys/netgraph7/lmi/ng_lmi.c:690
 panic reproduced fixed untriaged — —
DF-0473 High 7.2 ip_fw3_chk: unbounded filter_funcs[module][opcode] indexing -> OOB function pointer call on remote traffic
sys/net/ipfw3/ip_fw3.c:506
 panic reproduced fixed untriaged — —
DF-0352 Medium 7.1 RANN frame overwrites shared global ieee80211_hwmp_rannint without lock: remote timer DoS
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1971
 none not_reproduced not_testable untriaged — —
DF-0556 Low 6.8 DLCI array index without local bounds check in nglmi_rcvdata: latent heap OOB write
sys/netgraph/lmi/ng_lmi.c:692
 panic reproduced fixed untriaged — —
DF-0281 High 6.5 Remote kernel panic: divide-by-zero via PN MCC command with mtu=0
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3019
 dos reproduced fixed untriaged — —
DF-0350 High 6.5 Unbounded mesh route-table growth + attacker-controlled lifetime: remote memory exhaustion DoS
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1057
 dos reproduced fixed untriaged — —
DF-0453 High 6.5 Wrong session variable in rfcomm_session_newconn: timeout armed on listener not new session — memory leak + listener corruption DoS
sys/netbt/rfcomm_session.c:423
 panic reproduced not_testable untriaged — —
DF-0543 High 6.5 num_compl_pkts: unbounded variable-length loop reads past mbuf end -> remote kernel panic
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:884
 none not_reproduced not_testable untriaged — —
DF-0558 High 6.5 hci_event_num_compl_pkts: unbounded variable-length loop NO per-iteration bounds check -> remote kernel panic
sys/netbt/hci_event.c:376
 panic inconclusive not_testable untriaged — —
DF-0559 High 6.5 hci_event_inquiry_result/rssi_result: unbounded loops guarded only by KKASSERT -> remote kernel panic on short data
sys/netbt/hci_event.c:447
 panic inconclusive not_testable untriaged — —
DF-0654 High 6.5 ccmp_setkey omits AES key load for software-decrypt-only keys, causing kernel panic on first received frame
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:140
 none inconclusive not_testable untriaged — —
DF-0751 High 6.5 Infinite loop for MPLS explicit-NULL label 0/2 with clear bottom-of-stack bit — single-packet remote hard hang
sys/netproto/mpls/mpls_input.c:101
 dos / hard-hang - single-packet remote kernel busy-loop (one CPU at 100% holding mplock, no panic, no dmesg, power-cycle required) reproduced fixed untriaged — —
DF-0287 Medium 6.5 Divide-by-zero kernel panic in mesh_airtime_calc via ni_txrate==0
sys/netproto/802_11/wlan/ieee80211_mesh.c:3366
 none inconclusive not_testable untriaged — —
DF-0301 Medium 6.5 Missing replay protection on CARP advertisements: L2-adjacent DoS of failover
sys/netinet/ip_carp.c:1137
 dos reproduced fixed untriaged — —
DF-0418 Medium 6.5 Unbounded default-router and prefix list growth from spoofed RAs: RA-flooding kernel memory exhaustion DoS
sys/netinet6/nd6_rtr.c:689
 dos reproduced fixed untriaged — —
DF-0445 Medium 6.5 altq_etherclassify NULL-pointer dereference: mbuf chain walk advances to m_next without NULL check
sys/net/if_ethersubr.c:927
 panic reproduced fixed untriaged — —
DF-0752 Medium 6.5 mbuf leak in mpls_forward on route-not-found — remote memory-exhaustion DoS
sys/netproto/mpls/mpls_input.c:199
 dos reproduced fixed untriaged — —
DF-0653 Low 6.5 Signed integer overflow in ieee80211_pwrsave frame-age computation yields KASSERT panic
sys/netproto/802_11/wlan/ieee80211_power.c:359
 dos reproduced fixed untriaged — —
DF-0322 Low 6.1 No validation of tid/baw before indexing ni_rx_ampdu[tid] and setting rxa_wnd
sys/netproto/802_11/wlan/ieee80211_ht.c:566
 none reproduced fixed untriaged — —
DF-0660 High 6.0 Heap memory corruption: kfree() on mbuf data pointer in ng_device_rcvdata
sys/netgraph/ng_device.c:363
 none not_reproduced not_testable untriaged — —
DF-2570 High 6.0 Heap corruption: kfree() of in-mbuf data pointer on every received packet in ng_device_rcvdata
sys/netgraph/ng_device.c:363
 none not_reproduced not_testable untriaged — —
DF-0276 Medium 6.0 Wrong-pointer kfree in DIOCADDADDR error path frees framework pointer instead of allocated pooladdr
sys/net/pf/pf_ioctl.c:2160
 none not_reproduced not_testable untriaged — —
DF-0302 Medium 5.9 Failover state machine in input path runs without synchronization: concurrent state corruption
sys/netinet/ip_carp.c:1108
 dos inconclusive not_testable untriaged — —
DF-0391 Medium 5.9 pf_fragcache: m_dup NULL dereferenced before NULL check in m_adj argument: remote DoS under memory pressure with fragcrop
sys/net/pf/pf_norm.c:661
 panic inconclusive not_testable untriaged — —
DF-0645 Medium 5.9 NULL pointer dereference in div_packet() on re-injected divert packets (rcvif==NULL)
sys/netinet/ip_divert.c:182
 panic reproduced not_testable untriaged — —
DF-0493 Low 5.9 KASSERT-only bounds check on nack before xwin[] indexing: no runtime protection in production kernels
sys/netgraph/l2tp/ng_l2tp.c:1141
 dos reproduced fixed untriaged — —
DF-0663 Medium 5.7 SLIST_REMOVE on never-inserted element in newhook error paths corrupts list head
sys/netgraph/ng_device.c:286
 panic reproduced not_testable untriaged — —
DF-0403 Low 5.7 Unvalidated dst_ring from custom lookup causes OOB index into dst_ents array
sys/net/netmap/netmap_vale.c:1162
 dos reproduced fixed untriaged — —
DF-0618 Low 5.7 Signed integer overflow in ieee80211_dwds_discover age calculation causes KASSERT panic
sys/netproto/802_11/wlan/ieee80211_wds.c:336
 dos reproduced fixed untriaged — —
DF-0308 Low 5.6 X_ipip_input reads viftable/last_encap_vif without mroute_token: race with vif teardown
sys/net/ip_mroute/ip_mroute.c:1709
 none reproduced fixed untriaged — —
DF-0475 Medium 5.5 act_ofs never validated: OOB pointer deref via ACTION_PTR during packet matching
sys/net/ipfw3/ip_fw3.c:520
 panic reproduced fixed untriaged — —
DF-0687 Medium 5.5 Missing break in sco_ctloutput PRCO_GETOPT causes NULL-deref panic via getsockopt (DF-0682 pattern)
sys/netbt/sco_socket.c:113
 panic reproduced fixed untriaged — —
DF-0688 Medium 5.5 sco_ctloutput PRCO_SETOPT unconditionally NULL-dereferences on every setsockopt
sys/netbt/sco_socket.c:123
 panic reproduced fixed untriaged — —
DF-0705 Medium 5.5 Local DoS / panic via out-of-order ioctls, kthread_create failure, and negative count in show_conf
sys/net/ipfw3_basic/ip_fw3_sync.c:239
 none not_reproduced not_testable untriaged — —
DF-0709 Medium 5.5 sco_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — mbuf-exhaustion DoS
sys/netbt/sco_socket.c:111
 dos reproduced fixed untriaged — —
DF-0759 Low 5.5 Double NG_FREE_ITEM on out-hook data path panics INVARIANTS kernels
sys/netgraph7/ng_split.c:134
 panic reproduced fixed untriaged — —
DF-2601 Low 5.5 snd_queue enqueue ignores ifq_maxlen unbounded kernel memory exhaustion DoS
sys/netgraph7/ng_source.c:280
 dos reproduced not_testable untriaged — —
DF-0282 Medium 5.4 Signed tx_cred overflow and OOB credit byte read in UIH reception
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2409
 none inconclusive not_testable untriaged — —
DF-0431 Medium 5.4 Dead expire-scaling code: imported state expiry is always raw attacker value, enabling infinite-lifetime states
sys/net/pf/if_pfsync.c:402
 none inconclusive not_testable untriaged — —
DF-0353 Low 5.4 hwmp_recv_perr switches on dest_flags instead of dest_rcode: PERR never actioned
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1768
 none reproduced fixed untriaged — —
DF-0371 Low 5.4 Unlocked memcmp of lp_marker before LACP_LOCK: torn-read data race with lacp_xmit_marker
sys/net/lagg/ieee8023ad_lacp.c:1934
 none reproduced fixed untriaged — —
DF-0481 Low 5.4 Integer overflow in root path cost comparison allows topology manipulation via crafted BPDU
sys/net/bridge/bridgestp.c:513
 none reproduced fixed untriaged — —
DF-0555 Low 5.4 m_pullup is dead code: packetlen=m_len then m_len<packetlen always false, mbuf chains mis-parsed
sys/netgraph/lmi/ng_lmi.c:575
 none reproduced fixed untriaged — —
DF-0584 Info 5.4 ieee80211_ff_decap skips framelen validation: truncated frame delivery
sys/netproto/802_11/wlan/ieee80211_superg.c:309
 none reproduced not_testable untriaged — —
DF-0271 Medium 5.3 NULL deref in bridge_input: unchecked bridge_lookup_member_if result (race with member deletion)
sys/net/bridge/if_bridge.c:2738
 panic not_reproduced not_testable untriaged — —
DF-0406 Medium 5.3 in_delayed_cksum: unchecked m_pullup return leads to NULL pointer write panic
sys/netinet/ip_output.c:940
 panic inconclusive not_testable untriaged — —
DF-0518 Medium 5.3 ICMP error generation (icmp_error) not rate-limited: reflection/amplification DoS
sys/netinet/ip_icmp.c:144
 dos reproduced fixed untriaged — —
DF-0566 Medium 5.3 ACL reassembly want is uint16_t: overshoot wraps -> L2CAP RX stall + unbounded memory growth
sys/netbt/hci_link.c:421
 none not_reproduced not_testable untriaged — —
DF-0659 Medium 5.3 ng_l2cap_discon_untimeout leaves AUTO_DISCON_TIMO flag set on timer-already-fired path, causing kernel panic via con_ref/con_unref cycle
sys/netgraph7/bluetooth/l2cap/ng_l2cap_misc.c:223
 panic reproduced not_testable untriaged — —
DF-0729 Medium 5.3 NULL mbuf dereference in P2P routing-loop detector when m_copym(M_NOWAIT) fails — kernel panic under memory pressure
sys/netinet6/ip6_forward.c:138
 panic reproduced fixed untriaged — —
DF-0264 Low 5.3 Unsigned wraparound in p_len when TCP th_off exceeds actual header
sys/net/pf/pf.c:6623
 none reproduced fixed untriaged — —
DF-0283 Low 5.3 Unconditional kernel panic if mbuf chain ends with zero-length mbuf
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:1956
 panic reproduced fixed untriaged — —
DF-0309 Low 5.3 Unbounded pending NOCACHE upcall entries: remote memory-exhaustion DoS when mrouter active
sys/net/ip_mroute/ip_mroute.c:1266
 dos reproduced not_testable untriaged — —
DF-0331 Low 5.3 Unbounded kprintf on fragment-queue exhaustion: remote log-flood DoS
sys/netgraph7/ppp/ng_ppp.c:1519
 dos reproduced fixed untriaged — —
DF-0392 Low 5.3 Fragment overlap trim uses non-8-aligned shifts for last-fragment overlaps: inconsistent reassembly metadata
sys/net/pf/pf_norm.c:412
 none reproduced fixed untriaged — —
DF-0456 Low 5.3 NULL deref in rfcomm_session_complete: credit NULL check under #ifdef DIAGNOSTIC only, no guard on production
sys/netbt/rfcomm_session.c:446
 dos reproduced fixed untriaged — —
DF-0485 Low 5.3 IPv6 syncache hash uses only 64/128 address bits with 32-bit secret: attacker-guaranteed bucket collisions
sys/netinet/tcp_syncache.c:157
 none reproduced fixed untriaged — —
DF-0487 Low 5.3 sc_flags assign instead of OR wipes SCF_HASH and negotiated-option flags on TF_NOOPT listener
sys/netinet/tcp_syncache.c:1102
 none reproduced fixed untriaged — —
DF-0519 Low 5.3 ICMP PMTUD accepts attacker-controlled nextmtu: PMTU poisoning via unauthenticated frag-needed
sys/netinet/ip_icmp.c:282
 dos reproduced fixed untriaged — —
DF-0563 Low 5.3 Dead m_pullup: packetlen=m_len makes check tautologically false — ng7 twin of DF-0555
sys/netgraph7/lmi/ng_lmi.c:569
 none reproduced fixed untriaged — —
DF-0626 Low 5.3 frag6_nfragpackets counter leak on queue allocation failure permanently reduces reassembly capacity
sys/netinet6/frag6.c:267
 dos reproduced fixed untriaged — —
DF-0646 Low 5.3 ip_len double-counted in ip_divert_in() after ip_reass() (corrupted packet metadata on fragmented divert)
sys/netinet/ip_divert.c:607
 dos reproduced fixed untriaged — —
DF-0470 Info 5.3 Disabling ip6_hdrnestlimit sysctl (=0) removes only ext-header depth bound: no hard floor
sys/netinet6/ip6_input.c:693
 none reproduced fixed untriaged — —
DF-0575 Info 5.3 Wrong timeout variable for inbound TCP/UDP state cleanup: 6x/3x premature expiry
sys/net/ipfw3_nat/ip_fw3_nat.c:971
 none reproduced fixed untriaged — —
DF-0606 Medium 5.1 _db_show_mesh invokes ieee80211_mesh_rt_update() from DDB: takes lockmgr lock and mutates mesh route state inside a read-only debugger pretty-printer
sys/netproto/802_11/wlan/ieee80211_ddb.c:897
 panic reproduced fixed untriaged — —
DF-0334 Low 5.1 Divide-by-zero panic in ephemeral port allocation on degenerate sysctl port range
sys/netinet/in_pcb.c:424
 panic reproduced fixed untriaged — —
DF-0442 Low 5.1 rmc_init stores user-driven maxqueued_ without validation: div-by-zero or heap OOB via fixed-size array modulus
sys/net/altq/altq_rmclass.c:680
 dos reproduced fixed untriaged — —
DF-0484 Medium 4.8 SYN-cookie crypto state global unsynchronized across netisr CPUs: racy MD5_CTX + tcp_secret[] defeats SYN-flood mitigation
sys/netinet/tcp_syncache.c:1351
 none not_reproduced not_testable untriaged — —
DF-0263 Low 4.8 ICMP-error NAT for other protocol corrupts inner source (copy-paste bug)
sys/net/pf/pf.c:5732
 none reproduced fixed untriaged — —
DF-0305 Low 4.8 HMAC comparison uses non-constant-time bcmp: timing side-channel
sys/netinet/ip_carp.c:581
 none reproduced fixed untriaged — —
DF-0310 Low 4.8 Non-atomic increment of global fragment ID (ip6_id): data race / predictable fragment IDs
sys/netinet6/ip6_output.c:753
 none reproduced fixed untriaged — —
DF-0317 Low 4.8 Unsynchronized global static shared across all WireGuard interfaces in wg_is_underload
sys/net/wg/if_wg.c:1577
 none reproduced not_testable untriaged — —
DF-0516 Low 4.8 ip6opts_match bails to opts_check on short first mbuf: IPv6 option matching silently skipped -> firewall bypass
sys/net/ip6fw/ip6_fw.c:256
 none reproduced fixed untriaged — —
DF-0325 Medium 4.7 Deadlock: callout_stop under pcb_lock while timeout callback requires pcb_lock
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2765
 none inconclusive not_testable untriaged — —
DF-0366 Medium 4.7 Lockless sc_count pre-check in lagg_start races with port destroy causing divide-by-zero panic
sys/net/lagg/if_lagg.c:1758
 none inconclusive not_testable untriaged — —
DF-0604 Medium 4.7 Cross-CPU race on global pfi_buffer corrupts pf dynamic-interface address tables (filtering bypass)
sys/net/pf/pf_if.c:74
 panic reproduced fixed untriaged — —
DF-0370 Low 4.7 Marker PDU reflection without rate-limiting or request-address validation: on-link amplification DoS
sys/net/lagg/ieee8023ad_lacp.c:1911
 none reproduced fixed untriaged — —
DF-2587 Low 4.7 NULL-dereference panic in ng_ether_input/input_orphan/output when IFP2NG(ifp) NULL
sys/netgraph/ether/ng_ether.c:206
 panic reproduced fixed untriaged — —
DF-0678 Info 4.7 Missing NULL-node guard in ng_gif_input/ng_gif_input_orphan (latent panic; unreachable while file is dead code)
sys/netgraph7/ng_gif.c:170
 none reproduced not_testable untriaged — —
DF-0267 Low 4.5 Race condition in fixed Huffman table initialization
sys/net/zlib.c:4496
 none reproduced not_testable untriaged — —
DF-0382 Medium 4.4 config_red divides by (max_th-min_th) and max_th without zero check: kernel panic — same bug class as dummynet v1 unfixed
sys/net/dummynet3/ip_dummynet3.c:1351
 panic reproduced fixed untriaged — —
DF-0411 Medium 4.4 Infinite loop in ng_parse_skip_value on unclosed quoted string inside brackets: kernel thread hang DoS
sys/netgraph7/netgraph/ng_parse.c:1651
 none not_reproduced not_testable untriaged — —
DF-0441 Medium 4.4 Divide-by-zero kernel panic when ns_per_byte==0: CBQ class add/modify unconditionally divides by user-supplied value
sys/net/altq/altq_rmclass.c:237
 panic reproduced fixed untriaged — —
DF-0474 Medium 4.4 Opcode iteration loop: F_LEN(cmd)==0 causes infinite loop hanging netisr thread
sys/net/ipfw3/ip_fw3.c:493
 dos reproduced fixed untriaged — —
DF-0527 Medium 4.4 ng_fec_choose_port NULL dereference when computed port index removed: reachable panic after port delete
sys/netgraph/fec/ng_fec.c:896
 none not_reproduced not_testable untriaged — —
DF-0535 Medium 4.4 Integer underflow in ngc_send path-length math: sg_len<2 -> bcopy with SIZE_MAX -> kernel heap smash
sys/netgraph7/socket/ng_socket.c:245
 none not_reproduced not_testable untriaged — —
DF-0622 Medium 4.4 NULL-pointer dereference panic: ng_car_disconnect does not cancel the pending SHAPE callout, ng_car_q_event dereferences purged queue
sys/netgraph7/ng_car.c:553
 none not_reproduced not_testable untriaged — —
DF-0666 Medium 4.4 NULL mbuf deref/panic on m_devget failure in ngdwrite
sys/netgraph/ng_device.c:589
 none not_reproduced not_testable untriaged — —
DF-0669 Medium 4.4 NULL-pointer dereference in rn_flush on never-created tables -> kernel panic via delete/flush ioctl and module unload
sys/net/ipfw3_basic/ip_fw3_table.c:130
 panic reproduced fixed untriaged — —
DF-0731 Medium 4.4 rssadapt_tx_complete unconditionally dereferences arg2(rssi) NULL — every in-tree driver passes NULL — instant panic
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:327
 panic reproduced fixed untriaged — —
DF-2576 Medium 4.4 ip_fw3_ctl_zero_entry KKASSERT(zmsg.start_rule==NULL) fires deterministically on every zero/resetlog of a specific rule (root DoS panic on default INVARIANTS kernel)
sys/net/ipfw3/ip_fw3.c:932
 panic reproduced fixed untriaged — —
DF-0358 Low 4.4 Sign error in netmap_grab_packets: computes cur+reserved instead of cur-reserved, forwarding wrong slots to host stack
sys/net/netmap/netmap.c:736
 none reproduced fixed untriaged — —
DF-0374 Low 4.4 config_red divides by (max_th-min_th) and max_th without zero/negative check: kernel panic via setsockopt
sys/net/dummynet/ip_dummynet.c:1346
 dos reproduced fixed untriaged — —
DF-0375 Low 4.4 red_drops divides by fs->lookup_step taken verbatim from user config: panic when lookup_step==0
sys/net/dummynet/ip_dummynet.c:885
 dos reproduced fixed untriaged — —
DF-0421 Low 4.4 ng_ubt_rcvdata calls panic() on malformed HCI frames from netgraph hook: local DoS
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1755
 dos reproduced fixed untriaged — —
DF-0422 Low 4.4 Missing validation of queue length in NGM_UBT_NODE_SET_QLEN: negative qlen -> uint32 wrap to 0xFFFFFFFF unbounded queuing
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1625
 dos reproduced fixed untriaged — —
DF-0439 Low 4.4 hfsc_dequeue panic() on NULL from hfsc_getq: kernel-panic DoS if backlogged class queue drains underneath scheduler
sys/net/altq/altq_hfsc.c:827
 dos reproduced fixed untriaged — —
DF-0623 Low 4.4 Divide-by-zero panic in ng_car_schedule: SET_CONF permits cir==0 in non-SHAPE modes
sys/netgraph7/ng_car.c:656
 dos reproduced fixed untriaged — —
DF-0648 Low 4.4 NULL-deref panic in NGM_NETFLOW_INFO and NGM_NETFLOW_IFINFO response allocation
sys/netgraph7/netflow/ng_netflow.c:305
 panic inconclusive — untriaged — —
DF-0649 Low 4.4 Per-node ~1.5 MB kernel-memory amplification via fixed NG_NETFLOW_MAXIFACES array
sys/netgraph7/netflow/ng_netflow.c:172
 dos inconclusive — untriaged — —
DF-0684 Low 4.4 hci_complete_sco enqueues to hci_scodone without bounds check (kernel memory exhaustion DoS)
sys/netbt/hci_unit.c:538
 dos reproduced fixed untriaged — —
DF-0727 Low 4.4 NULL-pointer dereference in NGM_FLOW_COOKIE handler when lasthook is NULL and left/right hook disconnected
sys/netgraph7/tee/ng_tee.c:263
 panic reproduced fixed untriaged — —
DF-0736 Low 4.4 Kernel panic via forged mbuf tag with invalid dir value — panic() on attacker-controllable data
sys/netgraph7/ng_ipfw.c:251
 panic reproduced fixed untriaged — —
DF-2547 Low 4.4 Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion
sys/netgraph7/ng_source.c:564
 dos reproduced not_testable untriaged — —
DF-0290 Low 4.3 GANN sequence comparison not wrap-safe (raw <= on uint32)
sys/netproto/802_11/wlan/ieee80211_mesh.c:2649
 none reproduced fixed untriaged — —
DF-0294 Low 4.3 KASSERT panic/uint16 truncation in get_scan_result from remote IE length
sys/netproto/802_11/wlan/ieee80211_ioctl.c:280
 panic reproduced fixed untriaged — —
DF-0386 Low 4.3 ng_ppp_frag_checkstale sequence tracking diverges after gaps: stale-packet delivery suppressed
sys/netgraph/ppp/ng_ppp.c:1384
 none reproduced fixed untriaged — —
DF-0387 Low 4.3 No MRRU enforcement on MP fragment reassembly: peer can assemble oversized PDUs beyond negotiated MRRU
sys/netgraph/ppp/ng_ppp.c:1203
 dos reproduced fixed untriaged — —
DF-0432 Low 4.3 Crafted PFSYNC_ACT_BUS endtime prematurely marks pfsync_sync_ok: HA-status spoofing
sys/net/pf/if_pfsync.c:950
 none reproduced fixed untriaged — —
DF-0455 Low 4.3 MCC multi-byte length decode reverses octet ordering: interoperability bug for MCC frames >= 128 bytes
sys/netbt/rfcomm_session.c:1027
 none reproduced fixed untriaged — —
DF-0468 Low 4.3 ip6_savecontrol ext-header walk has no nest limit (self-flagged by code comment)
sys/netinet6/ip6_input.c:1214
 dos reproduced fixed untriaged — —
DF-0482 Low 4.3 sc_topology_change_time never initialized: premature TC timer expiry defeats topology change notification
sys/net/bridge/bridgestp.c:1465
 none reproduced fixed untriaged — —
DF-2579 Low 4.3 Silent uint16_t truncation of iv_swbmiss_period can yield zero (callout flood DoS)
sys/netproto/802_11/wlan/ieee80211_tdma.c:284
 dos reproduced not_testable untriaged — —
DF-0483 Info 4.3 No validation of attacker-supplied STP timer values from winning root bridge BPDU
sys/net/bridge/bridgestp.c:393
 none reproduced not_testable untriaged — —
DF-0273 Medium 4.2 Missing break between SIOCSIFDESCR and SIOCSIFFLAGS: fall-through reinterprets description length as interface flags
sys/net/if.c:2131
 dos reproduced fixed untriaged — —
DF-0323 Low 4.2 ampdu_dispatch re-enters ieee80211_input while iterating rxa_m[] (re-entrancy)
sys/netproto/802_11/wlan/ieee80211_ht.c:616
 none reproduced not_testable untriaged — —
DF-0338 Low 4.2 tcp_mtudisc accepts forged ICMP MTU small enough to drive t_maxseg negative
sys/netinet/tcp_subr.c:1783
 none reproduced fixed untriaged — —
DF-0399 Low 4.2 rtredirect_oncpu ignores rt_setgate return: routes redirect that failed or self-targets
sys/net/route.c:421
 none reproduced fixed untriaged — —
DF-2573 Medium 4.1 NULL deref / panic: SLIST_REMOVE on connection never inserted in error paths of ng_device_newhook
sys/netgraph/ng_device.c:290
 panic reproduced not_testable untriaged — —
DF-0376 Low 4.1 Negative qsize bypasses queue-size limit via signed/unsigned comparison: unbounded mbuf accumulation / OOM
sys/net/dummynet/ip_dummynet.c:1437
 dos reproduced fixed untriaged — —
DF-0397 Low 4.1 rt_setshims: unchecked R_Malloc (M_NULLOK) leads to NULL-pointer-write panic via bcopy to NULL
sys/net/route.c:1374
 dos reproduced fixed untriaged — —
DF-0491 Low 4.1 NULL td dereference in SIOCSIFDSTADDR and default ioctl handlers despite documented td might be NULL contract
sys/netinet/in.c:606
 dos reproduced fixed untriaged — —
DF-0587 Low 4.1 NULL vap deref in scan_curchan_task: scan state not re-validated after dropping IEEE80211_LOCK across ic_set_channel
sys/netproto/802_11/wlan/ieee80211_scan_sw.c:741
 panic not_reproduced not_testable untriaged — —
DF-0713 Low 4.1 cac_timeout assigns dfs->newchan (may be NULL) to iv_des_chan — downstream hostap/adhoc/mesh dereference NULL via IEEE80211_IS_CHAN_RADAR
sys/netproto/802_11/wlan/ieee80211_dfs.c:154
 none inconclusive not_testable untriaged — —
DF-0345 Info 3.9 IP header checksum left stale after kernel records RR/TS options on locally-delivered packets
sys/netinet/ip_input.c:1702
 none reproduced not_testable untriaged — —
DF-0372 Info 3.9 Undefined behavior shift 1 << if_dunit for member NIC unit numbers >= 32
sys/net/lagg/ieee8023ad_lacp.c:310
 none reproduced fixed untriaged — —
DF-0467 Info 3.9 Dead code in ip6_savecontrol: RTHDRDSTOPTS walk result discarded, RFC3542 semantics not implemented
sys/netinet6/ip6_input.c:1173
 none reproduced not_testable untriaged — —
DF-0488 Info 3.9 Hash secret only 32-bit + sc_flags 8-bit near exhaustion: hardening gaps
sys/netinet/tcp_syncache.c:118
 none reproduced not_testable untriaged — —
DF-0465 Low 3.7 Handshake state irrevocably corrupted when noise_begin_session kmalloc(M_NOWAIT) fails
sys/net/wg/wg_noise.c:1188
 none reproduced fixed untriaged — —
DF-0319 Info 3.7 Lockless torn reads of multi-word struct wg_endpoint in fast paths
sys/net/wg/if_wg.c:746
 none reproduced not_testable untriaged — —
DF-0448 Info 3.7 Safety-critical checks rely on KASSERT/KKASSERT which are no-ops on production kernels without INVARIANTS
sys/net/if_ethersubr.c:993
 none reproduced not_testable untriaged — —
DF-0656 Info 3.7 CCMP MIC verified with non-constant-time memcmp
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:642
 none reproduced not_testable untriaged — —
DF-0303 Medium 3.6 HMAC precomputed context torn-read race between config and input paths
sys/netinet/ip_carp.c:504
 dos inconclusive not_testable untriaged — —
DF-0311 Low 3.6 Multicast setsockopt discards copyin error: partially-initialized mbuf fed to ip6_setmoptions
sys/netinet6/ip6_output.c:1496
 none reproduced fixed untriaged — —
DF-0330 Low 3.6 Global mutable pointer used as qsort comparator state: latent cross-bundle race
sys/netgraph7/ppp/ng_ppp.c:471
 none reproduced not_testable untriaged — —
DF-0268 Low 3.5 No decompression bomb (zip bomb) protection
sys/net/zlib.c:3209
 dos reproduced not_testable untriaged — —
DF-2564 Low 3.5 Decompress path signed integer underflow from missing minimum packet size check
sys/netgraph7/ng_pred1.c:468
 dos reproduced not_testable untriaged — —
DF-0373 Low 3.4 delete_pipe uses wrong constant DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 permanently undeletable
sys/net/dummynet/ip_dummynet.c:1654
 none reproduced fixed untriaged — —
DF-0551 Low 3.4 MTU unsigned underflow when parent MTU < EVL_ENCAPLEN(4)
sys/net/vlan/if_vlan.c:727
 panic reproduced fixed untriaged — —
DF-0343 Info 3.4 IPv6 address configured while interface is down bypasses Duplicate Address Detection entirely
sys/netinet6/in6.c:1070
 none reproduced not_testable untriaged — —
DF-0359 Low 3.3 Unguarded uint32 subtraction can underflow nr_hwavail causing self-inflicted ring-state corruption
sys/net/netmap/netmap.c:906
 dos reproduced fixed untriaged — —
DF-0498 Low 3.3 SIOC_L2CAP_L2CA_GET_INFO: unvalidated info_size causes oversized kmalloc + feature non-functional
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:1061
 dos reproduced fixed untriaged — —
DF-0591 Low 3.3 Legacy netgraph/ng_bridge leaks mbuf+meta when the bridge has exactly one link (numLinks==1 fan-out loop never runs)
sys/netgraph/bridge/ng_bridge.c:663
 dos reproduced fixed untriaged — —
DF-0686 Low 3.3 Duplicate m_copym in l2cap_ssend leaks an mbuf chain on every send()
sys/netbt/l2cap_socket.c:433
 dos reproduced fixed untriaged — —
DF-0690 Low 3.3 mbuf + item leak on debug-hook data path (unreachable free condition) in dormant template
sys/netgraph7/ng_sample.c:337
 none inconclusive — untriaged — —
DF-0698 Low 3.3 Filter entries leaked on hook disconnect (LIST_REMOVE without kfree) and node shutdown (no hashtable walk)
sys/netgraph/etf/ng_etf.c:473
 dos reproduced fixed untriaged — —
DF-0757 Low 3.3 Global ifnet_mtx held across user-controlled copyin/copyout in sysctl_ifdata - unprivileged local DoS
sys/net/if_mib.c:88
 dos reproduced not_testable untriaged — —
DF-2581 Low 3.3 radix_node_head leak on table_delete and on table re-create enables kernel memory exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_table.c:100
 none not_reproduced not_testable untriaged — —
DF-0463 Info 3.3 Lockless write to seq->inproc in M_PREPEND failure path: data race
sys/netgraph7/l2tp/ng_l2tp.c:957
 none reproduced not_testable untriaged — —
DF-0419 Low 3.1 nd6_ra_input mutates per-interface ND timing state (reachable/retrans/chlim/linkmtu) without nd6_mtx: data race
sys/netinet6/nd6_rtr.c:272
 dos reproduced fixed untriaged — —
DF-0545 Low 3.1 Buffer accounting u_int16_t wrap in num_compl_pkts via attacker-controlled compl_pkt: throughput DoS
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:905
 dos reproduced fixed untriaged — —
DF-0567 Low 3.1 Memory leak of in-progress reassembly mbuf when new ACL START arrives
sys/netbt/hci_link.c:471
 dos reproduced fixed untriaged — —
DF-0724 Low 3.1 Unsynchronized timer-vs-caller double-close race in rfcomm_dlc_close — no lock/atomic on CLOSED transition
sys/netbt/rfcomm_dlc.c:156
 none not_reproduced not_testable untriaged — —
DF-0348 Info 3.1 Missing m_pullup for management frames: no guarantee frame header contiguous
sys/netproto/802_11/wlan/ieee80211_hostap.c:594
 none reproduced not_testable untriaged — —
DF-0364 Info 3.1 ieee80211_fix_rate and findrix iterate rs_rates without validating rs_nrates <= IEEE80211_RATE_MAXSIZE: missing defense-in-depth
sys/netproto/802_11/wlan/ieee80211_proto.c:623
 none reproduced not_testable untriaged — —
DF-0383 Low 3.0 SET_TICKS computes len*8*dn_hz as signed int: overflow for jumbo at high dn_hz — same as dummynet v1 unfixed
sys/net/dummynet3/ip_dummynet3.c:450
 dos reproduced fixed untriaged — —
DF-0443 Low 3.0 Integer overflow in scaled scheduler parameter math: maxidle/offtime/pkttime products truncate to 32-bit int
sys/net/altq/altq_rmclass.c:248
 none reproduced fixed untriaged — —
DF-0446 Low 3.0 SIOCSIFMTU missing lower-bound validation: ifr_mtu=0 or negative accepted, corrupts downstream MSS/fragmentation math
sys/net/if_ethersubr.c:715
 none reproduced fixed untriaged — —
DF-0548 Low 3.0 bitmap[0]=~3 marks non-existent objects free when pool has <32 objects
sys/net/netmap/netmap_mem2.c:677
 dos reproduced fixed untriaged — —
DF-0299 Info 3.0 ng_bypass rewrites peer back-pointers without topology lock
sys/netgraph7/netgraph/ng_base.c:1207
 none reproduced not_testable untriaged — —
DF-0342 Info 3.0 in6_update_ifa inconsistent error handling on multicast group joins
sys/netinet6/in6.c:1144
 none reproduced not_testable untriaged — —
DF-0378 Info 3.0 SET_TICKS computes len*8*dn_hz in int: overflow for jumbo packets at high dn_hz -> shaper bypass
sys/net/dummynet/ip_dummynet.c:431
 none reproduced not_testable untriaged — —
DF-0347 Low 2.9 Undefined behavior: 1<<32 in WPA/RSN cipher selector parsing for unknown OUI
sys/netproto/802_11/wlan/ieee80211_hostap.c:1198
 none reproduced fixed untriaged — —
DF-0505 Low 2.9 ng_fec_input defined 2 params but assigned to 4-param if_input slot: calling-convention UB
sys/netgraph7/ng_fec.c:862
 none not_reproduced — untriaged — —
DF-0561 Info 2.9 hci_event ignores hci_event_hdr_t.length: per-spec bound for all variable-length events dropped (root cause)
sys/netbt/hci_event.c:163
 none reproduced not_testable untriaged — —
DF-0507 Info 2.6 IPv6 port-selection hash XORs destination with itself: always zero, no load balancing
sys/netgraph7/ng_fec.c:1056
 none reproduced fixed untriaged — —
DF-0538 Info 2.6 Type-confused stack buffer: char *addrbuf[NG_HOOKSIZ+4] is pointer array not byte array
sys/netgraph7/socket/ng_socket.c:981
 none reproduced not_testable untriaged — —
DF-0415 Low 2.5 Signed integer overflow in keepalive t_maxidle: t_keepintvl*t_keepcnt exceeds INT_MAX at high hz
sys/netinet/tcp_usrreq.c:1644
 dos reproduced fixed untriaged — —
DF-0501 Low 2.5 netgraph message leak on ioctl timeout-vs-response race
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:910
 dos reproduced fixed untriaged — —
DF-0685 Low 2.5 TOCTOU on hci_num_cmd_pkts in hci_send_cmd causes uint8_t underflow
sys/netbt/hci_unit.c:314
 panic reproduced fixed untriaged — —
DF-0697 Low 2.5 SET_FILTER ENOMEM path leaks the inbound ng_mesg (return bypasses epilogue)
sys/netgraph/etf/ng_etf.c:327
 dos reproduced fixed untriaged — —
DF-0760 Low 2.5 Unsynchronized per-CPU IP-ID swap lets duplicate IDs be emitted within 32768-call non-reuse window
sys/netinet/ip_id.c:110
 none reproduced not_testable untriaged — —
DF-0416 Info 2.5 TCP_MAXSEG minmss floor can raise t_maxseg above current negotiated value on small-MTU paths
sys/netinet/tcp_usrreq.c:1613
 none reproduced not_testable untriaged — —
DF-2582 Info 2.5 Unbounded shift and missing masklen=0 guard in table_append_dispatch yield wrong mask (logic bug UB)
sys/net/ipfw3_basic/ip_fw3_table.c:161
 corruption reproduced not_testable untriaged — —
DF-0340 Low 2.3 in6_ifremloop leaks rtentry refcount when matched route is not loopback host route
sys/netinet6/in6.c:318
 none reproduced fixed untriaged — —
DF-0341 Low 2.3 in6_lifaddr_ioctl SIOCDLIFADDR copies prefix mask into ifra_dstaddr instead of ifra_prefixmask
sys/netinet6/in6.c:1606
 none reproduced fixed untriaged — —
DF-0478 Low 2.3 Rule set field not validated: 1<<set with set>=32 is UB enabling rule-set bypass
sys/net/ipfw3/ip_fw3.c:487
 none reproduced fixed untriaged — —
DF-0577 Low 2.3 Integer overflow in SLIOCSKEEPAL/SLIOCSOUTFILL interval computation: tight callout loop DoS
sys/net/sl/if_sl.c:398
 dos reproduced fixed untriaged — —
DF-0613 Low 2.3 Control-message request msg leaked on EBUSY early return in POINT2POINT/BROADCAST handler
sys/netgraph/iface/ng_iface.c:660
 dos reproduced fixed untriaged — —
DF-0723 Low 2.3 Error-path kfree uses wrong malloc type M_NETGRAPH_SPPP for M_IFNET allocation and bypasses if_free (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:261
 dos inconclusive — untriaged — —
DF-2574 Low 2.3 Memory leak of struct ngd_connection in ng_device_disconnect (unbounded kernel heap exhaustion)
sys/netgraph/ng_device.c:411
 dos reproduced not_testable untriaged — —
DF-0318 Info 2.3 Inconsistent atomic vs non-atomic access to wg_packet::p_state
sys/net/wg/if_wg.c:508
 none reproduced not_testable untriaged — —
DF-0369 Info 2.3 lagg_port_ioctl fallback forwards ioctl to driver but always returns EINVAL discarding result
sys/net/lagg/if_lagg.c:896
 none reproduced not_testable untriaged — —
DF-0384 Info 2.3 delete_pipe uses DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 undeletable — same as v1
sys/net/dummynet3/ip_dummynet3.c:1645
 none reproduced fixed untriaged — —
DF-0461 Info 2.3 Potential signed integer overflow in kern_load burst-adaptation math
sys/net/if_poll.c:1019
 none reproduced not_testable untriaged — —
DF-0531 Info 2.3 NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path: all packets silently dropped
sys/netgraph/fec/ng_fec.c:1180
 none reproduced not_testable untriaged — —
DF-0390 Low 1.9 rt_xaddrs accepts sockaddrs with sa_len below _SA_MINSIZE: inconsistent with RO_MISSFILTER validation
sys/net/rtsock.c:1010
 none reproduced fixed untriaged — —
DF-0479 Low 1.9 ip_fw3_ctl_delete_rule: unchecked direct pointer deref of sopt_val without size validation
sys/net/ipfw3/ip_fw3.c:850
 dos reproduced fixed untriaged — —
DF-0530 Low 1.9 ng_fec_free_unit increments usage counter instead of decrementing + global bitmap mutated without locks
sys/netgraph/fec/ng_fec.c:290
 none not_reproduced — untriaged — —
DF-0552 Low 1.9 VLAN tag match strips priority on input but stores full 16-bit tag: input/output asymmetry
sys/net/vlan/if_vlan.c:605
 none reproduced fixed untriaged — —
DF-0576 Low 1.9 Callout handlers dereference sc_ttyp before NULL check/token: callout-vs-close race panic
sys/net/sl/if_sl.c:1012
 panic reproduced fixed untriaged — —
DF-0452 Info 1.9 Octal/hex escape loops in ng_get_string_token: counter k never incremented, consumes all consecutive digits
sys/netgraph/netgraph/ng_parse.c:1599
 none reproduced fixed untriaged — —
DF-0459 Info 1.9 user_frac sysctl accepts any uint32 without range validation (documented 0-100)
sys/net/if_poll.c:1116
 none reproduced not_testable untriaged — —
DF-0460 Info 1.9 status_frac / tx_frac sysctls have no upper bound: signed int overflow in ifpoll_compat_setup
sys/net/if_poll.c:1497
 none reproduced not_testable untriaged — —
DF-0681 Info 1.9 Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports bogus flow-control credits
sys/netbt/rfcomm_upper.c:550
 none reproduced fixed untriaged — —
DF-0695 Info 1.9 RC4 key material and S-box left unzeroed on kernel stack after encrypt/decrypt
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:334
 none reproduced fixed untriaged — —
DF-2596 Info 1.9 Incorrect totlen update after packet truncation produces wrong xmitOctets statistics
sys/netgraph/bpf/ng_bpf.c:415
 — reproduced not_testable untriaged — —
DF-0568 Info 1.7 ACL/SCO packet type and length validation only compiled under #ifdef DIAGNOSTIC
sys/netbt/hci_link.c:431
 none reproduced not_testable untriaged — —
DF-0313 Info 1.3 Sticky Hop-by-Hop/Destination options un-settable: hardcoded priv=0 always returns EPERM for root
sys/netinet6/ip6_output.c:2019
 none reproduced not_testable untriaged — —
DF-0675 Info 1.1 BPF LSH/RSH shift amount unbounded: shift-by->=32 is undefined behavior
sys/net/bpf_filter.c:443
 none reproduced not_testable untriaged — —
DF-0699 Info 1.1 Wrong byte counter after BPF truncation: totlen -= len should be totlen = len
sys/netgraph/bpf/ng_bpf.c:414
 none reproduced fixed untriaged — —
DF-0300 Info 0.8 ng_decodeidname truncates u_long to ng_ID_t without range check
sys/netgraph7/netgraph/ng_base.c:919
 none reproduced fixed untriaged — —
DF-0332 Info 0.8 Statistics counters read without lock: torn 64-bit reads
sys/netgraph7/ppp/ng_ppp.c:647
 none reproduced not_testable untriaged — —
DF-0553 Info 0.8 SIOCSETVLAN accepts reserved VLAN IDs (0 and 0xFFF) without validation
sys/net/vlan/if_vlan.c:996
 none reproduced not_testable untriaged — —
DF-0708 Low 0.5 Filter entries leaked on shutdown — hashtable not purged before kfree(privdata)
sys/netgraph7/etf/ng_etf.c:437
 dos reproduced fixed untriaged — —
DF-0339 Info 0.5 tcp_new_isn last_offset signed int overflow-wrap on churn (UB / monotonicity erosion)
sys/netinet/tcp_subr.c:1670
 none reproduced not_testable untriaged — —
DF-0398 Info 0.5 rt_setshims leaks previously allocated shims on partial allocation failure
sys/net/route.c:1374
 none reproduced not_testable untriaged — —
DF-0464 Info 0.5 bzero (not explicit_bzero) used to clear sensitive key material in heap structs: DSE risk
sys/net/wg/wg_noise.c:411
 none reproduced fixed untriaged — —
DF-0466 Info 0.5 Potentially unaligned 64-bit write constructing transport AEAD nonce
sys/net/wg/wg_noise.c:996
 none reproduced not_testable untriaged — —
DF-0647 Info 0.5 Module is dead code: cannot link because all engine symbols are defined only in non-compilable netflow.c
sys/netgraph7/netflow/ng_netflow.c:188
 none reproduced not_testable untriaged — —
DF-0711 Info 0.5 Build break: ADD_FILTER references undefined EVL_VLID_MASK macro — dead code not in any build
sys/netgraph7/ng_vlan.c:218
 none reproduced not_testable untriaged — —

Base system — drivers 1337

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-3761 Medium 8.6 alc_rxintr() Rx walk has no work bound — the process_limit knob exists but is never read: a remote line-rate flood keeps the return ring perpetually non-empty so the interrupt handler loops forever holding the serializer (NIC + CPU livelock); FreeBSD bounds this loop, DFly msk(4) bounds its own
sys/dev/netif/alc/if_alc.c:3236 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3904 Medium 8.6 sk_rxeof() Rx walk has no work bound — for(;;) loop's only exit is the OWN bit, so a line-rate remote flood keeps the walk running forever under the card-global serializer (DF-3761 family)
sys/dev/netif/sk/if_sk.c:1820 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3907 Medium 8.6 xl_rxeof() interrupt-mode Rx walk has no work bound — the count>=0 budget exists but every interrupt-path caller passes -1, and non-905B chips goto-again restart the walk on uplist stall (DF-3761 family)
sys/dev/netif/xl/if_xl.c:1960 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4232 High 7.8 txp(4) walks device-fed ring cursors unvalidated: OOB descriptor walk via kernel pointer in DMA memory, wild rx_sd deref, non-terminating loops
sys/dev/netif/txp/if_txp.c:658 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4521 High 7.8 drm_mm_for_each_node_in_range leaks the unallocated head_node sentinel into the caller's body and never terminates when end > mm end; i915_gem_evict_for_node's unclamped end += 4K turns it into a livelock or fake-i915_vma unbind
sys/dev/drm/drm_mm.c:171 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5128 Medium 7.8 for_each_sg_page/_sg_iter_next entry-budget underflow: iteration runs past caller-declared nents across chained chunks; real sg_pcopy_to_buffer processes out-of-budget entries (guest-proven fatal OOB entry deref)
sys/dev/drm/linux_scatterlist.c:261 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5143 Low 7.8 GFP_DMA32 <4GiB constraint for I965G/GM internal objects is dead code on DragonFly — shim alloc_pages ignores gfp_mask, so pre-gen6 32-bit GTT PTEs truncate >4GiB physical addresses and the GPU DMAs to aliased physical pages
sys/dev/drm/i915/i915_gem_internal.c:72 · pass 2 · new
 latent 8B OOB write on sub-word call / GPU DMA to aliased physical pages untested not_testable untriaged — —
DF-4697 High 7.7 nvme(4): duplicate nsid in the device-supplied ACTIVE NAMESPACE LIST re-attaches a live namespace — second nvme_disk_attach() bzeroes the live struct disk inside the global disklist (self-loop), double-inserts devstat, creates duplicate /dev/nvmeN cdevs → deterministic kernel panic on any later disklist walk
sys/dev/disk/nvme/nvme_admin.c:636 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3844 Medium 7.7 mrsas_issue_blocked_cmd times out and lets callers release mfi commands still owned by the firmware — late completions land on recycled commands, double-inserting them into the free pool (shared sc->chan ident wakes the wrong waiter)
sys/dev/raid/mrsas/mrsas.c:2865 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4671 Medium 7.7 bktr_mmap is re-executed at page-fault time and reads bktr->bigbuf/alloc_pages with no lock while METEORSETGEO's grow path kmem_free()s and reassigns the buffer — fault in the window maps pages via a dangling KVA pointer (stale mappings; ceiling: RW kernel-memory alias)
sys/dev/video/bktr/bktr_os.c:677 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3820 Low 7.6 aac(4) dereferences adapter-controlled completion/AIF indices with no bounds validation at five sites — malicious or faulty controller gets wild kernel pointers and unlink writes
sys/dev/raid/aac/aac.c:853 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3823 Low 7.6 asr_intr maps the adapter-posted FromFIFO reply offset into a kernel pointer with no validation — forged reply frame yields a forged ccb with LIST_REMOVE/callout_stop writes; FAIL path uses device-controlled MMIO offsets unbounded
sys/dev/raid/asr/asr.c:2890 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4381 High 7.5 Duplicate transaction DELETE double-dispatches xdisk state callbacks: kernel panic (KKASSERT on stock kernels; NULL deref at xaio_rcvdmsg:538 / xa_sync_completion:1127 otherwise)
sys/dev/disk/xdisk/xdisk.c:535 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3782 Medium 7.5 vmxnet3_rxq_eof() RX completion walk has no work bound: interrupt-thread livelock holding the RXQ lock under a remote line-rate flood (DF-3761/3778 family, vmx(4) instance)
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2201 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3990 Medium 7.5 RX walk has no work bound (ALE_PROC_* knobs are dead code) — serializer-held livelock on line-rate flood; ale_txeof takes the 16-bit TPD_CONS_IDX unmasked vs the 256-ring — TX over-reclaim of still-owned mbufs (DF-3761/3778/3934 family)
sys/dev/netif/ale/if_ale.c:2026 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4259 Low 7.5 my_stop frees all RX/TX mbufs and zeroes descriptor rings without waiting for the TX/RX engines to go idle — trailing DMA into freed clusters (packet-controlled kernel heap corruption)
sys/dev/netif/my/if_my.c:1651 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3934 Medium 7.4 RX walk has no work bound (AGE_PROC_* knobs are dead code) and 16-bit CMB producer indices are not masked to ring sizes — serializer-held livelock DoS and TX over-reclaim
sys/dev/netif/age/if_age.c:2149 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4444 High 7.1 DragonFly-only drm_vma_node_unmap() cannot revoke a single user mapping: user CPU PTEs into the physical GGTT aperture survive VMA unbind/evict/fence-steal/object-free and read+write whatever object later reuses the aperture range (unprivileged cross-object/cross-user GPU memory access)
sys/dev/drm/i915/i915_vma.c:857 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4791 High 7.1 ttm_shrink ↔ ttm_bo_swapout unbounded recursion: the TTM memory-accounting shrinker re-enters itself through the lazy page-populate of the very BO it is swapping out — attacker-controlled nesting depth exhausts the 16KiB kernel stack
sys/dev/drm/ttm/ttm_memory.c:502 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3629 High 7.0 iwm_rx_tx_cmd: firmware-supplied qid indexes sc->txq[IWM_MAX_QUEUES=31] with no bounds check - OOB ring access, NULL writes at OOB offsets, wild node deref (iwm twin of DF-1122)
sys/dev/netif/iwm/if_iwm.c:3598 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3727 High 7.0 ciss_disable_adapter: uninitialized STAILQ head qh -> wild kernel write/read (missing STAILQ_INIT)
sys/dev/raid/ciss/ciss.c:3465 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-3929 Medium 7.0 mly_done() completion slot has no lower-bound check: command_id 0 indexes mly_command[-1] — OOB field writes + TAILQ pointer writes + indirect call through firmware-fed memory
sys/dev/raid/mly/mly.c:1535 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4191 Medium 7.0 sdhci_start_data treats bus_dmamap_load()==EINPROGRESS as a plain failure: the deferred sdhci_adma2_getaddr callback stays armed against the shared ADMA2 descriptor table (and the map against a freed buffer) — potential mid-transfer descriptor rewrite -> controller DMA to stale addresses
sys/dev/disk/sdhci/sdhci.c:1326 · pass 2 · new
 none untested not_testable untriaged — —
DF-4467 Medium 7.0 Software XTS races on session-shared running tweak: silent ciphertext corruption and data-unit tweak reuse on multicore dm-crypt I/O
sys/dev/disk/dm/crypt/dm_target_crypt.c:958 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4566 Medium 7.0 VCN rings ship with zero CS ib validation — no .parse_cs hook, userspace decode messages (session handle, fb buffer addresses/sizes) reach firmware unvalidated
sys/dev/drm/amd/amdgpu/amdgpu_vcn.c:465 · pass 2 · new
 none untested not_testable untriaged — —
DF-5083 Medium 7.0 ata_dmaload() mishandles bus_dmamap_load()==EINPROGRESS: busdma defers the load and later fires setprd into a dead stack frame (and re-loads the completed request's freed buffer) — kernel memory corruption + permanent channel wedge
sys/dev/disk/nata/ata-dma.c:223 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3704 Medium 6.7 vega10_odn_edit_dpm_table signed-compare lets negative user 'long' pass the bounds check -> wild kernel write (DF-3687 twin)
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4884 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3708 Medium 6.7 arcmsr_action() invalid kfree() of bus_dmamem SRB-pool interior pointer on CAM SG error path
sys/dev/raid/arcmsr/arcmsr.c:3053 · pass 2 · new
 corruption reproduced fixed untriaged — —
DF-4019 Low 6.7 debugfs amdgpu_iomem: upstream page-ownership check is #if 0'd, turning the debug file into arbitrary physical-memory read/write for debugfs holders
sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2424 · pass 2 · new
 debugfs amdgpu_iomem: the upstream page-ownership check is #if 0'd ('XXX DRAGONFLY - dev_mapping NULL atm'), so the file gives its holder arbitrary physical-memory read/write by llseek+read/write (only pfn_valid is checked). untested not_testable untriaged — —
DF-4535 Low 6.7 lptwrite() ignores uiomove() failure: stale kernel-heap bytes transmitted out the parallel port and a non-terminating write (unkillable, mplock-starvation system DoS in polled mode)
sys/dev/misc/lpt/lpt.c:657 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4307 Medium 6.6 adw_intr walks device-fed 32-bit completion tokens (areq_ba/next_ba) through unchecked acbbotov/carrierbotov pointer arithmetic — OOB kernel read/write and interrupt livelock
sys/dev/disk/advansys/adwcam.c:1280 · pass 2 · new
 none untested not_testable untriaged — —
DF-4266 High 6.5 Inverted RX descriptor-ownership test in wb_rxeof(): receive path completely broken, per-packet chip reset/reinit storm from interrupt context
sys/dev/netif/wb/if_wb.c:973 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4404 High 6.5 u32 integer overflow in amdgpu_uvd_cs_msg_decode defeats DPB/ctx buffer size validation — UVD runs physical addressing, so undersized decode sessions GPU-DMA past validated buffers (cross-process VRAM/GTT corruption)
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5134 High 6.5 dma_buf_fd() never drops the caller's file reference after fsetfd(): every PRIME export orphans one reference — struct file + dma_buf + GEM object (+ pinned user-sized pages) + drm_device immortal, nfiles walks to system-wide ENFILE
sys/dev/drm/linux_dma-buf.c:139 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3576 Medium 6.5 Remote kernel panic: division by zero in iwn_set_timing() via AP beacon with bintval=0 (net80211 stores the invalid value anyway)
sys/dev/netif/iwn/if_iwn.c:5596 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3710 Medium 6.5 arcmsr_srb_timeout vs interrupt completion: unsynchronized srb_state check-then-act double-completes one CCB (double xpt_done, srboutstandingcount underflow)
sys/dev/raid/arcmsr/arcmsr.c:856 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4192 Medium 6.5 pcm-core chn_trigger() trigger-flag/busy-list race (reached via es137x /dev/dsp): unprivileged kernel panic and unrecoverable system-wide hang
sys/dev/sound/pci/es137x.c:755 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4221 Medium 6.5 pvscsi_process_completion() writes through a NULL ccb on duplicate/spurious device completion (missing guard its own timeout handler has)
sys/dev/virtual/vmware/pvscsi/pvscsi.c:903 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4267 Medium 6.5 RX ring collapse: constant-condition ternary links all 64 RX descriptors (software and hardware next pointers) to descriptor 0
sys/dev/netif/wb/if_wb.c:909 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4279 Medium 6.5 CCDIOCSET accepts a negative interleave: negative component transfer size drives an unbounded dispatch loop and a guaranteed kernel panic
sys/dev/disk/ccd/ccd.c:1326 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4413 Medium 6.5 radeon_vm_bo_set_addr() commits the mapping before page-table allocation — allocation failure leaves NULL page tables and the next update panics in radeon_vm_update_ptes()
sys/dev/drm/radeon/radeon_vm.c:519 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4458 Medium 6.5 drm_gem_mmap_single passes the user-controlled mmap length and in-object offset (bits 0..39 of the fake offset) to the GEM device pager with no bounds check — the only upstream clamp is dead in #if 0
sys/dev/drm/drm_gem.c:1082 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4476 Medium 6.5 IOCATADETACH/ATTACH/REINIT dispatched unserialized: double channel teardown (double bus_teardown_intr/bus_release_resource/lockuninit) -> sysref_put panic
sys/dev/disk/nata/ata-all.c:369 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-4564 Medium 6.5 radeon: dropped radeon_bo_unreserve() in radeon_driver_open_kms permanently holds the IB-pool BO reservation — first DRM close (and every later open) hangs uninterruptible, wedging the GPU for all users
sys/dev/drm/radeon/radeon_kms.c:662 · pass 2 · new
 dos not_reproduced not_testable untriaged — —
DF-4882 Medium 6.5 Reachable KASSERT panic in ath_rate_ctl_start() from a zero-length Supported Rates IE beacon — remote DoS on default (INVARIANTS) DragonFly kernels with ath+onoe+IBSS
sys/dev/netif/ath/ath_rate/onoe/onoe.c:285 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4235 Low 6.5 rl(4): any RX-error frame triggers a full adapter re-init in interrupt context under the ifnet serializer (remote per-frame DoS amplifier)
sys/dev/netif/rl/if_rl.c:1028 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4513 Low 6.5 vmbus: vmbus_msghc_wait_result blocks uninterruptibly with no timeout - a silent or malicious Hyper-V host permanently wedges device attach at boot (and later wedges vmbus_msghc_ctx_destroy/kldunload too)
sys/dev/virtual/hyperv/vmbus/vmbus.c:517 · pass 2 · new
 Permanent boot-hang / sticky msghc wedge with no panic or recovery (availability twin of DF-1668's memory corruption) untested not_testable untriaged — —
DF-3661 Medium 6.4 isp_attach_chan() cam_simq_release()s the shared devq once per channel while isp_attach held only one reference - premature cam_devq free + write-after-free on multi-channel adapters
sys/dev/disk/isp/isp_freebsd.c:95 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4414 Medium 6.4 radeon_vm_fini() DragonFly rewrite spins forever when radeon_bo_reserve() fails — unkillable kernel livelock (upstream single-pass merely leaks)
sys/dev/drm/radeon/radeon_vm.c:1250 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4963 Low 6.4 snd_hdspe attach has no error unwind: failed attach leaks snd lock/IRQ/DMA resources and leaves hdspe_intr live on a dead device — after kldunload the IRQ vector dispatches into unmapped module text
sys/dev/sound/pci/hdspe.c:293 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-4473 High 6.3 dm_table_load_ioctl mutates the inactive-table TAILQ under a SHARED table lock — concurrent reload ioctls race TAILQ_INSERT_TAIL (kernel list corruption -> panic / permanent orphan leaks)
sys/dev/disk/dm/dm_ioctl.c:722 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3765 Medium 6.3 32-bit multiply overflow in r100_cs_track_check() PW=1 vertex-array bound (esize * max_indx * 4) -> CS validator bypass -> GPU OOB index/vertex fetch
sys/dev/drm/radeon/r100.c:2326 · pass 2 · new
 leak inconclusive not_testable untriaged — —
DF-4203 Medium 6.3 ahci_xpt_action() XPT_SCSI_IO re-entrant probe runs without the port lock — concurrent probe/state-machine race corrupts port state
sys/dev/disk/ahci/ahci_cam.c:989 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4714 Medium 6.3 bre5() second-bad-subdisk guard requires checksdstate() to fail: badsdno silently overwritten for reviving/reborn data subdisks -> parityless-write conversion defeated and two-bad-column writes accepted (silent data loss, parity scribbled onto down subdisk)
sys/dev/raid/vinum/vinumraid5.c:404 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4837 Medium 6.3 ida bio path never sets DMA direction flags: bounced READ data never copied back (silent disk corruption) and dmamap_unload/bounce pages leak on >4GB hosts
sys/dev/raid/ida/ida.c:391 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4317 Low 6.3 lge_jref() check-then-increment runs without the jslot serializer: racing lge_jfree() recycles the slot onto the free list with inuse==1 — double ownership of a 9KB RX jumbo cluster (DF-1384 nge twin)
sys/dev/netif/lge/if_lge.c:810 · pass 2 · new
 none untested not_testable untriaged — —
DF-4605 Medium 6.2 amdgpu_atif_handler: port gutted the event guard into an empty if (#if 0) — unconditional fall-through dereferences adev->atif (NULL+0x12) on ATIF-less systems → kernel panic on first ACPI notify
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:375 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-4961 Medium 6.2 amdgpu bit-bang i2c adapters registered without lock_ops → NULL function-pointer call in i2c_transfer() → kernel panic on first DDC/EDID access
sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:193 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4891 High 6.1 DragonFly DIV_ROUND_DOWN_ULL compat shim corrupts drm_rect_clip_scaled(): post-validation source-rectangle corruption feeds OOB display-engine scanout on i915 sprite paths
sys/dev/drm/drm_rect.c:64 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4075 Medium 6.1 mps_request_polled has no timeout cancellation: mps_update_events prints a NULL reply (NULL-deref panic) and callers free still-posted commands that late-complete against freed/reallocated cm state
sys/dev/raid/mps/mps.c:1724 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4447 Medium 6.1 VCE two-pass parse desynchronization: amdgpu_vce_cs_reloc patches the NEXT command's len/cmd header via in-IB dword aliasing — attacker-synthesized command stream skips loop-1 validation and len=0 causes an infinite in-kernel loop in the CS ioctl
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:656 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4500 Medium 6.1 radeon_uvd CS parser/hardware desync: stale-or-unset DATA0/DATA1 dword indices patch the validated IB and make the UVD engine consume unvalidated GPU addresses
sys/dev/drm/radeon/radeon_uvd.c:583 · pass 2 · new
 none untested not_testable untriaged — —
DF-4900 Medium 6.1 dm unit allocation is unbounded while the dev_t minor encoding holds only 512 units — the 513th live dm device aliases a live device's minor and KKASSERT-panics dm_dev_insert deterministically (race-free); dkunit() truncation on destroy also frees live devices' clone-bitmap bits
sys/dev/disk/dm/dm_dev.c:234 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4965 Low 6.1 dce110 hw_translate offset_to_id returns success for all eight DDC-family offsets without writing *id — dal_gpio_service_create_irq switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6/7 into the 6-entry hpd_regs[] (OOB rodata read driving MMIO)
sys/dev/drm/amd/display/dc/gpio/dce110/hw_translate_dce110.c:143 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3598 Medium 6.0 gfx_v8_0_init_microcode ignores amdgpu_ucode_validate() result for the RLC firmware (asymmetric size gate)
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1082 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3779 Medium 6.0 vmxnet3_rxq_eof() selects UNPOPULATED RX ring 1 from host rxcd->qid -> NULL-mbuf write -> guest kernel panic
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2217 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3780 Medium 6.0 vmxnet3_txq_eof() advances TX ring from unchecked host txcd->eop_idx -> permanent mbuf/cluster leak (unbounded) and TXRING_AVAIL desync
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:1966 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3852 Medium 6.0 Voltage-GPIO MMIO register index taken raw from VBIOS and executed by r100_pm_misc() — arbitrary in-BAR register RMW and out-of-BAR MM_INDEX writes (up to 0x3FFFC)
sys/dev/drm/radeon/radeon_combios.c:2748 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3983 Medium 6.0 sbp_orb_pointer fw_asyreq-failure branch xpt_done()s the CCB while leaving the OCB queued on sdev->ocbs, timeout-armed and dmamap-loaded — later timeout/device completion fires a second xpt_done on the stale ccb and/or duplicate-frees the OCB
sys/dev/disk/sbp/sbp.c:1175 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4423 Medium 6.0 vtblk_finish_bio() drops its error argument: detach mid-I/O completes unperformed transfers as SUCCESS — silent data fabrication plus stale kernel memory returned as file data
sys/dev/virtual/virtio/block/virtio_blk.c:1202 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4760 Medium 6.0 free_vinum()'s daemon-stop loop wedges kldunload for the holder's chosen duration, permanently leaks one struct daemonq kmalloc per tick, and blocks kldload/kldstat system-wide via the linker lock
sys/dev/raid/vinum/vinum.c:215 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5062 Medium 6.0 vinum volume-minor aliasing: volume #256 wraps into VOL[0] — every access to /dev/vinum/vol/v256 is served by volume v0 (deterministic cross-volume data corruption + wrong-object sizing)
sys/dev/raid/vinum/vinumutil.c:241 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3631 Low 6.0 iwm_read_firmware TLV walk: size_t underflow on len -= roundup2(tlv_len,4) (and datasize < header) walks the parser past the firmware image
sys/dev/netif/iwm/if_iwm.c:607 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3687 Low 6.0 Signed-compare bypass in smu7_odn_edit_dpm_table: negative sysfs level passes the bounds check and wraps to a u32 wild write index
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4854 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3778 Medium 5.9 jme_rxeof() RX walk has no work bound on the interrupt path (count=-1 at all three call sites): a remote line-rate small-packet flood keeps the ring perpetually non-empty so the interrupt handler loops forever holding the serializer — NIC + CPU livelock, whole-interface wedge on legacy/MSI (DF-3761/alc family, jme(4) instance)
sys/dev/netif/jme/if_jme.c:2494 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4335 Medium 5.8 twa CL: tw_cli_get_param/tw_cli_set_param re-queue a request after ETIMEDOUT — FREE_Q double-insert (unwalkable queue, spin under gen_lock) or BUSY_Q+FREE_Q dual membership (request reuse under live firmware DMA)
sys/dev/raid/twa/tw_cl_io.c:804 · pass 2 · new
 none untested not_testable untriaged — —
DF-4216 Low 5.8 dc_submit_i2c indexes dc->links[] with an unvalidated, wrong-domain index (DDC line number from VBIOS): NULL/wild deref panic and silent wrong-connector DDC routing
sys/dev/drm/amd/display/dc/core/dc.c:1742 · pass 2 · new
 none untested not_testable untriaged — —
DF-5779 Low 5.8 seq_puts() shim passes its data string as the ksnprintf format — kernel format-string trap with live %n write conversion (latent for ported code)
sys/dev/drm/include/linux/seq_file.h:44 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3593 Medium 5.7 Duplicate firmware TX-done re-completes a freed TX slot: NULL-deref/KASSERT panic and TX-ring accounting underflow
sys/dev/netif/bwn/bwn/if_bwn.c:5996 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4503 Medium 5.7 ahci_pm_read/write recycle the ata_xfer while the command is still programmed on the chip (deferred timeout returns ATA_S_ONCHIP): CCB freed and re-issuable while chip owns the slot -> ahci_ata_cmd_done KKASSERT panic or cross-command completion corruption
sys/dev/disk/ahci/ahci_pm.c:976 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3628 Low 5.7 Unvalidated VBT backlight.controller used as power-sequencer register index (out-of-range MMIO writes on BXT)
sys/dev/drm/i915/intel_dp.c:864 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3875 Low 5.7 mfi_intr bounds reply-queue contexts by mfi_max_fw_cmds but mfi_commands[] is allocated MIN(128, mfi_max_fw_cmds) -> OOB command object under firmware misbehavior
sys/dev/raid/mfi/mfi.c:1228 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4328 Low 5.7 sf_attach() bus_setup_intr() failure path double-invokes ether_ifdetach() and passes a NULL intr cookie to bus_teardown_intr()
sys/dev/netif/sf/if_sf.c:777 · pass 2 · new
 none untested not_testable untriaged — —
DF-4908 Low 5.7 ath_descdma_setup() returns error==0 (success) after tearing everything down when the ath_buf array kmalloc fails — and the unvalidated RWTUN hw.ath.*buf sysctls feeding it make the failure deterministic (and can truncate bsize into a small kmalloc walked OOB by the setup loop)
sys/dev/netif/ath/ath/if_ath_descdma.c:272 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4909 Low 5.7 __drm_legacy_pci_free consumes never-initialized tag/map: the DF port broke the _DRM_CONSISTENT map's alloc/free contract — drm_pci_alloc's descriptor is kfree'd at addmap, the rmmap path forges it on the stack with only vaddr/busaddr/size, and the DF bus_dma teardown then runs bus_dmamap_unload/bus_dmamem_free/bus_dma_tag_destroy on uninitialized stack pointers while the real tag/map/DMA memory leak permanently
sys/dev/drm/drm_pci.c:152 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-5057 Low 5.7 mlxd lifetime TOCTOU: MLX_DETACH_DRIVE checks MLXD_OPEN then sleeps in mlx_flush before device_delete_child; mlxd_detach has no recheck and no in-flight drain — softc freed under racing open fds / in-flight bios (DF-5025/DF-5046 family, last LD sibling)
sys/dev/raid/mlx/mlx_disk.c:98 · pass 2 · new
 none untested not_testable untriaged — —
DF-4030 Medium 5.6 u32 (size + offset) wraparound defeats VALID_BUFFER BO bound check (+ forced-size underflow)
sys/dev/drm/radeon/r600_cs.c:2001 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4032 Medium 5.6 Texture mipmap BO bounds check is commented out (GPU OOB mip walk past mipmap BO)
sys/dev/drm/radeon/r600_cs.c:1399 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4046 Medium 5.6 stge_stop() deadlocks the callout subsystem against stge_tick (AB-BA): synchronous callout_stop() issued while holding the driver serializer vs a tick callback parked in lwkt_serialize_enter — mechanism PROVEN on the guest via protocol replica; stge_tick re-arms UNCONDITIONALLY under the lock
sys/dev/netif/stge/if_stge.c:1758 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4415 Low 5.6 atkbdc drain/poll loops reset their budget on every received byte with no overall cap — unbounded kernel busy-loop under i8042/AUX data flood (empty_both_buffers got the cap, these four did not)
sys/dev/misc/kbd/atkbdc.c:865 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4511 Low 5.6 acpi_wmi: _WDG result consumed unvalidated — NULL-deref boot panic on missing Return; ACPI_OBJECT union type-confusion memcpy on non-Buffer _WDG return
sys/dev/acpica/acpi_wmi/acpi_wmi.c:725 · pass 2 · new
 Boot-time NULL-deref panic on missing Return; type-confused wild memcpy read with contents rendered via world-readable /dev/wmistat untested not_testable untriaged — —
DF-4617 Low 5.6 hdacc_stream_intr/hdacc_stream_free index codec->streams[dir][stream] with an unvalidated controller-derived stream tag — negative DF-4115 BSS tags dispatch through an OOB-read device_t (wild indirect call)
sys/dev/sound/pci/hda/hdacc.c:665 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4630 Low 5.6 mpt_user: shared static user_handler_id over a global reply-handler table — detaching one controller unregisters mpt_user_reply_handler for all others, leaking requests until pool exhaustion
sys/dev/disk/mpt/mpt_user.c:90 · pass 2 · new
 Storage DoS: each RAID_ACTION on the surviving controller leaks one of 512 request slots until ENOMEM takes down all mpt I/O including disk traffic untested not_testable untriaged — —
DF-5230 Low 5.6 NULL rdev->uvd_fw dereference in uvd_v4_2_resume via the unguarded KV DPM ungate path (kv_dpm.c:1628) — kernel panic on suspend/pm-fini of a DPM-enabled CIK APU without UVD firmware
sys/dev/drm/radeon/uvd_v4_2.c:51 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4918 High 5.5 drain_workqueue() tsleep()s holding worker_lock — permanent kernel-thread/workqueue deadlock (drain never returns; worker starved; queue_work callers cascade-wedge)
sys/dev/drm/linux_workqueue.c:265 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3589 Medium 5.5 Unprivileged kernel panic: CTLFLAG_ANYBODY psm sysctls allow the smoother divisor product div_x*multiplicator to wrap to zero (divide-by-zero in psmsmoother)
sys/dev/misc/psm/psm.c:4337 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3610 Medium 5.5 NULL-pointer dereference in si_dpm_enable when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state (boot_ps unvalidated) — radeon twin of amdgpu DF-3586
sys/dev/drm/radeon/si_dpm.c:6354 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3612 Medium 5.5 Integer divide-by-zero in spread-spectrum programming when VBIOS usSpreadRateInKhz == 0 (si_calculate_sclk_params:4831 and si_populate_mclk_value:4931) — distinct sink from DF-1137
sys/dev/drm/radeon/si_dpm.c:4831 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3613 Medium 5.5 Integer divide-by-zero on zero PLL reference clock from VBIOS FirmwareInfo (do_div at si_calculate_sclk_params:4811; mpll divide at si_populate_mclk_value:4927)
sys/dev/drm/radeon/si_dpm.c:4811 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3653 Medium 5.5 NULL pointer dereference in amdgpu_dm_atomic_commit_tail() via update_stream_scaling_settings() with NULL dc_stream_state (underscan path)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4882 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3665 Medium 5.5 Divide-by-zero (#DE panic) in evergreen_latency_watermark(): zero available_bandwidth from tiny user mode clocks, u32 fixed-point wrap of mclk/sclk, or zero VBIOS clocks
sys/dev/drm/radeon/evergreen.c:2048 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3685 Medium 5.5 NULL-subtable dereference family at backend init: V1 parser treats mm/lookup/PowerTune subtables as optional, smu7 derefs them unconditionally with ignored error returns
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1842 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3696 Medium 5.5 Degraded RAID5 I/O: per-chunk ata_request leaked and bio never completed — boot wedge / unkillable hangs
sys/dev/disk/nata/ata-raid.c:386 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3702 Medium 5.5 vega10 backend-init NULL-derefs optional pptable subtables (tdp/mm/lookup/dep tables) — missing-offset VBIOS panics the kernel (DF-3685 twin)
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:269 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3763 Medium 5.5 r100_cs_track_cube() NULL-pointer dereference via unbound cube-face BOs -> kernel panic from unprivileged CS ioctl (pre-R300)
sys/dev/drm/radeon/r100.c:2143 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3788 Medium 5.5 BT848_SCAPAREA performs no validation: x_size=0 reaches build_dma_prog's horizontal-delay computation → integer division by zero → kernel panic
sys/dev/video/bktr/bktr_core.c:1758 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3828 Medium 5.5 Divide-by-zero family in DCE11 display watermark math: dce_v11_0_latency_watermark divides by available_bandwidth and disp_clk before any guard (DF-3665 twin)
sys/dev/drm/amd/amdgpu/dce_v11_0.c:908 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3839 Medium 5.5 SET_RESOURCE SQ_TEX_VTX_VALID_BUFFER bound-check bypass: (size + offset) added in u32 (+ forced-size underflow) → GPU vertex fetch up to ~4 GB past the BO
sys/dev/drm/radeon/evergreen_cs.c:2416 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3871 Medium 5.5 MFI_CMD ioctl: devclass_get_softc() result used without NULL check -> one-ioctl kernel NULL-deref panic
sys/dev/raid/mfi/mfi.c:2953 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3873 Medium 5.5 mfi ioctl handlers dereference user ioctl buffers without copyin/copyout -> trap_fatal panic on unmapped args (and kernel writes through raw user pointers)
sys/dev/raid/mfi/mfi.c:2909 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3878 Medium 5.5 Divide-by-zero family in DCE8 display watermark math: dce_v8_0_latency_watermark divides by available_bandwidth and disp_clk before any guard (DF-3828 DCE11 / DF-3857 DCE10 twin)
sys/dev/drm/amd/amdgpu/dce_v8_0.c:817 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3946 Medium 5.5 dce110_apply_ctx_for_surface programs a front end for a head pipe whose plane was detached (plane_state NULL) -> kernel NULL-deref panic
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2743 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3993 Medium 5.5 User-selected UVD/VCE CS ring dereferences NULL asic->ring[] slot on asic families whose dispatch table lacks the ring — kernel panic from unprivileged CS ioctl
sys/dev/drm/radeon/radeon_asic.c:214 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4042 Medium 5.5 Hostile SCSI target panics the kernel via MESSAGE REJECT of the driver's own MSG_ABORT/MSG_NOOP: amdsentmsg panic("Inconsistent msg buffer")
sys/dev/disk/amd/amd.c:1435 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4043 Medium 5.5 amdsettags panic("Implement me!") reached when a target rejects a tagged command (MESSAGE REJECT handling)
sys/dev/disk/amd/amd.c:846 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4044 Medium 5.5 amdparsemsg MSG_DISCONNECT writes through NULL active_srb after an unexpected reselection
sys/dev/disk/amd/amd.c:1218 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4097 Medium 5.5 XPT_RESET_DEV device reset is silently converted to a malformed opcode-0 CCB by btexecuteccb's no-data opcode clobber — HBA error reply then panics the kernel
sys/dev/disk/buslogic/bt.c:1062 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4098 Medium 5.5 btdone/btreset panic() on HBA-supplied btstat and reset-state bytes (hostile-controller panic family)
sys/dev/disk/buslogic/bt.c:1517 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4099 Medium 5.5 Unknown mailbox comp_code leaks the BCCB, dmamap and CAM command forever — btdone's comp_code switch has no default case after the timer was stopped
sys/dev/disk/buslogic/bt.c:1449 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4100 Medium 5.5 recovery BCCB is never marked BCCB_ACTIVE, so the BDR-completion recovery branch is dead code — every command timeout escalates to a full hard bus reset after a 2s freeze
sys/dev/disk/buslogic/bt.c:852 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4149 Medium 5.5 Zero-length iovec sends cuse_client_read/write into an infinite command loop; the looping reader becomes unkillable (survives SIGKILL)
sys/dev/misc/cuse/cuse.c:1687 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4217 Medium 5.5 ae_stop_rxmac()/ae_stop_txmac() decrement their idle-wait loop counter (i--): a non-idle device busy-wedges the kernel thread forever, timeout branch unreachable
sys/dev/netif/ae/if_ae.c:288 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4219 Medium 5.5 ae_rx_intr() for(;;) descriptor walk has no work bound: a device that keeps AE_RXD_UPDATE set livelocks the interrupt handler holding ifp->if_serializer (DF-3990 family)
sys/dev/netif/ae/if_ae.c:643 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4225 Medium 5.5 Divide-by-zero (kernel panic) in drm_mode_vrefresh: user-supplied umode with htotal*vtotal == 0 (mod 2^32) passes drm_mode_validate_basic and wraps den to zero
sys/dev/drm/drm_modes.c:783 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4242 Medium 5.5 panic("DPT Rebooted") on device-fed register signature — a rebooting or hostile HBA takes down the kernel (DF-4042/4098 hostile-input family)
sys/dev/raid/dpt/dpt_scsi.c:1551 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4251 Medium 5.5 mprsas_SSU_to_SATA_devices leaks mpr_lock on two error-path returns — permanent adapter deadlock at shutdown
sys/dev/raid/mpr/mpr_sas_lsi.c:1497 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4262 Medium 5.5 CS ioctl with num_chunks==0 returns early success, amdgpu_cs_ib_fill dereferences NULL parser->entity — unprivileged kernel panic
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:114 · pass 2 · new
 none untested not_testable untriaged — —
DF-4263 Medium 5.5 Duplicate BO_HANDLES/FENCE/SYNCOBJ_OUT chunks overwrite parser state, permanently leaking bo_list + all BO refs, user-fence BO refs, and syncobj refs
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:88 · pass 2 · new
 none untested not_testable untriaged — —
DF-4283 Medium 5.5 midi(4) kqueue filter detach removes knote from BOTH klists — unguarded SLIST_REMOVE walks off the foreign list and dereferences NULL → deterministic kernel panic
sys/dev/sound/midi/midi.c:932 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4331 Medium 5.5 Spanset code divides by firmware fields that can be zero: mr_update_span_set quad->diff (map load) and get_arm/mr_spanset_get_phy_params spanRowSize (first FP IO) - kernel #DE panic
sys/dev/raid/mrsas/mrsas_fp.c:969 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4373 Medium 5.5 Divide-by-zero in dce_transform_get_max_num_of_supported_lines: prescaler_on + fully-off-CRTC plane (or underscan-inset stream dst) yields pixel_width==0 — ASSERT is WARN_ON-only, integer #DE kernel panic from an unprivileged atomic TEST_ONLY check
sys/dev/drm/amd/display/dc/dce/dce_transform.c:675 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4390 Medium 5.5 NULL request-descriptor dereference in mfi_tbolt_send_frame for PD_SCSI_IO with READ_10/WRITE_10 CDBs - any I/O to a Thunderbolt system PD panics the kernel
sys/dev/raid/mfi/mfi_tbolt.c:1156 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4472 Medium 5.5 dm_table_load_ioctl dereferences uninitialized stack pointer `type` as a C string (strcmp/ksnprintf wild read -> kernel panic)
sys/dev/disk/dm/dm_ioctl.c:684 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4505 Medium 5.5 ipmi(4): IPMICTL_SEND_COMMAND flood parks an unbounded in-flight request backlog — kernel memory exhaustion, panic "ipmi: malloc limit exceeded" (operator-group local kernel DoS)
sys/dev/misc/ipmi/ipmi.c:401 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4576 Medium 5.5 amdgpu_gem: GEM_VA MAP/REPLACE commits page tables for the entire attacker-chosen range before amdgpu_vm_bo_map() validates the mapping — every failed map strands ~(map_size>>18) bytes of page-table BOs until fd close; unprivileged render-node GTT/kernel exhaustion (cross-process GPU wedge)
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:638 · pass 2 · new
 none untested not_testable untriaged — —
DF-4580 Medium 5.5 radeon_cs_parser_init: fully attacker-controlled u32 num_chunks/length_dw drive unbounded wired GFP_KERNEL allocations — on DragonFly GFP_KERNEL is M_WAITOK without M_NULLOK, so failure is panic('malloc limit exceeded')/panic('kernel_map ran out of space') or an eternal unkillable vm_wait() loop (local kernel DoS); latent NULL-return path would additionally crash radeon_cs_parser_fini via parser->chunks[i]
sys/dev/drm/radeon/radeon_cs.c:287 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4582 Medium 5.5 rs690 watermark fixed-point divide-by-zero via pixel-clock 2^20 wrap: dfixed_const(1048576 kHz) == 0 → do_div by zero → kernel panic (trap 18), reachable from an unprivileged DRM master via DRM_IOCTL_MODE_SETCRTC on RS690/RS740/RS780/RS880
sys/dev/drm/radeon/rs690.c:326 · pass 2 · new
 panic inconclusive fixed untriaged — —
DF-4608 Medium 5.5 NULL-pointer dereference panic in radeon_vce_cs_reloc when a VCE command stream is submitted without a relocation chunk
sys/dev/drm/radeon/radeon_vce.c:478 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4639 Medium 5.5 ips: debug.ips.ignore_flush_cmd polarity inverted - the adapter cache-flush command is silently dropped on the DEFAULT configuration (fsync() durability broken)
sys/dev/raid/ips/ips_commands.c:195 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4657 Medium 5.5 plip: lpoutput/lp_intr spin on the parallel port inside crit_enter() with unbounded aggregate time — unprivileged CPU-pinning DoS
sys/dev/netif/plip/if_plip.c:606 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4672 Medium 5.5 METEORSETGEO grow path frees the contigmalloc'd frame buffer with bare kmem_free() — wired vm_pages are never returned: permanent unprivileged wired-memory leak (plus stale kernel PTEs / mistabulated resident_count)
sys/dev/video/bktr/bktr_os.c:399 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4696 Medium 5.5 Divide-by-zero (#DE kernel panic) in dpp1_dscl_calc_lb_num_partitions: UABI-legal off-CRTC plane yields recout.width==0 (line_size==0 → 816/0 at :439, also :440/:441) — DCN10 commit-path twin of DF-4373
sys/dev/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c:411 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4819 Medium 5.5 i915 GEM shrinker is dead code: never registered with any memory-reclaim path — purgeable/unbound GPU buffer pages are never reclaimed under system memory pressure (DF-4507 family)
sys/dev/drm/i915/i915_gem_shrinker.c:313 · pass 2 · new
 none untested not_testable untriaged — —
DF-5026 Medium 5.5 Bios queued to an IPS_OFFLINE adapter are never biodone'd — ips_start_io_request swallows ips_get_free_cmd's EIO; every issuer parks in an unkillable D-state and bio_queue grows unbounded
sys/dev/raid/ips/ips_disk.c:128 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5070 Medium 5.5 SPECTRAL_CONTROL_SET_PARAMS dereferences indata without checking the ATH_DIAG_IN flag — unprivileged NULL-pointer-deref panic (DFS_SET_THRESH twin of DF-2052, missed in pass 1)
sys/dev/netif/ath/ath/if_ath_spectral.c:233 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5133 Medium 5.5 dmabuf_fileops leaves fo_shutdown NULL: shutdown(2) on any dma-buf fd is an unprivileged kernel NULL function-pointer call (panic)
sys/dev/drm/linux_dma-buf.c:107 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3633 Low 5.5 iwm_notif_intr: 12-bit closed_rb_num compared against 256/512-entry ring positions - non-terminating interrupt-context loop, hard system hang (iwm twin of DF-3581)
sys/dev/netif/iwm/if_iwm.c:5710 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4015 Low 5.5 mps_user_command leaks one mps_command per timed-out MPSIO_MPS_COMMAND (shared pool exhaustion starves the storage stack)
sys/dev/raid/mps/mps_user.c:705 · pass 2 · new
 mps_user_command leaks one mps_command per timed-out MPSIO_MPS_COMMAND (goto Ret skips RetFreeUnlocked) - operator drains the finite command pool shared with SCSI I/O -> ENOMEM for management ioctls and eventual I/O starvation of the boot disk. untested not_testable untriaged — —
DF-4245 Low 5.5 dpt_get_conf ready-wait is an unbounded, interrupts-disabled spin driven only by HBA register values — hostile status shape hangs the kernel at attach
sys/dev/raid/dpt/dpt_scsi.c:498 · pass 2 · new
 none demonstrated on guest (no DPT hardware); source-level impact: unbounded crit-section MMIO spin at attach → kernel hang (boot-time DoS) from hostile/faulty HBA status untested not_testable untriaged — —
DF-4355 Low 5.5 Four unbounded MMUCR_BUSY busy-waits (two in hard interrupt context) plus no-exit device-driven loops: unrecoverable system hang on SMC91xx glitch or PCMCIA ejection
sys/dev/netif/sn/if_sn.c:275 · pass 2 · new
 none untested not_testable untriaged — —
DF-4425 Low 5.5 VIRTIO_BLK_F_MQ with device-reported num_queues=0: modulo-by-zero panic in vtblk_attach before any validation
sys/dev/virtual/virtio/block/virtio_blk.c:292 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4843 Low 5.5 Unvalidated device-DMA'd IH wptr (alignment never checked, only masked) + unbounded amdgpu_ih_process ring walk — a misaligned wptr can never equal the 16-byte-stepping rptr, permanently hard-spinning the amdgpu interrupt thread (all GPU interrupt delivery dead)
sys/dev/drm/amd/amdgpu/tonga_ih.c:196 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3750 Medium 5.3 Raw-xmit path lacks TXWI pool-empty guard → NULL-pointer write panic under Tx saturation
sys/dev/netif/ral/rt2860.c:1536 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3760 Medium 5.3 alc_stop()/alc_tick() AB-BA deadlock: self-re-arming tick callout blocks on the driver serializer while alc_stop calls the synchronous callout_stop() holding it — permanent kernel wedge on ifconfig down/MTU change/detach/suspend (DF-3715 family, independent instance)
sys/dev/netif/alc/if_alc.c:3414 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3894 Medium 5.3 XPT_RESET_DEV allocates from the normal command pool but frees via the high-priority list, and underflows tm_count: both pools' accounting corrupted, TM simq-freeze discipline permanently disabled (DF-1223 twin)
sys/dev/raid/mps/mps_sas.c:2765 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4079 Medium 5.3 oce_rx builds mbuf chain with m_pkthdr.len from the CQE 14-bit pkt_size unclamped to num_fragments x frag_size: chain up to 2047 bytes shorter than claimed, handed to if_input — stack offset-walkers (m_copydata KASSERT) panic, TCP desynchronizes
sys/dev/netif/oce/oce_if.c:1260 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4154 Medium 5.3 amdgpu_atombios_init_mc_reg_table: zero-stride reg_data walk never terminates; unbounded block walk and unvalidated offsets read past the VBIOS buffer (amdgpu twin of DF-3741)
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:1607 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4382 Medium 5.3 Peer-initiated BLK_OPEN termination strands the open tag on tag_pendq forever: silent tag exhaustion (stale sc->last_error masks it), device wedge, softc/module unload permanently blocked
sys/dev/disk/xdisk/xdisk.c:1126 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4694 Medium 5.3 sili_pm_softreset polls with sili_quick_timeout whose sole-active KKASSERT is violated by co-active PM-target commands — XPT_RESET_DEV enters softreset without draining the port
sys/dev/disk/sili/sili_pm.c:450 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4971 Medium 5.3 mfip_detach frees the CAM sim without draining mfi_cam_ccbq or clearing mfi_cam_start: queued passthrough ccbs leak permanently (unkillable hang) and are later dispatched through the stale callback into deregistered/freed CAM state
sys/dev/raid/mfi/mfi_cam.c:142 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-5235 Medium 5.3 wait_for_completion()/wait_for_completion_interruptible(): MAX_SCHEDULE_TIMEOUT (LONG_MAX) truncates to int -1 in lksleep() — every 'infinite' completion wait expires after one tick with spurious success
sys/dev/drm/linux_completion.c:33 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3600 Low 5.3 sq_edc_source_names[] indexed by unbounded 3-bit SQ_EDC_INFO.SOURCE field: OOB rodata pointer handed to %s
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6811 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3608 Low 5.3 ncr(4) on >4GB amd64 systems: all chip DMA descriptors are 32-bit but filled from unrestricted 64-bit vtophys() — silent address truncation drives transfers to wrong physical memory
sys/dev/disk/ncr/ncr.c:4149 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3718 Low 5.3 mxge_tx_done walks the TX ring toward the unvalidated NIC send_done_count: premature TX-buffer free (device DMA-after-free) and permanent interrupt-context spin under tx/main serializers
sys/dev/netif/mxge/if_mxge.c:2369 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3737 Low 5.3 emx_tx_collect walks the TX ring toward an unvalidated TDH register value: out-of-range write-back (0xFFFFFFFF on surprise removal) -> all TX buffers freed (DMA-after-free window) then KKASSERT panic / permanent serializer-held spin (DF-3714 em(4) twin)
sys/dev/netif/emx/if_emx.c:2817 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4300 Low 5.3 vkbd_dev_close check-then-sleep TASK handshake can miss the drain task's wakeup and pin the kernel mplock indefinitely (system-wide device-I/O stall until signalled)
sys/dev/misc/vkbd/vkbd.c:307 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4383 Low 5.3 Unbounded softc/cdev/tag allocation from remote LNK_SPANs, and span-loss termination disabled (#if 0): devices never reclaimed, kldunload xdisk permanently EBUSY
sys/dev/disk/xdisk/xdisk.c:429 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4562 Low 5.3 mpssas_add_device/mpssas_volume_add re-initialize a target slot without checking the asynchronous removal is still in flight (INREMOVAL flag cleared under an outstanding TM; TAILQ_INIT over possibly-linked command lists)
sys/dev/raid/mps/mps_sas_lsi.c:653 · pass 2 · new
 none untested not_testable untriaged — —
DF-4715 Low 5.3 Second-bad-subdisk stale-marking loop indexes plex->sdnos[] by subdisk COUNT instead of the participating ordinals -> healthy subdisks force-marked stale
sys/dev/raid/vinum/vinumraid5.c:413 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5170 Low 5.3 evergreen_copy_dma discards radeon_sync_resv()/radeon_sync_rings() returns — Evergreen/Cayman twin of DF-4871/DF-5089: DMA copy committed without cross-ring ordering on sync failure, silent bo data corruption
sys/dev/drm/radeon/evergreen_dma.c:130 · pass 2 · new
 none untested not_testable untriaged — —
DF-4388 High 5.2 CENTRAL FIX: V1 PowerPlay parser has no bounds-validation layer — every firmware USHORT offset/UCHAR count/UCHAR index is consumed unvalidated (V1 side of DF-4247; count-provenance root of the powerplay count family)
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:772 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4082 Low 5.2 oce_tx returns 0 (success) when oce_insert_vlan_tag fails on !M_WRITABLE mbufs: the dequeued mbuf is leaked and the packet silently dropped while oce_start_locked believes it was sent
sys/dev/netif/oce/oce_if.c:833 · pass 2 · new
 none untested not_testable untriaged — —
DF-4319 Low 5.2 dce80_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source (DF-4312 family)
sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:661 · pass 2 · new
 none untested not_testable untriaged — —
DF-4661 Low 5.2 ar2413: numPdGainsUsed==0 (EEPROM xpd_mask==0) → uint32-wrapped wild reads at array+0x1FFFFFFFE (+8.59 GB) + uninitialized Pmin_t2[0] (twin of DF-4620/ar5413, DF-4649/ar2316)
sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:424 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4662 Low 5.2 ar2413: flat EEPROM power curve → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/ar5413, DF-4650/ar2316)
sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:457 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4749 Low 5.2 nmdm prison guard never initialized: pt_prison never assigned — jail affinity unenforced, jailed reopen degenerates to unconditional EBUSY
sys/dev/misc/nmdm/nmdm.c:88 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3649 Medium 5.1 Wild OOB kernel read in ci_get_std_voltage_value_sidd when the CAC leakage table count is 0: idx=(u16)(count-1)=65535 past a ZERO_LENGTH_PTR that passes the entries!=NULL guard
sys/dev/drm/radeon/ci_dpm.c:2374 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3835 Medium 5.1 bwn_phy_lp_calc_rx_iq_comp divides by hardware-controlled ie_ipwr under a sum-only guard (ie_ipwr==0 with ie_qpwr>=2 passes) — kernel #DE panic from the init/60s calibration path
sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2340 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4068 Medium 5.1 ti_rxeof/ti_txeof/ti_handle_events terminate on raw equality with NIC-DMA'd 32-bit producer/consumer words: one out-of-range word makes the loop condition unsatisfiable — interrupt-context livelock with host interrupts masked and the ifnet serializer held (DF-3761 unbounded-walk family, ti(4) instance)
sys/dev/netif/ti/if_ti.c:511 · pass 2 · new
 none observed (hardware-gated); source-level: hard CPU livelock with host interrupts masked and ifnet serializer held (permanent DoS of the system) from a single out-of-range DMA'd 32-bit producer/consumer word; txeof variant also underflows sc->ti_txcnt per spin inconclusive not_testable untriaged — —
DF-4270 Medium 5.1 wb_start() ignores wb_encap() failure: failure paths leak the dequeued packet chain and leave a half-armed, unterminated OWN-marked descriptor chain for the NIC
sys/dev/netif/wb/if_wb.c:1327 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4502 Medium 5.1 ahci_pm_softreset leaks the error-CCB reservation on final-retry second-FIS failure: stuck AP_F_ERR_CCB_RESERVED + permanently zeroed ap_active/ap_sactive -> port I/O wedge and KKASSERT panic on next error recovery/probe
sys/dev/disk/ahci/ahci_pm.c:805 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4613 Medium 5.1 ips_timeout performs the forced adapter reinit while holding queue_lock and then tsleeps forever on a completion only the lock-blocked interrupt handler can deliver — permanent watchdog-path deadlock (timer twin of DF-2163)
sys/dev/raid/ips/ips.c:337 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4987 Medium 5.1 tws_passthru trusts driver_pkt.buffer_length with no bound: arbitrary-size M_ZERO kernel alloc, EFBIG ignored → command submitted with truncated SGL, protected-dmamap EINPROGRESS panic on >4GB-RAM hosts, unkillable 60s sleep + controller-wide reset
sys/dev/raid/tws/tws_user.c:117 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3606 Low 5.1 MSI-X allocation failure silently falls back to one MSI/legacy vector while rx_ring_cnt stays >1: RSS rings 1..N are configured but never serviced — traffic blackhole on BCM5709/5716
sys/dev/netif/bce/if_bce.c:6748 · pass 2 · new
 RSS rings un-serviced traffic blackhole untested — untriaged — —
DF-3834 Low 5.1 Inverted KASSERT in bwn_phy_lp_tblinit_r2 asserts rev < 2 although it is only ever called for rev >= 2 — deterministic panic at PHY init on INVARIANTS kernels (upstream-inherited)
sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2742 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4120 Low 5.1 Second divide-by-zero window in cypress_populate_mclk_value: clk_s truncating to 0 makes (clk_s * 625) a zero divisor at :567 (sibling of DF-1387, different expression and condition)
sys/dev/drm/radeon/cypress_dpm.c:565 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4272 Low 5.1 dcn_bw_notify_pplib_of_wm_ranges dereferences unchecked res_pool->pp_smu (kzalloc-failure NULL) — probe-time panic on DCN1
sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1401 · pass 2 · new
 none untested not_testable untriaged — —
DF-4273 Low 5.1 twa(4) firmware-passthrough buffer_length completely unvalidated: unbounded kernel kmalloc/copyin (memory-exhaustion DoS) and silent no-payload execution for lengths >= 0xFFFFFE01
sys/dev/raid/twa/tw_osl_freebsd.c:927 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4287 Low 5.1 acpi_thinkpad attach: kfreeenv(NULL) on the nosmbios path → panic("trying to free NULL pointer") when exactly one SMBIOS env var is unset
sys/dev/acpica/acpi_thinkpad/acpi_thinkpad.c:622 · pass 2 · new
 boot-time / attach-time kernel panic (kfree of NULL pointer) on ThinkPad firmware with a partial SMBIOS Type-1 table; no user interaction inconclusive not_testable untriaged — —
DF-4555 Low 5.1 dce_aux: ignored acquire() failure + unconditional release_engine() closes NULL ddc — near-NULL deref panic under AUX/GPIO contention
sys/dev/drm/amd/display/dc/dce/dce_aux.c:53 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4735 Low 5.1 coretemp: raw rdmsr(MSR_THERM_STATUS/MSR_PKG_THERM_STATUS) in the 2s-periodic sensor task turns a CPUID-lying platform (VMM advertising DTS without the MSR) into an unrecoverable kernel #GP panic — guest-reproduced consequence
sys/dev/powermng/coretemp/coretemp.c:592 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4813 Low 5.1 ata_marvell_edma_allocate() dereferences ch->dma unconditionally (work_bus/work/work_tag): NULL-pointer panic when ata_dmaalloc() failed at channel attach — DF-4809 class, but in ->allocate (marvell is the only nata chipset whose allocate touches ch->dma)
sys/dev/disk/nata/chipsets/ata-marvell.c:209 · pass 2 · new
 none untested not_testable untriaged — —
DF-4930 Low 5.1 atphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → DragonFly panic("ifmedia_set") at attach
sys/dev/netif/mii_layer/atphy.c:135 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5001 Low 5.1 miibus_mediainit calls ifmedia_set() on an EMPTY media list → panic("ifmedia_set") at NIC attach — the hub owning the DF-4930/DF-4957/DF-4981 empty-media family panic (family fix belongs here)
sys/dev/netif/mii_layer/mii.c:232 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5003 Low 5.1 truephy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (4th leaf of the DF-4930/DF-4957/DF-4981 family)
sys/dev/netif/mii_layer/truephy.c:171 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5053 Low 5.1 qsphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (5th leaf of the DF-4930/4957/4981/5003 family, hub DF-5001)
sys/dev/netif/mii_layer/qsphy.c:166 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5077 Low 5.1 acphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → panic("ifmedia_set") at attach (6th leaf of the DF-4930/4957/4981/5003/5053 family; hub DF-5001)
sys/dev/netif/mii_layer/acphy.c:169 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-5105 Low 5.1 amdgpu_do_test_moves success path leaks all n pinned+reserved+referenced GTT test BOs (~entire GTT) with reservation locks held forever
sys/dev/drm/amd/amdgpu/amdgpu_test.c:92 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5120 Low 5.1 vtrnd_harvest runs unbounded virtqueue_poll() busy-wait inside the periodic softclock callout — a stalled host entropy backend permanently hangs the guest kernel
sys/dev/virtual/virtio/random/virtio_random.c:215 · pass 2 · new
 none untested not_testable untriaged — —
DF-3772 Low 4.8 Hardware-fed CI/SACT consistency KKASSERT (and CI==0 asserts) panic on chipset misbehavior the driver documents and recovers from elsewhere
sys/dev/disk/ahci/ahci.c:2622 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3773 Low 4.8 ahci_beg_exclusive_access() drain loop never processes deferred timeouts -> permanent port wedge with the port lock held
sys/dev/disk/ahci/ahci.c:2266 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4723 Low 4.8 ath_tdma_settimers computes DBA/SWBA alerts with 32-bit (nexttbtt<<3) while nexttbtt is the full TSF-derived TU value — inconsistent timer wrap corrupts beacon timers after ~6.2 days of continuous TDMA operation (the in-file unaudited wrap TODO)
sys/dev/netif/ath/ath/if_ath_tdma.c:144 · pass 2 · new
 none untested not_testable untriaged — —
DF-5110 Low 4.8 SATA hotplug connect tasks are unsynchronized and never drained at channel teardown: racing ATTACH/DETACH tasks yield NULL-softc panic or duplicate disk children
sys/dev/disk/nata/ata-sata.c:45 · pass 2 · new
 NULL-deref panic / duplicate disk children untested not_testable untriaged — —
DF-3584 Medium 4.7 isp_control() ISPCTL_RESET_DEV/ABORT_CMD index fcp->isp_dev_map[tgt] without validating tgt; the CAM glue packs bus<<16 into tgt so every channel>0 device reset reads ~108 KB out of bounds
sys/dev/disk/isp/isp.c:4522 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3621 Medium 4.7 Integer divide-by-zero in spread-spectrum programming when VBIOS SS rate == 0 (or truncates to 0 via /=100)
sys/dev/drm/amd/amdgpu/ci_dpm.c:3337 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3622 Medium 4.7 Integer divide-by-zero on zero MPLL reference clock in ci_calculate_mclk_params (usMemoryReferenceClock stored unchecked)
sys/dev/drm/amd/amdgpu/ci_dpm.c:2977 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3623 Medium 4.7 NULL-pointer dereference of adev->pm.dpm.boot_ps when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state
sys/dev/drm/amd/amdgpu/ci_dpm.c:5297 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3657 Medium 4.7 XPT_ABORT passes the abort CCB itself to ISPCTL_ABORT_CMD - every SCSI command abort fails (upstream passes accb)
sys/dev/disk/isp/isp_freebsd.c:4541 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3700 Medium 4.7 synchronize_irq() is an empty lkpi stub: interrupt-drain barriers in i915_irq.c are void (MMIO after power-well off, work resurrected after cancel_work_sync)
sys/dev/drm/i915/i915_irq.c:3710 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3738 Medium 4.7 callout_stop(&sc->timer) under main_serialize deadlocks against emx_timer's blocking lwkt_serialize_enter (AB-BA): emx_stop/emx_intr_body/emx_npoll_status vs the 1 Hz emx_timer — mechanism PROVEN on the guest kernel via protocol replica; fix validated at protocol level (DF-3715 em(4) twin)
sys/dev/netif/emx/if_emx.c:1914 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3754 Medium 4.7 NULL-pointer dereference of rdev->pm.dpm.boot_ps (and ps_priv) when the crafted-VBIOS power table has no usable BOOT state — panic at default-enabled DPM
sys/dev/drm/radeon/ni_dpm.c:3914 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3758 Medium 4.7 tulip_rx_intr() RX-replenish path panics on bus_dmamap_load_mbuf() failure instead of backing off (local DoS)
sys/dev/netif/de/if_de.c:3134 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3801 Medium 4.7 mprsas_resetdev_complete dereferences a NULL task-management reply: XPT_RESET_DEV outstanding during a Diag Reset panics the kernel
sys/dev/raid/mpr/mpr_sas.c:3392 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3802 Medium 4.7 mprsas_send_abort/mprsas_send_reset early -1 returns are ignored by every caller: targ->tm stays set forever, the timed-out CCB is never completed (unkillable I/O hang) and the high-priority TM leaks
sys/dev/raid/mpr/mpr_sas.c:1609 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3807 Medium 4.7 mskc_handle_events(): 'continue' on a status LE naming an unattached port skips the loop's only consumer-index advance -> permanent mskc_intr() drain spin with the serializer held and the IRQ never re-enabled
sys/dev/netif/msk/if_msk.c:3174 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3814 Medium 4.7 Reallocating diag reset tears down all interrupt handlers and never re-establishes them — controller permanently dead (hang/panic DoS)
sys/dev/raid/mpr/mpr.c:801 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3818 Medium 4.7 NVMe PRP page pool exhaustion: NULL dereference / KASSERT panic above 2048 concurrent native-SGL NVMe I/Os (unprivileged local DoS)
sys/dev/raid/mpr/mpr.c:2716 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3893 Medium 4.7 mpssas_resetdev_complete dereferences a NULL task-management reply: XPT_RESET_DEV outstanding during a Diag Reset panics the kernel (DF-3801 twin)
sys/dev/raid/mps/mps_sas.c:2799 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3895 Medium 4.7 mpssas_send_abort/mpssas_send_reset early -1 returns are ignored by every caller: targ->tm wedged forever, TM leaked, timed-out CCBs never returned to CAM, simq frozen for the life of the adapter (DF-3802 twin)
sys/dev/raid/mps/mps_sas.c:1303 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3922 Medium 4.7 hpt_timeout (takes driver_lock) vs callout_stop under driver_lock: DragonFly's synchronous callout_stop creates an AB-BA sleep deadlock - permanent storage wedge
sys/dev/raid/hptmv/entry.c:2629 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3935 Medium 4.7 age_stop() (serializer held) vs age_tick (blocking lwkt_serialize_enter): AB-BA callout deadlock — DF-3715 family instance, mechanism PROVEN on the guest via replica (stopper stuck D5 wchan 'costp')
sys/dev/netif/age/if_age.c:2194 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3991 Medium 4.7 ale_stop() (serializer held) vs ale_tick() (blocking lwkt_serialize_enter in a self-re-arming NON-MP callout): AB-BA deadlock against synchronous callout_stop — permanent kernel wedge + softclock starvation; mechanism PROVEN on the guest via protocol replica (DF-3715/3760/3935 family)
sys/dev/netif/ale/if_ale.c:2263 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4051 Medium 4.7 nfe_stop() deadlocks the callout subsystem against nfe_tick (AB-BA): synchronous callout_stop() issued while holding the driver serializer vs a tick callback parked in lwkt_serialize_enter — mechanism PROVEN on the guest via nfe-shaped replica (DF-3715/4025/4046 family instance)
sys/dev/netif/nfe/if_nfe.c:636 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4057 Medium 4.7 et_stop() calls synchronous callout_stop() while holding the driver serializer; et_tick() must lwkt_serialize_enter() that same serializer before exiting and re-arms unconditionally — AB-BA deadlock of the callout subsystem against the tick (DF-3715/4025/4046/4051 family instance; mechanism already PROVEN on this kernel for em/re/stge/nfe)
sys/dev/netif/et/if_et.c:553 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4101 Medium 4.7 Stale-callout race: callout_stop cannot cancel an in-progress bttimeout, which then fires BDR/hard-reset against a healthy reused CCB
sys/dev/disk/buslogic/bt.c:839 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4153 Medium 4.7 amdgpu_atombios_get_clock_info stores VBIOS reference clocks unchecked — zero reference_freq reaches PLL/SS divisions (#DE panic) (amdgpu twin of DF-3742)
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:592 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4159 Medium 4.7 xe_intr() RX livelock: packet-drop paths 'continue' without releasing the packet to the card — permanent hard hang
sys/dev/netif/xe/if_xe.c:742 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4161 Medium 4.7 Missing !conn_state->crtc guard in intel_panel_set_backlight: unprivileged hw.backlight_level sysctl write NULL-derefs to_intel_crtc(NULL)->pipe in vlv_set_backlight (VLV/CHV)
sys/dev/drm/i915/intel_panel.c:1148 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4167 Medium 4.7 get_firmware_info_v3_2 can return crystal_frequency == 0 — divide-by-zero (#DE panic) in DCE clock-source PLL math
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1229 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4169 Medium 4.7 Unchecked smu8 power-state casts: NULL deref (panic) when VBIOS powerplay table has no Boot-classified state — DF-4143 family twin for smu8
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1044 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4194 Medium 4.7 drm_mode_create_tile_group() ERR_PTR vs NULL contract mismatch poisons connector->tile_group — wild-pointer kref_put/deref at four sites (kernel panic)
sys/dev/drm/drm_connector.c:1917 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4196 Medium 4.7 Lock-free vblank->hwmode.crtc_clock = 0 store in drm_crtc_vblank_off() races the reloaded divisor in drm_calc_vbltimestamp_from_scanoutpos() — TOCTOU integer divide-by-zero (#DE kernel panic)
sys/dev/drm/drm_vblank.c:618 · pass 2 · new
 dos inconclusive inconclusive untriaged — —
DF-4218 Medium 4.7 ae_tick() (non-MP, self-re-arming, blocking lwkt_serialize_enter) vs ae_stop() (sync callout_stop under the serializer): permanent AB-BA deadlock (DF-3715 family)
sys/dev/netif/ae/if_ae.c:232 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4237 Medium 4.7 sili(4): sili_cam_probe() dereferences unchecked sili_ata_get_xfer() NULL — kernel panic when a port reprobe runs against a saturated ccb pool (IDENTIFY write at :290, NCQ-renegotiation read at :372)
sys/dev/disk/sili/sili_cam.c:289 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4303 Medium 4.7 bfe_stop() can deadlock the callout subsystem against bfe_tick (AB-BA): sync callout_stop under the serializer waits forever for a callback blocked on that serializer — interface + one softclock CPU wedged (DF-3715 family)
sys/dev/netif/bfe/if_bfe.c:1494 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4304 Medium 4.7 bfe_rxeof/bfe_txeof completion walks trust the 12-bit DMA current-descriptor field with no range validation and no work bound: encodable off-ring index 511 (byte offsets 4088..4095) makes the interrupt loop non-terminating — serializer-held livelock / KKASSERT panic
sys/dev/netif/bfe/if_bfe.c:1064 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4314 Medium 4.7 GPU-reset vs overlay-off lifetime race: intel_overlay_reset() clears overlay->crtc while an in-flight overlay-off retire still dereferences it — NULL+offset kernel write or GEM_BUG_ON panic
sys/dev/drm/i915/intel_overlay.c:373 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4316 Medium 4.7 lge_stop() callout_stop-under-serializer AB-BA deadlock: lge_tick() parks on if_serializer every stop-path caller holds (DF-3715 family) — permanent kernel hang + CPU-wide callout starvation
sys/dev/netif/lge/if_lge.c:984 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4365 Medium 4.7 pcn_stop()/pcn_tick() AB-BA callout deadlock: synchronous callout_stop() under the ifnet serializer vs the 1 Hz self-re-arming non-MPSAFE tick parked in blocking lwkt_serialize_enter — DF-3715 family, pcn(4) instance (mechanism PROVEN on guest via protocol replica)
sys/dev/netif/pcn/if_pcn.c:879 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4432 Medium 4.7 sln_rx() feeds a NULL mbuf to ifp->if_input() when m_devget() fails — guaranteed kernel panic (guard dropped from the rl(4) ancestor)
sys/dev/netif/sln/if_sln.c:913 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4433 Medium 4.7 sln_mii_cmd() busy-waits on SL_MIISTAT_BUSY with no timeout while holding the interface serializer — unprivileged SIOCGIFMEDIA turns a wedged PHY/PCI readback into a permanent serializer-held kernel busy loop
sys/dev/netif/sln/if_sln.c:389 · pass 2 · new
 Unkillable kernel busy-loop holding the interface serializer (SIOCGIFMEDIA path) / wedged interrupt thread (media_intr path); permanent network DoS untested not_testable untriaged — —
DF-4461 Medium 4.7 amdtemp_gettemp17to19h KASSERTs on mutable CCD-valid hardware state — unprivileged sysctl read or the periodic sensor task panics stock INVARIANTS kernels
sys/dev/powermng/amdtemp/amdtemp.c:960 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4507 Medium 4.7 ttm_page_alloc: TTM page pools have no memory-pressure reclamation — the vm_lowmem eventhandler is never invoked anywhere in the kernel and register_shrinker does not exist
sys/dev/drm/ttm/ttm_page_alloc.c:442 · pass 2 · new
 none untested not_testable untriaged — —
DF-4516 Medium 4.7 Cross-device PRIME import panics unconditionally: dma_buf_attach() stub returns NULL (not ERR_PTR), IS_ERR misses it, and the fail_detach unwind calls dma_buf_detach() which is hardcoded panic()
sys/dev/drm/drm_prime.c:733 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4545 Medium 4.7 pptable init reports SUCCESS with NULL OD arrays: revision gate (ucODTableRevision != 1) skips all OD copies and five copy-helper -ENOMEM returns are ignored → unconditional NULL-deref in vega20_od8_set_feature_capabilities, kernel panic at amdgpu driver load
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4606 Medium 4.7 ata_timeout() mid-callback state_mtx window deadlocks the channel against synchronous callout_cancel (or double-completes the request)
sys/dev/disk/nata/ata-queue.c:551 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4643 Medium 4.7 dce_virtual's crtc_irq .set callback invokes the DragonFly hrtimer_cancel emulation, which may sleep (taskqueue_drain) and migrate CPUs, while amdgpu_irq_update holds adev->irq.lock — atomic-context contract violation, display-irq stall/lock-protocol hazard
sys/dev/drm/amd/amdgpu/dce_virtual.c:715 · pass 2 · new
 none untested not_testable untriaged — —
DF-4692 Medium 4.7 sili_pm: sili_pm_read/sili_pm_write/sili_pm_set_feature dereference unchecked sili_ata_get_xfer() NULL — kernel panic when any PM register access runs against an exhausted ccb pool
sys/dev/disk/sili/sili_pm.c:549 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4763 Medium 4.7 Unchecked M_PREPEND(M_NOWAIT) failure in fwe_as_output() NULL-derefs the already-freed mbuf — guaranteed kernel panic under mbuf pressure
sys/dev/netif/fwe/if_fwe.c:506 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4915 Medium 4.7 DragonFly port removed upstream's in_interrupt() guard from amdgpu_virt_kiq_rreg/wreg: unconditional console kprintf per SR-IOV MMIO access and msleep() from hardirq context on KIQ fence timeout
sys/dev/drm/amd/amdgpu/amdgpu_virt.c:162 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4942 Medium 4.7 offset_to_id accepts mmGPIOPAD_A with en up to 30; the DDC consumer dal_gpio_create_ddc ignores the id output and hands en to define_ddc_registers, indexing ddc_data_regs[8]/ddc_clk_regs[8] out of bounds — OOB const-array read whose garbage register descriptors then drive MMIO programming
sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:164 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5004 Medium 4.7 amdgpu_pll_compute() divide-by-zero via degenerate derived dividers: fb_div under-runs to 0 (DIV_ROUND_UP(nom_min,0) at :56) and ref_div forced to 0 by post_div>=129 (0/0 at :203) — distinct sinks and windows from DF-2037
sys/dev/drm/amd/amdgpu/amdgpu_pll.c:56 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5012 Medium 4.7 mfi_disk_strategy leaks bios on hw_crit_error / issuepend_done early returns — permanent unkillable D-state (DF-2066 systemic twin, this file)
sys/dev/raid/mfi/mfi_disk.c:266 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5176 Medium 4.7 hrtimer shim shares one struct task across per-CPU taskqueue_thread queues — cross-CPU restart while a previous expiry's task is pending panics (KKASSERT) or races unlocked task state
sys/dev/drm/linux_hrtimer.c:37 · pass 2 · new
 kernel panic (local DoS) on INVARIANTS kernels via KKASSERT in taskqueue_enqueue_locked; unlocked cross-CPU task-state race on non-INVARIANTS kernels; triggered from drm hrtimer usage (i915_pmu/intel_uncore/i915_perf/amdgpu cross-CPU restart of a timer whose previous expiry task is still pending) reproduced fixed untriaged — —
DF-3570 Low 4.7 MP_ReadOtherFunPciEConfigSpace never reads RE_CSIDR (constant 0xffffffff return) -> NULL CMAC bus_space handle dereference at re(4) attach on RTL8168FP/RTL8117, plus PCIe config RMW clobbering on all CSIAR users
sys/dev/netif/re/re.c:31163 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3579 Low 4.7 NULL-deref panic in iwn_ampdu_tx_done(): TX_DONE on an aggregation queue with no bound session (sc->qid2tap[qid]==NULL)
sys/dev/netif/iwn/if_iwn.c:3600 · pass 2 · new
 panic untested not_testable untriaged — —
DF-3581 Low 4.7 Non-terminating RX loop in iwn_notif_intr(): 12-bit firmware closed_count vs 64-slot ring
sys/dev/netif/iwn/if_iwn.c:3900 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3595 Low 4.7 sc_curmac left NULL after failed band-switch/hw-reset while RUNNING: bwn_stop/bwn_detach/bwn_suspend NULL-deref panic
sys/dev/netif/bwn/bwn/if_bwn.c:4764 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3596 Low 4.7 Unbounded device-register polling under BWN_LOCK in bwn_intr_pmq and bwn_core_start: permanent unkillable wlan-subsystem wedge
sys/dev/netif/bwn/bwn/if_bwn.c:5172 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3603 Low 4.7 Unbounded exponential backtracking in hdaa_audio_trace_as_out/trace_dac DAC-assignment search — kernel livelock at attach/reconfig with hostile codec topology
sys/dev/sound/pci/hda/hdaa.c:3595 · pass 2 · new
 attach-time livelock with hostile codec untested — untriaged — —
DF-3655 Low 4.7 NULL dereference via WARN_ON(!status->plane_count) immediately after WARN_ON(!status) in amdgpu_dm_atomic_commit_tail()
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4889 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3662 Low 4.7 wpi(4): divide-by-zero in wpi_get_power_index() — interpolate() divisor is the difference of two unvalidated int8 EEPROM TX-power sample bytes (wpi twin of DF-3578)
sys/dev/netif/wpi/if_wpi.c:3812 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3668 Low 4.7 ix_txeof/ix_txgc loop on unvalidated NIC TX-head index: out-of-range write-back → infinite interrupt-context spin (KKASSERT panic on INVARIANTS, soft-lockup otherwise)
sys/dev/netif/ix/if_ix.c:2368 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3674 Low 4.7 mpt_scsi_reply_handler / mpt_scsi_tgt_reply_handler dereference req with no NULL check while mpt_intr dispatches handlers with req=NULL on out-of-range IOC context
sys/dev/disk/mpt/mpt_cam.c:2649 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3680 Low 4.7 igb_txeof/igb_txgc loop on unvalidated NIC TX-head index: out-of-range 32-bit write-back → infinite interrupt-context spin holding tx_serialize (KKASSERT panic on INVARIANTS after one ring wrap; permanent soft-lockup otherwise)
sys/dev/netif/igb/if_igb.c:2186 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3707 Low 4.7 vega10_get_sclk_od/get_mclk_od divide by zero when the golden top clock is 0 (crafted VBIOS) — world-readable sysfs trigger
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4540 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3714 Low 4.7 em_tx_collect walks the TX ring toward an unvalidated TDH register value: out-of-range write-back -> all TX buffers freed (DMA-after-free) then KKASSERT panic / permanent serializer-held spin; same class in the 82547 TDT walk
sys/dev/netif/em/if_em.c:3284 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3774 Low 4.7 Unchecked NULL from ahci_ata_get_xfer() in ahci_set_feature() and ahci_read_log() (ahci.c instances of the DF-2420/DF-2423 class) -> kernel panic
sys/dev/disk/ahci/ahci.c:4057 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3810 Low 4.7 skl_calc_wrpll_link divides by p0*p1*p2*5 with no zero guard — QDIV_MODE=1 with QDIV_RATIO=0 readback panics the kernel (#DE)
sys/dev/drm/i915/intel_ddi.c:1322 · pass 2 · new
 none untested not_testable untriaged — —
DF-3831 Low 4.7 No CCB timeout handler (callout block #if 0'd, 'XXX Need a timeout handler') plus ignored bus_dmamap error — lost commands wedge the SIM queue forever
sys/dev/disk/trm/trm.c:470 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3833 Low 4.7 Stale completion after bus-reset recovery: trm_Interrupt dereferences NULL pActiveDCB/pActiveSRB (KASSERT only guards INVARIANTS), and trm_SRBdone's going-list unlink walk has no termination
sys/dev/disk/trm/trm.c:1339 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3842 Low 4.7 Firmware ring indices used unmasked: iwi_tx_intr/iwi_rx_intr termination depends on a raw CSR-read index; an out-of-range value → non-terminating interrupt loop holding IWI_LOCK + wlan serializer (hard hang) and txq->queued int underflow
sys/dev/netif/iwi/if_iwi.c:1681 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3867 Low 4.7 emu_intr() NULL-check and indirect call of ihandler[].irq_func are unsynchronized against emu_intr_unregister() -> call through NULL function pointer (panic)
sys/dev/sound/pci/emu10kx.c:995 · pass 2 · new
 none untested not_testable untriaged — —
DF-3877 Low 4.7 MFI_DCMD_LD_DELETE post-check assumes the volume still exists: AEN-driven deletion during the DCMD round-trip hits KASSERT('volume dissappeared')/NULL->ld_dev deref
sys/dev/raid/mfi/mfi.c:2625 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3897 Low 4.7 WarpDrive validation accepts NumPhysDisks == 0: guaranteed integer divide-by-zero panic in mpssas_direct_drive_io on the first qualifying READ/WRITE
sys/dev/raid/mps/mps_sas.c:2190 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3926 Low 4.7 siba_cc_power_init (reached unconditionally from siba_core_resume -> siba_cc_resume) dereferences scc->scc_dev with no NULL check - panic on resume when scan found no ChipCommon core
sys/dev/netif/bwn/siba/siba_core.c:1042 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3937 Low 4.7 ena_com_admin_destroy() dereferences comp_ctx four lines before its NULL check — OOM-gated NULL-deref panic in the ena(4) attach path
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1581 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4033 Low 4.7 NULL radeon_encoder dereference family in connector property handlers and monitor-bpc path
sys/dev/drm/radeon/radeon_connectors.c:159 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4034 Low 4.7 radeon_connector_get_edid dereferences ddc_bus->has_aux with ddc_bus==NULL (unprivileged GETCONNECTOR DoS)
sys/dev/drm/radeon/radeon_connectors.c:309 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4035 Low 4.7 OOM NULL-deref family: unchecked drm_cvt_mode() results in radeon_tv_get_modes and radeon_add_common_modes
sys/dev/drm/radeon/radeon_connectors.c:549 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4040 Low 4.7 polaris10 VCE/UVD/CAC level population NULL-derefs when the PowerPlay table omits usMMDependencyTableOffset / usVddcLookupTableOffset
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:712 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4074 Low 4.7 NULL mm_dep_table dereference panics: V1 parser leaves the subtable NULL (usMMDependencyTableOffset==0) and vegam_update_uvd/vce_smc_table deref it unconditionally
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:340 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4111 Low 4.7 tl_start ignores tl_encap() failure: mbuf chain leak, NULL-mbuf BPF tap (panic with listener), non-READY list chained into TX
sys/dev/netif/tl/if_tl.c:1773 · pass 2 · new
 none untested not_testable untriaged — —
DF-4180 Low 4.7 twe_done indexes twe_lookup[TWE_Q_LENGTH=255] with the controller-supplied 8-bit response_id — id 255 reads one pointer past the array (into twe_drive[0]) and dereferences it as a request (wild read + write)
sys/dev/raid/twe/twe.c:1199 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4198 Low 4.7 get_bytes_per_element() returns 0 for dm_444_8/dm_mono_8 and unhandled enum values -> integer divide-by-zero (#DE kernel panic) at get_surf_rq_param():641 for linear surfaces, dead-code #DE at :745, and dml_log2(0)=-127 UB-shift garbage programming
sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:44 · pass 2 · new
 dos inconclusive inconclusive untriaged — —
DF-4200 Low 4.7 NULL function-pointer call: encoder_funcs->detect invoked without check in amdgpu_connector_dp_detect DP-bridge branch — external (Travis/Nutmeg) encoders ship helper funcs without .detect
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1386 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4201 Low 4.7 NULL amdgpu_encoder / enc_priv dereference family after best_encoder() in the two scaling-mode property handlers and amdgpu_connector_get_monitor_bpc (radeon DF-4033 twin)
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:139 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4202 Low 4.7 Unchecked drm_cvt_mode() NULL results: mode->type write through NULL in amdgpu_connector_lcd_native_mode (:406) and drm_mode_probed_add(NULL) list_add in amdgpu_connector_add_common_modes (:460) (radeon DF-4035 twin)
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:405 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4214 Low 4.7 RAID reply-handler deregistration is not refcounted across mpt(4) controllers: detaching one controller strands the other's RAID actions (request leak → unkillable hang)
sys/dev/disk/mpt/mpt_raid.c:135 · pass 2 · new
 none untested not_testable untriaged — —
DF-4215 Low 4.7 construct() OOM failure path dereferences NULL current_state / NULL dc->ctx in destruct() → GPU-probe NULL-deref panic instead of graceful fallback
sys/dev/drm/amd/display/dc/core/dc.c:519 · pass 2 · new
 none untested not_testable untriaged — —
DF-4252 Low 4.7 mprsas_fw_work IR-event early return leaks fw_event allocation and strands the startup refcount (discovery can never complete)
sys/dev/raid/mpr/mpr_sas_lsi.c:327 · pass 2 · new
 none untested not_testable untriaged — —
DF-4298 Low 4.7 Lock-order inversion: kbd_token acquired before kb_lock in kbd.c cdev/register paths versus kb_lock before kbd_token in the syscons/vkbd ioctl paths (AB-BA deadlock)
sys/dev/misc/kbd/kbd.c:802 · pass 2 · new
 none untested not_testable untriaged — —
DF-4313 Low 4.7 dcn10 construct() OOM error path: dcn10_pp_smu_create() result never checked — NULL pp_smu dereferenced via dcn_bw_notify_pplib_of_wm_ranges (probe-time panic); dcn10_create_resource_pool leaks the pool allocation on construct failure
sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1350 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4336 Low 4.7 twa CL: tw_cl_reset_ctlr has no entry guard — MPSAFE watchdog callout and passthru-timeout ioctl threads run the reset state machine concurrently
sys/dev/raid/twa/tw_cl_io.c:1049 · pass 2 · new
 none untested not_testable untriaged — —
DF-4354 Low 4.7 sn_attach() ignores sn_activate() failure: rman_get_cpuid(NULL) guaranteed kernel panic during attach, plus register writes into ISA DMA-controller ports 0x00-0x0F
sys/dev/netif/sn/if_sn.c:164 · pass 2 · new
 none untested not_testable untriaged — —
DF-4367 Low 4.7 Dispatch entries bypassing hwmgr->smu_lock (pp_get_power_profile_mode, pp_set_clockgating_by_smu, pp_dpm_powergate_gfx/mmhub/acp/sdma) race the smu_lock-protected pp_table reset path that frees the hwmgr backend
sys/dev/drm/amd/powerplay/amd_powerplay.c:873 · pass 2 · new
 Unlocked powerplay dispatch entries race the smu_lock-protected pp_table reset that frees the hwmgr backend: NULL-deref panic or freed-slab disclosure to an unprivileged reader. untested not_testable untriaged — —
DF-4392 Low 4.7 mfi_process_fw_state_chg_isr dereferences sc->mfi_aen_cm before its NULL check - OCR with no AEN outstanding NULL-derefs (and uses an unvalidated pool index)
sys/dev/raid/mfi/mfi_tbolt.c:1298 · pass 2 · new
 The OCR completion path kfrees and indexes through mfi_aen_cm BEFORE the NULL guard untested not_testable untriaged — —
DF-4393 Low 4.7 Unbounded firmware-status spin and 20-second busy-wait in the OCR path execute in the watchdog callout while holding mfi_io_lock - single stuck firmware wedges softclock and all card I/O
sys/dev/raid/mfi/mfi_tbolt.c:1275 · pass 2 · new
 The OCR path busy-waits 20 seconds then spins indefinitely on the RSR bit with no timeout; invoked from the reset holding mfi_io_lock in callout context - a firmware that never clears the bit parks the softclock thread forever with the lock held, permanently stalling all callouts system-wide untested not_testable untriaged — —
DF-4401 Low 4.7 Unguarded tws_reset re-entry: unlocked state check races the TWS_RESET_START transition — KASSERT panic (INVARIANTS) or leaked xpt_freeze_simq count freezing the adapter forever (twa sibling DF-4336)
sys/dev/raid/tws/tws_cam.c:1203 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4403 Low 4.7 Error paths permanently strand reserved request slots and hang CAM ccbs: AEN/param channels die; map-failed ccb is on no queue and can never be completed
sys/dev/raid/tws/tws_cam.c:807 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4426 Low 4.7 UINT8 loop-variable wraparound in CMI enumeration causes infinite loop while holding the global hp lock (local DoS; also amplifies cmi_order[] overflow)
sys/dev/acpica/acpi_hp/acpi_hp.c:1145 · pass 2 · new
 dos not_reproduced not_testable untriaged — —
DF-4431 Low 4.7 hubp1_program_tiling: log_2() of gfx9 tiling config uses ilog2, and ilog2(0)==-1 programs NUM_PIPES/NUM_BANKS/etc. to FIELD MAX (GPU-hang class, hw-config-gated)
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:133 · pass 2 · new
 Misprogrammed DCSURF_ADDR_CONFIG (fields set to max) -> display-pipe hang on DCN1 hw with zeroed/garbage GB_ADDR_CONFIG readback untested not_testable untriaged — —
DF-4448 Low 4.7 dce120 construct(): ipps/transforms NULL checks index slot [i] while allocation went to slot [j] — on Vega20 with harvested pipes the check trips on a never-written kzalloc slot and kills the entire display pool init (spurious false-failure)
sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1049 · pass 2 · new
 none untested not_testable untriaged — —
DF-4459 Low 4.7 drm_gem_init: unchecked mm kzalloc (NULL-deref panic under kernel OOM), partial-failure leaks, and dangling dev->mm_private on the drm_ht_create failure path
sys/dev/drm/drm_gem.c:139 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4498 Low 4.7 sbsh: frames with total length 1-4 bytes cause an unbounded repack loop in encap_frame() - permanent kernel spin holding the interface serializer
sys/dev/netif/sbsh/if_sbsh.c:636 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4501 Low 4.7 radeon_uvd_send_msg NULL-deref panic: radeon_fence_ref(ib.fence) executed when radeon_ib_schedule() failed and left ib.fence NULL
sys/dev/drm/radeon/radeon_uvd.c:763 · pass 2 · new
 none untested not_testable untriaged — —
DF-4508 Low 4.7 e1000_i210: e1000_release_swfw_sync_i210 acquires the SWSM hardware semaphore in an unbounded empty-body loop on every NVM/PHY release path — a stuck SMBI bit pins the calling thread forever
sys/dev/netif/ig_hal/e1000_i210.c:146 · pass 2 · new
 Calling thread pinned in-kernel forever on stuck SMBI/SWSM semaphore (surprise removal, wedged fw); interface wedged under serializer untested not_testable untriaged — —
DF-4509 Low 4.7 twa(4): tw_cli_drain_aen_queue() re-queues a firmware-owned request into FREE_Q on ETIMEDOUT — request left dual-linked in BUSY_Q/PENDING_Q + FREE_Q (request handed out twice, internal DMA buffer re-assigned, crossed completions; third site of the DF-4335/DF-4274/DF-1814 class)
sys/dev/raid/twa/tw_cl_misc.c:353 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4575 Low 4.7 adw_idle_cmd_send: single RISC command mailbox shared across sim-lock, callout and lock-free ISR contexts without serialization — raced status word panics the kernel (or BDRs the wrong target); any chip wedge during timeout recovery ends in an unconditional panic after a 10-second interrupts-disabled spin
sys/dev/disk/advansys/adwlib.c:850 · pass 2 · new
 Kernel DoS: 10s interrupts-disabled spin then unconditional panic on raced mailbox (or wedged chip during timeout recovery); torn param can BDR the wrong target untested not_testable untriaged — —
DF-4602 Low 4.7 Unconditional per-ioctl failure diagnostics + full chain rebuild per SETFMT/SPEED/CHANNELS give an unprivileged user an unbounded kernel console print rate; a one-shot guest-wide starvation/livelock was observed during such storms (inconclusive)
sys/dev/sound/pcm/feeder_chain.c:150 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-4705 Low 4.7 ar5210GetDiagState HAL_DIAG_EEREAD dereferences args==NULL when SIOCGATHDIAG omits ATH_DIAG_IN — kernel page-fault panic (DF-4670 family; sibling of DF-1819, distinct deref)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:633 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4713 Low 4.7 amdgpu_irq: amdgpu_irq_dispatch/amdgpu_irq_update call the optional .process/.set callbacks with no NULL guard while every sibling path validates them — dce_virtual registers a .process==NULL crtc_irq (num_types=7) at LEGACY/229, one stray IV away from a hardirq NULL-call panic
sys/dev/drm/amd/amdgpu/amdgpu_irq.c:436 · pass 2 · new
 none demonstrated (hardware-gated: guest has no AMD GPU, amdgpu never binds); realistic ceiling is a hardirq NULL function-pointer call => kernel panic (local DoS) if an IH vector ever reaches a .process-less registered source (dce_virtual crtc_irq, LEGACY/229, num_types=7) or if a num_types>0 .set-less source is ever registered and the GPU-reset resume helper runs untested fixed untriaged — —
DF-4720 Low 4.7 XPT_ABORT/XPT_TERM_IO are decorative stubs and aac_timeout() only logs: timed-out CAM CCBs and their FIBs leak permanently until the command pool is exhausted (controller-wide I/O wedge)
sys/dev/raid/aac/aac_cam.c:526 · pass 2 · new
 none untested not_testable untriaged — —
DF-4730 Low 4.7 apple_smc_sms_intr() unconditionally reads the ISA int-port via ASMC_INTPORT_READ while MMIO-backend devices have sc->sc_ioport == NULL — NULL resource deref → panic in interrupt context
sys/dev/apple/smc/smc_io.c:609 · pass 2 · new
 none untested not_testable untriaged — —
DF-4732 Low 4.7 Sleepable lockmgr acquisition from the GPU interrupt dispatch path: DM_IRQ_TABLE_LOCK in amdgpu_dm_irq_immediate_work/amdgpu_dm_irq_schedule_work runs lockmgr(LK_EXCLUSIVE) inside the serialized DRM ithread (DragonFly port divergence)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:305 · pass 2 · new
 none untested not_testable untriaged — —
DF-4765 Low 4.7 Divide-by-zero (SIGFPE) in hpt_copy_array_info rebuild/verify percentage for arrays with bArnMember==1 or per-member capacity < 2MB
sys/dev/raid/hptmv/hptproc.c:457 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4770 Low 4.7 intel_dp_mst_atomic_check dereferences drm_atomic_get_new_crtc_state() result without NULL check (latent NULL-deref panic, currently masked by earlier drm-core NULL sinks)
sys/dev/drm/i915/intel_dp_mst.c:123 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4786 Low 4.7 NULL-pointer write in drm_atomic_normalize_zpos when a zpos-changed plane's CRTC is absent from the atomic transaction — kernel panic via DRM_IOCTL_MODE_OBJ_SETPROPERTY/MODE_ATOMIC on any normalize_zpos driver
sys/dev/drm/drm_blend.c:502 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4787 Low 4.7 dal_gpio_service_open calls define_ddc_registers/define_hpd_registers on the create_*() result before the NULL check — deterministic NULL-deref panic when DDC/HPD pin allocation fails
sys/dev/drm/amd/display/dc/gpio/gpio_service.c:245 · pass 2 · new
 none untested not_testable untriaged — —
DF-4804 Low 4.7 amdsbwd hardware watchdog is never deactivated on reboot/halt (nor on panic by default): shutdown handler #if 0'd and no framework hook fires — default-auto-armed 30s timer hard-resets machines mid-POST/dump and can reset-loop long-boot hosts
sys/dev/misc/amdsbwd/amdsbwd.c:112 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4809 Low 4.7 ata_ahci_reset() dereferences ch->dma unconditionally: NULL-pointer panic when ata_dmaalloc() failed at channel attach
sys/dev/disk/nata/chipsets/ata-ahci.c:466 · pass 2 · new
 none untested not_testable untriaged — —
DF-4823 Low 4.7 acpi_dock: deferred AcpiOsExecute(acpi_dock_attach_later) callbacks jump into freed module text after kldunload — OSL has no drain (AcpiOsWaitEventsComplete unimplemented/stubbed)
sys/dev/acpica/acpi_dock/acpi_dock.c:237 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4872 Low 4.7 ar9287FillCapabilityInfo never enforces 2GHz-only Kiwi-2 silicon: GMODE divergence re-adds 11A/11NA wireless modes the EEPROM layer explicitly denies, and 5GHz channel edges are inherited — 5GHz channels admitted on 2GHz-only silicon (enabler of the DF-4793 NULL-pier panic)
sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:433 · pass 2 · new
 none untested not_testable untriaged — —
DF-4878 Low 4.7 dal_i2caux_release_engine(): unsynchronized engine state — engine->ddc NULL-wipe race ends in dal_ddc_close(NULL) NULL-deref panic (DAL2 mutex dropped) + wrong-owner pin close
sys/dev/drm/amd/display/dc/i2caux/i2caux.c:420 · pass 2 · new
 none untested not_testable untriaged — —
DF-4883 Low 4.7 ASSERT-only domain validation in the DC fixed-point library: dc_fixpt_log diverges into an integer 0/0 (#DE, kernel panic) for nonpositive arguments; exp/mul/sqr/from_fraction overflow-and-UB siblings
sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:378 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4897 Low 4.7 complete_raid5_write() computes and commits RAID-4/5 parity from FAILED (undefined) first-phase reads — garbage parity written to stable storage; the corruption survives retries and later surfaces as silently corrupt recovery reads
sys/dev/raid/vinum/vinuminterrupt.c:194 · pass 2 · new
 persistent silent on-disk RAID-4/5 parity corruption from a single failed component read: complete_raid5_write() XORs undefined (non-zeroed malloc) buffer contents of failed reads into the parity block and writes it to stable storage; the corruption survives daemon retries (retry XORs against the poisoned parity) and later surfaces as corrupt reconstructed data with no error indication untested not_testable untriaged — —
DF-4932 Low 4.7 irq_source_info_dce110[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs without a NULL check (DF-4713 family)
sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:226 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4979 Low 4.7 SSIF READ_START retry loop retries ENXIO/EBUSY forever — unbounded kthread livelock DoS via stuck/malicious BMC (distinct site from DF-2026)
sys/dev/misc/ipmi/ipmi_ssif.c:186 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4981 Low 4.7 jmphy_attach 'no media present' branch skips mii_phy_add_media, so miibus_mediainit calls ifmedia_set on an EMPTY media list → DragonFly panic("ifmedia_set") at attach (DF-4930/DF-4957 family)
sys/dev/netif/mii_layer/jmphy.c:119 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4995 Low 4.7 irq_service_dcn10[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-4713/DF-4932 family tail on the DCN10 (Raven) table
sys/dev/drm/amd/display/dc/irq/dcn10/irq_service_dcn10.c:245 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5009 Low 4.7 rlphy_service() entry KASSERT panics stock GENERIC kernels on multi-PHY MII buses (DF-1973 family)
sys/dev/netif/mii_layer/rlphy.c:200 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5020 Low 4.7 dp_enable_link_phy reassigns pipes to a possibly-NULL dp_clock_source and calls program_pix_clk through it unguarded — latent NULL function-pointer call on DCE112/DCE120/DCN10 whose resource constructs skip the dp_clock_source NULL check; planted NULL also dereferenced by dp_retrain_link_dp_test
sys/dev/drm/amd/display/dc/core/dc_link_hwss.c:65 · pass 2 · new
 kernel UAF/NULL-deref per finding untested not_testable untriaged — —
DF-5028 Low 4.7 NULL-pointer dereference of radeon_encoder->enc_priv in dce6_audio_get_pin() encoder walk (dce6_afmt.c:104-105)
sys/dev/drm/radeon/dce6_afmt.c:104 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5048 Low 4.7 Bios submitted to a wedged IDA controller park forever — unkillable D-state issuers and unbounded bio_queue (DF-5026 pattern)
sys/dev/raid/ida/ida_disk.c:172 · pass 2 · new
 none untested not_testable untriaged — —
DF-5054 Low 4.7 irq_source_info_dce80[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-2168/DF-4932/DF-4995 family instance on the DCE80 table
sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:188 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5058 Low 4.7 Bios submitted to a never-completing mlx controller park on mlx_bioq forever — unkillable D-state issuers and unbounded bioq growth (DF-5048/DF-5026 family, mlx instance)
sys/dev/raid/mlx/mlx_disk.c:156 · pass 2 · new
 none untested not_testable untriaged — —
DF-5061 Low 4.7 ida_v4_done()'s empty-reply-FIFO sentinel 'completed == -1' is dead code on LP64: bus_addr_t is uint64_t while the register read is 32-bit, so an empty 42xx FIFO is consumed as completion 0xFFFFFFFF → idahwqcbptov() wild kernel dereference (boot-time page fault on <4GB hosts, infinite ISR spin on >=4GB)
sys/dev/raid/ida/ida_pci.c:101 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5078 Low 4.7 irq_source_info_dce120[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-2168/4713/4932/4995/5054 NULL-funcs-dispatch family instance on the DCE120 table
sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5145 Low 4.7 ipmi_acpi SSIF stub attaches a dead softc (return 0 with nothing initialized); any later detach executes NULL sc->ipmi_enqueue_request → fatal kernel trap
sys/dev/misc/ipmi/ipmi_acpi.c:104 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5160 Low 4.7 aperf: raw rdmsr(MSR_IA32_APERF/MSR_IA32_MPERF) in the 1s-periodic per-CPU sensor task turns a CPUID-lying platform (VMM advertising the leaf-6 hooks bit without the MSR) into a fatal kernel #GP ~1s after attach — DF-4735/DF-5155 class, driver-level guest-reproduced
sys/dev/misc/aperf/aperf.c:159 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3571 Info 4.7 Unbounded register busy-wait in re_reset() (MACFG_38/39/50-53) can hard-lock the kernel thread with the ifnet serializer held
sys/dev/netif/re/re.c:7678 · pass 2 · new
 hardware-gated thread+serializer hang untested — untriaged — —
DF-3658 Info 4.7 XPT_GET/SET_TRAN_SETTINGS index isp_devparam[tgt]/isp_dev_map[tgt] with unchecked CCB target_id (sym DF-3574 / ncr DF-3609 class)
sys/dev/disk/isp/isp_freebsd.c:4585 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3948 Info 4.7 dce110_enable_per_frame_crtc_position_reset dereferences triggered_crtc_reset.event_source without NULL check (dead path today)
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2320 · pass 2 · new
 none untested not_testable untriaged — —
DF-4886 Info 4.7 phm_start_thermal_controller is the only phm_* dispatcher in hardwaremanager.c without PHM_FUNC_CHECK — unchecked hwmgr->adev (:238), hwmgr->hwmgr_func (:240) and stores through unchecked adev (:249-250): latent kernel NULL-deref (DF-1913/DF-4831 family)
sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:234 · pass 2 · new
 panic untested not_testable untriaged — —
DF-3586 Medium 4.6 NULL-pointer dereference in si_dpm_enable when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state (boot_ps unvalidated)
sys/dev/drm/amd/amdgpu/si_dpm.c:6783 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3626 Medium 4.6 Unbounded sink-driven go_again retry loop in intel_dp_check_mst_status livelocks the DP hotplug workqueue (MST HPD DoS)
sys/dev/drm/i915/intel_dp.c:4294 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3654 Medium 4.6 hpd_lock pairing asymmetry in handle_hpd_rx_irq(): link-type flip inside handler strands the lock (permanent hang) or releases an unheld lock
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:1209 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3682 Medium 4.6 Divide-by-zero kernel panic in drm_gtf_mode_complex() via unvalidated secondary-GTF parameters from crafted EDID
sys/dev/drm/drm_edid.c:2066 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-3885 Medium 4.6 drm_pick_crtcs exponential recursion: (CRTCs+1)^connectors kernel CPU burn holding fb_helper->lock via hub-inflated connector count
sys/dev/drm/drm_fb_helper.c:2422 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3888 Medium 4.6 num_levels==0 count-1 underflow: kv_dpm_get_sclk (:2938) and kv_set_valid_clock_range (:1791/:1817) read levels[0xFFFFFFFF] ~48 GB out (panic; unprivileged ioctl trigger)
sys/dev/drm/amd/amdgpu/kv_dpm.c:2938 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3889 Medium 4.6 boot_ps NULL dereference in kv_dpm_disable (kv_update_current_ps(adev, NULL) -> kv_get_ps(NULL)) when the VBIOS power table has no BOOT-classified state — panic on suspend/detach
sys/dev/drm/amd/amdgpu/kv_dpm.c:1400 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3988 Medium 4.6 dc_link_dp_set_test_pattern NULL-pointer dereference on inactive pipe (pipes[i].stream->sink unchecked) plus wrong-object blank (pipes[0] instead of matched pipe_ctx) — sink-triggerable panic with no active stream
sys/dev/drm/amd/display/dc/core/dc_link_dp.c:2605 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3578 Low 4.6 Division by zero in iwn4965_set_txpower(): interpolate() divisor from unvalidated EEPROM channel samples
sys/dev/netif/iwn/if_iwn.c:5707 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3777 Low 4.6 jme_rxeof() descriptor consistency check admits (nsegs=0, pktlen=0): jme_rxpkt neither reposts the descriptor nor advances jme_rx_cons — unbounded in-handler spin (RX halt + serializer-held CPU softlock) on faulty/malicious controller writeback; the DF-3604-family heap-OOB is otherwise CLOSED by the :2513 cross-check
sys/dev/netif/jme/if_jme.c:2511 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3815 Low 4.6 mpr_resize_queues() divide-by-zero when firmware reports IOCMaxChainSegmentSize == 1
sys/dev/raid/mpr/mpr.c:399 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4047 Low 4.6 NULL command_table_helper callbacks called via BIOS-controlled command revisions on DCE10/11/11.2 (assign_control_parameter/transmitter_bp_to_atom/clock_source_id_to_ref_clk_src) + uninit crev steering in init_transmitter_control
sys/dev/drm/amd/display/dc/bios/command_table.c:204 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4078 Low 4.6 Unbounded waits and ignored reinit errors: mps_wait_command(...,0) sleeps forever, mps_reinit ignores mps_reregister_events() failure leaving the simq frozen permanently
sys/dev/raid/mps/mps.c:353 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4160 Low 4.6 Unbounded PHY-reset poll in xe_mii_init(): card insertion / ifconfig up hangs the kernel in crit + serializer
sys/dev/netif/xe/if_xe.c:1637 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4620 Low 4.6 ar5413: numPdGainsUsed==0 path — uint32 counter underflows make pPdGainBoundaries[ii-1] / pPDADCValues[kk-1] read at array+0x1FFFFFFFE (+8.6 GB wild reads), plus uninitialized Pmin_t2[0] stack read
sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:468 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4622 Low 4.6 ar5413: flat pd-gain curve makes sizeCurrVpdTable-1/-2 wrap uint32 -> VpdTable_I[ii][0xFFFFFFFF] wild read at row+0x1FFFFFFFE (+8.6 GB)
sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:501 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4649 Low 4.6 ar2316: numPdGainsUsed==0 (EEPROM xpd_mask==0) -> uint32-wrapped wild reads at array+0x1FFFFFFFE + uninitialized Pmin_t2[0] (twin of DF-4620/ar5413)
sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:427 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4650 Low 4.6 ar2316: flat EEPROM power curve -> VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads (twin of DF-4622/ar5413)
sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:460 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3925 Low 4.5 hptmv_event_notify uses closed-blob param2 as MV_U8 channel index into sataEvents[8]/VDevices[8] with no bounds check (hardening)
sys/dev/raid/hptmv/entry.c:860 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4151 Low 4.5 adv_send_scsi_queue computes the per-queue sense DMA bus address from unvalidated firmware-LRAM free_q_head — device-DMA write outside sense_buffers (write-side twin of DF-2412)
sys/dev/disk/advansys/advlib.c:1709 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4738 Low 4.5 cbb_pci_attach() CardBus secondary-bus allocator is a driver-static counter seeded at 2: collision-blind against firmware-assigned bus numbers (config-space aliasing of unrelated devices) and unbounded into the u_int8_t secbus/subbus (256 -> 0 'unconfigured' sentinel wrap)
sys/dev/pccard/pccbb/pccbb_pci.c:299 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3646 Medium 4.4 NULL-pointer dereference of rdev->pm.dpm.boot_ps when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state
sys/dev/drm/radeon/ci_dpm.c:3593 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3647 Medium 4.4 Integer divide-by-zero in spread-spectrum programming when the VBIOS SS rate is 0 (ci_calculate_mclk_params / ci_calculate_sclk_params)
sys/dev/drm/radeon/ci_dpm.c:2876 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3648 Medium 4.4 Integer divide-by-zero on zero MPLL/SPLL reference clock in ci_calculate_mclk_params (usMemoryReferenceClock stored unchecked)
sys/dev/drm/radeon/ci_dpm.c:2872 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3651 Medium 4.4 NULL-pointer dereference of rdev->pm.dpm.dyn_state.cac_tdp_table when the VBIOS has no PowerTune table: five unchecked sinks in ci_dpm.c
sys/dev/drm/radeon/ci_dpm.c:330 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3741 Medium 4.4 Zero-stride VBIOS record walks never terminate: radeon_atom_init_mc_reg_table and atom_lookup_voltage_object_v3 infinite loops
sys/dev/drm/radeon/radeon_atombios.c:4023 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3742 Medium 4.4 radeon_atom_get_clock_info stores VBIOS reference clocks unchecked — zero reference_freq reaches mode-set and DPM divisions (#DE panic)
sys/dev/drm/radeon/radeon_atombios.c:1146 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3743 Medium 4.4 Spread-spectrum rate parses to zero (raw 0, v2/v3 /=100 truncation, or ppll never assigns rate) and reaches DPM SS divisions (#DE panic)
sys/dev/drm/radeon/radeon_atombios.c:1546 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3853 Medium 4.4 Unchecked BIOS sysclk reference frequency (0) reaches calc_eng_mem_clock division — kernel divide-by-zero panic (local DoS) on PM transitions
sys/dev/drm/radeon/radeon_combios.c:741 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3921 Medium 4.4 hpt_async is an unconditional panic("Here") registered for AC_LOST_DEVICE - losing a disk (or any rescan of a lost target) panics the kernel
sys/dev/raid/hptmv/entry.c:2147 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3958 Medium 4.4 Mergeable-RX sub-buffer negative device length installs a negative-m_len mbuf chain into the network stack (vtnet_rxeof_merged signed clamp)
sys/dev/virtual/virtio/net/if_vtnet.c:1663 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4116 Medium 4.4 Guaranteed kernel panic in sndstat_sysuninit on sound.ko unload: SNDSTAT_FLUSH deletes a never-initialized sbuf (sndstat_buflen=0 static init vs sbuf-only-created-in-open invariant)
sys/dev/sound/pcm/sndstat.c:68 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4224 Medium 4.4 Divide-by-zero (kernel panic) in drm_cvt_mode/drm_gtf_mode_complex via unvalidated cmdline @refresh — simple_strtol value wraps through unsigned int into int vfieldrate
sys/dev/drm/drm_modes.c:1465 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4350 Medium 4.4 adv_run_doneq walks the device-fed done-queue FWD chain with no iteration bound — cyclic chain = interrupt-context livelock / hard system hang (DF-4307 livelock facet, narrow twin)
sys/dev/disk/advansys/advansys.c:1043 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4563 Medium 4.4 vn: VNF_DESTROY teardown run from inside the rawdev close path races concurrent last-but-one close — cdev sysref double-put kernel panic (reproduced 2/2) plus minutes-long uninterruptible system-wide devfs stalls and a post-free struct-disk deref in diskclose
sys/dev/disk/vn/vn.c:169 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4800 Medium 4.4 Concurrent revive_block() calls race the sd->revived cursor: both advance it, the block between the advances is silently skipped, and the subdisk comes 'up' with never-revived stale data (plus concurrent set_sd_state/save_config races)
sys/dev/raid/vinum/vinumrevive.c:89 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4801 Medium 4.4 Revive waitlist is orphaned when a revive stops: queued conflicting writes hang forever in uninterruptible biowait — kill -9-proof, survives 'vinum setstate -f down' abort, leaks the requests
sys/dev/raid/vinum/vinumrevive.c:198 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5017 Medium 4.4 dma_fence_wait_any_timeout: unsigned deadline wrap returns bogus negative error on clean timeout, long→int truncation turns infinite waits into tick-rate poll loops, and an uninterlocked check→tsleep window permanently loses completion wakeups
sys/dev/drm/linux_fence.c:206 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5119 Medium 4.4 Unvalidated user-controlled datasize/namesize in EFIIOC_VAR_GET/VAR_NEXT/VAR_SET: kmalloc(M_WAITOK) panics on huge sizes; sizes near SIZE_MAX wrap round_page() to 0 and corrupt kernel_map
sys/dev/misc/efirt/efidev.c:105 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5195 Medium 4.4 wait_scrn_saver_stop sleeps holding vga_token while its only wake path must take vga_token: CONS_SET/KDSETMODE/VT_ACTIVATE issued while an LKM screen saver has the console blanked deadlocks the console subsystem, and killing the caller leaves scrn_blanked permanently stuck (saver module unloadable forever, later saver-stop waiters sleep forever)
sys/dev/misc/syscons/syscons.c:2720 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5228 Medium 4.4 dma_free_coherent() permanently leaks every physical page (wired, unreclaimable) and orphans the kernel PTE
sys/dev/drm/linux_dma.c:81 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3575 Low 4.4 NULL CDB pointer dereference in sym_action() INQUIRY peek (CAM_CDB_POINTER with cdb_ptr == NULL)
sys/dev/disk/sym/sym_hipd.c:7526 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3599 Low 4.4 cz_init_cp_jump_table: NULL mec2_fw dereference on Carrizo when the MEC2 firmware request fails
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1170 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3794 Low 4.4 ACPIIO_DO_MCALL leaks the copied-in argument object list when copyinstr() of the method path faults
sys/dev/acpica/acpi.c:3353 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3825 Low 4.4 asr(4) unbounded polled waits: wait-forever ASR_resetIOP retry spin inside a critical section (asr_timeout-reachable), zero-timeout ASR_initOutBound reply poll reachable from the I2OUSRCMD ioctl, deadline-less ASR_queue_s poll, PCATCH-less ioctl wait
sys/dev/raid/asr/asr.c:1254 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3924 Low 4.4 fOsBuildSgl executes panic("physical address unsupported") on CAM_DATA_PHYS passthrough CCBs (reachable debug panic)
sys/dev/raid/hptmv/entry.c:2518 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3949 Low 4.4 MLX_NEXT_CHILD uses mlx_sysdrive[0] instead of the found [i] -> device_get_unit(NULL) panic after drive 0 is detached
sys/dev/raid/mlx/mlx.c:753 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4058 Low 4.4 hw.etX.tx_intr_nsegs sysctl accepts 0 (no handler) -> integer division by zero panic on the TX hot path (sc_tx / sc_tx_intr_nsegs); the two rx sysctls validate v>0 but the tx one is a raw SYSCTL_ADD_INT
sys/dev/netif/et/if_et.c:314 · pass 2 · new
 Privileged local user turns a tuning variable into an instant kernel panic of a production host. untested not_testable untriaged — —
DF-4062 Low 4.4 ioctl transfer lengths are accepted unbounded and flow into kmalloc(M_WAITOK|M_ZERO)/copyin/copyout: native au_length is a 64-bit unsigned long (up to 2^64-1), the linux generic path's imax(inlen,outlen) sign-extends a negative int through amr_ioctl_buffer_length, and the linux PASS path allocates the card-supplied ap_data_transfer_length — oversized-allocation panic, unbounded kernel-memory pinning, and a round_page() wrap hazard in the oversized-slab path
sys/dev/raid/amr/amr.c:501 · pass 2 · new
 Privileged local user trivially panics/wedges the kernel (oversized-allocation path / round_page wrap) or pins tens of GB of zeroed kernel memory per ioctl; kmalloc happens before any controller access. untested not_testable untriaged — —
DF-4136 Low 4.4 ioctls that can throw without lock_config() panic the kernel: VINUM_MOVE onto a full/hot-spare drive is a one-ioctl panic
sys/dev/raid/vinum/vinumconfig.c:105 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4228 Low 4.4 Root-writable debug.cyapa_*_freq sysctls feed an integer divide-by-zero in cyapa_poll_thread — deterministic kernel panic
sys/dev/smbus/cyapa/cyapa.c:227 · pass 2 · new
 none untested not_testable untriaged — —
DF-4236 Low 4.4 rl(4): rapid IFF_DOWN/UP churn leaves TX completions permanently missed - recurring watchdog timeouts and multi-second TX stalls (reproduced on emulated rtl8139)
sys/dev/netif/rl/if_rl.c:935 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4351 Low 4.4 Unconditional panic() on device-fed completion status bytes: q_status != QS_DONE (fires on legitimate QS_DONE|QS_DISC1) and unhandled host_stat codes (including codes the driver itself enumerates)
sys/dev/disk/advansys/advansys.c:1092 · pass 2 · new
 none untested not_testable untriaged — —
DF-4366 Low 4.4 [amdgpu_pm.c] Deterministic kernel NULL-deref panic in the pp_power_profile_mode store: strsep returns NULL on un-delimited writes and isspace(*tmp_str) dereferences address 0; buf_cpy[128] also never NUL-terminated
sys/dev/drm/amd/amdgpu/amdgpu_pm.c:916 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4481 Low 4.4 complete_rqe() raw-plex error path never biodone's the user bio nor frees the request — permanent unkillable I/O hang plus locked-buf/pbuf leak per errored plex I/O
sys/dev/raid/vinum/vinuminterrupt.c:219 · pass 2 · new
 Permanent unkillable D-state I/O hang per errored raw-plex I/O plus locked-buf/pbuf leak; repeated errors exhaust the pbuf pool system-wide untested not_testable untriaged — —
DF-4546 Low 4.4 lm_detach on a zero-sensor attach (W83791SD) TAILQ_REMOVEs a never-installed ksensordev: NULL-pointer write plus global sensordev_list corruption, kernel panic on driver detach
sys/dev/powermng/lm/lm78.c:590 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4756 Low 4.4 Mailbox handshake busy-waits up to 12 seconds with mdelay() inside the hard-IRQ .process handler — host/PF can stall the guest in interrupt context per message
sys/dev/drm/amd/amdgpu/mxgpu_vi.c:318 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4780 Low 4.4 corecstat attach-time kernel panic on original Atom: the chip-representative CPU of any model-0x1c/0x26/0x27/0x35/0x36 system falls into corecstat_init_atom_cpu() with sc_version==0, violating its own KKASSERT — boot/kldload panic on INVARIANTS builds, silently-wrong core-sensor init on production builds
sys/dev/powermng/corecstat/corecstat.c:355 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4911 Low 4.4 dm_dp_aux_transfer discards dc_link_aux_transfer() return on both AUX write paths: failed DPCD/I2C writes reported as full success to the DRM DP core (MST sideband desync on failing/hostile DP hardware)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:105 · pass 2 · new
 none untested not_testable untriaged — —
DF-5007 Low 4.4 tpm20_read disarms the discard-buffer callout before the owner check: an EPERM-failing read(2) permanently kills the only recovery that clears pending_data_length, wedging every later write(2) in an unkillable non-PCATCH cv_wait (permanent DoS of the TPM device and the writing process)
sys/dev/crypto/tpm/tpm20.c:78 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5019 Low 4.4 TBRIDGE_GETRESULT without a prior TBRIDGE_LOADTEST leaves tbridge_testcase NULL and panics the kernel in tbridge_test_done's KKASSERT on any INVARIANTS build (stock X86_64_GENERIC ships INVARIANTS; all dfregress kernels build tbridge in)
sys/dev/misc/tbridge/tbridge.c:265 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5155 Low 4.4 perfbias: raw wrmsr/rdmsr(MSR_IA32_ENERGY_PERF_BIAS=0x1b0) in the cpuhelper path takes a fatal kernel #GP on CPUID-lying platforms (DF-4735 class), root-gated panic
sys/dev/powermng/perfbias/perfbias.c:178 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5086 Info 4.4 AcpiOsFree forwards NULL to _kfree which panics ("trying to free NULL pointer") — latent NULL-free panic unique to the DragonFly port (Linux/FreeBSD kfree(NULL) are no-ops)
sys/dev/acpica/Osd/OsdMemory.c:73 · pass 2 · new
 per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption) untested not_testable untriaged — —
DF-3752 Low 4.3 Uninitialized retrycnt passed to ratectl on TX_FAILURE (amrr consumes it unconditionally)
sys/dev/netif/ral/rt2860.c:1129 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4006 Low 4.3 fiji VCE/ACP/UVD level population NULL-derefs when the PowerPlay table omits usMMDependencyTableOffset
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1433 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4618 Low 4.3 Uninterruptible multi-second busy-wait handshakes (VP0_LOW_SPINTMO=5,000,000 iterations) run under vpo_intr's critical section — malicious parallel-port device can pin a CPU against preemption per I/O
sys/dev/disk/vpo/immio.c:52 · pass 2 · new
 Multi-second per-CPU preemption blackout per I/O (missed ticks, soft lockups, uniprocessor system-wide stall); repeatable per command untested not_testable untriaged — —
DF-5039 Low 4.3 os_map_pci_bar(): unchecked bus_alloc_resource() failure → rman_get_virtual(NULL) NULL-deref panic at device probe
sys/dev/raid/hpt27xx/hpt27xx_os_bsd.c:113 · pass 2 · new
 probe panic / shutdown-window UAF per finding untested not_testable untriaged — —
DF-5082 Low 4.3 os_map_pci_bar(): unchecked bus_alloc_resource_any() failure → rman_get_virtual(NULL) NULL-deref panic at hptrr device attach (DF-5039 twin)
sys/dev/raid/hptrr/hptrr_os_bsd.c:101 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3982 Medium 4.2 Synchronous callout_stop() in the fwohci hard-interrupt path (mgm_ocb_timeout + CCB timeout sites) sleeps in 'costp' inside a critical section while the callback is INPROG — FireWire IRQ-thread stall plus softclock-wheel starvation cascade (DF-3715 family)
sys/dev/disk/sbp/sbp.c:1600 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3721 Low 4.2 mxge_dma_test divides by the firmware-returned tick count with no zero check: kernel divide-by-zero panic at attach, at every open, and inside watchdog recovery
sys/dev/netif/mxge/if_mxge.c:459 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3883 Low 4.2 mst_primary NULL dereference race in drm_dp_mst_handle_up_req (send_up_ack_reply without lock or NULL check)
sys/dev/drm/drm_dp_mst_topology.c:2401 · pass 2 · new
 race-window NULL panic / teardown UAF untested — untriaged — —
DF-3890 Low 4.2 vid_mapping num_entries==0 count-1 underflow in kv_convert_vid2_to_vid7 — entries[0xFFFFFFFF] wild read (~+16 GiB) at boot via kv_construct_max_power_limits_table
sys/dev/drm/amd/amdgpu/kv_dpm.c:90 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4653 Low 4.2 puc_setup_intr publishes ihand before ihandarg: shared-IRQ event during child attach dispatches siointr with a NULL argument -> kernel NULL-deref panic (boot-time DoS)
sys/dev/misc/puc/puc.c:691 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4985 Info 4.2 dce110 command-table helper leaves five vtable members NULL while six consumer call sites invoke them unguarded — latent NULL-function-pointer call under ASIC/VBIOS generation mismatch (generation-locked, unreachable on genuine hardware)
sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:332 · pass 2 · new
 none untested not_testable untriaged — —
DF-5000 Info 4.2 dce80 command-table helper leaves 2 of 17 vtable members NULL (dc_clock_type_to_atom, transmitter_color_depth_to_atom); the SetPixelClock-V7 rev handlers call transmitter_color_depth_to_atom unguarded — latent NULL-function-pointer kernel panic under cross-generation VBIOS pairing on DCE8 silicon
sys/dev/drm/amd/display/dc/bios/dce80/command_table_helper_dce80.c:329 · pass 2 · new
 none untested not_testable untriaged — —
DF-3717 Medium 4.1 mxge_detach() AB-BA deadlock: synchronous callout_stop() under ifnet_serialize_all vs mxge_tick blocked on main_serialize — mechanism PROVEN on guest via protocol replica (wchan 'costp' + softclock 'slize' wedge)
sys/dev/netif/mxge/if_mxge.c:4463 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3776 Medium 4.1 jme_stop()/jme_miibus_statchg() vs jme_tick() AB-BA deadlock: blocking lwkt_serialize_enter in the self-re-arming CPU0-pinned tick callback vs synchronous callout_stop() under ifnet_serialize_all — permanent kernel wedge + CPU0 softclock callout blackout (DF-3715/3738/3760 family, jme(4) instance)
sys/dev/netif/jme/if_jme.c:2571 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3806 Medium 4.1 msk_stop()/msk_tick() AB-BA callout deadlock: synchronous callout_stop() under ifnet serializer vs blocking lwkt_serialize_enter in the self-re-arming non-MPSAFE tick (DF-3715/3738/3760/3776 family, if_msk.c instance)
sys/dev/netif/msk/if_msk.c:2936 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3850 Medium 4.1 dc_stop()/dc_tick() AB-BA callout deadlock: synchronous callout_stop under the ifnet serializer vs dc_tick's blocking lwkt_serialize_enter — and dc_stat_timer is a NON-MPSAFE callout, so the parked softclock thread also holds the Giant MP lock (DF-3715 family, dc(4) instance, mechanism PROVEN on guest)
sys/dev/netif/dc/if_dc.c:2725 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3903 Medium 4.1 sk_stop()/sk_tick()/sk_yukon_tick() AB-BA callout deadlock: synchronous callout_stop() under the card-global serializer vs blocking lwkt_serialize_enter in the self-re-arming NON-MPSAFE 1 Hz tick (DF-3715 family, 7th instance) — mechanism PROVEN on guest
sys/dev/netif/sk/if_sk.c:2782 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3906 Medium 4.1 xl_stop()/xl_stats_update() AB-BA callout deadlock: synchronous callout_stop() under the ifnet serializer vs blocking lwkt_serialize_enter in the self-re-arming NON-MPSAFE 1 Hz stats tick (DF-3715 family, 10th instance) — mechanism PROVEN on guest
sys/dev/netif/xl/if_xl.c:3169 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3910 Medium 4.1 Divide-by-zero panic in tonga_thermal_setup_fan_table from VBIOS fan temperatures (usTMed==usTMin or usTHigh==usTMed)
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:2502 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-3953 Medium 4.1 boot_ps NULL dereference panic in kv_dpm_enable/kv_dpm_disable (plus kv_dpm_get_sclk ps_priv-NULL window) when VBIOS power table has no BOOT-classified state
sys/dev/drm/radeon/kv_dpm.c:1277 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3954 Medium 4.1 num_levels==0 (VBIOS state with no valid clock entries) -> levels[0xFFFFFFFF] wild read ~48 GiB out in kv_set_valid_clock_range / kv_dpm_get_sclk
sys/dev/drm/radeon/kv_dpm.c:1721 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4022 Medium 4.1 NULL-deref panic in rv770_dpm_enable->rv770_init_smc_table when the VBIOS power table has no BOOT-classified state (or ucStateEntrySize<=1) or dpm.init failed — rv770-family twin of DF-3972/3953/3754/3646/3610
sys/dev/drm/radeon/rv770_dpm.c:1901 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4025 Medium 4.1 re_stop(sc,TRUE) deadlocks against re_tick (callout_stop AB-BA under the driver serializer): permanent D3/'costp' wedge of two threads + CPU-wide callout starvation — re(4) instance of DF-3715(em); mechanism PROVEN on the guest via protocol replica
sys/dev/netif/re/if_re.c:1354 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4056 Medium 4.1 et_rxeof/et_txeof completion walks have no termination bound, and the device-supplied index fields are WIDER than the software rings (RX stat 12-bit vs ET_RX_NSTAT=1024; TX done 10-bit vs ET_TX_NDESC=512): a value in the unreachable range spins forever under the driver serializer / KKASSERT-panics (DF-3761 family instance)
sys/dev/netif/et/if_et.c:1847 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4064 Medium 4.1 fxp_stop() callout_stop under the ifnet serializer can deadlock the callout subsystem against fxp_tick (AB-BA): non-MPSAFE fxp_stat_timer callback blocks in lwkt_serialize_enter and holds the MP lock while parked — DF-3715 (em) / DF-3738 (emx) family twin, mechanism PROVEN on the guest kernel via fxp-faithful replica
sys/dev/netif/fxp/if_fxp.c:399 · pass 2 · new
 none inconclusive fixed untriaged — —
DF-4109 Medium 4.1 tl(4) callout AB-BA deadlock: tl_stats_update blocks on the driver serializer while tl_stop synchronously stops the timer under it (DF-3715 family)
sys/dev/netif/tl/if_tl.c:1671 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4112 Medium 4.1 nge(4) callout AB-BA deadlock: nge_tick blocks on the driver serializer while nge_stop synchronously stops the timer under it (DF-3715 family)
sys/dev/netif/nge/if_nge.c:1372 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4118 Medium 4.1 NULL boot_ps page-fault panic in cypress_dpm_enable when the VBIOS power table has no BOOT-classified state (or dpm.init failed) — cypress twin of DF-4022/DF-3972/DF-3754
sys/dev/drm/radeon/cypress_dpm.c:1839 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4124 Medium 4.1 NULL boot_ps page-fault panic in rv6xx_dpm_enable (:1577) / rv6xx_dpm_disable (:1640) when the VBIOS power table lacks a BOOT-classified state, has ucStateEntrySize<=1, or dpm.init failure was swallowed (rv6xx twin of DF-4022/DF-4118)
sys/dev/drm/radeon/rv6xx_dpm.c:1549 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4143 Medium 4.1 NULL boot_ps page-fault panic in trinity_dpm_enable (:1129) / trinity_dpm_disable (:1177) when the VBIOS power table has no BOOT-classified state or dpm.init failed — Trinity/Richland twin of DF-4022/DF-4118/DF-4124/DF-3972
sys/dev/drm/radeon/trinity_dpm.c:1105 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4187 Medium 4.1 NULL boot_ps page-fault panic in sumo_dpm_enable (:1235) / sumo_dpm_disable (:1280) when the VBIOS power table has no BOOT-classified state or dpm.init failed — sumo twin of DF-4118/4143/4124/3972/3754/3953
sys/dev/drm/radeon/sumo_dpm.c:1205 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4189 Medium 4.1 ucNumDPMLevels==0 pplib state leaves ps->num_levels==0: levels[num_levels-1] == levels[0xFFFFFFFF] wild read ~96 GB past the kzalloc'd sumo_ps (deterministic page-fault panic) in set_uvd_clock before/after (:847/:865), program_bsp (:350), program_at (:426), get_sclk (:1891) — sumo twin of DF-4145/3954/3888
sys/dev/drm/radeon/sumo_dpm.c:1508 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4260 Medium 4.1 vr_stop() invokes the synchronous callout_stop() while holding if_serializer: permanent kernel deadlock (CPU-local timer death) against vr_tick() blocked on that serializer
sys/dev/netif/vr/if_vr.c:1630 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4275 Medium 4.1 epic_stop() calls synchronous callout_stop() while holding ifp->if_serializer while the 1s mii tick epic_stats_update() must first enter that serializer — AB-BA deadlock (DF-3715 family instance; wedge holds the MP lock and, via the watchdog path, netisr0)
sys/dev/netif/tx/if_tx.c:1341 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4290 Medium 4.1 SS getters return success with speed_spectrum_rate == 0 — integer divide-by-zero panic in every clock-spread consumer
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1248 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4291 Medium 4.1 atomctrl_get_voltage_evv dereferences hwmgr->dyn_state.vddc_dependency_on_sclk without a NULL check (parser contract allows NULL)
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1131 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4327 Medium 4.1 sf_stop()'s blocking callout_stop() under the driver serializer AB-BA deadlocks against sf_stats_update(): permanent hang of ifnet serializer + softclock thread (DF-3715 family)
sys/dev/netif/sf/if_sf.c:1344 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4493 Medium 4.1 rs780_dpm: NULL boot_ps / skipped state parse (ucStateEntrySize==1 or no BOOT-classified state) -> NULL-pointer page-fault panic in rs780_dpm_enable and print paths
sys/dev/drm/radeon/rs780_dpm.c:741 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5037 Medium 4.1 dm_pdev_insert holds dm_pdev_mutex across vn_open/VOP_GETATTR/dev_dioctl which re-enter dm (dmopen→dm_dev_lookup→dm_dev_mutex), inverting against dm_dev_remove/remove_all holding dm_dev_mutex across the ref-drain cv_wait and table destruction (→ dm_pdev_decr → dm_pdev_mutex): permanent AB-BA kernel deadlock of the whole dm subsystem
sys/dev/disk/dm/dm_pdev.c:128 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3617 Low 4.1 ath_intr TDMA/SWBA branch: unchecked TAILQ_FIRST(&ic->ic_vaps) and NULL vap->iv_tdma dereference in hard interrupt context (sc_tdma outlives the TDMA vap)
sys/dev/netif/ath/ath/if_ath.c:2186 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3854 Low 4.1 NULL-deref: 'rev = RBIOS8(offset)' executed before 'if (offset)' in radeon_combios_external_tmds_setup() IGP branch — panic when rdev->bios == NULL
sys/dev/drm/radeon/radeon_combios.c:2889 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3870 Low 4.1 bw_calcs_init: number_of_dram_channels = vram_width / dram_channel_width truncates to 0 -> #DE divisor family at boot/first modeset
sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:2041 · pass 2 · new
 dos inconclusive not_testable untriaged — —
DF-3876 Low 4.1 mfi_aen_setup dereferences log_state before the error check whose EBUSY/ENOMEM paths leave it NULL; attach caller discards the error via a comma-operator bug
sys/dev/raid/mfi/mfi.c:1020 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3912 Low 4.1 Non-terminating reply walk in mpt_recv_handshake_reply when IOC reports MsgLength < 2 (negative loop counter, attach-time livelock holding MPT_LOCK)
sys/dev/disk/mpt/mpt.c:1475 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-3942 Low 4.1 Five spread-spectrum table parsers dereference unchecked GET_IMAGE() results — NULL-page kernel panic at amdgpu/dc attach from a crafted/corrupt VBIOS
sys/dev/drm/amd/display/dc/bios/bios_parser.c:1041 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-3950 Low 4.1 mlx_wait_command(): timeout counter never incremented -> unkillable infinite 1s-sleep loop on a never-completing command
sys/dev/raid/mlx/mlx.c:1655 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3951 Low 4.1 mlx_start() controller-wedge path leaks mlx_busycmds (slot never decremented) -> permanent EBUSY lockout of all controller I/O; WEDGED command's DMA map left loaded
sys/dev/raid/mlx/mlx.c:2107 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3952 Low 4.1 mlx_setup_dmamap() panics when DMA segments exceed firmware me_max_sg, while the buffer tag is hard-coded to MLX_NSEG=64 and MLX_COMMAND passthrough is uncapped
sys/dev/raid/mlx/mlx.c:2010 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3956 Low 4.1 vid_mapping_table num_entries==0 -> entries[0xFFFFFFFF] wild read (~16 GiB) in kv_convert_vid2_to_vid7 / kv_convert_vid7_to_vid2
sys/dev/drm/radeon/kv_dpm.c:566 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3957 Low 4.1 Unguarded enc_priv derefs (NULL-page read AND write) for LCD-supporting digital encoders when radeon_atombios_get_lvds_info returns NULL
sys/dev/drm/radeon/atombios_encoders.c:742 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3959 Low 4.1 vtnet_exec_ctrl_cmd waits for control-queue completion with an unbounded spin loop (virtqueue_poll) under held serializers
sys/dev/virtual/virtio/net/if_vtnet.c:2407 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3968 Low 4.1 rt2661_scan_end and rt2661_enable_tsf_sync dereference TAILQ_FIRST(&ic->ic_vaps) without a NULL check — panic racing last-vap destruction during the scanner's unlocked ic_scan_end call
sys/dev/netif/ral/rt2661.c:2747 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3969 Low 4.1 rt2560_scan_end and rt2560_enable_tsf_sync dereference the vap without a NULL check — panic racing last-vap destruction during the scanner's unlocked ic_scan_end call (DF-3968 family)
sys/dev/netif/ral/rt2560.c:2277 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3997 Low 4.1 NULL-pointer dereference in envy24_pci_attach error path when resource allocation fails before cfg initialization
sys/dev/sound/pci/envy24.c:2569 · pass 2 · new
 NULL deref (sc->cfg->codec) on the envy24 attach error path when resource allocation fails before envy24_init assigns sc->cfg — panic during device attach. Privileged/physical context only. Mirror of DF-1331 (envy24ht.c) on a distinct trigger path; distinct from DF-1322. untested not_testable untriaged — —
DF-4103 Low 4.1 Unguarded enc_priv (NULL) dereferences in all DIG setup paths when get_lcd_info()/get_dig_info() fail — NULL-page read at amdgpu attach and NULL-page WRITE on DPMS-ON (DF-3957 amdgpu twin)
sys/dev/drm/amd/amdgpu/atombios_encoders.c:648 · pass 2 · new
 none untested not_testable untriaged — —
DF-4127 Low 4.1 Divide-by-zero in rv6xx_calculate_spread_spectrum_clk_v: truncating second-division divisor at :541 (and zero ref_freq first division at :538) — rv6xx twin of DF-4120
sys/dev/drm/radeon/rv6xx_dpm.c:538 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-4150 Low 4.1 NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0'd out)
sys/dev/drm/amd/amdgpu/cik.c:1379 · pass 2 · new
 NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0'd out in the DFly port). Boot/attach DoS on server platforms / VM GPU passthrough topologies. untested not_testable untriaged — —
DF-4170 Low 4.1 smu8_upload_pptable_to_smu NULL-derefs the four optional dependency tables (vdd_gfx/acp/uvd/vce) at driver load
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:443 · pass 2 · new
 none untested not_testable untriaged — —
DF-4185 Low 4.1 acd_fixate() integer divide-by-zero panic when all acd_get_cap() capability reads failed at attach (cur_write_speed stays 0)
sys/dev/disk/nata/atapi-cd.c:1158 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4186 Low 4.1 radeon_device_init ignores radeon_doorbell_init() failure: NULL doorbell aperture WDOORBELL32 write (kernel panic) on CIK+ when BAR2 ioremap fails
sys/dev/drm/radeon/radeon_device.c:1422 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4212 Low 4.1 mpt_raid_attach error paths: MPT_UNLOCK of a never-acquired lock (deterministic lockmgr panic) plus csa CCB leak
sys/dev/disk/mpt/mpt_raid.c:283 · pass 2 · new
 none untested not_testable untriaged — —
DF-4222 Low 4.1 XPT_ABORT handler dereferences the ccb hcb back-pointer without a NULL check — aborting a completed/never-issued CCB panics
sys/dev/virtual/vmware/pvscsi/pvscsi.c:1395 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4258 Low 4.1 Unbounded PHY-reset busy-wait in my_autoneg_xmit — the driver's only hardware-wait loop without MY_TIMEOUT (spins forever in ioctl, boot, and ISR contexts holding ifp->if_serializer)
sys/dev/netif/my/if_my.c:377 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4277 Low 4.1 cbb_resume() error path NULLs irq_res/base_res and returns ENOMEM but leaves the driver attached with stale intrhand — subsequent cbb_detach/cbb_suspend dereference the NULL resources (kernel panic)
sys/dev/pccard/pccbb/pccbb.c:1574 · pass 2 · new
 cbb_resume() error path NULLs irq_res/base_res and returns ENOMEM but leaves the driver attached with stale intrhand and a live event thread - subsequent cbb_detach/cbb_suspend dereference the NULL resources (kernel panic in rman/bus paths). untested not_testable untriaged — —
DF-4285 Low 4.1 midi_init() error paths: lockuninit() on held locks (KKASSERT panic) and m->synth leaked on every destruction path
sys/dev/sound/midi/midi.c:371 · pass 2 · new
 attach-time kernel panic (KKASSERT in lockuninit on held lock) when MPU_INIT fails; permanent small heap leak of m->synth on all init-error and destroy paths inconclusive not_testable untriaged — —
DF-4292 Low 4.1 atomctrl_get_smc_sclk_range_table dereferences the SMU_Info table pointer without a NULL check (companion guard to DF-1496)
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1374 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4293 Low 4.1 mixer_reinit and mixer_hwvol_* dereference the mixer cdev pointer with no NULL guards — NULL-deref panic on resume/reinit of a mixer-less pcm device
sys/dev/sound/pcm/mixer.c:828 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4295 Low 4.1 musycc_intr0 SHT event path dereferences sc->chan[ch] without the NULL check all sibling paths perform
sys/dev/misc/musycc/musycc.c:820 · pass 2 · new
 Interrupt-context NULL-deref write panic on stray MUSYCC event for an unconfigured channel. untested not_testable untriaged — —
DF-4296 Low 4.1 musycc_attach error-path asymmetry leaves half-initialized csoftc on the global list; sibling-function attach then NULL-derefs
sys/dev/misc/musycc/musycc.c:1455 · pass 2 · new
 Boot-time NULL-deref write panic on a dual-function card whose f0 BAR/IRQ allocation fails. untested not_testable untriaged — —
DF-4333 Low 4.1 hpt_add_disk_to_array divides by (bArnMember-1) unchecked - #DE panic on degenerate 1-member RAID1/5 arrays (sibling site of DF-1682)
sys/dev/raid/hptmv/gui_lib.c:935 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4368 Low 4.1 pp_get_current_clocks dereferences hwmgr->current_ps without the NULL guard its siblings have — NULL-deref panic after a failed pp_table reset, triggered via unprivileged DC modeset
sys/dev/drm/amd/powerplay/amd_powerplay.c:1051 · pass 2 · new
 pp_get_current_clocks NULL-deref panic after a failed (non-overflowing) pp_table reset leaves current_ps freed-and-NULL while dpm_enabled stays true; next unpriv modeset panics. untested not_testable untriaged — —
DF-4391 Low 4.1 mfi_tbolt_alloc_cmd never checks request_desc_pool for NULL - failed kmalloc leads to near-NULL memset write on first command build
sys/dev/raid/mfi/mfi_tbolt.c:455 · pass 2 · new
 The alloc validates only the second kmalloc; if request_desc_pool fails while the pool-array succeeds, the setup loop stores cmd->request_desc = NULL + i and the first command issue memsets at address 16*index - a write into the unmapped low page, panicking the boot untested not_testable untriaged — —
DF-4408 Low 4.1 acpi_asus_probe dereferences the unchecked INIT evaluation result: NULL Obj or non-String object -> NULL/wild pointer panic at probe
sys/dev/acpica/acpi_asus/acpi_asus.c:579 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4453 Low 4.1 RVDA raw-VBT mapping: pmap_mapbios() of unvalidated firmware-supplied 64-bit address / 32-bit length, re-leaked every resume (amplifies DF-1629; panic-capable KVA exhaustion)
sys/dev/drm/i915/intel_opregion.c:1029 · pass 2 · new
 none untested not_testable untriaged — —
DF-4528 Low 4.1 Admin submission queue lock-protocol violation: every admin-queue caller submits without queue->lk, racing subq_tail/unsubmitted/ksubq[] against the admin thread
sys/dev/disk/nvme/nvme.c:446 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4538 Low 4.1 cs4281_pci_detach() releases the BA0/BA1 register mappings before bus_teardown_intr - live ISR reads released mappings (shared-IRQ use-after-release window)
sys/dev/sound/pci/cs4281.c:893 · pass 2 · new
 none untested not_testable untriaged — —
DF-4539 Low 4.1 cs4281 attach ignores mixer_init()/pcm_addchan() failures; half-attached device NULL-derefs in cs4281_pci_resume (ch->parent NULL and mixer_dev NULL)
sys/dev/sound/pci/cs4281.c:845 · pass 2 · new
 none untested not_testable untriaged — —
DF-4561 Low 4.1 mpssas_ir_shutdown scans [start_idx, end_idx) over an inclusive IR map range: the last volume slot is never checked, so its SYSTEM_SHUTDOWN_INITIATED action (cache flush) is skipped
sys/dev/raid/mps/mps_sas_lsi.c:902 · pass 2 · new
 none untested not_testable untriaged — —
DF-4583 Low 4.1 VBIOS-derived zero clocks reach dfixed_div as divisors in the rs690 watermark math: igp_sideport_mclk == 0 (no zero fallback) and ulDefaultEngineClock == 0 (pm.sclk == 0) → integer-divide-fault panic at boot/first bandwidth update
sys/dev/drm/radeon/rs690.c:371 · pass 2 · new
 panic inconclusive inconclusive untriaged — —
DF-4627 Low 4.1 mipi_exec_delay: VBT-controlled u32 delay becomes a kernel BUSY-WAIT of up to ~71.6 minutes per element (arbitrarily many elements)
sys/dev/drm/i915/intel_dsi_vbt.c:194 · pass 2 · new
 Display subsystem hang + CPU burn up to ~71.6 min per delay element, indefinitely across elements, holding KMS locks so all DRM clients block untested not_testable untriaged — —
DF-4656 Low 4.1 Bounce-buffer kmalloc failure path drops the ccb (xpt_done never called) — CAM devq wedge under memory pressure
sys/dev/raid/twa/tw_osl_cam.c:336 · pass 2 · new
 Each occurrence permanently strands one CAM_SIM_QUEUED ccb / devq slot; repeated occurrences wedge all I/O to the controller until reboot untested not_testable untriaged — —
DF-4674 Low 4.1 bktr_attach fail-path releases the memory BAR with resource type SYS_RES_IRQ — resource_list_release() panics ('can't find resource') on any attach failure after the BAR was mapped
sys/dev/video/bktr/bktr_os.c:331 · pass 2 · new
 bktr_attach fail-path releases the memory BAR with SYS_RES_IRQ type - resource_list_release panics on any attach failure after BAR mapping (availability only) untested not_testable untriaged — —
DF-4676 Low 4.1 cmx_kqfilter is the only entry point without the sc==NULL||sc->dying guard — kevent() on a still-open fd after card detachment dereferences the NULL softc (kernel NULL-deref panic)
sys/dev/misc/cmx/cmx.c:663 · pass 2 · new
 cmx_kqfilter is the only entry without the sc/dying guard - kevent after card detach dereferences the NULL softc (panic). Root-only device + physical removal untested not_testable untriaged — —
DF-4681 Low 4.1 numPdGainsUsed==0 (EEPROM xpd_mask==0): uint32-wrapped wild reads at array+0x1FFFFFFFE (+8.59 GB) in the backfill loops + uninitialized Pmin_t2[0] stack read (twin of DF-4620/4649/4661)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:402 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4682 Low 4.1 Flat pd-gain curve makes sizeCurrVpdTable==0 → VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/4650/4662)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:438 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4706 Low 4.1 amr_pci_attach registers amr_pci_intr before the state it consumes exists: a shared-IRQ-line interrupt in the attach window dispatches through the still-NULL sc->amr_get_work -> boot/kldload panic (setup-side mirror of DF-1820)
sys/dev/raid/amr/amr_pci.c:257 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4718 Low 4.1 aac_cam_fix_inquiry dereferences csio->data_ptr on successful INQUIRY completions without checking a data buffer exists (NULL-deref panic via no-data pass-through INQUIRY)
sys/dev/raid/aac/aac_cam.c:551 · pass 2 · new
 none untested not_testable untriaged — —
DF-4729 Low 4.1 guc_ctl_log_params_flags() NULL-derefs guc->log.vma: the port compiled out intel_guc_log_create() but left its consumer live — instant kernel panic whenever GuC is enabled (enable_guc!=0) on Gen9+
sys/dev/drm/i915/intel_guc.c:294 · pass 2 · new
 none untested not_testable untriaged — —
DF-4734 Low 4.1 ar5210ResetTxQueue dereferences ah_curchan (IEEE80211_IS_CHAN_TURBO) without the NULL guard both sibling HALs carry ("NB: chan can be NULL during attach")
sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:157 · pass 2 · new
 none demonstrated (hardware-gated: no Atheros NIC on guest; latent NULL-deref kernel panic if a DATA queue is reset before the first channel set) untested fixed untriaged — —
DF-4751 Low 4.1 dm MOD_UNLOAD: unlocked dm_dev_counter check plus unpinned ops dispatch — kldunload racing a control ioctl executes freed module text (fatal trap 12)
sys/dev/disk/dm/device-mapper.c:161 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-4755 Low 4.1 VI mailbox RCV interrupt enabled before flr_work is initialized — host-timed mailbox interrupt executes schedule_work() on an uninitialized (zeroed) work_struct → NULL function-pointer call → kernel panic
sys/dev/drm/amd/amdgpu/mxgpu_vi.c:600 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4781 Low 4.1 Unchecked M_NOWAIT contigmalloc in dcons_drv_init: NULL buffer passed to dcons_init() -> NULL+0x14 store panic at kldload
sys/dev/misc/dcons/dcons_os.c:462 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4782 Low 4.1 Static-console path never wires si_drv1: first write to /dev/dcons on a 'device dcons' kernel NULL-derefs in dcons_putc()
sys/dev/misc/dcons/dcons_os.c:320 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4784 Low 4.1 suspend state leaves bio queue accepting I/O with no consumer and no bound: kernel-memory exhaustion under sustained load
sys/dev/disk/mmcsd/mmcsd.c:312 · pass 2 · new
 denial_of_service reproduced not_testable untriaged — —
DF-4793 Low 4.1 ar9287SetPowerCalTable: non-2GHz channel leaves pCalBChans=NULL/numPiers=0, unguarded per-chain walk NULL-derefs pList[0] in ath_ee_getLowerUpperIndex (kernel panic)
sys/dev/netif/ath/ath_hal/ar9002/ar9287_reset.c:68 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4802 Low 4.1 initsd() verify loop retries a mismatched block forever (verified=0 with no bound): unbounded uninterruptible kernel loop in the ioctl thread
sys/dev/raid/vinum/vinumrevive.c:526 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4805 Low 4.1 Disable path programs count=0 + reload while leaving AMDSB_WD_RUN armed — kern.watchdog.period=0 (and panic-path wdog_disable) never actually disarm the watchdog; a zero count under RUN may act as a 1-tick fuse per SB RRG countdown semantics
sys/dev/misc/amdsbwd/amdsbwd.c:220 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4818 Low 4.1 nvme(4): unchecked MSI-X vector IRQ resource allocation (and missing pci_teardown_msix on fallback) leads to boot-time kernel panics
sys/dev/disk/nvme/nvme_attach.c:166 · pass 2 · new
 panic inconclusive not_testable untriaged — —
DF-4857 Low 4.1 Divide-by-zero kernel panic in rv730_populate_sclk_value: do_div by verbatim VBIOS reference clock (usReferenceClock==0) — rv730 twin of DF-1992
sys/dev/drm/radeon/rv730_dpm.c:52 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-4863 Low 4.1 amdgpu_cgs_get_firmware_info indexes adev->firmware.ucode[fw_type_convert(type)] with no bound on the converter's default return (== the array size): one-past-end element whose .fw aliases firmware.fw_buf — type-confused deref of amdgpu_bo internals as struct firmware (latent: no in-tree caller passes an unmapped type)
sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:214 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4923 Low 4.1 tlphy_attach NULL-deref: strcmp(device_get_name(sibling), "tlphy") panics on not-yet-probed miibus sibling
sys/dev/netif/mii_layer/tlphy.c:175 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4945 Low 4.1 DCE12 copy of the uninitialized-*id defect: offset_to_id returns success for all DDC-family offsets (165-189) without writing *id — dal_gpio_service_create_irq switches on an uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles en=6/7 into the 6-entry hpd_regs[] (OOB)
sys/dev/drm/amd/display/dc/gpio/dce120/hw_translate_dce120.c:165 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4946 Low 4.1 DCN10 copy of the uninitialized-*id defect: offset_to_id returns success for all eight DDC-family offsets (165-189) without writing *id — dal_gpio_service_create_irq switches on the uninitialized gpio_id; garbage==GPIO_ID_HPD smuggles DDC-line en=6 (DDC_VGA) / en=7 (I2C_PAD) into the 6-entry hpd_regs[] (OOB)
sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:165 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4950 Low 4.1 ahci_os_stop_port(): unbounded thread-join with no escape converts any port-thread wedge into a permanent unkillable kernel hang at detach/shutdown, and tears down only 1 of the 3 per-port locks
sys/dev/disk/ahci/ahci_dragonfly.c:248 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4951 Low 4.1 vega12_pp_tables_uninitialize NULL-deref on second pptable_fini: hwmgr_hw_init err1/err2 already freed hwmgr->pptable while pm_en/dpm_enabled stay set, so the next hwmgr_hw_fini (second pp_table sysfs write via amd_powerplay_reset, driver teardown, GPU reset) faults at NULL+16 — kernel panic
sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c:296 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-4975 Low 4.1 AI (Vega20-class) mailbox RCV interrupt enabled before flr_work is initialized — host-timed IDH_FLR_NOTIFICATION executes schedule_work() on a zeroed work_struct → NULL function-pointer call → kernel panic (DF-4755 twin)
sys/dev/drm/amd/amdgpu/mxgpu_ai.c:351 · pass 2 · new
 none untested not_testable untriaged — —
DF-4986 Low 4.1 mfi_pci_attach failure unwind calls mfi_free() → callout_terminate() on a never-initialized watchdog callout → KKASSERT kernel panic (stock INVARIANTS GENERIC)
sys/dev/raid/mfi/mfi_pci.c:230 · pass 2 · new
 panic not_reproduced not_testable untriaged — —
DF-5005 Low 4.1 amdgpu_atombios_get_clock_info() accepts usReferenceClock==0 with no fixup (unlike every sibling field) → ppll.reference_freq==0 guarantees amdgpu_pll_compute divide-by-zero at first modeset (the rs400/r100 'reference_freq==0' lead, confirmed)
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:592 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5044 Low 4.1 sili_os_stop_port() waits for the port helper thread with no bound — a wedged helper thread turns kldunload/shutdown into a permanent kernel hang
sys/dev/disk/sili/sili_dragonfly.c:208 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5047 Low 4.1 idad_dump reports fake success for controller-failed/rejected dump writes — ida_command discards the controller error status (DF-5027 pattern)
sys/dev/raid/ida/ida_disk.c:204 · pass 2 · new
 none untested not_testable untriaged — —
DF-5085 Low 4.1 AcpiOsMapMemory's NULL failure contract is dead code — pmap_mapdev panics on KVA exhaustion instead of returning NULL, converting ACPICA's graceful AE_NO_MEMORY degradation into an unrecoverable kernel panic with firmware/AML-controlled mapping volume
sys/dev/acpica/Osd/OsdMemory.c:91 · pass 2 · new
 per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption) untested not_testable untriaged — —
DF-5102 Low 4.1 apple_fw_probe feeds kgetenv() NULL results to kfreeenv(): kfree(NULL) panics the kernel (kern_slaballoc.c:1407) when smbios kenv entries are absent
sys/dev/apple/fw/apple_fw.c:107 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5121 Low 4.1 MMalloc trace-table exhaustion (>=16384 outstanding allocations) makes Malloc() return NULL in VINUMDEBUG builds, breaking the never-fail M_WAITOK contract the vinum family relies on: unchecked callers NULL-deref (panic) and expand_table's CHECKALLOC longjmps out of crit_enter() without crit_exit() (leaked critical section)
sys/dev/raid/vinum/vinummemory.c:103 · pass 2 · new
 NULL-deref panic / leaked crit section in debug builds untested not_testable untriaged — —
DF-5127 Low 4.1 rcu_expand() performs a blocking GFP_KERNEL (M_WAITOK) allocation inside crit_enter() — sleeping allocation in a critical section under memory pressure
sys/dev/drm/linux_rcu.c:139 · pass 2 · new
 latent crit-section rule violation under memory pressure untested not_testable untriaged — —
DF-5129 Low 4.1 for_each_sg lacks Linux's `&& sg' termination guard — list shorter than sgmax turns into sg_next(NULL) NULL-deref panic
sys/dev/drm/linux_scatterlist.c:342 · pass 2 · new
 NULL-deref panic inside drm code on caller/list count mismatch untested not_testable untriaged — —
DF-5130 Low 4.1 ecc_amd8000_attach() executes rdmsr(0x017B)/wrmsr(0x17B) with no CPU vendor/family validation — chipset-ID-gated #GP kernel panic (coretemp DF-4735 shape, hardware-gated)
sys/dev/misc/ecc/ecc_amd8000.c:165 · pass 2 · new
 attach-time #GP panic on platform-lying config untested not_testable untriaged — —
DF-5168 Low 4.1 ips_ioctl_cmd ENOMEM error path feeds a failed bus_dmamem_alloc result into bus_dmamem_free — contigfree(NULL)/kfree(NULL) corrupts kernel_map or panics
sys/dev/raid/ips/ips_ioctl.c:116 · pass 2 · new
 kernel panic or kernel_map corruption on the ENOMEM path untested not_testable untriaged — —
DF-5179 Low 4.1 atkbdattach() ignores IRQ resource allocation failure: NULL resource reaches nexus_setup_intr() which panics by design (boot-time kernel panic; BUS_SETUP_INTR result also unchecked, resource leaked)
sys/dev/misc/atkbd/atkbd_isa.c:120 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4825 Info 4.1 clockmod: raw wrmsr(MSR_THERM_CONTROL) without a fault-safe accessor — a VMM advertising CPUID ACPI+TM but faulting the MSR turns the root sysctl select / kldunload raise-to-100% into an unrecoverable #GP panic (DF-4735 family)
sys/dev/powermng/clockmod/clockmod.c:472 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4831 Info 4.1 hwmgr_hw_fini dereferences hwmgr->hwmgr_func->backend_fini and hwmgr->pptable_func->pptable_fini guarded only by pm_en — no PHM_FUNC_CHECK-style preflight (same latent class as DF-1913 at unguarded sites)
sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:278 · pass 2 · new
 panic untested not_testable untriaged — —
DF-5096 Info 4.1 parser2 command-table helper hub failure ignored leaves bp->cmd_helper NULL inside a 'successfully' constructed firmware BIOS parser — latent whole-vtable NULL function-pointer call (v2 twin of DF-5075)
sys/dev/drm/amd/display/dc/bios/command_table_helper2.c:73 · pass 2 · new
 latent NULL vtable call (panic) untested not_testable untriaged — —
DF-5097 Info 4.1 helper2 hub wires v1 dce80/dce110 tables into the atomfirmware parser; both tables lack transmitter_color_depth_to_atom and dc_clock_type_to_atom which command_table2.c invokes unguarded — latent NULL function-pointer kernel panic under cross-generation VBIOS pairing (parser2 twin of DF-5000/DF-4985)
sys/dev/drm/amd/display/dc/bios/command_table_helper2.c:43 · pass 2 · new
 latent NULL vtable call (panic) untested not_testable untriaged — —
DF-5777 Info 4.1 splash() invokes splash_decoder->splash without the NULL guard its sibling callbacks get
sys/dev/video/fb/splash.c:204 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3972 Medium 4.0 NULL-pointer dereference of rdev->pm.dpm.boot_ps in btc_dpm_enable/btc_dpm_disable when the VBIOS power table has no BOOT-classified state (or ucStateEntrySize<=1) — btc twin of DF-3610/3646/3754/3953
sys/dev/drm/radeon/btc_dpm.c:2377 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3848 Low 4.0 bwn_phy_shm_tssi_read returns positive ENOENT but callers test < 0: the invalid-TSSI sentinel is treated as a valid TSSI of 2, so TX-power recalculation always 'adjusts' on fabricated data
sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:3520 · pass 2 · new
 TX-power correctness (bwn) / mbuf leak + ring wedge (dc) untested — untriaged — —
DF-3964 Low 4.0 Firmware-fed get_config values consumed unvalidated: PAGE_SIZE*(max_sg_count-1) maxsize underflow and cam_simq_alloc(max_requests-1) with openings=-1
sys/dev/raid/hptiop/hptiop.c:1928 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4308 Low 4.0 adwprocesserror() panics on firmware-defined host_status codes the switch does not enumerate (0x35/0x36/0x46/0x47) — target/device-triggerable kernel panic
sys/dev/disk/advansys/adwcam.c:1350 · pass 2 · new
 none untested not_testable untriaged — —
DF-4727 Low 4.0 aureal: au_intr calls chn_intr(au->pch.channel) while the channel is NULL — NULL-deref panic in the snd_setup_intr-to-pcm_addchan window that au_testirq deliberately enables IRQs inside
sys/dev/sound/pci/aureal.c:411 · pass 2 · new
 none untested not_testable untriaged — —
DF-5076 Low 4.0 ipmi2_pci_probe is the only IPMI frontend probe lacking the ipmi_attached singleton guard — double attach (second cdev + second kthread, interleaved KCS/SMIC state machines) on dual-description BMC hardware
sys/dev/misc/ipmi/ipmi_pci.c:183 · pass 2 · new
 none untested not_testable untriaged — —
DF-5173 Low 4.0 ata_jmicron_setmode reads PCI config from the ATA disk device instead of the controller — 80-pin cable detect and multifunction PATA routing are permanently dead
sys/dev/disk/nata/chipsets/ata-jmicron.c:161 · pass 2 · new
 UDMA over 40-pin cable / misrouted PATA setmode untested not_testable untriaged — —
DF-4757 Low 3.9 LLQ stride accounting inverted: ena_com.c:657 assigns descs_per_entry backwards (SINGLE→entry/64, MULTIPLE→1) contradicting the vendor enum semantics and ena_eth_com.c:202 — free-space guard undercounts for SINGLE-stride LLQs and lets the tail lap outstanding descriptors
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:657 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-3975 Medium 3.8 btc_dpm_get_sclk/btc_dpm_get_mclk dereference eg_pi->requested_rps.ps_priv (NULL) before the first power-state change — NULL-page read panic from display bandwidth updates
sys/dev/drm/radeon/btc_dpm.c:2802 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5075 Low 3.8 v1 command-table helper hub leaves bp->cmd_helper NULL for DCE12/DCN generations on the legacy BIOS parser; construct ignores the init failure — whole-vtable NULL dereference at the first BIOS command
sys/dev/drm/amd/display/dc/bios/command_table_helper.c:58 · pass 2 · new
 none untested not_testable untriaged — —
DF-5183 Low 3.8 wait_on_bit_timeout() passes Linux TASK_* state constants as tsleep(9) flags (TASK_INTERRUPTIBLE never maps to PCATCH: interruptible waits are silently unkillable) and truncates the unsigned long timeout to int (MAX_SCHEDULE_TIMEOUT → -1 → next-tick callout: 'infinite' waits are 1 Hz polling loops)
sys/dev/drm/linux_wait.c:105 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5782 Medium 3.6 i915: unauthenticated ADDFB2 u32 overflow in framebuffer offset/size math (tile-aligned geometry) defeats bo-bounds check — OOB GPU scanout read from wrong/adjacent GGTT mappings
sys/dev/drm/i915/intel_display.c:2398 · pass 2 · new
 none untested not_testable untriaged — —
DF-3642 Low 3.6 e1000_erase_flash_bank_ich8lan: erase address accumulates across retries, retry budget never reset, and erase failure reported as success
sys/dev/netif/ig_hal/e1000_ich8lan.c:4779 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3793 Low 3.6 acpi_GetInteger() reads uninitialized stack ACPI_OBJECT when AML evaluation succeeds but returns no object
sys/dev/acpica/acpi.c:2166 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4115 Low 3.6 hdac_stream_alloc() bidirectional-stream tag arithmetic: '+ num_oss' should be '- num_oss' (missing upstream FreeBSD fix) — wrong/colliding/negative HDA stream tags on BSS-capable controllers
sys/dev/sound/pci/hda/hdac.c:1933 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4430 Low 3.6 PRIME import on radeon: populate() ignores the sg table (fresh pages bound into the GART instead of the exporter's) and unpopulate() leaks those pages + TTM accounting per import cycle
sys/dev/drm/radeon/radeon_ttm.c:753 · pass 2 · new
 PRIME-imported (ttm_bo_type_sg) BOs on radeon: populate() ignores ttm->sg (slave branch #ifdef DUMBBELL_WIP, radeon_ttm.c:753-764) and allocates fresh pool pages that get bound into the GART — the GPU view of an imported dma-buf diverges from the exporter's memory (silent data corruption); unpopulate()'s live slave early-return (radeon_ttm.c:808,818-819) then never frees those pages or their ttm_mem_global accounting, so repeated import/destroy cycles leak wired kernel memory until GPU allocations fail (DoS). Sibling amdgpu_ttm.c:1268-1330 implements the slave path live. Reachability: cross-driver dma-buf import with radeon as importer (multi-GPU); same-driver self-import unaffected. untested not_testable untriaged — —
DF-4445 Low 3.6 radeon_router_select_ddc_port/cd_port write an uninitialized kernel-stack byte into the DDC/CD router i2c mux registers when the router read fails (and leak it via DRM_DEBUG)
sys/dev/drm/radeon/radeon_i2c.c:1110 · pass 2 · new
 none untested not_testable untriaged — —
DF-4552 Low 3.6 snd_vibes: sv_attach failure paths after mixer_init leave a live 0666 /dev/mixerN over released bus resources and leak sc (DF-4156 family, 12th instance)
sys/dev/sound/pci/vibes.c:789 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4588 Low 3.6 ttm_bo_vm_fault_dfly maps SG (prime-imported) foreign pages through the card node — the upstream TTM_PAGE_FLAG_SG refusal is dead code in #if 0
sys/dev/drm/ttm/ttm_bo_vm.c:161 · pass 2 · new
 none untested not_testable untriaged — —
DF-4603 Low 3.6 ttm_bo_util: stale/uninitialized old_copy.bus snapshot drives iounmap() decision in ttm_bo_move_memcpy out: cleanup — kernel mapping leak, and full VRAM-aperture unmap when old BO sits at aperture offset 0
sys/dev/drm/ttm/ttm_bo_util.c:344 · pass 2 · new
 Permanent kernel mapping leak per failed move (VA pressure DoS), or full VRAM-aperture unmap when old BO sits at aperture offset 0 -> kernel panic on next premapped access untested not_testable untriaged — —
DF-4799 Low 3.6 ar9285: 2GHz-only Kite never enforced — 11A/11NA caps advertised (GMODE divergence), 5GHz channel edges inherited, nf_5g limits left zeroed: 5GHz channels selectable → radio programmed out of calibrated design with 2GHz-only data
sys/dev/netif/ath/ath_hal/ar9002/ar9285_attach.c:527 · pass 2 · new
 none untested not_testable untriaged — —
DF-4808 Low 3.6 dce110 i2c hw engine: SW engine-state accounting desync corrupts subsequent DDC/I2C transactions — write-path buffer_used_bytes undercounts (length consumed before the accounting add), counters never reset on aborted-busy/release paths, and I2C_HW_BUFFER_SIZE=538 exceeds the 8-bit DC_I2C_INDEX/COUNT0 fields
sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:334 · pass 2 · new
 none untested not_testable untriaged — —
DF-4816 Low 3.6 iwm phy_db: unbounded firmware channel-group id → up-to-1 MiB M_WAITOK allocations from interrupt context + uint8_t truncation of the group-count upload loop (-1→255 hard-fails firmware load)
sys/dev/netif/iwm/if_iwm_phy_db.c:279 · pass 2 · new
 none untested not_testable untriaged — —
DF-4830 Low 3.6 mdcreate unit allocation (mdunits++) is unlocked and non-atomic — concurrent mdopen auto-create of the top unit can mint two md devices with the same unit number/cdev name
sys/dev/disk/md/md.c:135 · pass 2 · new
 none untested not_testable untriaged — —
DF-4940 Low 3.6 if_ic: icoutput unconditionally forces IFF_RUNNING, bypassing the up state machine (permanently skipped buffer allocation/bus acquisition, TX over un-owned iicbus, spurious bus release)
sys/dev/netif/ic/if_ic.c:188 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5066 Low 3.6 dm_target_autoload clobbers linker_file->userrefs with an unsynchronized '=1' store outside kld_lock, racing kldunload's locked read-modify-write — corrupts kld module pin accounting
sys/dev/disk/dm/dm_target.c:88 · pass 2 · new
 module pin-accounting corruption untested not_testable untriaged — —
DF-5087 Low 3.6 Unsynchronized check-then-set of i2c_hw_buffer_in_use plus clear-before-release lets concurrent I2C acquisitions jointly drive the single shared DCE80 DC_I2C engine — interleaved single-instance MMIO and per-engine tracking divergence from the shared 144-byte HW data FIFO (dce80 twin of DF-5035/DF-4878; the DAL2 mutex was dropped in the port)
sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c:139 · pass 2 · new
 per finding (panic-instead-of-degrade / latent NULL-free / DDC data corruption) untested not_testable untriaged — —
DF-5131 Low 3.6 DF-4871 family completion: seven more callers discard radeon_sync_resv()/radeon_sync_rings() returns — GPU work submitted without its cross-ring dependency on sync failure (silent bo data corruption, racing VM page-table updates)
sys/dev/drm/radeon/radeon_sync.c:89 · pass 2 · new
 none untested not_testable untriaged — —
DF-4876 Low 3.5 afd_sense(): three uninitialized stack structs consumed as ATAPI response buffers — short (but successful) device responses publish stale kernel stack as disk geometry
sys/dev/disk/nata/atapi-fd.c:345 · pass 2 · new
 none untested not_testable untriaged — —
DF-4949 Low 3.5 smic_read_byte() writes a status code (SC_SMS_RD_NEXT 0xC5) into the control register instead of the command code (CC_SMS_RD_NEXT 0x45) — out-of-spec SMIC control write on every reply byte
sys/dev/misc/ipmi/ipmi_smic.c:202 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4594 Low 3.4 vinum_scandisk() early returns (ENOENT / longjmp) leave VF_READING_CONFIG set and leak drivelist — daemon config saves silently wedged
sys/dev/raid/vinum/vinumio.c:682 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4600 Low 3.4 renameobject() bcopy's full-width newname with no NUL-termination guard → unterminated drive/sd/plex/volume name fields persisted to config and fed to strcmp/strlen/log %s
sys/dev/raid/vinum/vinumioctl.c:740 · pass 2 · new
 Unterminated names in find_* strcmp walks, detachobject strlen/bcmp, log %s, and persisted config text (garbage-tailed lines re-parsed at next init); reads bounded within the struct by NULs in following state enums untested not_testable untriaged — —
DF-5151 Low 3.4 dm pdev dedup key silently truncated to 31 chars: a linear table load binds to the wrong physical device (or to a device whose path was never opened)
sys/dev/disk/dm/linear/dm_target_linear.c:67 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5166 Low 3.4 disable_irq/enable_irq resolve the victim entry by irq number only, ignoring dev_id — teardown/re-setup of the wrong device's handler whenever two registrations share or numerically collide on an irq
sys/dev/drm/linux_irq.c:150 · pass 2 · new
 interrupt-context UAF / orphaned armed handler / cross-device teardown untested not_testable untriaged — —
DF-5146 Medium 3.3 DRM hash tables collapse to a single bucket on 64-bit: linux-compat hash_64() is identically zero for bits<=32 (O(n²) drm_ht behavior, local DoS)
sys/dev/drm/drm_hashtab.c:80 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3677 Low 3.3 XPT_RESET_DEV on the RAID physical-disk bus resets the WRONG device: phydisk id passed unmapped as a bus-0 TMF TargetID (hits the RAID volume sharing the number)
sys/dev/disk/mpt/mpt_cam.c:3292 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3798 Low 3.3 ena_start_xmit leaks the dequeued mbuf when ena_xmit_mbuf returns ENA_COM_NO_MEM or ENA_COM_NO_SPACE
sys/dev/virtual/amazon/ena/ena.c:2936 · pass 2 · new
 mbuf leak / latent NULL-deref untested — untriaged — —
DF-3865 Low 3.3 DragonFly rbtree shim never maintains rb_root_cached.rb_leftmost — amdgpu_vm_fini's mapping-cleanup loop is dead code, leaking every mapping left in the interval tree at teardown
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3325 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4016 Low 3.3 mps_user_btdh off-by-one: target == max_devices passes the range check and reads mapping_table[max_devices] out of bounds
sys/dev/raid/mps/mps_user.c:2021 · pass 2 · new
 mps_user_btdh off-by-one: 'target > max_devices' lets TargetID==max_devices read mapping_table[max_devices] one 24-byte element past the heap allocation, disclosing a garbage u16 DevHandle to the operator-group caller. mpr twin at mpr_user.c:2240. untested not_testable untriaged — —
DF-4048 Low 3.3 transmitter_control_v1_6 applies 16-bit deep-color conversions to the 32-bit ulSymClock field — truncated transmitter symbol clock for HDMI deep color > 655.35 MHz
sys/dev/drm/amd/display/dc/bios/command_table.c:857 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4102 Low 3.3 dce4/avivo_crtc_do_set_base pin the scanout BO then return -EINVAL on unsupported-format/tiling errors without unpinning — repeatable VRAM pin-exhaustion DoS
sys/dev/drm/radeon/atombios_crtc.c:1183 · pass 2 · new
 Local DoS by any DRM-master-holding user on radeon hardware: one ioctl per leaked pin; VRAM exhaustion degrades/deadlocks the display subsystem. untested not_testable untriaged — —
DF-4226 Low 3.3 Output-lock asymmetry: radeon_legacy_tmds_int_commit and radeon_legacy_tv_dac_commit re-LOCK the output instead of unlocking after modeset
sys/dev/drm/radeon/radeon_legacy_encoders.c:768 · pass 2 · new
 none untested not_testable untriaged — —
DF-4239 Low 3.3 Stale ata_xfer resid propagated to CAM for zero-data commands: sili_unload_prb skips the resid update when datalen==0 and the completion copies the previous command's resid into csio->resid
sys/dev/disk/sili/sili_cam.c:1667 · pass 2 · new
 Stale ata_xfer resid propagated to CAM for zero-data commands: sili_unload_prb skips the resid update when datalen==0 and the completion copies the previous command's resid into csio->resid. Operator-group /dev/passN users receive bogus resid for zero-data commands; can mask real short-transfer conditions. untested not_testable untriaged — —
DF-4264 Low 3.3 AMDGPU_FENCE_TO_HANDLE default case returns -EINVAL without dma_fence_put — one leaked fence reference per invalid call
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1427 · pass 2 · new
 none untested not_testable untriaged — —
DF-4280 Low 3.3 CCDIOCCLR busy-guard is unsatisfiable (permanent make_only_dev reference): a configured ccd unit can never be unconfigured and ccd.ko can never unload
sys/dev/disk/ccd/ccd.c:1434 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4357 Low 3.3 AMDGPU_INFO_READ_MMR_REG missing upstream count>128 cap: unprivileged unbounded kernel kmalloc (hardening / local DoS)
sys/dev/drm/amd/amdgpu/amdgpu_kms.c:668 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4470 Low 3.3 Duplicate connector IDs in DRM_IOCTL_MODE_SETCRTC leak one drm_connector reference per duplicate slot per successful modeset — per-slot get vs per-connector binding, surplus dropped only on the fail path
sys/dev/drm/drm_crtc_helper.c:626 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4471 Low 3.3 __drm_helper_disable_unused_functions() NULLs crtc->primary->fb without dropping its framebuffer reference when invoked outside __drm_mode_set_config_internal — fb + GEM object reference leak per disabled unused CRTC
sys/dev/drm/drm_crtc_helper.c:189 · pass 2 · new
 none untested not_testable untriaged — —
DF-4532 Low 3.3 drm_open() calls device_busy() on every successful open but no live path ever calls device_unbusy(): drm device and its PCI parent wedged in DS_BUSY forever, permanently blocking device_detach()/kldunload
sys/dev/drm/drm_file.c:351 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4533 Low 3.3 drm_open() leaks one drm_device kref per successful open: the success-path drm_minor_acquire() is never balanced on any live path, so drm_dev_release()/drm_dev_fini() can never run and the whole drm_device leaks at unload
sys/dev/drm/drm_file.c:325 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4794 Low 3.3 ig_hal VF: E1000_VF_SET_MULTICAST_OVERFLOW flag overwritten before send — PF never told to enable multicast promiscuous, >30 joined groups silently dropped (IPv6 ND breakage)
sys/dev/netif/ig_hal/e1000_vf.c:421 · pass 2 · new
 none demonstrated at runtime (guest is virtio-only, no SR-IOV 82576/I350 VF device); logic-level proven from source ordering + upstream divergence: with >30 multicast groups joined on an igb VF interface, PF-visible msgbuf[0]=0x001E0003 loses E1000_VF_SET_MULTICAST_OVERFLOW (0x00800000), PF never enables multicast promiscuous, groups beyond the 30 forwarded hashes silently stop receiving (typ. IPv6 solicited-node/ND breakage) — availability only, no corruption/leak/privilege crossing untested not_testable untriaged — —
DF-4877 Low 3.3 afd_strategy(): no mediasize bounds check and 32-bit LBA truncation — out-of-range raw I/O wraps onto low LBAs instead of failing
sys/dev/disk/nata/atapi-fd.c:241 · pass 2 · new
 none untested not_testable untriaged — —
DF-5027 Low 3.3 ipsd_dump() reports fake success when ips_poll_cmd never completes — copperhead crash dumps can be silently empty/corrupt (zeroed status defeats COMMAND_ERROR)
sys/dev/raid/ips/ips_disk.c:249 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5029 Low 3.3 Unprivileged unkillable D-state sleep: pcfclock_open() requests the ppbus with bare PPB_WAIT (= PPB_WAIT|PPB_NOINTR) on world-readable /dev/pcfclock0
sys/dev/misc/pcfclock/pcfclock.c:152 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5050 Low 3.3 mfi_syspd_dump acknowledges every crash-dump chunk the firmware rejected — polled transport returns 0 for any firmware cmd_status, so a dead/removed system PD 'successfully' dumps an empty core (DF-5027 shape)
sys/dev/raid/mfi/mfi_syspd.c:287 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5215 Low 3.3 LinuxKPI interval 'tree' is an O(N) circular list — sole live consumer (radeon_vm.c GEM_VA path) turns it into unprivileged per-ioctl O(N) kernel scans (O(N^2) mapping churn), a kernel-CPU amplification DoS on radeon-equipped systems
sys/dev/drm/linux_interval_tree.c:34 · pass 2 · new
 latent interior kfree / kernel-CPU amplification / unkillable spin untested not_testable untriaged — —
DF-3868 Info 3.3 Copy-paste bug: 'debug' hint clamps sc->mch_rec instead of sc->dbg_level (and clamping is skipped exactly when the hint exists)
sys/dev/sound/pci/emu10kx.c:3081 · pass 2 · new
 log-spam DoS (debug sysctl unbounded) untested — untriaged — —
DF-3637 Low 3.1 ath_tx_start() discards ath_tx_normal_setup() failure ('done: return 0') — leaked ath_buf + 10-descriptor slab + dmamap per failure, phantom TIM set, caller told success
sys/dev/netif/ath/ath/if_ath_tx.c:2021 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4210 Low 3.1 Unknown-INOT-status path overwrites the parsed notify entry with a log string and then acknowledges the string instead of the queue entry (f/w gets garbage ack; original Immediate Notify never properly acknowledged)
sys/dev/disk/isp/isp_target.c:346 · pass 2 · new
 In the RQSTYPE_NOTIFY default case, ISP_SNPRINTF overwrites the just-parsed Immediate Notify entry in the 64-byte stack buffer with an ASCII log message; isp_print_bytes correctly prints the ORIGINAL entry (vptr) but isp_notify_ack(isp, local) is handed the STRING, which it re-parses as in_entry_t - na_iid/na_seqid/na_status/na_task_flags become ASCII bytes and that garbage Notify-Ack goes to the firmware queue untested not_testable untriaged — —
DF-4520 Low 3.1 ar5212_xmit: halTotalQueues taken unclamped from EEPROM AR_EEP_MAXQCU (raw 5-bit, 1..31) bounds ah_txq[HAL_NUM_TX_QUEUES=10] in every queue op -> SetupTxQueue OOB scan read + OS_MEMZERO OOB heap write at attach on crafted EEPROM
sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:137 · pass 2 · new
 none demonstrated (latent OOB kernel heap read + OS_MEMZERO OOB write at driver attach if the NIC EEPROM encodes MAXQCU>10; crafted/corrupted EEPROM = physical-card trust boundary) untested fixed untriaged — —
DF-3659 Low 3.0 ISP_TSK_MGMT ioctl (24xx) double-releases the FC scratch buffer on the error path, breaking fcbsy mutual exclusion
sys/dev/disk/isp/isp_freebsd.c:665 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3808 Low 3.0 msk_txeof() consumes the device-supplied TX done index (0..4095) with no MSK_TX_RING_CNT (256) range check: bogus index force-completes the entire in-flight TX window (premature dmamap_unload/m_freem on HW_OWNER descriptors)
sys/dev/netif/msk/if_msk.c:2884 · pass 2 · new
 none untested not_testable untriaged — —
DF-3846 Low 3.0 sc->map_update_cmd is never cleared: shutdown aborts a recycled pooled mfi command (stale handle → wrong-command abort)
sys/dev/raid/mrsas/mrsas.c:2953 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3856 Low 3.0 Unchecked BIOS shift counts >= 32 (C99 6.5.7p3 UB) used to build PLL/GPIO write masks at four parser sites
sys/dev/drm/radeon/radeon_combios.c:654 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3994 Low 3.0 Per-device runtime mutation of shared static radeon_asic dispatch tables (r420 'macs' hack, agp_disable gart swap, IGP clock-op NULL-out) — cross-device dispatch corruption in multi-GPU systems
sys/dev/drm/radeon/radeon_asic.c:167 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4407 Low 3.0 /dev/tpm open/read/write are not serialized across CPUs: TOCTOU on TPM_OPEN plus interleaved TIS transactions
sys/dev/crypto/tpm/tpm.c:1155 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4443 Low 3.0 vtpci_intr_alloc does not clamp the caller's interrupt count to the fixed vtpci_intr_res[1 + VIRTIO_MAX_VIRTQUEUES] array — latent out-of-bounds softc state write for any child driver requesting more than 9 vectors
sys/dev/virtual/virtio/pci/virtio_pci.c:460 · pass 2 · new
 Latent OOB write of softc state (rid ints + kernel pointers) past vtpci_intr_res[1+VIRTIO_MAX_VIRTQUEUES] for any child kmod requesting >9 vectors against a host advertising >=10 MSI-X vectors untested not_testable untriaged — —
DF-4519 Low 3.0 ar5212_xmit: TX-queue index q validated only by inert HALASSERT in 5 exported xmit ops; signed q<0 bypasses the >=-only checks in Set/GetTxQueueProps down to &ah_txq[q]
sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:91 · pass 2 · new
 none demonstrated (no unprivileged trigger; latent OOB kernel read/write below ah_txq[0] via negative q, and UB 1<<q / unchecked MMIO addressing, if a future/buggy caller passes an unvalidated queue index) untested fixed untriaged — —
DF-4541 Low 3.0 hptmv AS_INITIALIZE_START queues the rebuild DPC with flag VERIFY - initialization never starts; ioctl spins 80s and returns success
sys/dev/raid/hptmv/ioctl.c:572 · pass 2 · new
 none untested not_testable untriaged — —
DF-4595 Low 3.0 read_drive_label() ignores the read_drive() error and classifies stale/uninitialized heap as a vinum label (wrong-drive acceptance)
sys/dev/raid/vinum/vinumio.c:332 · pass 2 · new
 none untested not_testable untriaged — —
DF-4616 Low 3.0 ips_morpheus_poll deadline mixes units: seconds + watchdog ticks (10 s each) — crash-dump poll window 10× too short, dump proceeds on unacknowledged writes
sys/dev/raid/ips/ips.c:601 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4678 Low 3.0 DragonFly devm_request_mem_region shim is conflict-blind: i915_adjust_stolen's stolen-region safety check is dead code (+ static-rman double-init/leak/off-by-one)
sys/dev/drm/i915/i915_gem_stolen.c:83 · pass 2 · new
 none untested not_testable untriaged — —
DF-4712 Low 3.0 ar5211_xmit: signed q<0 bypasses the >=-only checks in ar5211Set/GetTxQueueProps down to &ah_txq[q], and five exported xmit ops gate q only via inert HALASSERT (ar5211 analogue of DF-4519)
sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:84 · pass 2 · new
 none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[10] via negative q through ar5211SetTxQueueProps/ar5211GetTxQueueProps and unchecked AR_Q* MMIO in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index) untested fixed untriaged — —
DF-4717 Low 3.0 XPT_RESET_DEV sends its FIB under a stale Header.Command (assigned only in the XPT_SCSI_IO case; aac_release_command() never clears it)
sys/dev/raid/aac/aac_cam.c:452 · pass 2 · new
 none untested not_testable untriaged — —
DF-4733 Low 3.0 ar5210_xmit: signed q<0 bypasses the >=-only checks in ar5210Set/GetTxQueueProps down to ah_txq[3], and five exported xmit ops gate q only via inert HALASSERT (ar5210 twin of DF-4519/DF-4712)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:40 · pass 2 · new
 none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[3] via negative q through ar5210Set/GetTxQueueProps, plus unvalidated ah_txq[q] struct reads in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index) untested fixed untriaged — —
DF-4798 Low 3.0 ad_get_geometry: signed-int overflow in cylinders*heads*sectors (with u16→u8 truncation of IDENTIFY heads/sectors) corrupts total_secs into an ~16-EiB media-size lie
sys/dev/disk/nata/ata-disk.c:471 · pass 2 · new
 corruption untested not_testable untriaged — —
DF-4807 Low 3.0 ppiwrite() ignores the uiomove() return value: stale ppi_buffer bytes are handed to byte_peripheral_write() and a fully-faulting write never terminates (DF-4535 lpt twin, IEEE1284-peripheral side)
sys/dev/misc/ppi/ppi.c:459 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4824 Low 3.0 acpi_dock: _EJ0 executed even when device_detach() of an _EJD-dependent child fails — hardware ejected out from under still-attached drivers
sys/dev/acpica/acpi_dock/acpi_dock.c:300 · pass 2 · new
 none untested not_testable untriaged — —
DF-4855 Low 3.0 agp_amd64_attach error exits leak the GATT and aperture resource and leave a live /dev/agpgart on an unattached device
sys/dev/agp/agp_amd64.c:183 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4931 Low 3.0 Spread-spectrum depth clk_v computed with wrapping u32 numerators — silent wrong SS programming (sclk twin of DF-4858's terminal effect, arithmetic class)
sys/dev/drm/radeon/rv740_dpm.c:166 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5068 Low 3.0 psm_init_power_state_table() ignores get_pp_table_entry() failures: partially-initialized or all-zero power states enter the state table, become boot/current/request states, and are programmed to the SMC
sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:76 · pass 2 · new
 none untested not_testable untriaged — —
DF-5153 Low 3.0 dpt_pci_attach() bus_setup_intr failure leaves XPT-registered SIMs, CAM wildcard paths, shutdown_post_sync handler and softc (on global dpt_softcs) live against released io/irq — phantom CAM bus issues bus_space I/O through a released rman record and never completes a command
sys/dev/raid/dpt/dpt_pci.c:159 · pass 2 · new
 none untested not_testable untriaged — —
DF-5210 Low 3.0 iounmap() passes a raw physical address to pmap_change_attr(), which requires a kernel virtual address — RAM-backed ioremap cleanup writes PTEs via vtopte() on a user-range address (page-fault panic or silent cache-attr corruption)
sys/dev/drm/linux_iomapping.c:90 · pass 2 · new
 attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure untested not_testable untriaged — —
DF-5030 Info 3.0 ar5312GetMacAddr dereferences unvalidated BSP board-config pointer; 6-byte wild read becomes the unprivileged-readable Wi-Fi MAC on a SoC build with corrupt flash board-data
sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:289 · pass 2 · new
 none untested not_testable untriaged — —
DF-5193 Info 3.0 drm_legacy_sg_free clears dev->sg before validating the handle: a failed match permanently orphans the sg allocation and a re-alloc stacks a second one on top (latent: root-only ioctl, no DRIVER_SG/LEGACY driver in tree)
sys/dev/drm/drm_scatter.c:131 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3965 Low 2.9 Per-I/O dmamap unloaded only on IOP_RESULT_SUCCESS: every BAD_TARGET/BUSY/FAIL/CHECK_CONDITION completion leaks a loaded map — deterministic per absent-target bus probe; bounce-pool exhaustion on bounce-capable configs
sys/dev/raid/hptiop/hptiop.c:2304 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4094 Low 2.9 emu_pci_attach bad: path never unwinds emu_init — leaks ptb_pages/silent_page DMA and mpu401/midi state on every late attach failure
sys/dev/sound/pci/emu10k1.c:2114 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4573 Low 2.9 DragonFly i915 PCI-ID matcher drops subvendor/subdevice criteria: Quanta entry hijacks all 0x016a IvyBridge devices into the headless num_pipes=0 info
sys/dev/drm/i915/i915_pci.c:810 · pass 2 · new
 Display loss (headless num_pipes=0 binding) on all non-Quanta 0x016a IvyBridge GT2-server iGPUs; no memory corruption untested not_testable untriaged — —
DF-4890 Low 2.9 AcpiOsAcquireLock implements one ACPICA lock as two disjoint primitives (idle thread → spinlock, everyone else → lockmgr+crit): no mutual exclusion between the two holder classes across CPUs
sys/dev/acpica/Osd/OsdSynch.c:383 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4997 Low 2.9 sc_invalid written through the rt2560 union alias misses on rt2860-family devices: rt2860_softc dropped sc_tx_timer from the documented common prefix, so the glue writes sc_debug (offset 7404) and rt2860_softc.sc_invalid (7400) is never set — card-eject guards permanently dead
sys/dev/netif/ral/if_ral_pci.c:205 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3664 Info 2.9 bge_nvram_getbyte leaks the NVRAM software-arbitration lock and leaves NVRAM access enabled on its two timeout paths (BCM5906)
sys/dev/netif/bge/if_bge.c:557 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5182 Medium 2.8 wait_event() family evaluates the condition before tsleep_interlock() and autoremove_wake_function() unlinks entries on wakes that were never delivered: in-window wake is lost, stranded sleeper burns its full timeout and wait_event_timeout() returns 0 (timeout) while the condition is true
sys/dev/drm/linux_wait.c:37 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5184 Low 2.8 wake_up_bit() ignores the bit number and wakes exactly ONE waiter on the word: wrong-waiter wakeups and N-1 stranded waiters for N concurrent waiters on one word (no per-(addr,bit) wait identity, fanout of one)
sys/dev/drm/linux_wait.c:97 · pass 2 · new
 stolen wakeups / stranded waiters (bounded by timeouts + accidental 1Hz repoll) untested not_testable untriaged — —
DF-4418 Low 2.7 e1000_phy_init_script_82541 ignores read_reg() failures and writes uninitialized kernel stack into PHY registers 0x2F5B / ANALOG_FUSE_CONTROL
sys/dev/netif/ig_hal/e1000_82541.c:1108 · pass 2 · new
 none untested not_testable untriaged — —
DF-3775 Low 2.6 DHRS-error path bypasses the blockable filter: blocking error recovery (tsleep-based pwaits, 1-2s each) executes in hard-interrupt context
sys/dev/disk/ahci/ahci.c:2843 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4820 Medium 2.5 radeon_ring_restore() leaks the kvmalloc'd ring-backup buffer on radeon_ring_lock() failure in the GPU-reset path (repeatable kernel heap exhaustion)
sys/dev/drm/radeon/radeon_ring.c:350 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3675 Low 2.5 Unsigned resid underflow: ccb->csio.resid = dxfer_len - IOC-supplied TransferCount with no clamp
sys/dev/disk/mpt/mpt_cam.c:3132 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3803 Low 2.5 mprsas_prepare_for_tm leaks one union ccb + cam_path per TM reuse/escalation during error recovery
sys/dev/raid/mpr/mpr_sas.c:3801 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3804 Low 2.5 mprsas_check_eedp error path calls xpt_free_path(NULL) instead of freeing local_path: deterministic NULL-deref panic under memory pressure during EEDP probe
sys/dev/raid/mpr/mpr_sas.c:3689 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3826 Low 2.5 e1000_read_i2c_byte_generic double-releases the SW_FW_SYNC PHY0 semaphore on retry exhaustion
sys/dev/netif/ig_hal/e1000_82575.c:3333 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3827 Low 2.5 Unchecked PHY register read in e1000_set_d0_lplu_state_82575 writes stale data into IGP01E1000_PHY_PORT_CONFIG
sys/dev/netif/ig_hal/e1000_82575.c:833 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3836 Low 2.5 static channel-pointer in bwn_phy_lp_b2063_switch_channel defeats the not-found NULL check after the first call — unsupported channels silently re-program the previous channel's RF values and return success
sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:794 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3901 Low 2.5 Uninitialized stack consumed as SKL DRAM channel info when one MAD_DIMM channel register is blank: ch0/ch1 rank/is_16gb_dimm/symmetric_memory steer watermark config
sys/dev/drm/i915/i915_drv.c:1219 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3916 Low 2.5 _mapping_get_dpm_idx_from_id reads PhysicalIdentifier once from entry 0 and compares every DPM entry against it - DPM lookups only ever match entry 0
sys/dev/raid/mpr/mpr_mapping.c:547 · pass 2 · new
 logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919) untested — untriaged — —
DF-3917 Low 2.5 _mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry) and its overlap test is off by one, clearing a map slot beyond the enclosure
sys/dev/raid/mpr/mpr_mapping.c:1076 · pass 2 · new
 logic/persistence corruption (3916/3917), error-path panic (3918), firmware-fed overread (3919) untested — untriaged — —
DF-3936 Low 2.5 ena_com_set_hash_function() inverts the device-support check — RSS hash function is never programmed on compliant devices
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2238 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4010 Low 2.5 mpr_user_pass_thru leaks the user-sized cm->cm_data buffer and its dmamap mapping across the timeout/reinit path
sys/dev/raid/mpr/mpr_user.c:1050 · pass 2 · new
 none untested not_testable untriaged — —
DF-4065 Low 2.5 Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms — upstream direction is 'never do this on LLC' (GPU hangs/wedges); DFly carries the pre-fix v4.19 state
sys/dev/drm/i915/intel_ringbuffer.c:1096 · pass 2 · new
 Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms (SNB+) - upstream direction 'never do this on LLC' (GPU hangs/wedges, display wedge/GPU DoS). untested not_testable untriaged — —
DF-4087 Low 2.5 _mapping_get_dpm_idx_from_id reads PhysicalIdentifier once from entry 0 and compares every DPM entry against it (mps twin of DF-3916)
sys/dev/raid/mps/mps_mapping.c:512 · pass 2 · new
 mapping-table/persistence corruption (logic class); no direct OOB untested not_testable untriaged — —
DF-4088 Low 2.5 _mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry), off-by-one overlap test, stale num_found (mps twin of DF-3917)
sys/dev/raid/mps/mps_mapping.c:802 · pass 2 · new
 mapping-table/persistence corruption (logic class); no direct OOB untested not_testable untriaged — —
DF-4090 Low 2.5 dpm_pg0_sz truncated to u16 in mps_mapping_initialize: DPM page silently under-read (benign direction proven)
sys/dev/raid/mps/mps_mapping.c:1721 · pass 2 · new
 none (functional: DPM entries silently under-read; overflow direction provably impossible) untested not_testable untriaged — —
DF-4091 Low 2.5 dce110_timing_generator_validate_timing: h_blank/h_back_porch u32 underflow bypasses the minimum checks; no vertical checks -> program_blanking programs wrapped (masked) blanking registers
sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:1109 · pass 2 · new
 none at kernel-memory level (masked MMIO only); worst case inconsistent CRTC timing -> display corruption/possible pipe hang on real ASIC untested not_testable untriaged — —
DF-4182 Low 2.5 Page flip programmed on a CRTC disabled while the flip was pending wedges that CRTC's flip path forever (flip_status never leaves RADEON_FLIP_SUBMITTED) and leaks the vblank reference
sys/dev/drm/radeon/radeon_display.c:449 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4197 Low 2.5 DragonFly's Linux-compat seqlock shim returns the seqcount to its pre-write value — drm_vblank_count_and_time() accepts torn {count,time} vblank snapshots (protocol violation)
sys/dev/drm/drm_vblank.c:784 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4305 Low 2.5 bfe_intr error reinit performs M_WAITOK cluster allocations in interrupt context: BFE_ISTAT_ERRORS -> bfe_init -> bfe_newbuf(init=1) sleeps in the ithread holding the serializer
sys/dev/netif/bfe/if_bfe.c:1186 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4306 Low 2.5 e1000_release_swfw_sync_80003es2lan acquires the SWSM hardware semaphore in an unbounded empty-body loop on every PHY/KMRN/NVM release path: a stuck SMBI bit pins a CPU forever under the driver serializer
sys/dev/netif/ig_hal/e1000_80003es2lan.c:455 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4318 Low 2.5 dce80/dce81/dce83_create_resource_pool leak struct dce110_resource_pool on construct() failure (missing kfree at 3 sites)
sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1052 · pass 2 · new
 none untested not_testable untriaged — —
DF-4360 Low 2.5 cik_sdma_soft_reset(): stale status variable — SDMA1-busy test reads mmSDMA0_F32_CNTL instead of mmSRBM_STATUS2, so a hung SDMA1 is never soft-reset
sys/dev/drm/amd/amdgpu/cik_sdma.c:1089 · pass 2 · new
 none untested not_testable untriaged — —
DF-4377 Low 2.5 probeCard() consumes uninitialized stack eeprom[256] when readEEProm() fails — uninitialized stack bytes reach console/dmesg and drive card identification (CWE-457)
sys/dev/video/bktr/bktr_card.c:605 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4389 Low 2.5 hwmgr->num_vce_state_tables stored unclamped (up to 255) over vce_states[6] — fill loop silently skipped, count left as a loaded gun for any consumer
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1328 · pass 2 · new
 none untested not_testable untriaged — —
DF-4437 Low 2.5 drm_mode_page_flip_ioctl: -EDEADLK retry bypasses the only drm_crtc_vblank_put - one vblank reference leaked per page flip that succeeds after a deadlock retry
sys/dev/drm/drm_plane.c:1053 · pass 2 · new
 none untested not_testable untriaged — —
DF-4455 Low 2.5 Unbounded MMIO spin in PLL atomic-update wait can wedge the DRM master permanently
sys/dev/drm/radeon/radeon_legacy_crtc.c:219 · pass 2 · new
 Permanent DRM-stack DoS: modeset ioctl never returns, holding mode_config.mutex and modeset locks forever untested not_testable untriaged — —
DF-4477 Low 2.5 ata_reinit drops a running request already flagged ATA_R_TIMEOUT after callout_cancel: request/buffer leak and permanently hung issuer
sys/dev/disk/nata/ata-all.c:205 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4490 Low 2.5 acpi_ec: ec_sci_pend publication race between EcGpeHandler and EcGpeQueryHandler permanently disables the EC GPE (lost AcpiFinishGpe)
sys/dev/acpica/acpi_ec.c:693 · pass 2 · new
 Permanent loss of EC-mediated event delivery (lid suspend, brightness/hotkeys, battery/AC/thermal notifies) plus transient EC I/O degradation to polled mode; availability only untested not_testable untriaged — —
DF-4518 Low 2.5 vke_stop() teardown can hang the vkernel forever: the tx cothread's done-fifo full-wait never checks the exit flag, and once the exit flag is set vke_tx_intr() refuses to drain the done fifo, so cothread_delete()'s pthread_join blocks while holding if_serializer
sys/dev/virtual/vkernel/net/if_vke.c:170 · pass 2 · new
 Unprivileged guest user permanently wedges the entire vkernel (ifconfig never returns; serializer held forever); vkernel-internal only, no host-kernel impact untested not_testable untriaged — —
DF-4522 Low 2.5 amdgpu_vm_fini's DragonFly cleanup loop iterates on vm->va.rb_leftmost, which the DFly rb_root_cached shim never maintains: zero iterations, all leftover VM mappings leak
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3325 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4523 Low 2.5 cik_sdma_ib_test leaks the IB (SA-bo) and its fence on fence-wait error/timeout — reachable after every GPU reset while a DMA engine stays wedged
sys/dev/drm/radeon/cik_sdma.c:738 · pass 2 · new
 One IB SA-bo + fence leaked from the fixed-size shared pool per unrecovered reset cycle - progressive pool exhaustion = persistent GPU-accel DoS untested not_testable untriaged — —
DF-4524 Low 2.5 vce_v3_0: VCE bo is sized exactly AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short — instance-1 DATA window extends past the end of vcpu_bo
sys/dev/drm/amd/amdgpu/vce_v3_0.c:427 · pass 2 · new
 Firmware writes to the last 256 bytes of the instance-1 DATA window land past vcpu_bo into the adjacent VRAM object (speculative - fw-defined; arithmetic overrun certain) untested not_testable untriaged — —
DF-4530 Low 2.5 vchan_trigger commits trigger state and parent busy-list membership before chn_notify() and never rolls back on failure, enabling a masked-retry fake-running channel (per-fd wedge)
sys/dev/sound/pcm/vchan.c:144 · pass 2 · new
 Per-fd dsp wedge: fake-running channel blocks writes/poll until close; no memory-safety impact (busy-list membership stays paired) untested not_testable untriaged — —
DF-4572 Low 2.5 exca_activate_resource leaks the ExCA window when parent BUS_ACTIVATE_RESOURCE fails (and exca_mem_map on its memreg error return) — permanent per-socket window-exhaustion DoS
sys/dev/pccard/exca/exca.c:250 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4577 Low 2.5 intel_hdcp_validate_v_prime KSV fill shift missing -sha_leftovers offset: repeater SHA-1 input stream corrupted for >=2 downstream devices, HDCP1.4 repeater authentication always fails (fail-closed)
sys/dev/drm/i915/intel_hdcp.c:221 · pass 2 · new
 none untested not_testable untriaged — —
DF-4581 Low 2.5 radeon_cs_parser_relocs: unchecked radeon_vm_get_bos() NULL return silently drops the VM page directory and page tables from the CS reservation/validation set — submission then updates the PD/PTs without holding their reservations (stale-address GPU writes, unsynchronized eviction); latent on DF as compiled, live upstream and after any DF-4580-style allocator fix
sys/dev/drm/radeon/radeon_cs.c:190 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4632 Low 2.5 radeon MST connector leaks one EDID blob per probe and per destroy (radeon_connector->edid overwritten without kfree)
sys/dev/drm/radeon/radeon_dp_mst.c:193 · pass 2 · new
 none untested not_testable untriaged — —
DF-4695 Low 2.5 sili_pm_softreset: error = EBUSY on unexpected device-signature change is dead-stored by the unconditional error = 0 — signature-change detection never propagates, probe proceeds with stale at_type
sys/dev/disk/sili/sili_pm.c:489 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4700 Low 2.5 snd_hdspe PCM: hdspechan_setspeed() read-modify-writes the shared ctrl_register and writes CONTROL/FREQ registers without sc->lock — cross-channel lost-update race (interrupt storm / stuck-enable / rate scramble)
sys/dev/sound/pci/hdspe-pcm.c:486 · pass 2 · new
 none untested not_testable untriaged — —
DF-4745 Low 2.5 am79900_start_locked lacks the upstream 'break' after detecting a LANCE-owned TMD: the driver dequeues an mbuf and overwrites the chip-owned descriptor and TX buffer on a ring desync
sys/dev/netif/lnc/am79900.c:540 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4775 Low 2.5 am7990_start_locked lacks the 'break' after detecting a LANCE-owned TMD (dead-code twin of DF-4745): on a ring desync the driver dequeues an mbuf and overwrites the chip-owned descriptor and TX buffer
sys/dev/netif/lnc/am7990.c:503 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4778 Low 2.5 aux_engine: read-continuation chunks copied to buffer BASE instead of buffer+offset — corruption of partial-ACK DPCD/EDID read data (twin in dce_aux.c)
sys/dev/drm/amd/display/dc/i2caux/aux_engine.c:204 · pass 2 · new
 none untested not_testable untriaged — —
DF-4870 Low 2.5 r600_dma_ib_test leaks the IB (suballocator chunk + fence ref) on both fence-wait error paths
sys/dev/drm/radeon/r600_dma.c:371 · pass 2 · new
 none untested not_testable untriaged — —
DF-4871 Low 2.5 r600_copy_dma discards radeon_sync_resv()/radeon_sync_rings() failures — copy committed without cross-ring ordering, silent bo data corruption
sys/dev/drm/radeon/r600_dma.c:466 · pass 2 · new
 none untested not_testable untriaged — —
DF-4879 Low 2.5 drm_mode_config_init() ignores drm_mode_create_standard_properties() failure: NULL standard properties are attached to every universal plane and atomic CRTC, turning any later unprivileged MODE_OBJ_GETPROPERTIES/GETCONNECTOR ioctl into a kernel NULL-deref panic (upstream-inherited, ENOMEM-gated)
sys/dev/drm/drm_mode_config.c:217 · pass 2 · new
 none untested not_testable untriaged — —
DF-4904 Low 2.5 Unsigned underflow in Phase-1 voltage ramp writes malformed MSR 0xc0010041 (reserved bits 13-31 garbage, wrong VID)
sys/dev/powermng/powernow/powernow.c:231 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4906 Low 2.5 READ_PENDING_WAIT spins forever on a stuck FID/VID change-pending bit (unkillable kernel-context CPU spin)
sys/dev/powermng/powernow/powernow.c:84 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4920 Low 2.5 Recursive drm_modeset_lock (same ctx, same lock) double-tracks and corrupts ww accounting: ctx->acquired off-by-one leak, ww->ctx/ww->stamp cleared while lock still held, latent lockmgr LK_RELEASE panic
sys/dev/drm/drm_modeset_lock.c:269 · pass 2 · new
 none untested not_testable untriaged — —
DF-4962 Low 2.5 amdgpu_i2c_get_byte() leaves *val uninitialized on failed transfers; router-select helpers then compute with and print the garbage byte
sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:309 · pass 2 · new
 infoleak reproduced not_testable untriaged — —
DF-4983 Low 2.5 cxm_iic_detach()'s CXM_IVAR_IICBUS invalidation is a permanent no-op (write_ivar guard rejects clears) — cxm_softc.iicbus dangles to a destroyed device_t after iic teardown
sys/dev/video/cxm/cxm_i2c.c:229 · pass 2 · new
 none untested not_testable untriaged — —
DF-5035 Low 2.5 Unsynchronized check-then-set of i2c_hw_buffer_in_use lets concurrent acquires on different DDC lines both hold the single shared DCE11 DC_I2C HW engine — acquire-side twin of DF-4878's release-side race (DAL2 mutex dropped)
sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:105 · pass 2 · new
 none untested not_testable untriaged — —
DF-5089 Low 2.5 si_copy_dma discards radeon_sync_resv()/radeon_sync_rings() returns — SI twin of DF-4871: DMA copy committed without cross-ring ordering on sync failure, silent bo data corruption
sys/dev/drm/radeon/si_dma.c:255 · pass 2 · new
 none untested not_testable untriaged — —
DF-5111 Low 2.5 amdgpu_job_dependency busy-loops forever on amdgpu_vmid_grab allocation failure, wedging the ring scheduler kthread (unbounded spin + DRM_ERROR flood, ring-wide GPU DoS)
sys/dev/drm/amd/amdgpu/amdgpu_job.c:193 · pass 2 · new
 sched kthread wedge / ring-wide GPU DoS untested not_testable untriaged — —
DF-5138 Low 2.5 ttm_eu_reserve_buffers() duplicate-BO (-EALREADY/dups) handling is dead code on DragonFly: the DFly ww_mutex never returns -EALREADY, so duplicate BOs from an unprivileged CS list are silently recursively double-locked and ww ticket accounting desyncs
sys/dev/drm/ttm/ttm_execbuf_util.c:113 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5181 Low 2.5 smu9_send_msg_to_smc/_with_parameter return 0 on SMC failure — vacuous caller error guards and stale smu9_get_argument() data flow into Vega10/12 powerplay decisions
sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:113 · pass 2 · new
 none untested not_testable untriaged — —
DF-5201 Low 2.5 linux_task_alloc() leaks the task_struct of every pure kernel thread that evaluates `current` - no drop path exists on the kthread-exit (lwkt_exit) route
sys/dev/drm/linux_sched.c:88 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5209 Low 2.5 pci_iomap() treats pci_resource_start()'s -1 failure sentinel as a valid base and drives __ioremap_common() into BUG_ON panic for any absent/unallocatable BAR
sys/dev/drm/linux_iomapping.c:47 · pass 2 · new
 attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure untested not_testable untriaged — —
DF-5219 Low 2.5 i915_timeline kref leak: intel_engine_create_ring error path frees the ring without dropping its timeline reference
sys/dev/drm/i915/i915_timeline.c:1190 · pass 2 · new
 bounded refcount/heap leak (DF-5219) / latent API trap (DF-5221) untested not_testable untriaged — —
DF-5783 Low 2.5 i915: intel_legacy_cursor_update() fast path mutates the LIVE crtc state's active_planes before a fallible section — failure leaves state desynchronized from hardware (missing upstream c249c5f64336), breaking subsequent plane disable / IPS / watermark decisions
sys/dev/drm/i915/intel_display.c:13686 · pass 2 · new
 none untested not_testable untriaged — —
DF-3725 Info 2.5 Dropped hardware-write statuses across X550 link/flow-control setup: failed MMIO/MDIO writes reported as success
sys/dev/netif/ix/ixgbe_x550.c:1812 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3762 Info 2.5 Unchecked PHY-read returns across the shared e1000 PHY layer: link-stall workaround branches on uninitialized kernel stack; power up/down write back a zeroed PHY_CONTROL after failed reads (DF-3643/DF-3671 family, e1000_phy.c instance)
sys/dev/netif/ig_hal/e1000_phy.c:3848 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3927 Info 2.5 siba_pcicore_intr computes 1 << tmp with MMIO-derived tmp up to 63 (SIBA_TPS_BPFLAG=0x3f) - UB shift silently enables the wrong INTR_MASK bit on pre-rev6 PCI cores
sys/dev/netif/bwn/siba/siba_core.c:2131 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4176 Info 2.5 iir_timeout is an empty handler: SCSI timeouts never abort, retry, or complete — timed-out CCBs hang forever; also references an undeclared identifier under GDT_DEBUG
sys/dev/raid/iir/iir.c:1472 · pass 2 · new
 gdtexecuteccb arms a callout to iir_timeout, but the body is only a GDT_DPRINTF - no abort, no retry, no xpt_done, no gdt_next untested not_testable untriaged — —
DF-4427 Info 2.5 acpi_hp_notify / acpi_hp_evaluate_auto_on_off run without the hp serial lock, racing sysctl handlers on softc state
sys/dev/acpica/acpi_hp/acpi_hp.c:809 · pass 2 · new
 Lost/duplicated WLAN/BT/WWAN on-air notifications; benign int races, no memory-safety consequence untested not_testable untriaged — —
DF-4601 Info 2.5 dce112_compressor_construct() init-order defects: dead 64-bit-bus LPT guard + lpt_channels_num wipe make program_lpt_control's only valid case unreachable (LPT armed with unprogrammed config)
sys/dev/drm/amd/display/dc/dce112/dce112_compressor.c:793 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4663 Info 2.5 dc_link_ddc: unchecked dal_ddc_aux/i2c_payloads_create() NULL in dal_ddc_service_query_ddc_data — OOM-gated (and zero-size-deterministic) NULL deref
sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:578 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-4664 Info 2.5 dc_link_ddc: uninitialized type2_dongle_buf[0x20] hexdumped to the kernel log on dongle-detect i2c failure (drm.debug)
sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:436 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-4728 Info 2.5 aureal: AC97 codec access busy-spins up to ~0.35s per register and ignores timeouts (au_wrcd writes anyway and always returns success)
sys/dev/sound/pci/aureal.c:126 · pass 2 · new
 none untested not_testable untriaged — —
DF-4839 Info 2.5 BUG_ON panic in drm_primary_helper_update() when SetPlane targets an enabled CRTC left with zero encoder-bound connectors
sys/dev/drm/drm_plane_helper.c:264 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5067 Info 2.5 power_state_management() NULL-checks pcurrent then dereferences it anyway — latent kernel NULL-deref (NULL check at :249 routes control INTO the :254 deref; :248 passes the pointer to the smu8 backend unchecked)
sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:246 · pass 2 · new
 none untested not_testable untriaged — —
DF-5113 Info 2.5 Spectral scan start/configure permanently disables radar-detect hardware with no restore path — latent DFS-detection bypass (ar5416DisableRadar clobbers AR_PHY_RADAR_0_ENA/EXT and AR_RX_FILTER; ar5416StopSpectralScan restores none of it)
sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:47 · pass 2 · new
 none untested not_testable untriaged — —
DF-5137 Info 2.5 kv_notify_message_to_smu() fail-open SMC response validation (radeon twin of DF-5132): timeout (0x0000) and all undefined response codes except 0x00FF/0x00FE reported as success to the entire kv_dpm power-management state machine
sys/dev/drm/radeon/kv_smc.c:44 · pass 2 · new
 none untested not_testable untriaged — —
DF-5148 Info 2.5 AUX completion poll off-by-one: a DisplayPort AUX transaction that completes on the 1001st poll is misreported as -EIO (counter-keyed timeout gate)
sys/dev/drm/radeon/radeon_dp_auxch.c:152 · pass 2 · new
 none untested not_testable untriaged — —
DF-5163 Info 2.5 amdgpu atom-i2c consumes the shared ATOM fb scratch after amdgpu_atom_execute_table released ctx->mutex — radeon's scratch_mutex fix was never ported; concurrent hw-DDC/atom-fb users deliver cross-contaminated DDC data
sys/dev/drm/amd/amdgpu/atombios_i2c.c:52 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5205 Info 2.5 trinity_notify_message_to_smu() fail-open SMC response validation: timeout (0x0) and all undefined codes outside exactly 0xFF/0xFE reported as success to the entire trinity_dpm power-management state machine — and unlike the kv twin (DF-5137), the response register is read UNMASKED
sys/dev/drm/radeon/trinity_smc.c:43 · pass 2 · new
 none untested not_testable untriaged — —
DF-5206 Info 2.5 trinity_acquire_mutex() is void and cannot fail: on SMC mutex-grant timeout it silently returns without the mutex, and all six live callers then program SMC registers assuming exclusivity against the SMC firmware
sys/dev/drm/radeon/trinity_smc.c:112 · pass 2 · new
 none untested not_testable untriaged — —
DF-5213 Info 2.5 amdgpu df_v3_6_funcs is an incomplete vtable: .enable_ecc_force_par_wr_rmw left NULL (latent NULL function-pointer dereference for any Vega20 caller)
sys/dev/drm/amd/amdgpu/df_v3_6.c:108 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5216 Info 2.5 interval_tree misuse degrades to unkillable kernel spin or panic instead of a bounded failure — remove() on an empty root NULL-derefs/panics, remove() of a non-member spins forever holding the caller's mutex, iter_next() on a detached sole node loops or returns the removed node
sys/dev/drm/linux_interval_tree.c:56 · pass 2 · new
 latent interior kfree / kernel-CPU amplification / unkillable spin untested not_testable untriaged — —
DF-3971 Low 2.4 rt2560 beacon-ring slot overwrite leaks the old beacon mbuf and its ieee80211_node reference on every re-entry to RUN — remotely pump-able in IBSS mode (ibss merge)
sys/dev/netif/ral/rt2560.c:820 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3985 Low 2.4 sbp_free_target early-returns on luns==NULL without clearing target->fwdev or stopping scan_callout — target slots permanently leaked holding dangling fw_device pointers (8-round hostile device-churn attach DoS), plus freed-fw_device derefs via armed mgm/ccb timeouts
sys/dev/disk/sbp/sbp.c:1993 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4340 Low 2.4 Undefined shift counts throughout the ATOM interpreter: VBIOS-controlled shift operands (up to 32-bit) used unmasked in shl/shr/shift ops, WS OR/AND masks and IIO masks
sys/dev/drm/radeon/atom.c:904 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4348 Low 2.4 Undefined shift counts throughout the amdgpu ATOM interpreter: VBIOS-controlled shift operands (up to full 32-bit) used unmasked in shl/shr/shift ops, WS OR/AND masks and IIO width masks (DF-4340's amdgpu twin)
sys/dev/drm/amd/amdgpu/atom.c:121 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4556 Low 2.4 dce_aux: partial AUX reads reassembled at buffer base instead of running offset — kernel-assembled DPCD/EDID corruption reported as SUCCEEDED
sys/dev/drm/amd/display/dc/dce/dce_aux.c:426 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4589 Low 2.4 radeon_dp_link_train_cr has no overall iteration bound: malicious DP sink oscillating adjust-request voltage wedges the modeset path forever (unkillable task + display-subsystem lock)
sys/dev/drm/radeon/atombios_dp.c:684 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4637 Low 2.4 vpoio: uninterruptible 500K/5M-iteration handshake spins (VP0_FAST_SPINTMO/VP0_LOW_SPINTMO) execute under vpo_intr's hard critical section — a malicious parallel-port ZIP emulator pins a CPU with interrupts masked for seconds per I/O (DF-4618 family, vpoio.c instance)
sys/dev/disk/vpo/vpoio.c:59 · pass 2 · new
 Multi-second uninterruptible CPU pin (preemption disabled, interrupts deferred) per I/O against a malicious/faulty parallel-port ZIP emulator; repeatable per command — local/physical DoS (DF-4618 family, vpio instance) untested not_testable untriaged — —
DF-4652 Low 2.4 amdgpu_atombios_dp_link_train_cr has no overall iteration bound: malicious DP sink oscillating adjust-request voltage wedges the modeset path forever (unkillable task + mode_config.mutex) — line-for-line twin of DF-4589 (radeon)
sys/dev/drm/amd/amdgpu/atombios_dp.c:605 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4866 Low 2.4 siba_bwn_attach leaks the MMIO BAR, bus mastering and scanned child devices when siba_core_attach fails (bad-SPROM CRC or unsupported-PHY child)
sys/dev/netif/bwn/siba/siba_bwn.c:151 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4913 Low 2.4 ath_hal_v14EepromAttach leaks the malloc'd HAL_EEPROM_v14 (~4.8KB, M_ATH_HAL) on all three post-malloc error returns — DF-4873 (ar9287) family twin
sys/dev/netif/ath/ath_hal/ah_eeprom_v14.c:363 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4956 Low 2.4 ath_hal_v4kEepromAttach leaks the malloc'd HAL_EEPROM_v4k (1152 B, M_ATH_HAL) on all three post-malloc error returns — third and final member of the eeprom-attach leak family (DF-4873 ar9287 / DF-4913 v14 / DF-1995 ar5210), verified live
sys/dev/netif/ath/ath_hal/ah_eeprom_v4k.c:311 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3768 Low 2.3 DFly i915 registers the GGTT aperture fictitious range on every attach but never unregisters it: unbounded fake-vm_page leak and permanent 8-slot exhaustion (graphics attach DoS) via kldload/kldunload cycles
sys/dev/drm/i915/i915_gem_gtt.c:2966 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3861 Low 2.3 amdgpu_device_fini never unregisters the fictitious VRAM range — permanent vm_page-array leak and exhaustion of the 8-slot DRM shim (EBUSY driver-load DoS)
sys/dev/drm/amd/amdgpu/amdgpu_device.c:2648 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3900 Low 2.3 i915 MMIO register mapping (pmap_mapdev KVA + global iomap node + shim bus resource) leaked on every driver detach: the only pci_iounmap in the i915 tree is #if 0'd
sys/dev/drm/i915/i915_drv.c:1027 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4135 Low 2.3 config_volume readpol case falls through into setupstate: VF_CONFIG_SETUPSTATE silently set for every volume configured with readpol
sys/dev/raid/vinum/vinumconfig.c:1527 · pass 2 · new
 none untested not_testable untriaged — —
DF-4257 Low 2.3 my_softc my_ldata_ptr (2056-byte DMA descriptor block) is never freed: leaked on every detach and every failed attach
sys/dev/netif/my/if_my.c:870 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4269 Low 2.3 wb_attach() allocates sc->wb_ldata but wb_detach() frees never-assigned sc->wb_ldata_ptr: ~296KB contigmalloc leak per attach/detach cycle
sys/dev/netif/wb/if_wb.c:779 · pass 2 · new
 none untested not_testable untriaged — —
DF-4302 Low 2.3 vkbd devfs clone unit numbers are never released on close — permanent unbounded unit/bitmap leak on the device's normal lifecycle
sys/dev/misc/vkbd/vkbd.c:222 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-4378 Low 2.3 DRM minor teardown leaks the make_dev'd /dev/dri/cardN cdev and the kzalloc'd struct device; stale devfs node keeps si_drv1 dangling at the freed drm_device
sys/dev/drm/drm_drv.c:158 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4397 Low 2.3 vega10_pp_tables_uninitialize leaks 8 subtable allocations (socclk/dcefclk/pixclk/phyclk/dispclk dep tables, pcie_table, valid_socclk_values, valid_dcefclk_values) on every pp_table reload / rebind cycle
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1183 · pass 2 · new
 none untested not_testable untriaged — —
DF-4479 Low 2.3 setstate(object_initialized) reports EBUSY 'Can't set state' for transitions it performed: 1046 compares against sd_initializing (the source state) instead of the requested/actual result
sys/dev/raid/vinum/vinumstate.c:250 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4485 Low 2.3 vo_get_brightness_levels leaks the _BCL ACPI evaluation buffer on every successful call (unbounded under firmware reprobe notifies)
sys/dev/acpica/acpi_video/acpi_video.c:1002 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-4553 Low 2.3 snd_vibes: sv_suspend() aborts the playback channel with the record trigger (copy-paste) — playback DMA engine left enabled across suspend
sys/dev/sound/pci/vibes.c:644 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4579 Low 2.3 radeon: every failed PCI attach leaks one drm_device — DragonFly's drm_get_pci_dev has its entire error unwind #if 0'd out (upstream err_free: drm_dev_unref deleted); radeon_pci_probe is the only live caller
sys/dev/drm/radeon/radeon_drv.c:318 · pass 2 · new
 dos not_reproduced not_testable untriaged — —
DF-4593 Low 2.3 format_config() plex line records zero subdisk names — missing string-advance inside the sd loop (DragonFly-specific regression vs FreeBSD)
sys/dev/raid/vinum/vinumio.c:485 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4597 Low 2.3 daemon_save_config() 'break' aborts the whole drive loop on the first malformed drive — later drives' config replicas never updated
sys/dev/raid/vinum/vinumio.c:601 · pass 2 · new
 none untested not_testable untriaged — —
DF-4655 Low 2.3 twa_bus_scan_cb frees the scan ccb with the wrong malloc type and leaks its timeout_ch callout on every bus scan
sys/dev/raid/twa/tw_osl_cam.c:578 · pass 2 · new
 Kernel heap leak (sizeof(struct callout) per bus scan, unbounded across controller resets) + wrong-type free corrupting malloc accounting untested not_testable untriaged — —
DF-4752 Low 2.3 gpio_unregister leaks the master device's clone unit and the shared struct gpio_driver (unlinked while sibling controllers still reference it)
sys/dev/misc/gpio/gpio.c:587 · pass 2 · new
 leak inconclusive inconclusive untriaged — —
DF-4852 Low 2.3 dm_target_stripe_init chunk-size validation bypassed via signed int overflow: chunk sizes up to INT_MAX blocks accepted (intended cap 256 blocks / 128KB)
sys/dev/disk/dm/striped/dm_target_striped.c:98 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4858 Low 2.3 Wrong-variable store mpll_ss |= CLK_V(clk_v) corrupts memory-clock spread-spectrum programming on RV730 (CLK_V lost from mpll_ss2, CLK_S clobbered) — typo also present in upstream Linux
sys/dev/drm/radeon/rv730_dpm.c:180 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4860 Low 2.3 Uninterruptible multi-second waits and 750ms DELAY busy-spin held under dev_lock in the TIS transmit path (DF-1991's TIS twin plus a new busy-wait): 40s unkillable sleep for user-chosen Create* command codes, ~750ms+ CPU spin per burst on a stalled TPM
sys/dev/crypto/tpm/tpm_tis.c:258 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4922 Low 2.3 dm_target_flakey_init() failure paths leak the dm_pdev reference and permanently pin the underlying device vnode
sys/dev/disk/dm/flakey/dm_target_flakey.c:86 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-4958 Low 2.3 led_parse() leaks the sbuf on every empty parsed spec (and on sbuf_finish error): *sb = NULL without sbuf_delete()
sys/dev/misc/led/led.c:202 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-4989 Low 2.3 TWS_IOCTL_GET_LOCK result dead-stored: time_remaining_msec/grant state computed but never copied back to the caller (advisory ioctl lock unobservable)
sys/dev/raid/tws/tws_user.c:280 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5072 Low 2.3 Silent 64→32-bit mb_lba truncation with a print-only beyond-EOF check in amr_bio_command — unchecked raw-disk I/O past 2TiB wraps to an attacker-chosen in-range LBA (firmware is the only backstop)
sys/dev/raid/amr/amr_disk.c:181 · pass 2 · new
 silent wrap-around write via raw device (root:operator) untested not_testable untriaged — —
DF-3625 Info 2.3 ci_dpm_force_performance_level passes the AMD_DPM_FORCED_LEVEL_HIGH enum value (8) instead of the computed top index to ci_dpm_force_state_pcie
sys/dev/drm/amd/amdgpu/ci_dpm.c:4369 · pass 2 · new
 firmware-side misbehavior untested — untriaged — —
DF-4254 Info 2.3 IR_PHYSICAL_DISK OFFLINE branch uses '|= ~MPR_TARGET_FLAGS_RAID_COMPONENT' — sets every flag bit instead of clearing one (disk stays hidden; HDD not stopped at power-off)
sys/dev/raid/mpr/mpr_sas_lsi.c:598 · pass 2 · new
 none untested not_testable untriaged — —
DF-4261 Info 2.3 acpi_pst_attach() leaks allocated _PCT bus resources (and burns cpu_next_rid) on every error path after acpi_pst_alloc_resource()
sys/dev/acpica/acpi_cpu_pstate.c:500 · pass 2 · new
 none untested not_testable untriaged — —
DF-4309 Info 2.3 adw_free() never destroys the per-ACB buffer DMA maps — attach/detach asymmetry leaks up to 253 bus_dmamaps and destroys their tag while live
sys/dev/disk/advansys/adwcam.c:205 · pass 2 · new
 none untested not_testable untriaged — —
DF-4892 Info 2.3 32-bit arithmetic overflow in SMU7 fan-RPM math: 60 * crystal_clock_freq * 10000 wraps for 25/27 MHz VI reference clocks, skewing reported fan speed (hwmon fan1_input/fan1_target) and the programmed TACH target by a constant ~7.09x (DF-4761 vega10 twin)
sys/dev/drm/amd/powerplay/hwmgr/smu7_thermal.c:100 · pass 2 · new
 none untested not_testable untriaged — —
DF-4966 Info 2.3 dce110 id_to_offset DDC_DATA/I2C_PAD translation carries the shared DDC6 DATA mask 0x100, but DC_GPIO_I2CPAD_A defines only SCL=bit0 (0x1) and SDA=bit1 (0x2) — reserved-bit MMIO write and dead SDA bit on the I2C pad
sys/dev/drm/amd/display/dc/gpio/dce110/hw_translate_dce110.c:190 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4992 Info 2.3 Failed SMB_READB/SMB_READW/SMB_PCALL transfers reported as success: copyout result clobbers the bus error
sys/dev/smbus/smb/smb.c:272 · pass 2 · new
 none untested not_testable untriaged — —
DF-4993 Info 2.3 SMB_BWRITE silently truncates wcount to u_char: 256..1024-byte block writes are short/zero-length yet return success
sys/dev/smbus/smb/smb.c:305 · pass 2 · new
 none untested not_testable untriaged — —
DF-5081 Info 2.3 mpu401_init/mpu401_uninit free the kobj without kobj_delete: parent mpu class reference never dropped, compiled kobj_ops pinned forever (unbounded refs++ on reattach)
sys/dev/sound/midi/mpu401.c:177 · pass 2 · new
 bounded leak + refcount imbalance untested not_testable untriaged — —
DF-4873 Low 2.1 ath_hal_9287EepromAttach error paths leak the malloc'd HAL_EEPROM_9287 (~1KB permanently per failed attach): three post-malloc returns never free or install it, and ar9287Attach's bad: unwind is a no-op for it
sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:239 · pass 2 · new
 none untested not_testable untriaged — —
DF-4970 Low 2.1 xe_pccard_probe flag loop exits at the DINGO bit before testing it: case XE_CARD_TYPE_FLAGS_DINGO is dead code, CEM56/REM56 Dingo cards are never detected as Dingos
sys/dev/netif/xe/if_xe_pccard.c:311 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3671 Info 2.1 Unchecked PHY/EEPROM read return values across ixgbe_common.c: config decisions from uninitialized kernel stack, and a failed PHY read written back clobbering the AN advertisement (DF-3643 parity)
sys/dev/netif/ix/ixgbe_common.c:278 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3992 Low 2.0 Ignored DPCD-read failures feed uninitialized stack into PSR/training-interval/dongle-quirk decisions; read_hpd_rx_irq_data uses a shared 'static' retval across links
sys/dev/drm/amd/display/dc/core/dc_link_dp.c:50 · pass 2 · new
 Ignored DPCD-read failures feed uninitialized stack into PSR/training-interval/dongle-quirk decisions (comparison-only, no disclosure); shared 'static retval' across links in read_hpd_rx_irq_data. Low/hardening — PoC skipped per contract. untested not_testable untriaged — —
DF-4347 Low 2.0 amdgpu VBIOS part-number string walked and printed past the BIOS image: unvalidated idx deref + %s/strlcpy on an unterminated source (DF-4339's amdgpu twin, worse shape — no bounded copy at all)
sys/dev/drm/amd/amdgpu/atom.c:1340 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4049 Info 2.0 dac1/2_output_control_v1 pass 3 uninitialized stack padding bytes as the VBIOS parameter space
sys/dev/drm/amd/display/dc/bios/command_table.c:1669 · pass 2 · new
 none untested not_testable untriaged — —
DF-4209 Info 2.0 Memory leak of ee_modePowerArray5112[].pChannels allocations when legacyEepromReadContents fails after eepromAllocExpnPower5112 succeeded
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:383 · pass 2 · new
 readEepromRawPowerCalInfo5112 allocates pChannels/pDataPerChannel per mode BEFORE eepromExpandPower5112 can fail untested not_testable untriaged — —
DF-3605 Low 1.9 bce_nvram_read returns on first-dword read failure while still holding the NVRAM arbitration lock and access-enable, permanently bricking NVRAM access (driver re-attach fails)
sys/dev/netif/bce/if_bce.c:1726 · pass 2 · new
 NVRAM lock permanently held on error path untested — untriaged — —
DF-3635 Low 1.9 i915_gem_object_get_pages_phys() error path returns holding the GEM backing vm_object (leaked hold_count + LWKT token)
sys/dev/drm/i915/i915_gem.c:305 · pass 2 · new
 none untested not_testable untriaged — —
DF-3640 Low 1.9 bnx_reset acquires the NVRAM software-arbitration lock (SET1/GNT1) and never releases it — flash arbiter held for the driver's lifetime, locking out APE/management firmware
sys/dev/netif/bnx/if_bnx.c:2585 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3795 Low 1.9 acpi_parse_prw() copies _PRW elements 0..N-3 instead of 2..N as wake power resources (off-by-two)
sys/dev/acpica/acpi.c:2963 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3847 Low 1.9 int8_t overflow in bwn G-PHY tssi2dbm table generation: clamp to 128 wraps to -128 (DFly divergence; FreeBSD clamps to 127), corrupting TX-power control
sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:230 · pass 2 · new
 TX-power correctness (bwn) / mbuf leak + ring wedge (dc) untested — untriaged — —
DF-3905 Low 1.9 sk_marv_miibus_writereg(): inverted YU_SMICR_BUSY check aborts the SMI write-completion wait the moment the write starts (vs correct msk_phy_writereg sibling)
sys/dev/netif/sk/if_sk.c:519 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-4126 Low 1.9 Inverted error checks at rv6xx_dpm_init:1957-1969 — ATOM-computed SPLL/MPLL reference divider used only when radeon_atom_get_clock_dividers FAILS; default used on success (rv6xx twin of DF-3976/DF-4119)
sys/dev/drm/radeon/rv6xx_dpm.c:184 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4177 Low 1.9 isp_pci_mbxdma allocations are never torn down: error paths leak the master DMA tag, and a successful attach->detach leaks pcmd_pool, xflist, tgtlist, control queues, per-channel FC scratch, per-cmd maps and all DMA tags
sys/dev/disk/isp/isp_pci.c:1536 · pass 2 · new
 isp_pci_mbxdma creates the master tag and allocates pcmd_pool, xflist/tgtlist, control-space tag+memory, per-channel FC scratch, and per-cmd dma maps untested not_testable untriaged — —
DF-4204 Low 1.9 ahci_cam_attach() error paths leak the cam_sim and leave the bus registered: ahci_cam_detach() no-ops because AP_F_CAM_ATTACHED is not yet set
sys/dev/disk/ahci/ahci_cam.c:137 · pass 2 · new
 ahci_cam_attach error paths leak the cam_sim and leave the bus registered: ahci_cam_detach no-ops because AP_F_CAM_ATTACHED is not yet set. Memory leak + stale registered CAM bus on any port whose device fails IDENTIFY at attach (hostile/misbehaving SATA device). Resource-exhaustion ceiling. untested not_testable untriaged — —
DF-4256 Low 1.9 Unsigned underflow in agp_i915_get_stolen_size: sc->stolen wraps to ~0x3FFFFFFF entries when BIOS stolen size < GTT size, permanently breaking all GTT binds
sys/dev/agp/intel-gtt.c:696 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4281 Low 1.9 drm_addmap_core leaks vmalloc'd SHM maps, WC MTRR registrations and CONSISTENT DMA memory on error paths
sys/dev/drm/drm_bufs.c:338 · pass 2 · new
 Kernel memory / MTRR-slot exhaustion (DoS ceiling) by root on DRM machines. untested not_testable untriaged — —
DF-4353 Low 1.9 dce110_create_resource_pool leaks the kzalloc'd pool on construct() failure (DF-4318 twin) and dc->fbc_compressor is never destroyed anywhere (dce110_compressor_destroy has zero callers)
sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:1373 · pass 2 · new
 none untested not_testable untriaged — —
DF-4376 Low 1.9 dce112_create_resource_pool leaks the kzalloc'd pool shell on construct() failure (DF-4318/4353 twin)
sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1353 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4406 Low 1.9 acpi_tz_attach: NULL-pointer panic when tz unit 0 fails acpi_tz_establish and a second thermal zone attaches (global sysctl tree dereferenced before creation)
sys/dev/acpica/acpi_thermal.c:237 · pass 2 · new
 NULL-pointer panic when thermal zone unit 0 fails acpi_tz_establish (malformed _ALx non-package) and a second zone attaches: the driver-global sysctl tree was never created (unit-0-only) but per-zone SYSCTL_ADD_NODE dereferences SYSCTL_CHILDREN(NULL) = raw (oid_ptr)->oid_arg1 -> NULL-page read panic at attach/boot. Firmware-gated boot-time DoS. untested not_testable untriaged — —
DF-4416 Low 1.9 wa_init_mcr uses 1-based fls() to index the 0-based subslice_mask[] and (via intel_calculate_mcr_s_ss_select) programs invalid MCR slice steering on gen10/11
sys/dev/drm/i915/intel_workarounds.c:787 · pass 2 · new
 none untested not_testable untriaged — —
DF-4465 Low 1.9 uguru_attach ENXIO paths leak the active IOPORT resource and permanently wedge the driver until reboot
sys/dev/powermng/uguru/uguru.c:757 · pass 2 · new
 Monitoring driver permanently dead until reboot after a failed attach (leaked active IOPORT range) untested not_testable untriaged — —
DF-4549 Low 1.9 viapm_wait() off-by-one: while(count--)/if(!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts — silent success with stale register data — and spuriously fails last-poll successes
sys/dev/powermng/viapm/viapm.c:574 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4591 Low 1.9 tws_attach error unwinds leak the MSI allocation and every post-probe resource (~200 KB heap + DMA maps/tags + scan_ccb per failed attach)
sys/dev/raid/tws/tws.c:309 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4609 Low 1.9 Uninitialized stack value used as relocation buffer bound before session validation
sys/dev/drm/radeon/radeon_vce.c:561 · pass 2 · new
 Negligible standalone: a kernel-stack garbage value gates a bounds decision on an IB that is then rejected before any execution; hardening correctness issue untested not_testable untriaged — —
DF-4698 Low 1.9 nvme(4): queue-creation retry (tryagain) re-allocates still-allocated subqueues — lockinit on a live lock and permanent leak of the previous queue's DMA maps + request array
sys/dev/disk/nvme/nvme_admin.c:453 · pass 2 · new
 none untested not_testable untriaged — —
DF-4699 Low 1.9 nvme(4): admin commands have no completion timeout — a stalled controller permanently wedges the admin thread and hangs detach/shutdown in nvwend
sys/dev/disk/nvme/nvme_admin.c:104 · pass 2 · new
 none untested not_testable untriaged — —
DF-4701 Low 1.9 twa(4): tw_cl_shutdown_ctlr tears the Common Layer down (active=FALSE, interrupts/watchdog gone, CL locks destroyed) before the firmware shutdown handshake result is known and returns that error — twa_detach then aborts, leaving a still-attached half-dead device whose I/O entry points have no ctlr->active gate, so subsequent unprivileged disk I/O is submitted to a dead controller until reboot
sys/dev/raid/twa/tw_cl_init.c:569 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4731 Low 1.9 DAL_VALID_IRQ_SRC_NUM off-by-one ('<=') accepts irq_source == DAL_IRQ_SOURCES_NUMBER — one-past-end index into amdgpu_dm_irq.c's handler-list tables
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:176 · pass 2 · new
 none untested not_testable untriaged — —
DF-4737 Low 1.9 amdpm_wait() off-by-one: while(count--)/if (!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts (silent success with stale HSTDATA/FIFO data) and spuriously fails completions on the final poll
sys/dev/powermng/amdpm/amdpm.c:302 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4739 Low 1.9 alpm_wait() off-by-one: while(count--)/if(!count) makes SMB_ETIMEOUT unreachable on genuine SMBus timeouts (silent success with stale SMBHDATA/SMBHBLOCK data) and spuriously fails last-poll completions — DF-4737/DF-4549 family
sys/dev/powermng/alpm/alpm.c:297 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4767 Low 1.9 PSP buffer objects (tmr_bo 3MB VRAM, asd_shared_bo 16KB, firmware.rbuf 4KB) leaked permanently when psp_hw_start fails during psp_load_fw
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:379 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4771 Low 1.9 intel_dp_add_mst_connector error path leaks the allocated intel_connector (drm_connector_cleanup without kfree)
sys/dev/drm/i915/intel_dp_mst.c:473 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4785 Low 1.9 psp_v11_0_init_microcode never loads ASD firmware for Vega20 — generic psp_asd_load memcpy's from NULL and submits a zero-length LOAD_ASD whose PSP rejection is silently swallowed
sys/dev/drm/amd/amdgpu/psp_v11_0.c:95 · pass 2 · new
 none untested not_testable untriaged — —
DF-4815 Low 1.9 mmhub_v1_0_init_cache_regs never programs mmVM_L2_CNTL3: BANK_SELECT/L2_CACHE_BIGK_FRAGMENT_SIZE computed into a stale CNTL2-derived local and silently dropped (the v5.2-era WREG32 line is missing from the DF vendor sync)
sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:171 · pass 2 · new
 none at runtime on this guest (no AMD GPU present); code-level: GPU MMU L2 TLB geometry (BANK_SELECT/L2_CACHE_BIGK_FRAGMENT_SIZE) never programmed — functional misconfiguration on Vega10-class ASICs, VM-fault/hang class on translate_further (Raven2) parts; no attacker control, no demonstrated memory-isolation breach untested not_testable untriaged — —
DF-4859 Low 1.9 Locality 0 never relinquished on any of the 9 error exits in tpmtis_transmit (TIS twin of DF-1990), leaving TPM arbitration claimed and imposing a fixed 750ms uninterruptible sleep on every later request
sys/dev/crypto/tpm/tpm_tis.c:407 · pass 2 · new
 dos untested not_testable untriaged — —
DF-4888 Low 1.9 iir_pci_attach error paths: BAR0 resource never released (release commented out, rid clobbered) and bus_setup_intr failure skips iir_free()/XPT teardown — leaked DMA state + /dev/iirN + live registered CAM SIMs with no interrupt (CCBs hang forever)
sys/dev/raid/iir/iir_pci.c:195 · pass 2 · new
 Permanent BAR/rman resource leak on every failed attach; late attach failure (bus_setup_intr) leaks all DMA state and /dev/iirN and leaves XPT-registered CAM SIMs with no interrupt handler - CAM scan CCBs hang forever (iir_timeout empty), wedging the rescan thread; hardware-gated local DoS/resource exhaustion (CWE-404) untested not_testable untriaged — —
DF-4896 Low 1.9 complete_rqe() volume error path abandons the request: recover_io() re-strategizes the bio but nobody frees the old request — full request leak (rq + rqg chain + malloc'd buffers + locked bufs) per errored volume I/O, unbounded with VF_RETRYERRORS; VOL[].active never decremented on error
sys/dev/raid/vinum/vinuminterrupt.c:223 · pass 2 · new
 kernel memory leak: full struct request + rqg chain + XFR_MALLOCED buffers + XFR_BUFLOCKED buf locks per errored volume I/O; unbounded with VF_RETRYERRORS (daemon retry loop leaks at I/O speed); VOL[].active counter also never decremented on the error path untested not_testable untriaged — —
DF-4941 Low 1.9 if_ic: SIOCSIFMTU frees the working buffers before checking the replacement allocations — on kmalloc failure installs NULL ic_obuf/ic_ifbuf while still updating if_mtu
sys/dev/netif/ic/if_ic.c:211 · pass 2 · new
 none untested not_testable untriaged — —
DF-4953 Low 1.9 aibs_attach ENXIO path leaks every kmalloc'd sc_asens_* sensor array — newbus never calls detach after a failed attach
sys/dev/acpica/aibs/atk0110.c:126 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4954 Low 1.9 mpr_pci_setup_interrupts: bus_setup_intr failure truncates msi_msgs before the failing queue, permanently leaking its allocated IRQ resource and (via ignored EBUSY) the MSI message
sys/dev/raid/mpr/mpr_pci.c:294 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4982 Low 1.9 iir(4) GDT_IOCTL_EVENT double-fetch: raced event_data.size drives memcmp/strcmp length against the 16-byte eu union in static ebuffer[] — OOB kernel read with byte-wise equality-oracle disclosure
sys/dev/raid/iir/iir_ctrl.c:324 · pass 2 · new
 none untested not_testable untriaged — —
DF-5014 Low 1.9 Broken attach-unwind contract: mps_attach leaks sc->facts on early failures, and mps_pci_free destroys the parent DMA tag over live child tags when mps_free early-returns
sys/dev/raid/mps/mps_pci.c:234 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5043 Low 1.9 adv_pci_attach leaves the active IRQ resource allocated when bus_setup_intr() fails after bus_alloc_resource(SYS_RES_IRQ) succeeded
sys/dev/disk/advansys/adv_pci.c:286 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5161 Low 1.9 check_and_purge_safe_mem livelocks forever when the head allocation fails _free_safe_mem's integrity checks — unbounded kernel loop + tbridge_printf spam turns any detected corruption into a hard hang
sys/dev/misc/tbridge/safe_mem.c:171 · pass 2 · new
 kernel livelock + console spam (corruption-detector amplifier) untested not_testable untriaged — —
DF-5171 Low 1.9 vcdstrategy() panics on BUF_CMD_FLUSH/BUF_CMD_FREEBLKS — mounting a HAMMER filesystem on a vcd-backed volume kills the vkernel inside mount(2)
sys/dev/virtual/vkernel/cdrom/vcd.c:154 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5203 Low 1.9 ipmi_smbus_probe is a second unguarded probe in the ipmi_attached singleton family (DF-5076 twin) — cross-bus/dual-smbus double attach yields second ssif kthread, second /dev/ipmiN cdev, and interleaved SSIF state machines on one BMC
sys/dev/misc/ipmi/ipmi_smbus.c:65 · pass 2 · new
 none untested not_testable untriaged — —
DF-5208 Low 1.9 ata-isa registers no device_detach and never unwinds probe-allocated resources: kldunload of the ISA nata attachment permanently fails (ENXIO) and attach-failure leaks both IOPORT ranges with dangling softc pointers
sys/dev/disk/nata/ata-isa.c:102 · pass 2 · new
 permanent unload failure + per-boot resource leak untested not_testable untriaged — —
DF-3724 Info 1.9 ixgbe_led_{on,off}_t_X550em: PHY read return ignored — uninitialized stack word masked and written back to the X557 LED provisioning register
sys/dev/netif/ix/ixgbe_x550.c:4551 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3726 Info 1.9 Unvalidated vf index in exported MDD/anti-spoof ops: register-index OOB MMIO read-modify-write if wired with vf beyond the register window
sys/dev/netif/ix/ixgbe_x550.c:1078 · pass 2 · new
 none inconclusive inconclusive untriaged — —
DF-3792 Info 1.9 drm_atomic_helper: unguarded CRTC helper-callback dereferences — funcs->dpms/funcs->commit fallbacks and crtc->helper_private derefs lack the NULL guards of upstream fe6169288666/26564be56d73
sys/dev/drm/drm_atomic_helper.c:461 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3947 Info 1.9 dce110_apply_ctx_to_hw error return leaves VBIOS scratch critical-state latched
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2028 · pass 2 · new
 none untested not_testable untriaged — —
DF-3979 Info 1.9 dcn10_enable_per_frame_crtc_position_reset dereferences triggered_crtc_reset.event_source without NULL check (dead path; DF-3948 twin)
sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3980 Info 1.9 hwss1_plane_atomic_disconnect: `opp` NULL check placed after its own dereferences (dead guard, latent NULL-deref)
sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4175 Info 1.9 iir_init: bus_dmamap_create failure returns with sc_init_level one step low — iir_free skips kfree(sc_gccbs) and every created gc_dmamap (permanent leak on failed attach)
sys/dev/raid/iir/iir.c:261 · pass 2 · new
 The gccb init loop returns 1 immediately when bus_dmamap_create fails, but sc_init_level is only bumped to 5 after the whole loop untested not_testable untriaged — —
DF-4420 Info 1.9 oce_mq_create leaks the CQ (struct + 4KiB DMA ring) on two of its three error paths
sys/dev/netif/oce/oce_queue.c:675 · pass 2 · new
 none untested not_testable untriaged — —
DF-4434 Info 1.9 sln_attach() error path after bus_setup_intr failure leaks the 64KB contigmalloc RX ring and skips ifmedia cleanup
sys/dev/netif/sln/if_sln.c:221 · pass 2 · new
 64KB contiguous kernel memory + media list leaked per failed attach (bus_setup_intr failure) untested not_testable untriaged — —
DF-4462 Info 1.9 Duplicate sensordev xname "dieN" installs two ksensordevs on one shared hw.sensors.dieN node; the CCD device's first sensor sysctl is silently dropped
sys/dev/powermng/amdtemp/amdtemp.c:706 · pass 2 · new
 Broken sensors(4) presentation on Zen: missing/shadowed temperature readings; no security impact untested not_testable untriaged — —
DF-4487 Info 1.9 acpi_video_vo_init kmalloc without M_ZERO leaves vo_sysctl_tree uninitialized when the global video sysctl node is absent
sys/dev/acpica/acpi_video/acpi_video.c:513 · pass 2 · new
 none untested not_testable untriaged — —
DF-4708 Info 1.9 amr_sglist_map's 'goto retry' leaks the rejected s/g table (and its dmamap) unboundedly and all three PCI-setup bus_dmamap_load results are ignored — load failure yields a 0/garbage bus address handed to the controller
sys/dev/raid/amr/amr_pci.c:592 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4747 Info 1.9 DragonFly's linux/hash.h hash_64() shim returns identically 0 for every bits <= 32, collapsing the chash (amdgpu retry-fault hash) so all keys probe from slot 0
sys/dev/drm/amd/lib/chash.c:397 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4750 Info 1.9 nmdm TIOCCDTR uses inverted mask: keeps DTR set and wipes all other modem bits
sys/dev/misc/nmdm/nmdm.c:565 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4761 Info 1.9 32-bit arithmetic overflow in fan-RPM math: 60 * crystal_clock_freq * 10000 wraps for any realistic xclk, skewing reported fan speed and the programmed TACH target
sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:115 · pass 2 · new
 none untested not_testable untriaged — —
DF-4822 Info 1.9 DCE110v output regamma mode is never engaged: configure_regamma_mode() discards its computed value and writes literal 0, and dce110_opp_set_regamma_mode_v() is an empty stub — user-programmed gamma LUT silently bypassed
sys/dev/drm/amd/display/dc/dce110/dce110_opp_regamma_v.c:111 · pass 2 · new
 none untested not_testable untriaged — —
DF-4833 Info 1.9 iwm_send_cmd: TFD TB0 length field (12 bits of hi_n_len) truncates to zero at the wide-header max-payload boundary (hdrlen+paylen==4096)
sys/dev/netif/iwm/if_iwm_util.c:220 · pass 2 · new
 none untested not_testable untriaged — —
DF-4845 Info 1.9 lnc PCI detach/unwind never frees the ifmedia list — small kernel memory leak per attach/detach cycle
sys/dev/netif/lnc/if_lnc_pci.c:449 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4851 Info 1.9 aac(4) MSI tunable registered under mfi(4)'s name (hw.mfi.msi.enable) and NOMSI attach path permanently mutates the shared boot global
sys/dev/raid/aac/aac_pci.c:61 · pass 2 · new
 none untested not_testable untriaged — —
DF-4856 Info 1.9 agp_amd64_via_init reads AGP3_VIA_ATTBASE as the RMW source for the AGP3_VIA_GARTCTRL write (register confusion, upstream-inherited)
sys/dev/agp/agp_amd64.c:460 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4867 Info 1.9 ata_intel_chipinit treats any non-ENXIO return of ata_ahci_chipinit as AHCI success, leaving ctlr->setmode NULL — latent boot-time NULL function-pointer call (fragile error contract)
sys/dev/disk/nata/chipsets/ata-intel.c:177 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4898 Info 1.9 vpo_cam_rescan leaks struct cam_path on every attach and the entire CCB (incl. its callout) when xpt_create_path fails
sys/dev/disk/vpo/vpo.c:176 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4899 Info 1.9 vpo_attach error paths never unwind the low-level attach (leaked microseq buffer, ppbus left claimed) and the driver has no detach method at all
sys/dev/disk/vpo/vpo.c:139 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4935 Info 1.9 dc_clock_type_to_atom default path leaves *atom_clock_type uninitialized yet returns true — latent uninitialized-stack feed into ATOM setdceclock params (v2)
sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper2_dce112.c:333 · pass 2 · new
 none untested not_testable untriaged — —
DF-4937 Info 1.9 dc_clock_type_to_atom default leaves *atom_clock_type uninitialized while returning true (v1 twin; consumer command_table.c:2432/2440)
sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper_dce112.c:333 · pass 2 · new
 none untested not_testable untriaged — —
DF-4938 Info 1.9 gfx sw_init partial-failure strands KIQ/MQD kernel BOs and mqd_backup allocations — teardown unreachable behind the IP-block status.sw gate
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:282 · pass 2 · new
 leak untested not_testable untriaged — —
DF-4973 Info 1.9 dm_target_dmirror.c is non-compiling, unregistered dead scratch code whose latent memory-safety bugs must never be revived — delete it
sys/dev/disk/dm/dmirror/dm_target_dmirror.c:135 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4980 Info 1.9 amdgpu_atomfirmware_allocate_fb_scratch: VBIOS-controlled unclamped kernel allocation (up to 64MB) whose -ENOMEM return the caller ignores — NULL-scratch write chain on Linux-semantics allocators, dead error branch on DragonFly
sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:99 · pass 2 · new
 none untested not_testable untriaged — —
DF-5023 Info 1.9 Unsupported 5GHz radio revision check fails open: the HAL_ENOTSUPP/goto bad rejection is compiled out unless AH_DEBUG (FreeBSD-inherited)
sys/dev/netif/ath/ath_hal/ar9001/ar9160_attach.c:228 · pass 2 · new
 fail-open hardware validation, no memory-safety impact untested not_testable untriaged — —
DF-5038 Info 1.9 Unsupported 5GHz radio-revision check fails open: the HAL_ENOTSUPP/goto bad rejection is compiled out unless AH_DEBUG — ar9160/DF-5023 family twin, shipped fail-open empirically confirmed
sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:197 · pass 2 · new
 none untested not_testable untriaged — —
DF-5092 Info 1.9 ar5416GpioCfgInput drives the GPIO pin (DRV_ALL) instead of tristating it, contradicting its own contract — BT-coexistence sense pins get actively driven by the MAC
sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:146 · pass 2 · new
 none untested not_testable untriaged — —
DF-5100 Info 1.9 joyread() busy-loops inside crit_enter() against WALL-CLOCK nanotime() — backward clock steps extend an interrupt-masked critical section beyond the configured timeout
sys/dev/misc/joy/joy.c:190 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5117 Info 1.9 dmamap_cb continues after bus_dmamap_load error: uninitialized-stack segments[0].ds_addr is stored into dcons_paddr and published to FireWire peers via the ConfigROM, the stack bytes are printed to console, and dcons_conf is wired for a map whose load failed — while dcons_crom_attach ignores all three bus_dma return values and reports success
sys/dev/misc/dcons/dcons_crom.c:130 · pass 2 · new
 none untested not_testable untriaged — —
DF-5132 Info 1.9 amdgpu_kv_notify_message_to_smu() fail-open response validation: SMC timeout (0x00) and undefined response codes 0x02–0xFD all reported as success to the whole kv_dpm power-management state machine
sys/dev/drm/amd/amdgpu/kv_smc.c:40 · pass 2 · new
 none untested not_testable untriaged — —
DF-5139 Info 1.9 iwm_abort_notification_waits() is dead code: the device stop path never aborts pending notification waits, leaving control threads stalled for their full bounded timeout during firmware stop/restart
sys/dev/netif/iwm/if_iwm_notif_wait.c:155 · pass 2 · new
 stalled control threads / detach-race UAF write untested not_testable untriaged — —
DF-5187 Info 1.9 Default drm_gem_dumb_map_offset returns offsets from the wrong address space: vma-manager address without DRM_GEM_MAPPING_KEY bits, unresolvable by (and unrelated to) the hash-key mmap path — latent (no in-tree caller)
sys/dev/drm/drm_dumb_buffers.c:123 · pass 2 · new
 none untested not_testable untriaged — —
DF-5204 Info 1.9 Terminal-emulator registry sc_term_list is completely unsynchronized and the SCTERM_MODULE MOD_UNLOAD refcount gate is TOCTOU — kldload/kldunload of any third-party scterm module races console ioctls into list corruption or a call into freed module text
sys/dev/misc/syscons/scterm.c:74 · pass 2 · new
 list corruption / freed-text call on third-party module races untested not_testable untriaged — —
DF-5211 Info 1.9 arch_io_reserve_memtype_wc() persists 4 uninitialized stack bytes into the global memrange descriptor array (mr_owner[4..7] leak into MEMRANGE_GET)
sys/dev/drm/linux_iomapping.c:111 · pass 2 · new
 attach-time BUG_ON panic / user-range vtopte panic / 4B stack disclosure untested not_testable untriaged — —
DF-5214 Info 1.9 Dead dal_hw_factory_destroy() kfrees a struct hw_factory that only ever exists embedded in gpio_service — latent interior-pointer kfree (heap corruption) one future caller away
sys/dev/drm/amd/display/dc/gpio/hw_factory.c:101 · pass 2 · new
 latent interior kfree / kernel-CPU amplification / unkillable spin untested not_testable untriaged — —
DF-5231 Info 1.9 Dead FPGA-diagnostics GPIO factory installs an all-NULL function table (create_* and both omitted define_*_registers): activating the unreachable MAXIMUS env would turn every GPIO operation into an immediate NULL function-pointer call
sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_factory_diag.c:45 · pass 2 · new
 latent NULL-call panic / latent invalid-state commit untested not_testable untriaged — —
DF-5232 Info 1.9 dml_init_instance's default branch is ASSERT-only (WARN_ON) and still commits lib->project with no bounding box loaded — latent invalid-state commit that would feed the dml_log2(0)/÷0 family (DF-4198) if a future project value lacks a case
sys/dev/drm/amd/display/dc/dml/display_mode_lib.c:38 · pass 2 · new
 latent NULL-call panic / latent invalid-state commit untested not_testable untriaged — —
DF-5234 Info 1.9 u32-domain shift truncation: PF_LFB_SIZE<<24 wraps before assignment to u64 node_segment_size, silently mis-placing XGMI VRAM/GART apertures
sys/dev/drm/amd/amdgpu/gfxhub_v1_1.c:47 · pass 2 · new
 GPU VM faults / device hang from mis-placed apertures (config DoS) untested not_testable untriaged — —
DF-4442 Info 1.8 Partially uninitialized mxt_message on the poller stack when the (device-controlled) T5 object size < 7 — stale stack bytes flow into the user-visible ELO pressure field
sys/dev/smbus/atmel_mxt/atmel_mxt.c:917 · pass 2 · new
 1-2 stale kernel stack bytes per ELO packet to the (already-root) device reader; physical-attacker/lying-device model untested not_testable untriaged — —
DF-4119 Low 1.6 Inverted error check at cypress_dpm_init:2059-2064 — ATOM engine-PLL reference divider used only on FAILURE (consuming uninitialized stack dividers), default used on success (cypress twin of DF-3976)
sys/dev/drm/radeon/cypress_dpm.c:2059 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4234 Low 1.1 txp(4) attach error path leaks the 256 rb_sd swdesc kmallocs (and ifmedia) when txp_alloc_rings() fails after allocating them
sys/dev/netif/txp/if_txp.c:948 · pass 2 · new
 none untested not_testable untriaged — —
DF-5080 Low 1.1 nsgphy_status() decodes 1000baseT from link-partner advertisement with no master/slave resolution (MSR) or fault (MSF) check, and never reports the master role (IFM_ETH_MASTER)
sys/dev/netif/mii_layer/nsgphy.c:252 · pass 2 · new
 none untested not_testable untriaged — —
DF-3769 Info 1.1 gen8 3-level PPGTT insert walk advances pdpe with a 4-level wrap constant and no runtime bound: latent OOB walk of the 4-entry pdp->page_directory array (GEM_BUG_ON-only guard is a production no-op)
sys/dev/drm/i915/i915_gem_gtt.c:1075 · pass 2 · new
 none untested not_testable untriaged — —
DF-4158 Info 1.1 vga_save_font()/vga_load_font() accept unvalidated glyph index and count — latent OOB-write API one caller away from a real overflow (user-influenced mouse_char already flows in)
sys/dev/video/fb/vga.c:1189 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-4199 Info 1.1 DCC/PTE read-bandwidth overhead factors (1 + 1/256)/(1 + 1/64)/(1 + 1/512) are C integer constant divisions that compile to *1 — the DCN1 DCC/PTE bandwidth overhead accounting is dead code
sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:178 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4446 Info 1.1 DF i2c bit-bang shim is a stub: every radeon bit-banged DDC/EDID transfer is a silent no-op and the whole bit-bang block of radeon_i2c.c is dead code on DragonFly (display detection dead on default config)
sys/dev/drm/radeon/radeon_i2c.c:955 · pass 2 · new
 none untested not_testable untriaged — —
DF-4460 Info 1.1 drm_gem_create_mmap_offset_size commits the offset-hash + unr publication before drm_vma_offset_add() is known to succeed — failure leaves on_map=true, a leaked idx/hash slot, and a retry that reports success with no vma offset
sys/dev/drm/drm_gem.c:566 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4586 Info 1.1 mmgrab() reference on the DF shim mm_struct is a no-op (mm_count is never read) and dev_priv->mm_structs is keyed by the recyclable current->mm pointer: i915_mm_struct.mm dangles after process exit and can silently alias a later process
sys/dev/drm/i915/i915_gem_userptr.c:322 · pass 2 · new
 None in shipped config (all stale-pointer derefs compiled out; unpriv creates fail, root objects inert); becomes a genuine UAF/wrong-mm registration when the notifier path is ever enabled untested not_testable untriaged — —
DF-4645 Info 1.1 ix(4): ixgbe_read_posted_mbx/ixgbe_write_posted_mbx dispatch to ops.read/ops.write with unvalidated size, bypassing the clamp/reject enforced only by the non-posted wrappers - latent OOB-to-MMIO and cross-VF-mailbox-spill footgun (twin of DF-4638 e1000_mbx); no in-tree caller (DF ix has no SR-IOV)
sys/dev/netif/ix/ixgbe_mbx.c:224 · pass 2 · new
 none untested not_testable untriaged — —
DF-5088 Info 1.1 Generic I2C HW-engine chunker boundary defects (max_payload_size==1 degenerate unaddressed 1-byte chunking; zero-length payload rejected FAILED_INCOMPLETE; timeout omits in-batch stretch accounting) — latent only: unit proven dead code in this port
sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96 · pass 2 · new
 none untested not_testable untriaged — —
DF-5112 Info 1.1 amdgpu_job_submit_direct latches *fence before checking the error and leaks ownership on failure — any future caller passing an uninitialized fence gets a wild kref_get (latent error-contract defect)
sys/dev/drm/amd/amdgpu/amdgpu_job.c:164 · pass 2 · new
 latent (no affected caller) untested not_testable untriaged — —
DF-5122 Info 1.1 Legacy drm_mmap: page/byte hash-key mismatch, user-token double-count in phys math, and PFN/byte return-convention inconsistency — three latent memory-safety-relevant defects in a d_mmap handler unreachable on every shipped driver
sys/dev/drm/drm_vm.c:91 · pass 2 · new
 none untested not_testable untriaged — —
DF-5123 Info 1.1 hypercall_md() inline asm violates the GCC extended-asm contract: %r8 lifetime unprotected between two separate asm statements; indirect-call asm missing caller-saved-register and memory clobbers
sys/dev/virtual/hyperv/x86_64/hyperv_machdep.c:80 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5190 Info 1.1 vmalloc()/vzalloc()/vmalloc_user() implemented over plain kmalloc violate the Linux vmalloc contract (page alignment, whole-page ownership) that the legacy DRM _DRM_SHM userspace-mapping path is written against
sys/dev/drm/linux_vmalloc.c:107 · pass 2 · new
 none untested not_testable untriaged — —
DF-5192 Info 1.1 Latent negative LRU bucket index in i915_gem_batch_pool_get walks cache_list[-1] and would write through the live engine pointer
sys/dev/drm/i915/i915_gem_batch_pool.c:95 · pass 2 · new
 none untested not_testable untriaged — —
DF-5233 Info 1.1 Underlay OPP constructed with NULL regs/shift/mask while every entry in its vtable dereferences regs (latent NULL-deref held off only by four cross-file invariants)
sys/dev/drm/amd/display/dc/dce110/dce110_opp_v.c:39 · pass 2 · new
 latent NULL-deref panic (display DoS) untested not_testable untriaged — —
DF-3641 Info 0.8 bnx_sysctl_std_refill iterates bnx_tx_ringcnt while indexing bnx_rx_ret_ring[] (copy-paste): only min(tx,rx) rings updated; validation admits negative cntmax that wraps uint16_t
sys/dev/netif/bnx/if_bnx.c:5684 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3652 Info 0.8 ci_populate_mvdd_value returns -EINVAL unconditionally, so MemoryACPILevel.MinMvdd is always programmed as 0 (inverted success return)
sys/dev/drm/radeon/ci_dpm.c:2355 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3799 Info 0.8 validate_tx_req_id inverts its NULL check — latent NULL-pointer dereference on out-of-range TX req_id (currently dead code)
sys/dev/virtual/amazon/ena/ena.c:1181 · pass 2 · new
 mbuf leak / latent NULL-deref untested — untriaged — —
DF-4011 Info 0.8 COMPAT_FREEBSD32 shim is un-compilable dead code (undefined com/td, 5-arg mpr_ioctl call); native RAID_ACTION ioctl referenced but unimplemented
sys/dev/raid/mpr/mpr_user.c:2425 · pass 2 · new
 none untested not_testable untriaged — —
DF-4017 Info 0.8 COMPAT_FREEBSD32 shim is un-compilable dead code (5-arg mps_ioctl call, undefined td); RAID_ACTION32 dispatches to an unimplemented ioctl (DF-4011 mpr twin)
sys/dev/raid/mps/mps_user.c:2303 · pass 2 · new
 COMPAT_FREEBSD32 shim is un-compilable dead code (5-arg mps_ioctl call, undefined td; RAID_ACTION32 dispatches to an unimplemented ioctl). DF-4011 mpr twin. untested not_testable untriaged — —
DF-4230 Info 0.8 cyapa_poll_thread reads uninitialized regs.stat when the device stops responding — garbage byte drives the bootloader re-init state machine
sys/dev/smbus/cyapa/cyapa.c:1164 · pass 2 · new
 none untested not_testable untriaged — —
DF-4436 Info 0.8 drm_universal_plane_init: format_count>64 error path returns without kfree(format_types) or drm_mode_object_unregister - leaks the format array and the mode-object id
sys/dev/drm/drm_plane.c:193 · pass 2 · new
 none untested not_testable untriaged — —
DF-4489 Info 0.8 apply_below_the_range: BTR min-frame-duration clamp uses wrong constant (dead clamp) and computed min_frame_duration_in_ns is never used
sys/dev/drm/amd/display/modules/freesync/freesync.c:250 · pass 2 · new
 none untested not_testable untriaged — —
DF-4716 Info 0.8 b_cmd=READ guard tests m.flags for XFR_BAD_SUBDISK (never set there) - condition always true, intended bad-subdisk exclusion dead
sys/dev/raid/vinum/vinumraid5.c:536 · pass 2 · new
 none untested not_testable untriaged — —
DF-4779 Info 0.8 corecstat attaches on any Intel CPU outside family 06h — probe()/attach() model whitelist has no else-return, so the driver matches (e.g.) family-0x0F Pentium 4 and runs with an unassigned sc_version
sys/dev/powermng/corecstat/corecstat.c:183 · pass 2 · new
 none reproduced fixed untriaged — —
DF-4826 Info 0.8 amdgpu_acp.c is a dead translation unit: not in any build, unbuildable (missing shim headers), config-gated off — known findings DF-1907/DF-1908/DF-1909/DF-1910 are unreachable at runtime on DragonFly
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:26 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4928 Info 0.8 corepower_probe family-0x06 model whitelist is a skip-guard, not a reject: non-family-06 Intel CPUIDs pass probing (attach then runs a raw rdmsr) — live-reproduced hardening gap
sys/dev/powermng/corepower/corepower.c:165 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-4959 Info 0.8 's' blink-spec filter typo `*s <= 'u'` accepts arbitrary characters as no-op blink ticks
sys/dev/misc/led/led.c:169 · pass 2 · new
 none untested not_testable untriaged — —
DF-4960 Info 0.8 led_set() always returns 0, swallowing ENOMEM/ENOENT from its own logic (DragonFly divergence)
sys/dev/misc/led/led.c:273 · pass 2 · new
 none untested not_testable untriaged — —
DF-4998 Info 0.8 hw.ral.msi_disable tunable is a no-op: pci_alloc_1intr receives ~ral_msi_disable, which is truthy for BOTH tunable values (0 → ~0 == 0xFFFFFFFF, 1 → ~1 == 0xFFFFFFFE)
sys/dev/netif/ral/if_ral_pci.c:254 · pass 2 · new
 none untested not_testable untriaged — —
DF-4999 Info 0.8 generic_reg_wait prototype in dm_services.h transposes (mask, shift) vs the definition in dc_helper.c (shift, mask) — latent API-contract trap in the DC register hub; harmless today only because REG_WAIT's FN() expansion happens to match the definition
sys/dev/drm/amd/display/dc/dc_helper.c:254 · pass 2 · new
 none untested not_testable untriaged — —
DF-5018 Info 0.8 radeon_mn.c is dead code: excluded from the kernel and module builds, gated on CONFIG_MMU_NOTIFIER which is never defined, and not even compilable if re-enabled (missing mmu_notifier compat API)
sys/dev/drm/radeon/radeon_mn.c:90 · pass 2 · new
 none untested not_testable untriaged — —
DF-5031 Info 0.8 it_generic_stemp missing (int8_t) sign conversion for IT87xx temperature registers — sub-zero temps published as +128..+255 C under hw.sensors
sys/dev/powermng/it/it.c:259 · pass 2 · new
 none untested not_testable untriaged — —
DF-5221 Info 0.8 framebuffer_alloc() ignores its size argument and never sets info->par — silent API-contract divergence, latent NULL-deref for any caller passing size > 0
sys/dev/drm/linux_compat.c:58 · pass 2 · new
 bounded refcount/heap leak (DF-5219) / latent API trap (DF-5221) untested not_testable untriaged — —
DF-5222 Info 0.8 drm_legacy_ioremapfree() bypasses linuxkpi iounmap() bookkeeping, permanently orphaning iomap_list entries for any kmod user of the exported wrapper pair
sys/dev/drm/drm_memory.c:76 · pass 2 · new
 none untested not_testable untriaged — —
DF-4612 Low 0.5 init_transmitter_control steers handler selection with uninitialized stack byte crev when the VBIOS master command table lacks dig1transmittercontrol (v2 twin of DF-4047's sub-issue)
sys/dev/drm/amd/display/dc/bios/command_table2.c:178 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3616 Info 0.5 ath_txq_addholdingbuf bounds check is off-by-one and comes after the OOB pointer arithmetic; ath_freebuf has no check at all (hardening, currently unreachable)
sys/dev/netif/ath/ath/if_ath.c:4805 · pass 2 · new
 latent one-past-end hardening untested not_testable untriaged — —
DF-3676 Info 0.5 mpt_abort_target_ccb indexes trt[target_lun] without the MPT_MAX_LUNS guard every sibling target-mode XPT case has
sys/dev/disk/mpt/mpt_cam.c:4631 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4096 Info 0.5 emupchan_init feeds unchecked emu_valloc() NULL into emu_vinit() — latent NULL-pointer write (unreachable today, hardening)
sys/dev/sound/pci/emu10k1.c:824 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4361 Info 0.5 select_tuner() bounds the tuners[] dispatch index on the upper side only — a negative tuner type would install an out-of-bounds TUNER pointer that consumers dereference (hardening)
sys/dev/video/bktr/bktr_tuner.c:710 · pass 2 · new
 none untested not_testable untriaged — —
DF-4380 Info 0.5 Latent divide-by-zero family in calculate_ss: unvalidated ATOMBIOS spread-spectrum percentage_divider and modulation rate (runtime-dead today: ENABLE_SS hardcoded 0)
sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:673 · pass 2 · new
 Latent divide-by-zero family in calculate_ss (percentage_divider / modulation rate / modulation_time); runtime-dead today because ENABLE_SS is hardcoded 0 at both producers. Becomes a crafted-VBIOS #DE panic the moment any change wires it. untested not_testable untriaged — —
DF-4411 Info 0.5 acpi_asus probe/attach mutate the driver-wide static model tables (non-idempotent probe, cross-device state contamination)
sys/dev/acpi/acpi_asus/acpi_asus.c:682 · pass 2 · new
 none untested not_testable untriaged — —
DF-4417 Info 0.5 wal_add() leaks the previous W/A list kmalloc on every growth step; i915_wa_lists are never freed at teardown
sys/dev/drm/i915/intel_workarounds.c:604 · pass 2 · new
 none untested not_testable untriaged — —
DF-4456 Info 0.5 radeon_crtc_do_set_base returns 'false' (0 = success) for unsupported framebuffer formats
sys/dev/drm/radeon/radeon_legacy_crtc.c:417 · pass 2 · new
 Swallowed error masquerading as success: unsupported fb formats leave stale scanout while modeset reports success (DRM-master-only) untested not_testable untriaged — —
DF-4499 Info 0.5 amdgpu_amdkfd_gfx_v9: entire KFD backend is dead code on DragonFly; latent unvalidated vmid/engine_id index arithmetic should be guarded before KFD is ever enabled
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:291 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4547 Info 0.5 lm_setup_sensors copies sensor tables into sc->sensors[WB_MAX_SENSORS] with no bound — w83792d_sensors already fills all 19 slots, zero headroom
sys/dev/powermng/lm/lm78.c:635 · pass 2 · new
 None today; defense-in-depth against a future one-row change turning into a softc overflow at probe untested not_testable untriaged — —
DF-4574 Info 0.5 adw_init_chip restores the saved BIOS image to the wrong LRAM base (addr + ADW_MC_BIOSLEN instead of addr + ADW_MC_BIOSMEM): 16-byte-shifted restore smears BIOS bytes over microcode variables 0x9C/0x9E and leaves 0x40-0x4F clobbered
sys/dev/disk/advansys/adwlib.c:353 · pass 2 · new
 Chip-internal correctness only: WDTR_ABLE/SDTR_ABLE LRAM words hold arbitrary BIOS bytes (negotiation misbehavior on the EEPROM-checksum-failed corner); no host memory impact untested not_testable untriaged — —
DF-4667 Info 0.5 phm_wait_on_indirect_register passes (mask, value) to a (index, value, mask) callee — swapped arguments, currently latent
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:145 · pass 2 · new
 None today (sole caller passes value==mask); future callers could silently skip an SMC firmware-ready handshake and race the microcontroller during clock/voltage programming untested not_testable untriaged — —
DF-4736 Info 0.5 Unguarded indirect call dev_priv->display.hpd_irq_setup() in intel_hpd_irq_handler() — guard asymmetry vs sibling call sites (latent NULL function-pointer call)
sys/dev/drm/i915/intel_hotplug.c:483 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4768 Info 0.5 psp_cmd_submit_buf ignores resp.status when ucode==NULL: TMR/ASD firmware-command failures silently reported as success
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:137 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4788 Info 0.5 Pin-busy bitmap indexed by unbounded caller-supplied en (no number_of_pins bound) and NULL create_generic/sync/gsl creator pointers invoked unchecked
sys/dev/drm/amd/display/dc/gpio/gpio_service.c:197 · pass 2 · new
 none untested not_testable untriaged — —
DF-4790 Info 0.5 Dead debug printers carry latent unvalidated firmware-count walks (mpr_print_evt_sas NumEntries) and mpr_describe_table relies on a sentinel-plus-one convention
sys/dev/raid/mpr/mpr_table.c:72 · pass 2 · new
 none untested not_testable untriaged — —
DF-4861 Info 0.5 aux_engine_funcs.configure left NULL in the dce110 (and all i2caux) AUX engine func tables while dal_i2caux_configure_aux() invokes it unconditionally — latent NULL function-pointer call/panic on any future caller
sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:451 · pass 2 · new
 panic untested not_testable untriaged — —
DF-4934 Info 0.5 dig_encoder_sel_to_atom computes a 7-case DIGx_SEL mapping then discards it with literal 'return 0' (v2; DF-2030 dce110 sibling; upstream-intended dead code)
sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper2_dce112.c:151 · pass 2 · new
 none untested not_testable untriaged — —
DF-4936 Info 0.5 dig_encoder_sel_to_atom dead 7-case mapping discarded by literal 'return 0' (v1 twin of DF-2030; file additionally dead code on genuine hardware)
sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper_dce112.c:151 · pass 2 · new
 none untested not_testable untriaged — —
DF-4947 Info 0.5 id_to_offset GPIO_ID_DDC_DATA hardwires the DDC6DATA bit-8 mask (0x100) for every line including the I2C pad, whose SDA field is bit 1 (0x2) — translate and factory tables disagree; the pin would be driven on the wrong GPIO bit
sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:211 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5045 Info 0.5 sili OS-glue lock lifecycle asymmetry: three of four per-port locks are never uninited, and the port-alloc error unwinds lockuninit() a never-lockinit'ed ap_lock
sys/dev/disk/sili/sili_dragonfly.c:198 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5090 Info 0.5 ruephy(4) is dead code — unreachable carrier of the DF-4930/DF-5001 empty-media attach-panic leaf and the DF-1973/DF-5009 service KASSERT: no NIC driver named "rue" exists anywhere in DragonFly
sys/dev/netif/mii_layer/ruephy.c:96 · pass 2 · new
 none untested not_testable untriaged — —
DF-5099 Info 0.5 joyopen/joyclose exclusive-access protocol is an unsynchronized check-then-set (TOCTOU) — EBUSY exclusivity bypass
sys/dev/misc/joy/joy.c:159 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5107 Info 0.5 SCDC channel-lock status bit macros use '<' comparison instead of '<<' shift: SCDC_CH0_LOCK==0 (channel-0 lock undetectable) and SCDC_CH_LOCK_MASK aliases SCDC_CLOCK_DETECT
sys/dev/drm/drm_scdc_helper.c:53 · pass 2 · new
 latent logic defect (no runtime path) untested not_testable untriaged — —
DF-5152 Info 0.5 if_ath_alq.c is permanently dead, unportable code on DragonFly: ATH_DEBUG_ALQ cannot be defined (commented out of sys/conf/options) and the FreeBSD ALQ API it calls does not exist anywhere in the DF tree
sys/dev/netif/ath/ath/if_ath_alq.c:58 · pass 2 · new
 none as shipped (dead TU); latent strncpy/race on revival untested not_testable untriaged — —
DF-5154 Info 0.5 dpt_pci_attach() leaks parent_dmat on the dpt_init() failure path — dpt_free()'s init_level ladder never destroys the DMA tag the PCI glue created
sys/dev/raid/dpt/dpt_pci.c:143 · pass 2 · new
 none untested not_testable untriaged — —
DF-5164 Info 0.5 amdgpu_atombios_i2c_channel_trans() omits the memset of its stack atom parameter block that its sibling performs — defense-in-depth only, every struct byte is coincidentally initialized today
sys/dev/drm/amd/amdgpu/atombios_i2c.c:169 · pass 2 · new
 none untested not_testable untriaged — —
DF-5172 Info 0.5 vcdstrategy() drains sc->bio_queue with no serialization — latent SMP TAILQ-corruption race, shielded today only by the missing D_MPSAFE flag (mplock)
sys/dev/virtual/vkernel/cdrom/vcd.c:148 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5174 Info 0.5 Operator-precedence bug in ata_jmicron_ident: '& 0x02 >> 1' tests bit 0 of config 0x40 instead of bit 1, misidentifying the AHCI/PATA function in the device description
sys/dev/disk/nata/chipsets/ata-jmicron.c:58 · pass 2 · new
 cosmetic description string untested not_testable untriaged — —
DF-5188 Info 0.5 ttm_agp_backend.c is dead, un-compilable, half-ported code: excluded from every build (CONFIG_AGP undefined, asm/agp.h absent), and if ever revived carries a pages-vs-bytes 8x under-allocation (heap OOB write in the bind loop) plus an agp_memory leak on every AGP rebind
sys/dev/drm/ttm/ttm_agp_backend.c:60 · pass 2 · new
 latent: 8x heap OOB write of page pointers + unbounded kernel agp_memory leak, only if the dead backend is ever compiled in; impact today: none untested not_testable untriaged — —
DF-5196 Info 0.5 warp_update() wrap off-by-one: star coordinate resting at exactly SCRW*SCRH is drawn and erased at vid[64000], one byte past the 64000-byte M_VGA_CG320 framebuffer (`>` must be `>=`)
sys/dev/misc/syscons/warp/warp_saver.c:72 · pass 2 · new
 none untested not_testable untriaged — —
DF-5236 Info 0.5 Dead FPGA-diagnostics hw_translate installs an all-NULL function table: activating the MAXIMUS env would turn every GPIO id/offset translation into an immediate NULL function-pointer call (kernel panic)
sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_translate_diag.c:34 · pass 2 · new
 none untested not_testable untriaged — —
DF-5778 Info 0.5 Unguarded irq_service->funcs->to_dal_irq_source double-deref in dal_irq_service_to_irq_source plus swallowed dal_irq_service_construct failure — latent NULL-deref hardening gap (asymmetric with every sibling entry point)
sys/dev/drm/amd/display/dc/irq/irq_service.c:53 · pass 2 · new
 none untested not_testable untriaged — —
DF-5224 Info 0.4 bios_get_image()'s sole bounds check uses wrap-prone 32-bit offset+size arithmetic — the security boundary for ~60 DC atombios parser dereferences, latent only (all current callers are uint16-bounded)
sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:40 · pass 2 · new
 none untested not_testable untriaged — —
DF-4496 Low 0.3 dce100_create_resource_pool leaks the kzalloc'd dce110_resource_pool shell on construct() failure (DF-4318/4353/4376 family twin)
sys/dev/drm/amd/display/dc/dce100/dce100_resource.c:1060 · pass 2 · new
 none untested not_testable untriaged — —
DF-3986 Info 0.3 cayman_init dropped the CP1/CP2 compute-ring r600_ring_init (upstream and in-tree si.c/cik.c have them) — cayman_cp_resume evaluates order_base_2(0) = 1UL<<64 (C-standard UB) and programs CP_RB1/CP_RB2_CNTL/BASE with zero-size garbage on every Cayman/Aruba boot
sys/dev/drm/radeon/ni.c:2434 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3976 Info 0.2 Inverted error check at btc_dpm_init:2602-2607 — ATOM-computed PLL reference divider used only when radeon_atom_get_clock_dividers FAILS (default used on success)
sys/dev/drm/radeon/btc_dpm.c:2602 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-3943 Medium — resource_build_scaling_params INTERLACE error path leaves shared dc_stream_state.dst.height permanently doubled (compounding signed-int overflow)
sys/dev/drm/amd/display/dc/core/dc_resource.c:1119 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3984 Medium — ORB completion matching is address-only across ORB recycling (OCB_MATCH compares just orb_lo): a replayed management-ORB status completes the recycled *command* ORB — premature bus_dmamap_unload while device DMA is live and spurious CAM_REQ_CMP with device-chosen status
sys/dev/disk/sbp/sbp.c:156 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-4957 Low — ciphy_attach 'no media present' branch skips all media setup → miibus_mediainit calls ifmedia_set on an EMPTY list → panic("ifmedia_set") at attach on zero-capability PHYs
sys/dev/netif/mii_layer/ciphy.c:142 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5084 Info — radeon_agp.c treats ai_aperture_size (BYTES tree-wide) as MB — dead <32MB guard and 2^20x-inflated gtt_size mis-programming GPU DMA-window registers; latent only (IS_ENABLED(CONFIG_AGP)==0, code not compiled on DragonFly)
sys/dev/drm/radeon/radeon_agp.c:152 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5199 Info — virtual_str_enc_funcs omits 7 ops (NULL) — latent NULL function-pointer call if virtual encoders are ever instantiated and cross-assigned to a real DP stream by the allocator fallback
sys/dev/drm/amd/display/dc/virtual/virtual_stream_encoder.c:77 · pass 2 · new
 latent NULL function-pointer call (DoS) untested not_testable untriaged — —
DF-5207 Info — virtual_lnk_enc_funcs omits 6 of 18 link_encoder_funcs ops (NULL) with 4 unguarded call sites in DC core — latent NULL function-pointer call if virtual link encoders are ever instantiated
sys/dev/drm/amd/display/dc/virtual/virtual_link_encoder.c:86 · pass 2 · new
 latent NULL function-pointer call (DoS) untested not_testable untriaged — —
DF-1173 High 7.8 Multiple metadata parsers: OOB write on ar_softc.disks[] via unvalidated disk_number
sys/dev/disk/nata/ata-raid.c:1806
 corruption reproduced not_testable untriaged — —
DF-1122 High 7.6 iwn_rx_compressed_ba: unbounded firmware-supplied qid indexes sc->txq[] and sc->qid2tap[] (OOB array access / NULL deref)
sys/dev/netif/iwn/if_iwn.c:3251
 none not_reproduced not_testable untriaged — —
DF-2427 High 7.6 Out-of-bounds array access in amd_Reselect when reselecting-ID byte decodes to no valid target
sys/dev/disk/amd/amd.c:1829
 panic reproduced not_testable untriaged — —
DF-1161 Medium 7.5 Unbounded els_cmd_ptrs[] index from IOC-supplied TransactionContext in FC ELS reply handler
sys/dev/disk/mpt/mpt_cam.c:2951
 panic reproduced not_testable untriaged — —
DF-1162 Medium 7.5 tgt_cmd_ptrs[rx_id] bounds check uses wrong limit in FC ABTS path
sys/dev/disk/mpt/mpt_cam.c:3004
 panic reproduced not_testable untriaged — —
DF-2175 High 7.1 hrtimer_start_range_ns corrupts per-CPU systimer queue by calling systimer_init_oneshot without prior systimer_del on an armed timer
sys/dev/drm/linux_hrtimer.c:115
 none not_reproduced not_testable untriaged — —
DF-1545 Medium 7.1 amdgpu atom WS operand index unbounded + NULL deref when ws=0
sys/dev/drm/amd/amdgpu/atom.c:222
 none inconclusive — untriaged — —
DF-1755 Medium 7.1 radeon_vce: integer overflow in create-message size calculation bypasses reloc buffer checks
sys/dev/drm/radeon/radeon_vce.c:602
 none inconclusive — untriaged — —
DF-2062 High 7.0 dm_table_busy exports only SHARED lock primitive; dm_table_load_ioctl races on inactive TAILQ -> kernel list corruption / wild-pointer write
sys/dev/disk/dm/dm_table.c:38
 panic reproduced not_testable untriaged — —
DF-1546 Medium 7.0 Unclamped csio->sense_len handed to firmware allows DMA overflow of the per-queue sense slot
sys/dev/disk/advansys/advansys.c:559
 none inconclusive — untriaged — —
DF-1979 Medium 7.0 queue_work broken lock protocol on multi-CPU bound workqueues enables cross-CPU STAILQ corruption and arbitrary code execution
sys/dev/drm/linux_workqueue.c:119
 none inconclusive — untriaged — —
DF-2532 High 6.8 xa_start panics in xa_done KKASSERT when a B_FAILONDIS bio fails with no live span
sys/dev/disk/xdisk/xdisk.c:976
 panic reproduced fixed untriaged — —
DF-1590 Medium 6.8 Firmware-supplied req_id used as heap index without bounds check in tws_intr_resp and tws_err_complete
sys/dev/raid/tws/tws_cam.c:1163
 none inconclusive — untriaged — —
DF-2518 Medium 6.8 OOB array access in sili_port_read_ncq_error via unchecked device-supplied NCQ tag
sys/dev/disk/sili/sili.c:2138
 none not_reproduced not_testable untriaged — —
DF-1242 Medium 6.6 mrsas_complete_cmd uses firmware-controlled SMID to index mpt_cmd_list with no bounds check
sys/dev/raid/mrsas/mrsas.c:1269
 none not_reproduced not_testable untriaged — —
DF-1655 Medium 6.6 radeon_uvd: integer overflow in radeon_uvd_cs_msg_decode bypasses buffer-size validation
sys/dev/drm/radeon/radeon_uvd.c:367
 panic reproduced fixed untriaged — —
DF-1315 High 6.5 Guest debug registers (DR7/DR0-3) persist in host after #VMEXIT enabling host kernel panic via injected HW breakpoint
sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1492
 none inconclusive not_testable untriaged — —
DF-2475 High 6.5 Wrong bitmask includes task-attribute bits in IU length causing ATIO queue consumer to skip 128-960 entries on any non-SIMPLE FCP_CMND (remote DoS)
sys/dev/disk/isp/isp_target.c:174
 none not_reproduced not_testable untriaged — —
DF-1126 Medium 6.5 Infinite loop in response queue processing when target mode consumes multiple entries
sys/dev/disk/isp/isp.c:5112
 dos reproduced not_testable untriaged — —
DF-1515 Medium 6.5 Kernel divide-by-zero via zero dst_height/dst_width in overlay PUT_IMAGE ioctl
sys/dev/drm/i915/intel_overlay.c:916
 none inconclusive — untriaged — —
DF-1312 Low 6.4 Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks
sys/dev/raid/hptiop/hptiop.c:336
 none reproduced not_testable untriaged — —
DF-2421 Medium 6.3 INQUIRY/READ_CAPACITY/page_inquiry dereference user-controlled data_ptr without CAM_DIR validation
sys/dev/disk/ahci/ahci_cam.c:1083
 panic reproduced fixed untriaged — —
DF-1262 Info 6.3 dsp_mmap (legacy d_mmap) performs unbounded vtophys() on user offset (dead code, latent critical)
sys/dev/sound/pcm/dsp.c:2287
 none reproduced not_testable untriaged — —
DF-1238 Medium 6.2 trm_Reselect walks circular DCB ring with no termination -> infinite loop / hard system hang
sys/dev/disk/trm/trm.c:2426
 none not_reproduced not_testable untriaged — —
DF-1377 Medium 6.2 btccbptov() performs no bounds validation on HBA-supplied ccb_addr yielding OOB kernel read/write
sys/dev/disk/buslogic/bt.c:104
 none inconclusive — untriaged — —
DF-1438 Medium 6.2 Divide-by-zero in sumo_calculate_bsp via BIOS-controlled high_clk=0
sys/dev/drm/radeon/sumo_dpm.c:323
 none inconclusive — untriaged — —
DF-1624 Medium 6.2 MSI-X fallback path passes rid=0 to pci_release_msix_vector, causing guaranteed kernel panic
sys/dev/virtual/virtio/pci/virtio_pci.c:494
 panic reproduced fixed untriaged — —
DF-2411 Medium 6.2 Divide-by-zero DoS in XPT_CALC_GEOMETRY via target-controlled block_size
sys/dev/disk/advansys/advansys.c:441
 none not_reproduced not_testable untriaged — —
DF-1456 Medium 6.1 Signed integer overflow in drm_mode_set_crtcinfo via unchecked vscan on user-supplied modes
sys/dev/drm/drm_modes.c:1102
 none inconclusive — untriaged — —
DF-1920 Medium 6.1 Cleanup loop reads uninitialized stack arrays when copyin fails partway through SGL loop
sys/dev/raid/mrsas/mrsas_ioctl.c:153
 none inconclusive — untriaged — —
DF-2181 Medium 6.1 wait_on_bit_timeout() timeout is permanently expired: absolute ticks compared against a relative jiffies count
sys/dev/drm/linux_wait.c:108
 dos reproduced fixed untriaged — —
DF-2161 Low 6.1 enable_irq ignores bus_setup_intr return value; disable_irq does not invalidate cookiep, inviting stale-cookie double-teardown
sys/dev/drm/linux_irq.c:159
 dos reproduced fixed untriaged — —
DF-1251 High 6.0 Unbounded BIOS table-walking loops read past rdev->bios and drive WREG32 with OOB garbage
sys/dev/drm/radeon/radeon_combios.c:291
 none not_reproduced not_testable untriaged — —
DF-1603 High 6.0 Divide-by-zero panic via attacker-controlled blk_size=0 in virtio-blk config space
sys/dev/virtual/virtio/block/virtio_blk.c:703
 panic reproduced not_testable untriaged — —
DF-1604 Medium 6.0 Divide-by-zero panic via attacker-controlled geometry (heads=0 or sectors=0) when cylinders==16383
sys/dev/virtual/virtio/block/virtio_blk.c:711
 panic reproduced fixed untriaged — —
DF-1212 Medium 5.8 OOB array access in FBSS saved-commands reissue loop (hardcoded 32 vs sc_ncmds)
sys/dev/disk/ahci/ahci.c:3972
 none inconclusive not_testable untriaged — —
DF-1159 Low 5.8 Unvalidated NIC descriptor index in RX mismatch recovery causes OOB kernel heap access
sys/dev/netif/bge/if_bge.c:3061
 panic reproduced fixed untriaged — —
DF-1756 Low 5.7 radeon_vce: unsigned underflow in firmware header scan when datasize < strlen(prefix)+9
sys/dev/drm/radeon/radeon_vce.c:60
 panic reproduced fixed untriaged — —
DF-1734 Medium 5.6 vinumio: remove_drive indexes drive[] with no bounds check; caller off-by-one > instead of >=
sys/dev/raid/vinum/vinumio.c:237
 none inconclusive — untriaged — —
DF-1739 Medium 5.6 vinumioctl: validdrive/validsd/validplex/validvol/resetstats accept negative indices -> OOB heap read/write via DRIVE[idx]/SD[idx]/PLEX[idx]/VOL[idx]
sys/dev/raid/vinum/vinumioctl.c:381
 none inconclusive — untriaged — —
DF-1639 High 5.5 NULL-deref kernel panic in dm_table_load_ioctl via missing/non-array cmd_data
sys/dev/disk/dm/dm_ioctl.c:707
 panic reproduced fixed untriaged — —
DF-1976 High 5.5 flush_workqueue hangs forever in uninterruptible tsleep (permanent kernel thread DoS)
sys/dev/drm/linux_workqueue.c:309
 none inconclusive — untriaged — —
DF-2163 High 5.5 tsleep while holding queue_lock deadlocks interrupt handler permanently hanging IPS controller
sys/dev/raid/ips/ips_ioctl.c:125
 none not_reproduced not_testable untriaged — —
DF-2164 High 5.5 get_user_pages() KKASSERT inverts td_proc polarity, panicking on every user-context call
sys/dev/drm/linux_shmem.c:137
 none not_reproduced not_testable untriaged — —
DF-2187 High 5.5 vunmap() unconditional SLIST_REMOVE/kfree on addr-not-found dereferences NULL and panics
sys/dev/drm/linux_vmalloc.c:77
 panic reproduced fixed untriaged — —
DF-2222 High 5.5 wait_for_completion_interruptible spins forever on signal (no break on ERESTART/EINTR) unkillable CPU-bound local DoS
sys/dev/drm/linux_completion.c:38
 none not_reproduced not_testable untriaged — —
DF-1143 Medium 5.5 Divide-by-zero in ci_thermal_setup_fan_table from VBIOS-controlled fan temperature deltas
sys/dev/drm/amd/amdgpu/ci_dpm.c:1094
 none not_reproduced not_testable untriaged — —
DF-1152 Medium 5.5 BUG_ON kernel panic in atomic_check via MST connector without dc_sink
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:5290
 none not_reproduced not_testable untriaged — —
DF-1174 Medium 5.5 Systemic divide-by-zero via zero width or interleave from crafted metadata
sys/dev/disk/nata/ata-raid.c:157
 panic reproduced not_testable untriaged — —
DF-1193 Medium 5.5 CISS_BIG_MAP_BUS divide-by-zero: drives_per_scsi_bus==0 from controller ID_CTLR panics the kernel
sys/dev/raid/ciss/ciss.c:4026
 none not_reproduced not_testable untriaged — —
DF-1245 Medium 5.5 Divide-by-zero DoS in evergreen_cs_track_validate_cb via user-controlled CB_COLOR_PITCH
sys/dev/drm/radeon/evergreen_cs.c:1396
 none inconclusive not_testable untriaged — —
DF-1260 Medium 5.5 AIOGCAP ioctl dereferences d->mixer_dev without NULL check, causing kernel panic
sys/dev/sound/pcm/dsp.c:1285
 none inconclusive not_testable untriaged — —
DF-1274 Medium 5.5 Divide-by-zero in SCLK/MCLK spread-spectrum math from VBIOS-controlled zero rates
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:591
 none inconclusive not_testable untriaged — —
DF-1323 Medium 5.5 Divide-by-zero panic in iceland_thermal_setup_fan_table from unchecked VBIOS fan temperatures
sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2122
 dos reproduced fixed untriaged — —
DF-1325 Medium 5.5 Divide-by-zero in fiji_thermal_setup_fan_table from unvalidated VBIOS fan temperature deltas
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:2171
 dos reproduced fixed untriaged — —
DF-1334 Medium 5.5 Kernel divide-by-zero panics from VBIOS-supplied zero clock/spread-spectrum/voltage divisors
sys/dev/drm/radeon/rv770_dpm.c:548
 dos reproduced fixed untriaged — —
DF-1341 Medium 5.5 Unsigned underflow of nlevels in r600_texture_size causes local DoS (multi-minute kernel spin)
sys/dev/drm/radeon/r600_cs.c:1418
 dos reproduced fixed untriaged — —
DF-1393 Medium 5.5 Off-by-one in seq_fetch_mid yields NULL kobj dereference (local kernel panic via 0666 device)
sys/dev/sound/midi/sequencer.c:724
 none inconclusive — untriaged — —
DF-1431 Medium 5.5 Divide-by-zero in radeon_compute_pll_avivo via sub-10 kHz mode clock
sys/dev/drm/radeon/radeon_display.c:959
 none inconclusive — untriaged — —
DF-1433 Medium 5.5 NULL pointer dereference in radeon_wb_init on GPU resume/reset (kernel panic)
sys/dev/drm/radeon/radeon_device.c:454
 none inconclusive — untriaged — —
DF-1453 Medium 5.5 NULL pointer dereference in radeon_legacy_tv_dac_mode_set via unguarded enc_priv
sys/dev/drm/radeon/radeon_legacy_encoders.c:1159
 none inconclusive — untriaged — —
DF-1471 Medium 5.5 NULL deref DoS in init_overdrive_limits and cac_dtp_table allocation path
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1062
 none inconclusive — untriaged — —
DF-1495 Medium 5.5 qlock leak in midi_read/midi_write/midisynth_writeraw blocks device permanently (local DoS)
sys/dev/sound/midi/midi.c:762
 none inconclusive — untriaged — —
DF-1509 Medium 5.5 Unbounded multicast CAM index in bfe_set_rx_mode enables local NIC hang DoS
sys/dev/netif/bfe/if_bfe.c:844
 none inconclusive — untriaged — —
DF-1555 Medium 5.5 Memory leak of drm_pending_vblank_event on out-fence error path in complete_signaling()
sys/dev/drm/drm_atomic_uapi.c:1083
 none inconclusive — untriaged — —
DF-1575 Medium 5.5 NULL pointer dereference in get_pcie_table/get_gpio_table when vdd_dep_on_sclk is NULL
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:522
 none inconclusive — untriaged — —
DF-1587 Medium 5.5 NULL pointer dereference in get_pcie_table when usGfxclkDependencyTableOffset is zero
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:765
 none inconclusive — untriaged — —
DF-1593 Medium 5.5 rv515_debugfs_ga_info issues destructive GPU reset on every read of world-readable debugfs file
sys/dev/drm/radeon/rv515.c:259
 none inconclusive — untriaged — —
DF-1595 Medium 5.5 Divide-by-zero in UVD decode message parser crashes the kernel
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524
 none inconclusive — untriaged — —
DF-1599 Medium 5.5 32-bit truncation of last_pfn bypasses VM offset bounds check and panics the kernel via BUG_ON
sys/dev/drm/radeon/radeon_vm.c:446
 panic reproduced fixed untriaged — —
DF-1611 Medium 5.5 Divide-by-zero in hubp1_cursor_set_position when pixel_clk_khz == 0
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:1117
 panic reproduced fixed untriaged — —
DF-1612 Medium 5.5 Divide-by-zero in hubp1_vready_workaround when pipe_dest->htotal == 0
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:123
 panic reproduced fixed untriaged — —
DF-1615 Medium 5.5 Unmatched crit_exit() in twe_suspend corrupts critical-section accounting and panics INVARIANTS kernels
sys/dev/raid/twe/twe_freebsd.c:494
 panic reproduced fixed untriaged — —
DF-1616 Medium 5.5 Divide-by-zero panic in ath_beacon_proc when ic->ic_lintval is 0
sys/dev/netif/ath/ath/if_ath_beacon.c:481
 panic reproduced fixed untriaged — —
DF-1635 Medium 5.5 NULL pointer dereference via strsep-parsed cipher spec components
sys/dev/disk/dm/crypt/dm_target_crypt.c:470
 panic reproduced fixed untriaged — —
DF-1648 Medium 5.5 Divide-by-zero panic from crafted EDID with min_vfreq == 0 in mod_freesync_build_vrr_params
sys/dev/drm/amd/display/modules/freesync/freesync.c:93
 panic reproduced fixed untriaged — —
DF-1658 Medium 5.5 nvmm: mach->commvmobj creation reference never dropped -> kernel memory leak / local DoS
sys/dev/virtual/nvmm/nvmm.c:197
 panic reproduced fixed untriaged — —
DF-1666 Medium 5.5 drm_syncobj: unprivileged fd+struct file leak via broken LinuxKPI fd shim -> system-wide ENFILE DoS
sys/dev/drm/drm_syncobj.c:407
 panic reproduced fixed untriaged — —
DF-1708 Medium 5.5 radeon_clocks: divide-by-zero in calc_eng_mem_clock via zeroed reference_freq from crafted VBIOS
sys/dev/drm/radeon/radeon_clocks.c:371
 none inconclusive — untriaged — —
DF-1717 Medium 5.5 amdgpu_display: GEM object reference leak on imported dma-buf framebuffer creation path (local memory-exhaustion DoS)
sys/dev/drm/amd/amdgpu/amdgpu_display.c:531
 none inconclusive — untriaged — —
DF-1724 Medium 5.5 radeon_cs: unchecked IB chunk length_dw in non-VM path triggers BUG_ON kernel panic
sys/dev/drm/radeon/radeon_cs.c:608
 none inconclusive — untriaged — —
DF-1726 Medium 5.5 radeon_cs: NULL parser->ib.fence dereference in radeon_cs_parser_fini when CS has relocs but no IB chunk
sys/dev/drm/radeon/radeon_cs.c:414
 none inconclusive — untriaged — —
DF-1775 Medium 5.5 mpt_user: kernel panic via len==0 kmalloc(0) returns ZERO_LENGTH_PTR -> page fault in copyin/hdr deref
sys/dev/disk/mpt/mpt_user.c:186
 none inconclusive — untriaged — —
DF-1855 Medium 5.5 Unbounded busy-wait in psp_cmd_submit_buf hangs kernel thread on PSP submission failure or non-response
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:130
 none inconclusive — untriaged — —
DF-1907 Medium 5.5 acp_poweron dereferences powerplay.pp_funcs without NULL guard: kernel panic
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:145
 none inconclusive — untriaged — —
DF-1921 Medium 5.5 Early-return error paths leak mfi cmds and DMA resources: cmd-pool exhaustion DoS
sys/dev/raid/mrsas/mrsas_ioctl.c:193
 none inconclusive — untriaged — —
DF-1932 Medium 5.5 kfree(NULL) kernel panic on any PCI attach failure path
sys/dev/raid/aac/aac_pci.c:358
 none inconclusive — untriaged — —
DF-1957 Medium 5.5 Divide-by-zero in clip_scaled when destination rectangle has zero width or height
sys/dev/drm/drm_rect.c:53
 none inconclusive — untriaged — —
DF-1987 Medium 5.5 BUG_ON panic on oversize SA allocation request converts user-triggerable error into kernel panic (Local DoS)
sys/dev/drm/radeon/radeon_sa.c:321
 none inconclusive not_testable untriaged — —
DF-2003 Medium 5.5 Unbounded busy-wait polling in SMIC allows permanent kernel thread hang / CPU DoS
sys/dev/misc/ipmi/ipmi_smic.c:53
 none inconclusive not_testable untriaged — —
DF-2069 Medium 5.5 Divide-by-zero kernel panic via crafted IDENTIFY in CHS path of tf_write
sys/dev/disk/nata/chipsets/ata-serverworks.c:216
 panic reproduced fixed untriaged — —
DF-2124 Medium 5.5 Unconditional NULL-pointer dereference in drm_mmap d_mmap handler panics before the auth check
sys/dev/drm/drm_vm.c:47
 panic reproduced fixed untriaged — —
DF-2127 Medium 5.5 Inverted skip condition + dead curoff in sg_pcopy_from_buffer / sg_pcopy_to_buffer break data extraction (GuC firmware loading DoS)
sys/dev/drm/linux_scatterlist.c:167
 corruption reproduced fixed untriaged — —
DF-2186 Medium 5.5 sn_pccard_detach re-enters the ifnet serializer instead of exiting it -- guaranteed panic on every device detach
sys/dev/netif/sn/if_sn_pccard.c:115
 panic reproduced fixed untriaged — —
DF-2386 Medium 5.5 Unchecked AcpiEvaluateObject return causes NULL-pointer-dereference panic reachable from unprivileged user via CTLFLAG_ANYBODY sysctl
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:276
 panic reproduced not_testable untriaged — —
DF-2420 Medium 5.5 NULL pointer dereference of xa when ahci_ata_get_xfer() returns NULL
sys/dev/disk/ahci/ahci_cam.c:1082
 panic reproduced fixed untriaged — —
DF-2426 Medium 5.5 Divide-by-zero panic via XPT_CALC_GEOMETRY with block_size == 0
sys/dev/disk/amd/amd.c:683
 panic reproduced not_testable untriaged — —
DF-2429 Medium 5.5 Divide-by-zero in XPT_CALC_GEOMETRY from unvalidated block_size (local DoS / panic)
sys/dev/disk/buslogic/bt.c:1157
 panic reproduced not_testable untriaged — —
DF-2432 Medium 5.5 Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0
sys/dev/disk/ccd/ccd.c:1319
 panic reproduced fixed untriaged — —
DF-2442 Medium 5.5 KKASSERT kernel panic in dm_dev_insert on concurrent dm_dev_create name collision
sys/dev/disk/dm/dm_dev.c:187
 panic reproduced fixed untriaged — —
DF-2448 Medium 5.5 dm_table_load_ioctl: NULL-pointer-dereference panic via missing cmd_data array
sys/dev/disk/dm/dm_ioctl.c:707
 panic reproduced fixed untriaged — —
DF-2450 Medium 5.5 NULL-deref kernel panic when dm backing path resolves to a non-device vnode
sys/dev/disk/dm/dm_pdev.c:69
 panic reproduced fixed untriaged — —
DF-2452 Medium 5.5 NULL-deref kernel panic via mismatched feature_count in _init_features
sys/dev/disk/dm/flakey/dm_target_flakey.c:131
 panic reproduced fixed untriaged — —
DF-2479 Medium 5.5 Divide-by-zero in mmcsd_delete via attacker-controlled CSD erase-sector size
sys/dev/disk/mmcsd/mmcsd.c:407
 none not_reproduced not_testable untriaged — —
DF-2489 Medium 5.5 Divide-by-zero kernel panic from zero geometry in ad_attach/ad_describe
sys/dev/disk/nata/ata-disk.c:147
 panic reproduced not_testable untriaged — —
DF-2496 Medium 5.5 Kernel divide-by-zero panics from crafted RAID geometry (width/interleave/total_sectors == 0)
sys/dev/disk/nata/ata-raid.c:1028
 panic reproduced fixed untriaged — —
DF-2512 Medium 5.5 Admin request leak on failed Identify NS exhausts pool and panics kernel
sys/dev/disk/nvme/nvme_admin.c:624
 none not_reproduced not_testable untriaged — —
DF-2514 Medium 5.5 Divide-by-zero kernel panic in XPT_CALC_GEOMETRY from block_size > 1MB
sys/dev/disk/sbp/sbp.c:2384
 none not_reproduced not_testable untriaged — —
DF-1170 Low 5.5 Divide-by-zero in smu7_get_profiling_clk when golden MCLK value is zero
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2737
 panic reproduced fixed untriaged — —
DF-1485 Low 5.5 NULL-pointer dereference when find_idle_secondary_pipe exhausts idle pipes
sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1151
 panic reproduced fixed untriaged — —
DF-1508 Low 5.5 kqfilter detach dereferences NULL dev->si_drv1 after close frees state
sys/dev/misc/vkbd/vkbd.c:311
 panic reproduced fixed untriaged — —
DF-1548 Low 5.5 Divide-by-zero panic in XPT_CALC_GEOMETRY when block_size > 1 MiB
sys/dev/disk/advansys/advansys.c:441
 panic reproduced fixed untriaged — —
DF-1582 Low 5.5 mfi_tbolt_get_cmd NULL-derefs when Thunderbolt command pool is empty
sys/dev/raid/mfi/mfi_tbolt.c:784
 panic reproduced fixed untriaged — —
DF-1840 Low 5.5 NULL-deref panic in amr_cam_complete when an INQUIRY CCB carries no data buffer
sys/dev/raid/amr/amr_cam.c:557
 none reproduced not_testable untriaged — —
DF-1973 Low 5.5 KKASSERT in mlphy_service panics INVARIANTS kernels on every autoneg tick
sys/dev/netif/mii_layer/mlphy.c:220
 none reproduced not_testable untriaged — —
DF-2067 Low 5.5 Unclamped si_iosize_max on syspd allows oversized bio to permanently stall controller
sys/dev/raid/mfi/mfi_syspd.c:135
 dos reproduced not_testable untriaged — —
DF-2160 Low 5.5 NULL-deref kernel panic in disable_irq/enable_irq when irq is not (or no longer) registered
sys/dev/drm/linux_irq.c:150
 panic reproduced fixed untriaged — —
DF-2390 Low 5.5 Boot-time kernel panic from inconsistent DPF handling between resource counter and link_add_crs
sys/dev/acpica/acpi_pci_link.c:180
 none not_reproduced not_testable untriaged — —
DF-2478 Low 5.5 Unbounded md device auto-creation on open allows kernel memory exhaustion (DoS) by operator-group users
sys/dev/disk/md/md.c:135
 denial_of_service reproduced fixed untriaged — —
DF-2501 Low 5.5 XPT_RESET_DEV dereferences softc->atadev[tid] with no NULL or bounds check
sys/dev/disk/nata/atapi-cam.c:428
 panic reproduced fixed untriaged — —
DF-2504 Low 5.5 CDRIOCSETBLOCKSIZE accepts block_size=0 -> divide-by-zero kernel panic
sys/dev/disk/nata/atapi-cd.c:723
 panic reproduced fixed untriaged — —
DF-1158 Medium 5.3 wpi_notif_intr RX index mask 0xfff wider than WPI_RX_RING_COUNT=64 can cause infinite softirq loop
sys/dev/netif/wpi/if_wpi.c:2208
 dos reproduced not_testable untriaged — —
DF-1371 Medium 5.3 oce_rx/oce_discard_rx_comp loop past empty RQ ring on firmware-misreported fragment count, NULL-deref panic
sys/dev/netif/oce/oce_if.c:1274
 none inconclusive — untriaged — —
DF-2533 Medium 5.3 xa_close leaks xdisk_lk and releases wrong lock on raced-destruction defensive paths
sys/dev/disk/xdisk/xdisk.c:767
 panic reproduced not_testable untriaged — —
DF-1472 Low 5.3 get_clock_voltage_limit reads entries[0] without numEntries check; off-by-one in get_state_entry_v2
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:432
 none reproduced fixed untriaged — —
DF-1572 Low 5.3 DMSG_DBG_SHELL reply handler logs attacker-controlled string to console without rate limiting
sys/dev/disk/xdisk/xdisk.c:592
 dos reproduced fixed untriaged — —
DF-2471 Low 5.3 Missing channel bounds check on card-reported channel in SCSI async event handler
sys/dev/disk/isp/isp.c:5438
 limited_write reproduced fixed untriaged — —
DF-1617 Info 5.3 No local guard against intval==0 in ath_beacon_config STA timer math
sys/dev/netif/ath/ath/if_ath_beacon.c:988
 none reproduced not_testable untriaged — —
DF-1874 Medium 5.2 Signed int32 (daddr_t) overflow in block/offset math corrupts data.data pointer for >1 TiB SDXC cards
sys/dev/disk/mmcsd/mmcsd.c:338
 none inconclusive — untriaged — —
DF-1386 Medium 5.1 Divide-by-zero panic in cypress_calculate_burst_time when memory_clock<=1
sys/dev/drm/radeon/cypress_dpm.c:907
 none inconclusive — untriaged — —
DF-1802 Medium 5.1 snp: SNPSTTY with NOUDEV drops snp_token before snp_down/snp_detach -> ASSERT_LWKT_TOKEN_HELD panic or unlocked race
sys/dev/misc/snp/snp.c:540
 none inconclusive — untriaged — —
DF-1978 Medium 5.1 queue_delayed_work silently ignores caller workqueue always runs on system_wq breaking ordered/highpri semantics
sys/dev/drm/linux_workqueue.c:151
 none inconclusive — untriaged — —
DF-2523 Medium 5.1 trm_Reselect spins forever (no exit) if reselected target/LUN does not match any DCB - interrupt-context DoS
sys/dev/disk/trm/trm.c:2427
 dos reproduced fixed untriaged — —
DF-2524 Medium 5.1 trm_Disconnect dereferences pDCB->pActiveSRB without NULL check kernel panic on spurious disconnect (acknowledged in source)
sys/dev/disk/trm/trm.c:2354
 panic reproduced fixed untriaged — —
DF-1387 Low 5.1 Divide-by-zero in cypress_populate_mclk_value when VBIOS ss.rate==0
sys/dev/drm/radeon/cypress_dpm.c:553
 none reproduced fixed untriaged — —
DF-1488 Low 5.1 Uninitialized stack read of prefetchable[] in cbb_cardbus_auto_open programs bridge prefetch bits with stack garbage
sys/dev/pccard/pccbb/pccbb.c:1005
 none reproduced fixed untriaged — —
DF-1738 Low 5.1 ata-lowlevel: divide-by-zero panic in ata_tf_write CHS path from device-supplied zero geometry
sys/dev/disk/nata/ata-lowlevel.c:771
 panic reproduced fixed untriaged — —
DF-1455 Info 5.1 Unvalidated completion context and ring log2 sizes from hypervisor-controlled shared DMA memory
sys/dev/virtual/vmware/pvscsi/pvscsi.c:899
 none reproduced not_testable untriaged — —
DF-2165 High 4.7 shem_read_mapping_page() leaks VM_OBJECT_LOCK and hold_count on every error path
sys/dev/drm/linux_shmem.c:52
 none not_reproduced not_testable untriaged — —
DF-2166 High 4.7 pagecache_write_begin() stores shmem ERR_PTR in *pagep and returns success, causing kmap panic
sys/dev/drm/linux_shmem.c:102
 none not_reproduced not_testable untriaged — —
DF-1137 Medium 4.7 Kernel divide-by-zero in si_thermal_setup_fan_table from unvalidated VBIOS fan temp deltas
sys/dev/drm/radeon/si_dpm.c:6057
 dos reproduced fixed untriaged — —
DF-1151 Medium 4.7 Divide-by-zero DoS in ci_thermal_setup_fan_table from unvalidated VBIOS fan temperatures
sys/dev/drm/radeon/ci_dpm.c:1018
 none not_reproduced not_testable untriaged — —
DF-1297 Medium 4.7 Divide-by-zero in ci_thermal_setup_fan_table from unvalidated VBIOS temperature deltas
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2159
 panic reproduced fixed untriaged — —
DF-1354 Medium 4.7 Integer underflow in mclk_latency loop in vega12_apply_clocks_adjust_rules (count-1 wraps when count==0)
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1973
 panic reproduced fixed untriaged — —
DF-1527 Medium 4.7 i915_request_skip reads uninitialized rq->postfix, causing ring-buffer memset with stale slab offset
sys/dev/drm/i915/i915_request.c:1019
 none inconclusive — untriaged — —
DF-1619 Medium 4.7 NULL-pointer dereference panic in mrsas_get_mpt_cmd when command pool is empty
sys/dev/raid/mrsas/mrsas_cam.c:580
 panic reproduced fixed untriaged — —
DF-1650 Medium 4.7 rs780_dpm: divide-by-zero in rs780_program_at via drm_mode_vrefresh()==0
sys/dev/drm/radeon/rs780_dpm.c:66
 panic reproduced fixed untriaged — —
DF-1695 Medium 4.7 atapi-cam: XPT_RESET_DEV dereferences atadev[tid] without NULL check or state_lock
sys/dev/disk/nata/atapi-cam.c:428
 panic reproduced fixed untriaged — —
DF-1834 Medium 4.7 NULL pointer deref in drm_sched_job_timedout first loop (missing parent check)
sys/dev/drm/scheduler/sched_main.c:259
 none inconclusive — untriaged — —
DF-1949 Medium 4.7 ASSERT-only divide-by-zero guard in fixed-point division panics kernel in production builds
sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43
 none inconclusive — untriaged — —
DF-1974 Medium 4.7 NULL pointer dereference in radeon_dig_monitor_is_duallink when encoder has no linked connector
sys/dev/drm/radeon/radeon_encoders.c:368
 none inconclusive — untriaged — —
DF-1985 Medium 4.7 u32 to uint16 truncation of pitch into fb_info.stride enables syscons mmap SIZE_MAX bound-check bypass (kernel memory read primitive)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:261
 none inconclusive — untriaged — —
DF-2037 Medium 4.7 Divide-by-zero kernel panic in amdgpu_pll_compute when target_clock or post_div is zero
sys/dev/drm/amd/amdgpu/amdgpu_pll.c:88
 panic reproduced fixed untriaged — —
DF-2038 Medium 4.7 dc_create_stream_for_sink: unchecked NULL from dc_create_transfer_func() dereferenced in construct() -> kernel panic
sys/dev/drm/amd/display/dc/core/dc_stream.c:58
 panic reproduced fixed untriaged — —
DF-2066 Medium 4.7 mfi_syspd_strategy leaks bio on controller fault/reset permanently wedging I/O
sys/dev/raid/mfi/mfi_syspd.c:249
 dos reproduced not_testable untriaged — —
DF-2076 Medium 4.7 drm_bufs_info NULL-pointer write when M_NULLOK kmalloc fails (local panic)
sys/dev/drm/drm_sysctl.c:226
 dos reproduced fixed untriaged — —
DF-2103 Medium 4.7 Daemon work queue (daemonq/dqend) and intqp pool guarded only by crit_enter/exit (per-CPU interrupt deferral not MP lock); cross-CPU races lose/leak requests and lose wakeups stalling daemon (local DoS)
sys/dev/raid/vinum/vinumdaemon.c:88
 corruption reproduced fixed untriaged — —
DF-2136 Medium 4.7 Reservation ww_mutex lock leak when reservation_object_reserve_shared fails in ttm_eu_reserve_buffers
sys/dev/drm/ttm/ttm_execbuf_util.c:131
 none reproduced fixed untriaged — —
DF-2182 Medium 4.7 wait_on_bit_timeout() lost-wakeup / indefinite hang: missing tsleep_interlock() before condition re-check
sys/dev/drm/linux_wait.c:111
 dos reproduced fixed untriaged — —
DF-2210 Medium 4.7 Unconditional NULL dereference of ch->dma in ata_national_setmode panics kernel when DMA unavailable
sys/dev/disk/nata/chipsets/ata-national.c:77
 panic reproduced fixed untriaged — —
DF-2423 Medium 4.7 NULL-pointer dereference in ahci_pm_read/ahci_pm_write when CCB pool is exhausted
sys/dev/disk/ahci/ahci_pm.c:976
 panic reproduced not_testable untriaged — —
DF-2509 Medium 4.7 ast_reinit frees softc/NULLs ivars; ast_detach then NULL-derefs (same class as DF-2507 never fixed here)
sys/dev/disk/nata/atapi-tape.c:202
 none not_reproduced not_testable untriaged — —
DF-1206 Low 4.7 alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure
sys/dev/netif/alc/if_alc.c:1361
 none reproduced fixed untriaged — —
DF-1226 Low 4.7 Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_calc_wrpll_link)
sys/dev/drm/i915/intel_ddi.c:1298
 none reproduced fixed untriaged — —
DF-1267 Low 4.7 NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cmdline_mode fails under OOM
sys/dev/drm/drm_fb_helper.c:2176
 none reproduced fixed untriaged — —
DF-1301 Low 4.7 Display scaling math divides by stream/plane rect dimensions with no zero guard (kernel #DE panic)
sys/dev/drm/amd/display/dc/core/dc_resource.c:635
 none reproduced fixed untriaged — —
DF-1302 Low 4.7 Unguarded integer divides by timing fields in modeset commit path allow kernel panic
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:1621
 none reproduced fixed untriaged — —
DF-1318 Low 4.7 NULL cam_path dereference in sbp_target_reset iterating all LUNs
sys/dev/disk/sbp/sbp.c:2098
 none reproduced fixed untriaged — —
DF-1322 Low 4.7 NULL-pointer dereference at attach when Envy24 subsystem unknown and EEPROM absent
sys/dev/sound/pci/envy24.c:2409
 none reproduced fixed untriaged — —
DF-1343 Low 4.7 OOM in radeon_add_atom_connector turns into NULL-deref panic via drm_connector_cleanup on uninitialized connector
sys/dev/drm/radeon/radeon_connectors.c:2343
 none reproduced fixed untriaged — —
DF-1376 Low 4.7 Unguarded divide-by-zero in spread-spectrum step_size when pll reference clock is zero
sys/dev/drm/radeon/atombios_crtc.c:1129
 none reproduced fixed untriaged — —
DF-1419 Low 4.7 NULL deref in smu8_construct_max_power_limits_table when VBIOS omits SCLK dependency table
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:259
 none reproduced fixed untriaged — —
DF-1440 Low 4.7 NULL ddc_bus dereference in amdgpu_connector_get_edid for connectors with failed I2C bus init
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:296
 none reproduced fixed untriaged — —
DF-1441 Low 4.7 drm_connector_cleanup on never-initialized connector in amdgpu_connector_add error path
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1902
 none reproduced fixed untriaged — —
DF-1444 Low 4.7 Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth)
sys/dev/disk/ahci/ahci_cam.c:1082
 none reproduced fixed untriaged — —
DF-1465 Low 4.7 dpt_intr exits entire ISR on one bogus status packet (return should be continue)
sys/dev/raid/dpt/dpt_scsi.c:1518
 none reproduced fixed untriaged — —
DF-1479 Low 4.7 my_start ignores my_encap failure: leaks dequeued mbuf and NULL-derefs BPF_MTAP under memory pressure
sys/dev/netif/my/if_my.c:1290
 panic reproduced fixed untriaged — —
DF-1583 Low 4.7 mfi_tbolt_alloc_cmd leaks lock and NULL-derefs sc->mfi_cmd_pool_tbolt on kmalloc failure
sys/dev/raid/mfi/mfi_tbolt.c:455
 panic reproduced fixed untriaged — —
DF-1613 Low 4.7 Unbounded pitch underflow in hubp1_program_size can hang the GPU
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:167
 dos reproduced fixed untriaged — —
DF-1623 Low 4.7 NULL-pointer dereference in atmel_reset_device when cmdprocobj (T6) object is absent
sys/dev/smbus/atmel_mxt/atmel_mxt.c:418
 panic reproduced fixed untriaged — —
DF-1628 Low 4.7 Missing error-handling goto after opps[j] NULL check leaves NULL OPP pointer in pool, enabling later NULL-deref DoS
sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1065
 panic reproduced fixed untriaged — —
DF-1644 Low 4.7 IOCATAREQUEST accepts count==0, passing ZERO_LENGTH_PTR as DMA target
sys/dev/disk/nata/ata-all.c:462
 panic reproduced fixed untriaged — —
DF-1647 Low 4.7 bre() plex_concat NULL dereference when plex has zero subdisks (local DoS panic)
sys/dev/raid/vinum/vinumrequest.c:491
 panic reproduced fixed untriaged — —
DF-1659 Low 4.7 ahci_pm: NULL deref in ahci_pm_read/ahci_pm_write when CCB pool exhausted
sys/dev/disk/ahci/ahci_pm.c:841
 panic reproduced fixed untriaged — —
DF-1723 Low 4.7 ath_edma_tx: unvalidated hardware-supplied ts_queue_id used to index sc->sc_txq[]
sys/dev/netif/ath/ath/if_ath_tx_edma.c:681
 panic reproduced fixed untriaged — —
DF-1787 Low 4.7 ast_reinit frees softc before ata_reinit calls ast_done/ast_detach -> NULL-deref panic on hot-unplug/reset
sys/dev/disk/nata/atapi-tape.c:210
 panic reproduced fixed untriaged — —
DF-1799 Low 4.7 smu_helper: latent infinite loop in phm_get_voltage_index and smu_get_voltage_dependency_table_ppt_v1 (uint8_t i vs uint32_t count)
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:388
 panic reproduced fixed untriaged — —
DF-1800 Low 4.7 smu_helper: phm_get_lowest_enabled_level infinite-loops when mask==0
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:520
 panic reproduced fixed untriaged — —
DF-1832 Low 4.7 NULL-pointer deref of intel_connector->encoder in HPD storm re-enable and poll-init workers
sys/dev/drm/i915/intel_hotplug.c:233
 none reproduced not_testable untriaged — —
DF-1856 Low 4.7 Unchecked kzalloc failure in i915 MST fake-encoder init leads to NULL-deref panic on hub plug-in
sys/dev/drm/i915/intel_dp_mst.c:541
 panic reproduced fixed untriaged — —
DF-1908 Low 4.7 get_mfd_cell_dev calls dev_info on possibly-NULL device: NULL-deref on lookup failure
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:165
 panic reproduced fixed untriaged — —
DF-1929 Low 4.7 NULL-pointer dereference in acpi_battery_find_dev when battery devclass is absent
sys/dev/acpica/acpi_battery.c:349
 panic reproduced fixed untriaged — —
DF-1934 Low 4.7 NULL-deref panic in dce4_hdmi_set_color_depth when radeon_get_connector_for_encoder returns NULL
sys/dev/drm/radeon/evergreen_hdmi.c:342
 panic reproduced fixed untriaged — —
DF-1939 Low 4.7 NULL-deref in siba_bwn_read_ivar SIBA_IVAR_PCICORE_REVID when hardware lacks detected PCI/PCIE core
sys/dev/netif/bwn/siba/siba_bwn.c:450
 panic reproduced fixed untriaged — —
DF-1967 Low 4.7 NULL pointer dereference in dm_dp_add_mst_connector on fake-MST encoder allocation failure
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:346
 none reproduced not_testable untriaged — —
DF-1983 Low 4.7 Latent kfree() on embedded drm_framebuffer in amdgpufb_create error path (slab-corruption landmine)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:255
 none reproduced not_testable untriaged — —
DF-2001 Low 4.7 NULL-pointer write in icintr if i2c peer delivers data before SIOCSIFFLAGS allocates the receive buffer
sys/dev/netif/ic/if_ic.c:127
 none reproduced not_testable untriaged — —
DF-2036 Low 4.7 Unguarded divide by pp_table->FanMaximumRpm in vega20_fan_ctrl_get_fan_speed_percent
sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:117
 panic reproduced fixed untriaged — —
DF-2168 Low 4.7 NULL-deref in dal_irq_service_set/ack when info->funcs is NULL on uninitialized table slots
sys/dev/drm/amd/display/dc/irq/irq_service.c:118
 panic reproduced fixed untriaged — —
DF-2470 Low 4.7 Infinite loop in response-queue pointer update when target mode advances the output index
sys/dev/disk/isp/isp.c:5113
 denial_of_service reproduced fixed untriaged — —
DF-1681 Info 4.7 cs4281: unguarded divide in cs4281_rate_to_rv would panic if rate==0 reaches the driver
sys/dev/sound/pci/cs4281.c:209
 panic reproduced fixed untriaged — —
DF-1729 Info 4.7 ttm_bo_vm: NULL deref panic in iomem fault path when fictitious page lookup misses
sys/dev/drm/ttm/ttm_bo_vm.c:665
 panic reproduced fixed untriaged — —
DF-2208 Info 4.7 Missing NULL checks on kzalloc/kasprintf returns in drm_sysfs_connector_add cause NULL-deref panic under OOM
sys/dev/drm/drm_sysfs.c:39
 none not_reproduced fixed untriaged — —
DF-1279 Medium 4.6 Divide-by-zero panic if malicious IOC reports RequestFrameSize == 0
sys/dev/disk/mpt/mpt.c:2654
 none inconclusive not_testable untriaged — —
DF-1463 Medium 4.6 Divide-by-zero panic in XPT_CALC_GEOMETRY from block_size==0
sys/dev/raid/dpt/dpt_scsi.c:1025
 none inconclusive — untriaged — —
DF-1923 Medium 4.6 Detach loop indexes mem_res[] by slot position rather than slot->num: NULL-deref panic + resource leak after partial slot-init failure
sys/dev/disk/sdhci/sdhci_pci.c:350
 none inconclusive — untriaged — —
DF-1940 Medium 4.6 Divide-by-zero in ata_intel_31244_tf_write via crafted IDENTIFY CHS geometry (heads=0 or sectors=0)
sys/dev/disk/nata/chipsets/ata-intel.c:471
 none inconclusive — untriaged — —
DF-1966 Medium 4.6 NULL pointer dereference in dm_dp_mst_get_modes via unchecked dc_link_add_remote_sink return
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:237
 none inconclusive — untriaged — —
DF-2415 Medium 4.6 Divide-by-zero panic in XPT_CALC_GEOMETRY from device-controlled block_size
sys/dev/disk/advansys/adwcam.c:734
 none not_reproduced not_testable untriaged — —
DF-2491 Medium 4.6 Divide-by-zero panic in CHS-mode ata_tf_write from device-controlled geometry
sys/dev/disk/nata/ata-lowlevel.c:771
 panic reproduced not_testable untriaged — —
DF-1549 Low 4.6 OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels
sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:1146
 panic reproduced fixed untriaged — —
DF-1568 Low 4.6 OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels (sibling of DF-1549)
sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1005
 panic reproduced fixed untriaged — —
DF-1777 Low 4.6 radeon_dp_mst: missing NULL check on create_fake_mst_encoder return -> NULL deref on best_encoder callback
sys/dev/drm/radeon/radeon_dp_mst.c:230
 panic reproduced fixed untriaged — —
DF-1812 Low 4.6 nvme_admin: unvalidated NVMe namespace LBA sect_size causes divide-by-zero panic at attach
sys/dev/disk/nvme/nvme_admin.c:673
 none reproduced not_testable untriaged — —
DF-1813 Low 4.6 nvme_admin: admin request leak on IDENTIFY NAMESPACE failure leads to KKASSERT panic via admin-queue exhaustion
sys/dev/disk/nvme/nvme_admin.c:624
 none reproduced not_testable untriaged — —
DF-1903 Low 4.6 nvme_pci_detach dereferences NULL bus handle on BAR(0)-mapping-failure error path: kernel panic
sys/dev/disk/nvme/nvme_attach.c:122
 panic reproduced fixed untriaged — —
DF-2480 Low 4.5 daddr_t (int32) truncation of block address for >1TB MMC/SD media
sys/dev/disk/mmcsd/mmcsd.c:326
 corruption reproduced fixed untriaged — —
DF-1204 Medium 4.4 Divide-by-zero in spread spectrum clock calculation via ss.rate == 0
sys/dev/drm/radeon/ni_dpm.c:2044
 none not_reproduced not_testable untriaged — —
DF-1310 Medium 4.4 Signed RX-length overflow in non-mergeable mode leads to NULL-deref panic from crafted device response
sys/dev/virtual/virtio/net/if_vtnet.c:1702
 panic reproduced fixed untriaged — —
DF-1596 Medium 4.4 UVD destroy message lacks filp ownership check (cross-user session kill)
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:781
 panic reproduced fixed untriaged — —
DF-1678 Medium 4.4 drm_close dereferences ERR_PTR from drm_minor_acquire on device unregister -> kernel panic
sys/dev/drm/drm_file.c:373
 panic reproduced fixed untriaged — —
DF-1682 Medium 4.4 hptmv: unchecked divide by (bArnMember-1) in hpt_rebuild_data_block -> kernel panic (local DoS)
sys/dev/raid/hptmv/ioctl.c:461
 panic reproduced fixed untriaged — —
DF-1801 Medium 4.4 snp: NULL-deref panic when read/kqfilter issued on unattached /dev/snpN device
sys/dev/misc/snp/snp.c:263
 none inconclusive — untriaged — —
DF-1965 Medium 4.4 Unconditional _objcache_destroy in MOD_UNLOAD leaves module obj_cache NULL while still in use
sys/dev/disk/dm/delay/dm_target_delay.c:440
 none inconclusive — untriaged — —
DF-2100 Medium 4.4 intel_vgt_deballoon calls drm_mm_remove_node on unallocated balloon slots, dereferencing NULL mm
sys/dev/drm/i915/i915_vgpu.c:119
 dos reproduced fixed untriaged — —
DF-2183 Medium 4.4 NULL-pointer dereference in backlight_register: make_dev() return value never assigned to sc->cdev
sys/dev/misc/backlight/backlight.c:116
 panic reproduced fixed untriaged — —
DF-1169 Low 4.4 Integer underflow sends 0xFFFFFFFF PCIe DPM level to SMC firmware
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4382
 none reproduced fixed untriaged — —
DF-1288 Low 4.4 NULL-pointer dereference in mly_user_command error path when command pool exhausted
sys/dev/raid/mly/mly.c:2883
 none reproduced not_testable untriaged — —
DF-1429 Low 4.4 NULL-deref panic in twe_report_request: device_printf(td_disk) when td_disk is NULL
sys/dev/raid/twe/twe.c:1862
 none reproduced fixed untriaged — —
DF-1493 Low 4.4 Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0
sys/dev/disk/ccd/ccd.c:1319
 panic reproduced fixed untriaged — —
DF-1505 Low 4.4 Missing NULL check on dev->si_drv1 in genkbdkqfilter and genkbdfiltdetach (kernel panic on detached kbd)
sys/dev/misc/kbd/kbd.c:839
 panic reproduced fixed untriaged — —
DF-1618 Low 4.4 Integer underflow in dce120_timing_generator_validate_timing defeats the v_blank lower-bound check
sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:107
 panic reproduced fixed untriaged — —
DF-1668 Low 4.4 vmbus: NULL deref in vmbus_msghc_wakeup on host-injected spurious VERSION_RESP
sys/dev/virtual/hyperv/vmbus/vmbus.c:613
 panic reproduced fixed untriaged — —
DF-1807 Low 4.4 amdgpu_fence: power-of-two check accepts 0 -> kcalloc(0) returns ZERO_LENGTH_PTR -> NULL deref panic on first emit
sys/dev/drm/amd/amdgpu/amdgpu_fence.c:424
 panic reproduced fixed untriaged — —
DF-1822 Low 4.4 aac_cam: kernel panic via CAM_SCATTER_VALID flag on pass-through (local DoS)
sys/dev/raid/aac/aac_cam.c:456
 none reproduced not_testable untriaged — —
DF-1853 Low 4.4 NULL-pointer dereference of gIal_Adapter in hptmv ioctl path panics kernel when no adapter attached
sys/dev/raid/hptmv/hptproc.c:309
 panic reproduced fixed untriaged — —
DF-1902 Low 4.4 Host-root triggerable kernel panic via IFM_ETH_MASTER on non-1000baseT media
sys/dev/netif/mii_layer/mii_physubr.c:372
 panic reproduced fixed untriaged — —
DF-1935 Low 4.4 CTLFLAG_ANYBODY on writable brightness/mute sysctls allows unprivileged local writes (variant of DF-1892)
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:167
 none reproduced fixed untriaged — —
DF-2048 Low 4.4 NULL-pointer dereference in TBRIDGE_GETRESULT dereferences tbridge_curtest without NULL check
sys/dev/misc/tbridge/tbridge.c:266
 panic reproduced fixed untriaged — —
DF-2057 Low 4.4 NULL pointer dereference via unvalidated backing-device vnode type in dm_pdev_insert
sys/dev/disk/dm/dm_pdev.c:168
 panic reproduced fixed untriaged — —
DF-2098 Low 4.4 GPIO index unvalidated in 4/5 ar5416 HAL exported functions (HALASSERT compiled out) -> UB shifts -> local DoS
sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:90
 dos reproduced fixed untriaged — —
DF-2212 Low 4.4 ttm_exit() deadlocks forever in uninterruptible wait_event on condition that can never become true
sys/dev/drm/ttm/ttm_module.c:40
 dos reproduced fixed untriaged — —
DF-2392 Low 4.4 Missing zero-validation on machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic
sys/dev/acpica/acpi_timer.c:310
 panic reproduced not_testable untriaged — —
DF-2437 Low 4.4 Module-unload handler destroys shared objcache even when dm_target_remove fails EBUSY causing NULL-deref panic on subsequent I/O
sys/dev/disk/dm/delay/dm_target_delay.c:440
 panic reproduced fixed untriaged — —
DF-2439 Low 4.4 FREEBLKS bio falls through delay target switch and is dispatched to underlying pdev without offset translation
sys/dev/disk/dm/delay/dm_target_delay.c:213
 none not_reproduced not_testable untriaged — —
DF-2455 Low 4.4 FD_STYPE accepts unvalidated fd_type enabling divide-by-zero panics and shift UB
sys/dev/disk/fd/fd.c:2325
 none not_reproduced not_testable untriaged — —
DF-2483 Low 4.4 mpt_pci_attach returns success on every failure path causing NULL-deref / linked-list corruption on detach
sys/dev/disk/mpt/mpt_pci.c:576
 none not_reproduced not_testable untriaged — —
DF-2540 Low 4.4 Signed integer overflow in amdsb_watchdog() timeout calc programs watchdog count=0 -> deterministic reboot
sys/dev/misc/amdsbwd/amdsbwd.c:217
 none not_reproduced not_testable untriaged — —
DF-2590 Low 4.4 Unchecked AcpiEvaluateObject return in acpi_panasonic_hkey_event causes NULL-deref panic
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:403
 panic reproduced not_testable untriaged — —
DF-1788 Info 4.4 acpi_fujitsu: CTLFLAG_ANYBODY sysctls forward unbounded user ints into ACPI control methods
sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:415
 none reproduced fixed untriaged — —
DF-1132 Low 4.3 NULL deref / panic in bwn_dma_parse_cookie on unexpected TX-status cookie
sys/dev/netif/bwn/bwn/if_bwn.c:7065
 panic reproduced fixed untriaged — —
DF-1448 Low 4.3 24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID leaks FCP exchange
sys/dev/disk/isp/isp_target.c:187
 none reproduced not_testable untriaged — —
DF-1344 Low 4.2 NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS740 floating-bus nulls ddc_bus but leaves shared_ddc=true)
sys/dev/drm/radeon/radeon_connectors.c:1340
 none reproduced not_testable untriaged — —
DF-1345 Medium 4.1 Divide-by-zero in polaris10_thermal_setup_fan_table from VBIOS-controlled fan temperature points
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:2048
 dos reproduced fixed untriaged — —
DF-1392 Medium 4.1 Divide-by-zero panic when VBIOS supplies zero SCLK or zero spread-spectrum rate
sys/dev/drm/radeon/rv6xx_dpm.c:411
 none inconclusive — untriaged — —
DF-1497 Medium 4.1 Missing NULL check on voltage_object in atomctrl_get_svi2_info dereferences lookup result
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1444
 none inconclusive — untriaged — —
DF-1511 Medium 4.1 TOCTOU NULL-pointer dereference of handler in vga_switcheroo_force_migd causes kernel panic
sys/dev/video/vga/vga_switcheroo.c:1231
 none inconclusive — untriaged — —
DF-1821 Medium 4.1 vinumraid5: missing plex->subdisks bounds check enables division-by-zero panic via config-race
sys/dev/raid/vinum/vinumraid5.c:142
 none inconclusive — untriaged — —
DF-2481 Medium 4.1 Divide-by-zero kernel panic via unchecked IOCFACTS RequestFrameSize
sys/dev/disk/mpt/mpt.c:2683
 none not_reproduced not_testable untriaged — —
DF-1129 Low 4.1 Divide-by-zero in si_thermal_setup_fan_table from unvalidated BIOS fan-table temperatures
sys/dev/drm/amd/amdgpu/si_dpm.c:6489
 panic reproduced fixed untriaged — —
DF-1331 Low 4.1 NULL pointer dereference in attach error path when cfg is unset
sys/dev/sound/pci/envy24ht.c:2519
 none reproduced fixed untriaged — —
DF-1426 Low 4.1 Divide-by-zero in iir_init from HBA-supplied mapping fields with zero heads or secs
sys/dev/raid/iir/iir.c:413
 none reproduced fixed untriaged — —
DF-1428 Low 4.1 NULL-deref panic in twe_describe_controller: p[0] from twe_get_param not checked
sys/dev/raid/twe/twe.c:1691
 none reproduced fixed untriaged — —
DF-1550 Low 4.1 NULL pointer dereference of tdp_table from VBIOS PowerPlay table missing usPowerTuneTableOffset
sys/dev/drm/amd/powerplay/hwmgr/vega10_powertune.c:1294
 panic reproduced fixed untriaged — —
DF-1610 Low 4.1 NULL pointer dereference of cac_dtp_table when VBIOS omits usPowerTuneTableOffset (sibling of DF-1550)
sys/dev/drm/amd/powerplay/hwmgr/smu7_powertune.c:1120
 panic reproduced fixed untriaged — —
DF-1653 Low 4.1 sbsh: unbounded spin loop in issue_cx28975_cmd hangs the kernel
sys/dev/netif/sbsh/if_sbsh.c:1042
 dos reproduced fixed untriaged — —
DF-1663 Low 4.1 ttm_page_alloc: fini races vm_lowmem shrinker on static_buf and _manager lifetime
sys/dev/drm/ttm/ttm_page_alloc.c:388
 panic reproduced fixed untriaged — —
DF-1731 Low 4.1 tws_attach arms IRQ and publishes /dev/tws<unit> before sc->reqs allocated -> NULL-deref panic
sys/dev/raid/tws/tws.c:268
 panic reproduced fixed untriaged — —
DF-1735 Low 4.1 vinumio: divide-by-zero panic in set_drive_parms when device reports media_blksize==0
sys/dev/raid/vinum/vinumio.c:119
 panic reproduced fixed untriaged — —
DF-1770 Low 4.1 intel_dsi_vbt: NULL-deref on dsi_hosts[port] in mipi_exec_send_packet
sys/dev/drm/i915/intel_dsi_vbt.c:127
 panic reproduced fixed untriaged — —
DF-1773 Low 4.1 intel_dsi_vbt: NULL-deref on vbt.lfp_lvds_vbt_mode in intel_dsi_vbt_init
sys/dev/drm/i915/intel_dsi_vbt.c:508
 panic reproduced fixed untriaged — —
DF-1785 Low 4.1 radeon_bios: kmalloc-NULL-deref ordering in radeon_acpi_vfct_bios - memcpy before NULL check
sys/dev/drm/radeon/radeon_bios.c:717
 panic reproduced fixed untriaged — —
DF-1865 Low 4.1 Unbounded KCS reply-collection loop hangs kthread on hostile/buggy BMC
sys/dev/misc/ipmi/ipmi_kcs.c:410
 dos reproduced fixed untriaged — —
DF-1866 Low 4.1 ipmi_kcs_probe_align has unbounded polling loops (boot-time DoS)
sys/dev/misc/ipmi/ipmi_kcs.c:527
 dos reproduced fixed untriaged — —
DF-1879 Low 4.1 Missing pipe_bpp!=0 guard in vlv_dsi_get_pclk causes kernel divide-by-zero panic
sys/dev/drm/i915/vlv_dsi_pll.c:325
 panic reproduced fixed untriaged — —
DF-1886 Low 4.1 parityrebuild divides by plex->stripesize and plex->subdisks with no zero guard: div0 panic
sys/dev/raid/vinum/vinumrevive.c:116
 panic reproduced fixed untriaged — —
DF-1937 Low 4.1 Divide-by-zero in spread-spectrum clock math when ATOM BIOS supplies ss.rate==0
sys/dev/drm/radeon/rv730_dpm.c:97
 panic reproduced fixed untriaged — —
DF-1942 Low 4.1 Integer overflow in r600_copy_dma size_in_dw: silent short/zero-length GPU copy with successful fence (latent on R600, live on rv770/evergreen siblings)
sys/dev/drm/radeon/r600_dma.c:457
 panic reproduced fixed untriaged — —
DF-1992 Low 4.1 Divide-by-zero kernel panic via unvalidated VBIOS clock/spread-spectrum divisors in rv740_populate_sclk_value / rv740_populate_mclk_value
sys/dev/drm/radeon/rv740_dpm.c:145
 none reproduced not_testable untriaged — —
DF-2044 Low 4.1 mps_pci_free releases never-allocated IRQ resource panicking kernel on attach-failure paths
sys/dev/raid/mps/mps_pci.c:230
 panic reproduced fixed untriaged — —
DF-2137 Low 4.1 NULL-deref panic via device_get_softc(devclass_get_device(...)) in sc_get_softc and sc_find_softc
sys/dev/misc/syscons/syscons_nexus.c:117
 panic reproduced fixed untriaged — —
DF-2138 Low 4.1 Missing u<0 guard in sc_get_cons_priority allows negative unit to reach sccninit and NULL-deref
sys/dev/misc/syscons/syscons_nexus.c:162
 none reproduced fixed untriaged — —
DF-2377 Low 4.1 Missing cst_cx_count==0 guard causes OOB heap read in set_lowest_oncpu and NULL-deref panic in idle
sys/dev/acpica/acpi_cpu_cstate.c:504
 panic not_reproduced not_testable untriaged — —
DF-2378 Low 4.1 HT-sibling C-state copy in acpi_cst_cx_probe_cst writes another CPU live softc without synchronization
sys/dev/acpica/acpi_cpu_cstate.c:621
 panic inconclusive not_testable untriaged — —
DF-2408 Low 4.1 tpm_legacy_read unconditionally writes through a NULL count pointer panicking on every multi-chunk read of a legacy TPM
sys/dev/crypto/tpm/tpm.c:1092
 none not_reproduced not_testable untriaged — —
DF-2477 Low 4.1 md_drvcleanup module-unload path has refcnt TOCTOU that frees md_s out from under a racing mdopen
sys/dev/disk/md/md.c:133
 corruption reproduced fixed untriaged — —
DF-2591 Low 4.1 Missing serial lock in acpi_panasonic_shutdown triggers KKASSERT panic on INVARIANTS kernels
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:231
 panic reproduced not_testable untriaged — —
DF-1995 Low 4.0 ar5210Attach error path leaks HAL_EEPROM_v1 sub-allocation (missing ath_hal_eepromDetach)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_attach.c:288
 none reproduced not_testable untriaged — —
DF-2508 Low 4.0 u32 integer overflow in afd_sense capabilities-path mediasize calculation
sys/dev/disk/nata/atapi-fd.c:409
 corruption reproduced fixed untriaged — —
DF-1791 Low 3.9 puc: NULL-deref kernel panic in puc_config_superio when BAR 0 fails to allocate
sys/dev/misc/puc/puc.c:273
 panic reproduced fixed untriaged — —
DF-1924 Low 3.9 Unbounded hardware spin in tws_init_ctlr hangs kernel at device attach
sys/dev/raid/tws/tws_hdm.c:100
 dos reproduced fixed untriaged — —
DF-1925 Low 3.9 Unbounded hardware spin in tws_ctlr_reset stage-1 hangs kernel during recovery
sys/dev/raid/tws/tws_hdm.c:473
 dos reproduced fixed untriaged — —
DF-1943 Low 3.9 r600_copy_dma under-reserves ring dwords: sync semaphore+fence can overflow reserved count corrupting GPU command stream
sys/dev/drm/radeon/r600_dma.c:459
 panic reproduced fixed untriaged — —
DF-1945 Low 3.8 afd_describe divides by attacker-controlled sectorsize=0: kernel panic at attach (bootverbose only)
sys/dev/disk/nata/atapi-fd.c:383
 panic reproduced fixed untriaged — —
DF-2406 Info 3.7 No RDRAND online health tests (NIST SP 800-90B repetition / adaptive-proportion)
sys/dev/crypto/rdrand/rdrand.c:159
 — reproduced not_testable untriaged — —
DF-1225 Low 3.6 Use of uninitialized stack variable n_entries when icl_get_combo_buf_trans hits default branch
sys/dev/drm/i915/intel_ddi.c:890
 none reproduced fixed untriaged — —
DF-1277 Low 3.6 sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors
sys/dev/netif/sk/if_sk.c:2712
 none reproduced fixed untriaged — —
DF-1757 Low 3.6 radeon_vce: TOCTOU in destroy-session cleanup clears handles reallocated to different filp
sys/dev/drm/radeon/radeon_vce.c:519
 none reproduced fixed untriaged — —
DF-1811 Low 3.6 cardbus_cis: UB in decode_tuple_bar 1<<(ffs(0)-1) when masked BAR probe value is zero
sys/dev/pccard/cardbus/cardbus_cis.c:360
 none reproduced not_testable untriaged — —
DF-1899 Low 3.6 UB left shift 1<<vmid in amdgpu_amdkfd_is_kfd_vmid lets out-of-range VMIDs pass KFD guard (latent: CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:514
 panic reproduced fixed untriaged — —
DF-2018 Low 3.6 drm_is_current_master returns stale is_master flag instead of comparing master pointers, defeating DRM_MASTER privilege revocation
sys/dev/drm/drm_auth.c:333
 none reproduced not_testable untriaged — —
DF-2090 Low 3.6 Unsigned underflow in max_payload_size-1 bypasses HW buffer chunking when HW buffer is empty (dead code today)
sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96
 none reproduced fixed untriaged — —
DF-2513 Low 3.6 Unvalidated device-controlled shift in namespace block-size computation
sys/dev/disk/nvme/nvme_admin.c:673
 corruption reproduced fixed untriaged — —
DF-1382 Low 3.4 SIOCSIFMTU sets if_mtu even when MTU exceeds VGE_JUMBO_MTU
sys/dev/netif/vge/if_vge.c:2005
 none reproduced fixed untriaged — —
DF-1405 Low 3.4 cuse_alloc_unit[] global arrays mutated under per-server lock instead of cuse_global_mtx
sys/dev/misc/cuse/cuse.c:181
 none reproduced not_testable untriaged — —
DF-1741 Low 3.4 vinumioctl: VINUM_RESETCONFIG case missing break falls through into VINUM_SETSTATE
sys/dev/raid/vinum/vinumioctl.c:214
 none reproduced fixed untriaged — —
DF-2017 Low 3.4 drm_setmaster_ioctl: disabled dev->master exclusivity check leaks master refcount and silently steals mastership
sys/dev/drm/drm_auth.c:190
 none reproduced not_testable untriaged — —
DF-1652 Info 3.4 sbsh: SIOCLOADFIRMW EBUSY guard is dead code (error clobbered by copyin)
sys/dev/netif/sbsh/if_sbsh.c:405
 none reproduced fixed untriaged — —
DF-1982 Medium 3.3 GEM object refcount leak on amdgpufb_create error path (VRAM buffer permanently leaked)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:308
 none inconclusive — untriaged — —
DF-1118 Low 3.3 Integer overflow in skl_wm_method1/skl_wm_method2 watermark calculation via downscale-adjusted pixel rate
sys/dev/drm/i915/intel_pm.c:4487
 panic reproduced fixed untriaged — —
DF-1233 Low 3.3 aac_close_aif orphans fibctx list when removing head, leaking every subsequent context permanently
sys/dev/raid/aac/aac.c:3488
 none reproduced fixed untriaged — —
DF-1273 Low 3.3 Stale index used as voltage lookup key in CAC table population (functional correctness)
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:423
 none reproduced fixed untriaged — —
DF-1324 Low 3.3 Wrong loop bound in iceland_populate_smc_mvdd_table uses VddciLevelCount instead of MvddLevelCount
sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:675
 none reproduced fixed untriaged — —
DF-1363 Low 3.3 MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
sys/dev/raid/mps/mps_user.c:765
 none reproduced not_testable untriaged — —
DF-1443 Low 3.3 ATA PASS-16 passthrough drops lba_high_exp (copy-paste bug assigns lba_mid_exp twice)
sys/dev/disk/ahci/ahci_cam.c:1319
 none reproduced fixed untriaged — —
DF-1507 Low 3.3 O_NONBLOCK never honored in vkbd read/write (uses wrong flag constant)
sys/dev/misc/vkbd/vkbd.c:347
 panic reproduced fixed untriaged — —
DF-1605 Low 3.3 NULL-pointer dereference in vtblk_strategy: sc dereferenced before the NULL check
sys/dev/virtual/virtio/block/virtio_blk.c:527
 panic reproduced fixed untriaged — —
DF-1720 Low 3.3 amdgpu_gem: amdgpu_gem_object_open ignores amdgpu_vm_bo_add OOM failure, returns success without bo_va
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:143
 none reproduced fixed untriaged — —
DF-1728 Low 3.3 ttm_bo_vm: BO kref leak on each mmap of already-mapped BO (kernel memory exhaustion DoS)
sys/dev/drm/ttm/ttm_bo_vm.c:420
 dos reproduced fixed untriaged — —
DF-1748 Low 3.3 radeon_gem: integer overflow in radeon_mode_dumb_create size (pitch*height wraps u32)
sys/dev/drm/radeon/radeon_gem.c:764
 panic reproduced fixed untriaged — —
DF-1867 Low 3.3 kcs_start_write uses 1-second busy DELAY inside 10x retry loop: CPU pin for ~minutes per ioctl
sys/dev/misc/ipmi/ipmi_kcs.c:182
 dos reproduced fixed untriaged — —
DF-1969 Low 3.3 GEM object reference leaked on radeonfb_create error path
sys/dev/drm/radeon/radeon_fb.c:322
 none reproduced not_testable untriaged — —
DF-2064 Low 3.3 32-bit integer overflow/underflow bypasses firmware truncation size check
sys/dev/drm/i915/intel_uc_fw.c:83
 none reproduced not_testable untriaged — —
DF-2070 Low 3.3 Incorrect 48-bit LBA reconstruction in tf_read corrupts read-back sector address
sys/dev/disk/nata/chipsets/ata-serverworks.c:179
 dos reproduced fixed untriaged — —
DF-2149 Low 3.3 pps_open is a boolean flag not a reference count; any close tears down the bus/interrupt for all openers
sys/dev/misc/pps/pps.c:118
 dos reproduced fixed untriaged — —
DF-2216 Low 3.3 dmi_match() leaks kgetenv() buffer on every code path
sys/dev/drm/linux_dmi.c:44
 denial_of_service reproduced fixed untriaged — —
DF-2434 Low 3.3 ii_index terminator allocation leaked on every CCDIOCSET/CCDIOCCLR cycle (ileave>0)
sys/dev/disk/ccd/ccd.c:629
 none not_reproduced not_testable untriaged — —
DF-2519 Low 3.3 ATA PASS-THROUGH 16 drops LBA high extension byte (copy-paste defect)
sys/dev/disk/sili/sili_cam.c:1217
 corruption reproduced fixed untriaged — —
DF-1698 Info 3.3 mps_sas_lsi: PhysDisk OFFLINE branch uses |= instead of &= ~ to clear RAID_COMPONENT flag, locking disk out of OS permanently
sys/dev/raid/mps/mps_sas_lsi.c:481
 none reproduced fixed untriaged — —
DF-2043 Info 3.3 i915_gem_dmabuf_mmap is a no-op stub that silently misreports success
sys/dev/drm/i915/i915_gem_dmabuf.c:149
 none reproduced fixed untriaged — —
DF-1229 Low 3.0 Untrusted diag BufferType used as fw_diag_buffer_list[3] index (OOB write into mpr_softc)
sys/dev/raid/mpr/mpr.c:2388
 none reproduced fixed untriaged — —
DF-1412 Low 3.0 bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset
sys/dev/drm/i915/intel_panel.c:1674
 none reproduced not_testable untriaged — —
DF-1462 Low 3.0 ATA_PASS_16 FIS lba_high_exp never set due to copy-paste duplication of lba_mid_exp assignment
sys/dev/disk/sili/sili_cam.c:1217
 none reproduced fixed untriaged — —
DF-1956 Low 3.0 Inverted loop condition in psp_v10_0_compare_sram_data bypasses SRAM integrity check
sys/dev/drm/amd/amdgpu/psp_v10_0.c:433
 panic reproduced fixed untriaged — —
DF-2077 Low 3.0 sizespec silently wraps on attacker-controlled length strings (integer overflow + signed-multiplier corruption)
sys/dev/raid/vinum/vinumutil.c:197
 none reproduced fixed untriaged — —
DF-2085 Low 3.0 Operator-precedence error in agp_sis_set_aperture misprograms WINCTRL to 512M and invokes signed-shift UB
sys/dev/agp/agp_sis.c:215
 none reproduced fixed untriaged — —
DF-2527 Low 3.0 vniocattach_file missing positive vn_size check -> signed integer overflow and bogus disk geometry
sys/dev/disk/vn/vn.c:559
 corruption reproduced fixed untriaged — —
DF-1147 Info 3.0 EEPROM read timeout detection broken by loop/check bound mismatch
sys/dev/netif/bnx/if_bnx.c:438
 none reproduced not_testable untriaged — —
DF-1202 Info 3.0 scmmap under-bounds offset when framebuffer height*stride is 0 or overflows int
sys/dev/misc/syscons/syscons.c:4089
 none reproduced not_testable untriaged — —
DF-1261 Low 2.5 dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race)
sys/dev/sound/pcm/dsp.c:2370
 none reproduced fixed untriaged — —
DF-1276 Low 2.5 DMA map cleanup loops use wrong array index [i] instead of [j], leaking all created maps
sys/dev/netif/sk/if_sk.c:3120
 none reproduced fixed untriaged — —
DF-1570 Low 2.5 xa_close returns holding xdisk_lk and releases the wrong lock on race paths
sys/dev/disk/xdisk/xdisk.c:767
 dos reproduced fixed untriaged — —
DF-1675 Low 2.5 ar5416_ani: ar5416AniControl OOB array index via untrusted maxLevel (DF-1660 variant)
sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:230
 panic reproduced fixed untriaged — —
DF-1864 Low 2.5 Missing braces in drm_sched_entity_init loop silently drops -ENOMEM, leaving partially-initialized sched entities
sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:174
 panic reproduced fixed untriaged — —
DF-1980 Low 2.5 _create_workqueue_common error path leaks wq->workers array and orphans already-scheduled worker threads
sys/dev/drm/linux_workqueue.c:229
 none reproduced not_testable untriaged — —
DF-2040 Low 2.5 Truncation of mem->num_pages (unsigned long) to unsigned in VRAM-visible accounting and free paths
sys/dev/drm/amd/amdgpu/amdgpu_vram_mgr.c:112
 panic reproduced fixed untriaged — —
DF-1489 Info 2.5 NULL dereference inside warning branch of cbb_cardbus_auto_open (rman_get_start(NULL))
sys/dev/pccard/pccbb/pccbb.c:1028
 none reproduced fixed untriaged — —
DF-2134 Info 2.5 dma_buf_fd silently ignores O_CLOEXEC -- fd leaks across exec()
sys/dev/drm/linux_dma-buf.c:150
 none reproduced fixed untriaged — —
DF-2176 Info 2.5 Missing NULL-buf guard in write-path memcpy diverges from amdgpu fix
sys/dev/drm/radeon/atombios_i2c.c:61
 panic reproduced fixed untriaged — —
DF-2218 Info 2.5 Missing NULL check on nvme_get_admin_request return potential kernel NULL-deref panic
sys/dev/disk/nvme/nvme_ioctl.c:49
 — not_reproduced not_testable untriaged — —
DF-2451 Info 2.5 Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert
sys/dev/disk/dm/dm_pdev.c:106
 panic reproduced not_testable untriaged — —
DF-1778 Low 2.4 radeon_dp_mst: unbounded goto-loop in check_status enables HPD workqueue DoS via malicious hub
sys/dev/drm/radeon/radeon_dp_mst.c:716
 dos reproduced fixed untriaged — —
DF-1446 Low 2.3 DSI host and device allocations leaked on init error path and encoder teardown
sys/dev/drm/i915/vlv_dsi.c:1655
 none reproduced not_testable untriaged — —
DF-1714 Low 2.3 evdev: client memory and lock leak in evdev_open error paths
sys/dev/misc/evdev/cdev.c:117
 dos reproduced fixed untriaged — —
DF-1745 Low 2.3 mpt_pci: DMA tag leak in mpt_dma_mem_alloc error paths
sys/dev/disk/mpt/mpt_pci.c:718
 none reproduced fixed untriaged — —
DF-1890 Low 2.3 Signed integer overflow in amdsb_watchdog period conversion, enabled by 100x-wrong period_max
sys/dev/misc/amdsbwd/amdsbwd.c:217
 panic reproduced fixed untriaged — —
DF-1990 Low 2.3 TPM locality not relinquished on four error paths in tpmcrb_transmit
sys/dev/crypto/tpm/tpm_crb.c:328
 none reproduced not_testable untriaged — —
DF-1991 Low 2.3 Non-interruptible polling in tpm_wait_for_u32 holds dev_lock for up to 40 seconds
sys/dev/crypto/tpm/tpm_crb.c:246
 none reproduced not_testable untriaged — —
DF-2050 Low 2.3 tsleep timeout computed as hz * user-controlled int32 can overflow or go negative
sys/dev/misc/tbridge/tbridge.c:274
 dos reproduced fixed untriaged — —
DF-2112 Low 2.3 Memory leak in led_attach error path when gpio_map fails
sys/dev/misc/gpio/gpio_led.c:190
 none reproduced fixed untriaged — —
DF-2120 Low 2.3 Wrong object unreserved on destination-BO pin failure (lock imbalance)
sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:114
 none reproduced fixed untriaged — —
DF-2404 Low 2.3 Memory leak of sc->sc_rng_co callout array on driver detach
sys/dev/crypto/rdrand/rdrand.c:126
 none reproduced not_testable untriaged — —
DF-1293 Info 2.3 Unbounded rx_cons from hardware return descriptor used to index fixed-size rxdesc[256] array
sys/dev/netif/age/if_age.c:1997
 none reproduced not_testable untriaged — —
DF-1427 Info 2.3 Broken sense-data copy in iir_intr GDT_GCF_IOCTL: duplicate data copy instead of sense copy
sys/dev/raid/iir/iir.c:1621
 none reproduced not_testable untriaged — —
DF-1743 Info 2.3 vinumioctl: resetstats() switch falls through drive_object->sd_object; reply->error uninitialized on no-match
sys/dev/raid/vinum/vinumioctl.c:427
 none reproduced fixed untriaged — —
DF-2400 Info 2.3 agp_mmap off-by-one allows mapping one physical page past the AGP aperture BAR
sys/dev/agp/agp.c:860
 — not_reproduced not_testable untriaged — —
DF-1752 Low 2.1 ata-queue: ata_fail_requests leaks controller serialization lock when failing running request
sys/dev/disk/nata/ata-queue.c:577
 dos reproduced fixed untriaged — —
DF-2173 Low 2.1 I/O resources leaked on ata_attach() failure in ata_pccard_attach()
sys/dev/disk/nata/ata-card.c:125
 none reproduced fixed untriaged — —
DF-1972 Info 2.0 u32 to uint16 truncation of pitch into fb_info enables syscons mmap SIZE_MAX underflow
sys/dev/drm/radeon/radeon_fb.c:271
 panic reproduced fixed untriaged — —
DF-1355 Low 1.9 Inverted assertion in vega12_display_configuration_changed_task (functional bug)
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:2112
 none reproduced fixed untriaged — —
DF-1421 Low 1.9 firmware_get() reference never released on attach-failure or detach (refcount leak)
sys/dev/disk/isp/isp_pci.c:856
 none reproduced not_testable untriaged — —
DF-1705 Low 1.9 virtio_balloon: inverted bounds KASSERT in vtballoon_update_stat disables defense-in-depth check
sys/dev/virtual/virtio/balloon/virtio_balloon.c:474
 panic reproduced fixed untriaged — —
DF-1706 Low 1.9 virtio_balloon: vtballoon_update_stats called from kthread without the serializer it requires
sys/dev/virtual/virtio/balloon/virtio_balloon.c:551
 panic reproduced fixed untriaged — —
DF-1707 Low 1.9 virtio_balloon: vtballoon_detach deadlocks if balloon thread waiting on host or balloon inflated
sys/dev/virtual/virtio/balloon/virtio_balloon.c:379
 dos reproduced fixed untriaged — —
DF-1794 Low 1.9 tw_osl_cam: CAM completion-status fallback is dead code - unhandled CL error codes complete CCB with status 0 (CAM_REQ_INPROG)
sys/dev/raid/twa/tw_osl_cam.c:731
 none reproduced fixed untriaged — —
DF-1846 Low 1.9 gpio_map leaks pin_mapped on partial-failure of the loop, permanently locking out pins
sys/dev/misc/gpio/gpio.c:211
 dos reproduced fixed untriaged — —
DF-1996 Low 1.9 Off-by-one in amdgpu_gfx_kiq_acquire loop invokes test_bit / bit_to_queue with bit = -1 (undefined shift)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:211
 none reproduced not_testable untriaged — —
DF-2022 Low 1.9 Unbounded non-interruptible ACK-poll loop in xgpu_ai_mailbox_trans_msg wedges unkillable kernel thread
sys/dev/drm/amd/amdgpu/mxgpu_ai.c:128
 none reproduced not_testable untriaged — —
DF-2058 Low 1.9 Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART fails at pdev insert time
sys/dev/disk/dm/dm_pdev.c:107
 panic reproduced fixed untriaged — —
DF-2063 Low 1.9 Unchecked adv_attach() return leaks all device resources and leaves interrupt handler active on half-initialized softc
sys/dev/disk/advansys/adv_pci.c:289
 none reproduced not_testable untriaged — —
DF-2197 Low 1.9 kthread_park() returns the wrong value (ts->kt_exitvalue instead of a success code)
sys/dev/drm/linux_kthread.c:103
 none reproduced fixed untriaged — —
DF-2224 Low 1.9 seq_printf forwards __va_list into ksnprintf variadic parameter instead of using kvsnprintf
sys/dev/drm/linux_printf.c:37
 leak reproduced fixed untriaged — —
DF-2438 Low 1.9 Signed integer overflow in delay tick computation produces negative/erratic delays for large user-supplied millisecond values
sys/dev/disk/dm/delay/dm_target_delay.c:140
 dos reproduced not_testable untriaged — —
DF-1350 Info 1.9 XPT_CALC_GEOMETRY divides by block_size with no zero check
sys/dev/disk/amd/amd.c:683
 none reproduced fixed untriaged — —
DF-1450 Info 1.9 Missing return after ASSERT_CRITICAL(false) in dc_link_set_drive_settings allows NULL deref fall-through
sys/dev/drm/amd/display/dc/core/dc.c:429
 none reproduced not_testable untriaged — —
DF-1627 Info 1.9 UB: 1<<session_idx executed before no-session guard when session_idx==-1
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812
 none reproduced not_testable untriaged — —
DF-1630 Info 1.9 KKASSERT bounds checks on pl_links indexing are no-ops in production kernels
sys/dev/acpica/acpi_pci_link.c:235
 none reproduced not_testable untriaged — —
DF-1671 Info 1.9 if_vke: LOW_POW_2(0) undefined shift when nmbclusters < NetifNum*2
sys/dev/virtual/vkernel/net/if_vke.c:89
 panic reproduced fixed untriaged — —
DF-1751 Info 1.9 amdgpu_acpi: wrong allocator - AcpiOsFree(M_ACPICA) on kzalloc(M_DRM) atif memory
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:755
 panic reproduced fixed untriaged — —
DF-1836 Info 1.9 nsclpcsio unconditional TMS/VLM init writes to 8237A DMA controller when logical devices are disabled
sys/dev/misc/nsclpcsio/nsclpcsio_isa.c:344
 none reproduced not_testable untriaged — —
DF-1847 Info 1.9 pin_mapped/pin_opened protected by two independent locks: mutual-exclusion race
sys/dev/misc/gpio/gpio.c:196
 none reproduced not_testable untriaged — —
DF-1859 Info 1.9 UB shift 1<<biBitCount in splash_bmp ncols computation (folded into DF-1857 fix)
sys/dev/video/fb/bmp/splash_bmp.c:538
 none reproduced fixed untriaged — —
DF-1889 Info 1.9 Timeout-detection mismatch in e1000_load_firmware FW-reset wait loop
sys/dev/netif/ig_hal/e1000_manage.c:508
 none reproduced not_testable untriaged — —
DF-1998 Info 1.9 amdgpu_gfx_kiq_init calls amdgpu_bo_unreserve on unreserved BO (ttm reservation imbalance)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:299
 none reproduced fixed untriaged — —
DF-2088 Info 1.9 ACPI_DEBUG_MEMMAP build reuses a found track by moving it to list head without unlinking, orphaning nodes and risking cycles
sys/dev/acpica/Osd/OsdMemory.c:96
 none reproduced fixed untriaged — —
DF-2099 Info 1.9 ar5416GpioGet reads wrong GPIO input bit on AR9287 (KIWI) due to missing else
sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:192
 none reproduced fixed untriaged — —
DF-2184 Info 1.9 Memory leak in backlight_destroy: softc is never freed
sys/dev/misc/backlight/backlight.c:111
 none reproduced fixed untriaged — —
DF-2441 Info 1.9 dmstrategy and dmdump dereference dev->si_drv1 without NULL check unlike dmsize and disk_ioctl_switch
sys/dev/disk/dm/device-mapper.c:365
 panic reproduced not_testable untriaged — —
DF-1893 Info 1.5 Uninitialized UINT32 arg consumed by SET after failed HCI GET in hci_key_action
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:474
 none reproduced fixed untriaged — —
DF-2190 Low 1.1 vmap() leaks the vmap descriptor when kmem_alloc_nofault fails
sys/dev/drm/linux_vmalloc.c:53
 none reproduced fixed untriaged — —
DF-1746 Info 1.1 ttm_bo_util: ttm_bo_kmap bounds check allows OOB page-array index
sys/dev/drm/ttm/ttm_bo_util.c:584
 panic reproduced fixed untriaged — —
DF-1747 Info 1.1 ttm_bo_util: ttm_bo_move_memcpy error path pairs wrong mem with new_iomap in cleanup
sys/dev/drm/ttm/ttm_bo_util.c:243
 panic reproduced not_testable untriaged — —
DF-2097 Info 1.1 sil164_detect uses uninitialized reg9 when sil164_readb fails (unchecked return)
sys/dev/drm/i915/dvo_sil164.c:176
 none reproduced fixed untriaged — —
DF-2180 Info 1.1 ttm_bo_man_get_node silently swallows allocator errors (returns 0 instead of ret)
sys/dev/drm/ttm/ttm_bo_manager.c:75
 none reproduced fixed untriaged — —
DF-1459 Info 0.8 bzero of softc uses sizeof(pointer) instead of sizeof(struct) - latent garbage init
sys/dev/smbus/cyapa/cyapa.c:488
 none reproduced fixed untriaged — —
DF-1513 Info 0.8 vga_switcheroo_write uses negative errno return convention inconsistent with BSD dev_write
sys/dev/video/vga/vga_switcheroo.c:1112
 none reproduced fixed untriaged — —
DF-2030 Info 0.8 dig_encoder_sel_to_atom discards computed value returns literal 0
sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:154
 none reproduced fixed untriaged — —
DF-1780 Info 0.6 radeon_dp_mst: dead error-threshold check (retries==10000 vs loop bound 50) silently hides SAT timeout
sys/dev/drm/radeon/radeon_dp_mst.c:101
 none reproduced fixed untriaged — —
DF-1558 Info 0.5 HPD enable/disable are silent no-ops: register modification never written back
sys/dev/drm/amd/display/dc/dce/dce_link_encoder.c:1366
 none reproduced not_testable untriaged — —
DF-1677 Info 0.5 nvme: queue alloc/free/create/delete helpers accept uint16_t qid without validating against NVME_MAX_QUEUES
sys/dev/disk/nvme/nvme.c:128
 panic reproduced fixed untriaged — —
DF-1913 Info 0.5 hwmgr_hw_init preflight check dereferences hwmgr_func before its NULL guard (latent)
sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214
 none reproduced not_testable untriaged — —
DF-1970 Info 0.5 Latent kfree() on embedded drm_framebuffer would corrupt slab if reached
sys/dev/drm/radeon/radeon_fb.c:331
 panic reproduced fixed untriaged — —
DF-1997 Info 0.5 amdgpu_gfx_scratch_free performs unbounded 1u << (reg - reg_base) shift (latent UB)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:98
 panic reproduced fixed untriaged — —
DF-2109 Info 0.5 Undefined behavior in radix_max when tree height reaches RADIX_TREE_MAX_HEIGHT (shift >= word width)
sys/dev/drm/linux_radix.c:42
 none reproduced fixed untriaged — —
DF-2398 Low — Integer overflow in aperture bounds check in agp_generic_bind_memory
sys/dev/agp/agp.c:520
 corruption reproduced not_testable untriaged — —
DF-2019 Info — drm_setmaster_ioctl: lessor check and drm_set_master fall-through (lines 215-225) are dead code
sys/dev/drm/drm_auth.c:187
 none reproduced fixed untriaged — —

Base system — bus / platform / cpu 368

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5403 High 8.1 sg(4) SG_IO submits CCBs with data_ptr=NULL and dxfer_len>0: deterministic NULL-page-write kernel panic in nata/ahci transports and bus_dmamap_load(NULL) PRDT at physical address 0
sys/bus/cam/scsi/scsi_sg.c:543 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5371 Medium 7.8 Unlocked shared dmat->segments array across all load paths — concurrent loads on one tag corrupt each other's scatter/gather lists (vkernel never got pc64's bus_dma_tag_lock/BUS_DMA_CACHE_SEGMENTS fix)
sys/platform/vkernel64/platform/busdma_machdep.c:314 · pass 2 · new
 device-visible corrupted S/G lists (DF-5371) / 72B-per-failure leak (DF-5373) untested not_testable untriaged — —
DF-5246 High 7.5 Write-after-free race on run_vap::beacon_mbuf: run_update_beacon (ic lock) vs run_newstate/run_vap_delete (sc lock) - disjoint lock domains
sys/bus/u4b/wlan/if_run.c:4887 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5581 Medium 7.5 Intel graphics stolen-memory reservation is compiled out; drm/i915 trusts the unreserved firmware values and its only conflict guard is a no-op rman stub
sys/bus/pci/x86_64/pci_early_quirks.c:264 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5315 High 7.3 USB_FS_OPEN double-entry: two racing opens both pass the unlocked slot check and both run usbd_transfer_setup() — the second NULLs/overwrites the first's pointer, orphaning its usb_xfer (permanent M_USB leak + endpoint refcount_alloc exhaustion → endpoint dead for ALL consumers)
sys/bus/u4b/usb_generic.c:1458 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5472 Medium 7.3 Backtracer frame walk trusts stack content — INKERNEL() defined but never used AND semantically wrong for the vkernel; walk escapes into guest-user VAs (guaranteed fault on this platform) and prints attacker-chosen kernel symbols (DF-5470 twin, vkernel-amplified)
sys/platform/vkernel64/x86_64/db_trace.c:227 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5324 Medium 7.0 ukbd unplug vs kbd_switch consumer lifetime race: kbd_unregister frees the keyboard under in-flight console consumers -> lockmgr on freed lock and kbdsw[NULL]->ioctl NULL-deref panic (reproduced)
sys/bus/u4b/input/ukbd.c:1370 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5294 Medium 6.7 rum_ratectl_task re-arms rvp->ratectl_ch unconditionally; the re-armed callout survives rum_vap_delete's drain order and fires on the freed rum_vap (post-free callout/task cycle)
sys/bus/u4b/wlan/if_rum.c:3140 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5473 Medium 6.5 Backtrace fault outside an established DDB session longjmps into the BSS-zeroed global db_jmpbuf — on the vkernel the longjmp is host libc's from inside the SIGSEGV handler: restores rsp=0/rbp=0, vkernel process dies of SIGILL inside longjmp+115, core dumped, zero further diagnostics (DF-5471 twin)
sys/platform/vkernel64/x86_64/db_trace.c:231 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5655 Medium 6.5 vkernel sys_set_tls_area accepts a non-canonical TLS base that crosses to the host kernel via go_user()/vmspace_ctl() and panics the HOST in wrmsr(MSR_KGSBASE) — unprivileged in-vkernel user → host kernel panic (DF-5639 vkernel twin, boundary-crossing)
sys/platform/vkernel64/x86_64/tls.c:96 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5365 Medium 6.4 lapic_map() maps firmware-supplied Local APIC physical address with zero validation -> arbitrary-physical-address kernel read/write page at boot (MADT LocalApicAddr / MP apic_address never cross-checked against IA32_APICBASE)
sys/platform/pc64/apic/lapic.c:1081 · pass 2 · new
 memcorrupt reproduced not_testable untriaged — —
DF-5773 Medium 6.4 handle_term() inherited by reforked vkernel children runs kill(0, SIGTERM): process-group-wide TERM splash plus a self-re-arming, unstoppable signal storm
sys/platform/vkernel64/platform/init.c:217 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5326 Low 6.4 mp_bootaddress() integer underflow on degenerate base-memory size corrupts the kernel physical memory map
sys/platform/pc64/x86_64/mp_machdep.c:212 · pass 2 · new
 none untested not_testable untriaged — —
DF-5372 Low 6.4 _bus_dmamap_sync() switches on a bitmask op: combined BUS_DMASYNC_PREWRITE|BUS_DMASYNC_POSTREAD matches no case and silently performs no bounce copy in either direction
sys/platform/vkernel64/platform/busdma_machdep.c:903 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5432 Medium 6.3 ioapic_map() of unvalidated firmware IOAPIC Address: arbitrary-physical-address kernel MMIO reads and writes at boot (DF-5365's IOAPIC twin)
sys/platform/pc64/acpica/acpi_madt.c:619 · pass 2 · new
 memcorrupt reproduced not_testable untriaged — —
DF-5306 Medium 6.2 NULL-deref kernel panic at attach: VC header declaring zero streaming interfaces leaves sc->data NULL and uvc_drv_init_video() dereferences it
sys/bus/u4b/uvc/uvc_drv.c:2109 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5335 High 6.1 doreti_iret fault state machine is espfix64-class broken: sigreturn with %ss resolving to the null GDT descriptor or an absent LDT descriptor hard-crashes the machine from unprivileged userland (silent CPU reset or SMP livelock, no panic); subclasses that do reach C code get their frame rebuilt from PCB padding/stale stack
sys/platform/pc64/x86_64/trap.c:679 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5479 Medium 6.1 efi_enter()/efi_leave(): per-CPU CR4.SMEP disable with no critical section or CPU pinning (the comment claims one) — preempt+migrate inside the runtime window leaves the source CPU with SMEP permanently off and the migrated firmware call SMEP-fault-looping with efi_lock held forever
sys/platform/pc64/x86_64/efirt.c:327 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5588 Medium 6.1 sdt_probe() accepts hint.acpi.0.rsdp with zero validation: total-acceptance injection vector for the crafted-ACPI family (DF-5430..5433/5583) and one-line boot brick
sys/platform/pc64/acpica/acpi_sdt.c:71 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5327 Medium 6.0 chopen() publishes CH_FLAG_OPEN / drops the secondary opener's acquire BEFORE cam_periph_hold(PCATCH): a signal-interrupted open burns one periph reference (refcount desync -> 0-with-open-fd -> premature free / silent unsigned underflow)
sys/bus/cam/scsi/scsi_ch.c:415 · pass 2 · new
 peripheral refcount desync (deterministic 2->1->0 with the ch device OPEN, then close 0->0xFFFFFFFF silent underflow) plus premature free: cam_periph_invalidate() at refcount==0 runs camperiphfree()/chcleanup() and kfrees softc+periph while the descriptor is still open (dmesg 'removing device entry' + postmortem of the freed chunk) -- same memcorrupt class and privilege gate as DF-5273, but via chopen()'s flag-before-hold ordering in a driver DF-5273 did not cover reproduced fixed untriaged — —
DF-5444 Medium 6.0 pnp_set_config() panics on card-supplied misaligned memory base (MEMORY32_RANGE/FIXED descriptors have no 256-byte granularity clamp)
sys/bus/isa/pnp.c:260 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5519 Medium 6.0 ISA DMA channel validation is DIAGNOSTIC-only: OOB static-array writes forge another channel's bounce pointer (wild kernel write), and 1<<chan wraps to free/corrupt live channels
sys/bus/isa/x86_64/isa_dma.c:95 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5632 Medium 6.0 iicbus_add_child registered with a 4-arg/int prototype against DragonFly's 5-arg/device_t bus_add_child interface — argument+return skew causes an out-of-bounds kernel write in devclass_add_device
sys/bus/iicbus/iicbus.c:57 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5358 Low 6.0 kvm_access_check()'s /dev/kmem residency gate is built on pc64 pmap_kextract(), which validates no paging level: a pread at any ungrown kernel VA page-faults the validator itself (Fatal trap 12 -> panic), and PTE-empty queries return (va & PAGE_MASK) garbage instead of 0
sys/platform/pc64/x86_64/vm_machdep.c:1276 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5445 Low 6.0 Unbounded resource-data ingestion: no-END stream wedges the kernel with unbounded kmalloc growth; endless logical-device tags amplify ~164× into permanent kernel memory
sys/bus/isa/pnp.c:428 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5579 Low 6.0 vkernel64 kvm_access_check() /dev/kmem validator faults on ungrown KVA: pmap_kextract()'s vtopde() assert() SIGABRTs the whole vkernel from inside the residency check (DF-5358 pc64 twin)
sys/platform/vkernel64/x86_64/vm_machdep.c:310 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5348 Medium 5.8 bus_dmamap_unload() of an EINPROGRESS-queued map is a silent no-op: phantom deferred load + callback on stale buffer state, reservation leak
sys/platform/pc64/x86_64/busdma_machdep.c:1022 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5442 Low 5.7 Cross-CPU MTRR reprogram race: amd64_mrstore() fire-and-forget IPI vs amd64_mrfetch() immediate rewrite of the shared mr_desc[] array leaves a persistent per-CPU memory-type desync (torn descriptor generation)
sys/platform/pc64/x86_64/amd64_mem.c:289 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5536 Low 5.7 Dump walk trusts kernel page-table frames at panic time: unguarded dump_add_page(PTE frame) plus missing bitmap bounds check gives an uncontrolled OOB kernel write / double-panic instead of a crash dump
sys/platform/pc64/x86_64/minidump_machdep.c:260 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5375 High 5.6 No func_code whitelist in targwrite(): arbitrary queued XPT opcode injected by the daemon → deterministic targdone() panic (and raw kernel pointers forwarded to SIMs)
sys/bus/cam/scsi/scsi_target.c:584 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5660 High 5.6 vkernel shutdown fallback calls the HOST libc reboot(2): a SIGTERM landing in the boot SYSINIT sliver asks the host kernel to reboot/power off the physical machine
sys/platform/vkernel64/platform/shutdown.c:61 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5285 Medium 5.5 sastrategy integer divide-by-zero panic from device-driven min_blk==0 with non-power-of-2 fixed blocksize
sys/bus/cam/scsi/scsi_sa.c:756 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5302 Medium 5.5 NULL-pointer write panic in fwohci_db_init() via zero ndb from unvalidated FW_SSTBUF bnpacket*bnchunk (RX and TX enable paths)
sys/bus/firewire/fwohci.c:1229 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5415 Medium 5.5 fw_kqfilter dereferences d->ir with no NULL check: knote_insert on NULL+offsetof(fw_xferq,rkq) -> kernel panic (EVFILT_WRITE also hooked to the receive queue)
sys/bus/firewire/fwdev.c:721 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5416 Medium 5.5 FW_CBINDADDR unbinds a foreign bind via the global fw_bindlookup and STAILQ_REMOVEs it from the wrong xferq's (empty) bind list -- unguarded walk-off-NULL -> kernel panic; cross-node bind theft
sys/bus/firewire/fwdev.c:593 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5532 Medium 5.5 usb_proc_mwait() wakeup is gated on the whole queue becoming empty, not on the waited-for messages completing: any continuously refilled usb_process queue holds waiters in uninterruptible (PCATCH-less) sleep indefinitely — the root mechanism beneath the DF-5367..5504 cfg-stall family's uninterruptible-occupancy measurements
sys/bus/u4b/usb_process.c:163 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5639 Medium 5.5 Unprivileged kernel panic: unvalidated non-canonical TLS base reaches wrmsr(MSR_FSBASE/MSR_KGSBASE) in set_user_TLS()
sys/platform/pc64/x86_64/tls.c:100 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5657 Medium 5.5 set_dbregs() stores DR7 with architecturally-reserved bits 63:32 unvalidated; the value is loaded by cpu_heavy_restore during a context switch, raising a ring-0 #GP (fatal trap, panic) from an unprivileged ptrace() of the attacker's own child
sys/platform/pc64/x86_64/procfs_machdep.c:98 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5611 Low 5.5 SIGXCPU omitted from cpu_disable_intr()/cpu_mask_all_signals() while stopsig() dereferences mycpu — one process-directed host signal silently kills the entire vkernel via the DF-5587 recursion
sys/platform/vkernel64/platform/machintr.c:194 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5309 Medium 5.3 usb_fifo_open() curr_cpd single-owner check is unlocked — concurrent opens of the same ugen endpoint bypass EBUSY and yield two live owners on one fifo
sys/bus/u4b/usb_dev.c:701 · pass 2 · new
 single-owner invariant break -> concurrent-setup entry / latent dangling curr_cpd untested not_testable untriaged — —
DF-5382 Medium 5.3 umcs7840_intr_callback issues synchronous 500ms EP0 control reads on the shared per-bus USB callback thread: an evil MCS7840 device freezes ALL USB transfer callbacks on the bus indefinitely (2.25 s per crafted 13-byte interrupt packet)
sys/bus/u4b/serial/umcs.c:745 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5397 Medium 5.3 urndis(4) attach-failure paths call urndis_detach() on a never-attached usb_ether → deterministic kernel panic (lockmgr of NULL, fault VA 0) from plugging a malicious RNDIS device
sys/bus/u4b/net/if_urndis.c:309 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5399 Medium 5.3 mos_attach() failure paths call mos_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch)
sys/bus/u4b/net/if_mos.c:706 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5411 Medium 5.3 udav_attach() failure paths call udav_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch)
sys/bus/u4b/net/if_udav.c:263 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5493 Medium 5.3 uether_ifdetach() performs no never-attached state validation — class-wide owner of the 8-instance DF-5334 goto-detach panic family (lockmgr through NULL ue_lock; ether_ifdetach() on a never-if_attach()ed ifnet)
sys/bus/u4b/net/usb_ethernet.c:267 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5636 Medium 5.3 smbus_request_bus returns success without acquiring ownership: wake-path break skips the ownership re-check and the EWOULDBLOCK->0 fixup converts the SMB_DONTWAIT refusal into a grant (phantom grants / double grants)
sys/bus/smbus/smbconf.c:126 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5483 Low 5.2 _PCT/_PSS firmware-ABI trust: kernel writes firmware-chosen 32/16-bit values to firmware-chosen IO ports unattended at boot (ACPI-S5 machine poweroff demonstrated); world-readable members sysctl turns the status port into an unprivileged read oracle
sys/platform/pc64/acpica/acpi_pstate_machdep.c:430 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5543 Low 5.2 uep(4) one-remaining-byte stash stores the already-consumed buf[0] instead of the remaining p[0]: fabricated touch reports, dropped stream bytes, and cascade into the permanent stall
sys/bus/u4b/input/uep.c:230 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5475 Low 5.1 gdb_handle_exception runs with gdb_tab == NULL: getDebugChar()'s -1 sentinel is masked into data by every wait loop, and the shipped gcc8 constprop clone drops the accessor NULL guards - first putpacket() NULL-derefs at consdev+0x68 and the trap_fatal->kdb_trap(db_active)->stub re-entry loop floods Fatal trap 12 forever: permanent all-CPU hang, no ddb fallback, no dump, no reboot
sys/cpu/x86_64/misc/x86_64-gdbstub.c:148 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5490 Low 5.1 Missing DRIVER_MODULE(iicbus, pcf): the iicbus child never attaches, so pcf->iicbus has a NULL softc forever and the first chip interrupt panics the kernel via iicbus_intr()->sc->owner
sys/bus/iicbus/pcf/pcf.c:193 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5509 Low 5.1 ehci_pci_attach arms ehci_interrupt before controller takeover/init: the pre-init handler is mute (reads USBSTS from the HCSPARAMS capability register, sc_eintrs==0 forces exit WITHOUT acknowledging) — a level-INTx IRQ storm runs for the entire window, including the up-to-5-second BIOS-handoff park, with no code touching USBINTR/USBSTS until ehci_init's hcreset
sys/bus/u4b/controller/ehci_pci.c:390 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5356 Medium 4.8 pccard_attach_card re-entry on card-detect bounce: previous function list orphaned (unbounded kernel memory leak) and duplicate children stacked over live drivers
sys/bus/pccard/pccard.c:189 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5244 Medium 4.7 pmap_unwire() PTE teardown is non-atomic and unsynchronized vs cmpset-based removal → double vm_page_unwire (panic) / PHYS_TO_VM_PAGE(0) = vm_page_array[-1] out-of-bounds
sys/platform/pc64/x86_64/pmap.c:5598 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5368 Medium 4.7 ums_detach tears down the USB fifo and evdev before stopping/draining the intr xfer: with an evdev consumer holding the device, a report delivered during detach dereferences a NULL/freed usb_fifo or the freed evdev -> kernel panic (Fault VA 0x0)
sys/bus/u4b/input/ums.c:773 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5369 Medium 4.7 Lock-order inversion sc->sc_lock <-> evdev ev_mtx: ums_intr_callback pushes evdev events under sc_lock while evdev open/close/detach call ums_ev_open/ums_ev_close (taking sc_lock) under the evdev lock -> permanent unkillable deadlock
sys/bus/u4b/input/ums.c:363 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5471 Medium 4.7 Backtrace fault outside an established DDB session longjmps into the BSS-zeroed (or stale) global db_jmpbuf → double fault → panic: double fault; every stock panic with a garbage frame pointer is upgraded to an undiagnosable crash
sys/platform/pc64/x86_64/db_trace.c:227 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5594 Medium 4.7 devq lifetime is anchored to the sim refcount, not to the peripherals queued on it — devq freed with cam_ed allocation slots still queued (contradicts cam_sim.c's own comment)
sys/bus/cam/cam_sim.c:236 · pass 2 · new
 none untested not_testable untriaged — —
DF-5283 Low 4.7 cpu_mwait_cx_hint() NULL-pointer dereference when deep-sleep inhibition is active on a MONITOR-without-MWAIT-EXT CPU (latent kernel panic)
sys/platform/pc64/x86_64/machdep.c:1133 · pass 2 · new
 hard hang/panic in idle loop untested not_testable untriaged — —
DF-5323 Low 4.7 Second M_WAITOK-sleep-reachable-inside-critical-section site: fw_bus_probe() holds crit_enter() across fw_bus_explore()'s device kmalloc(M_WAITOK|M_ZERO) (distinct from known DF-1021/fw_get_tlabel)
sys/bus/firewire/firewire.c:1239 · pass 2 · new
 sleep-inside-critical-section livelock hazard untested not_testable untriaged — —
DF-5341 Low 4.7 mptable_map() adopts firmware pap/base_table_length with no 'PCMP' signature, no MPFPS/MPCTH checksum, and no PA-range validation — arbitrary-physical-address kernel read and parse at boot
sys/platform/pc64/x86_64/mptable.c:512 · pass 2 · new
 none untested not_testable untriaged — —
DF-5452 Low 4.7 nexus_alloc_resource() indexes irq_rman[cpuid] with only an INVARIANTS-gated KASSERT; plain bus_alloc_resource() reaches it with cpuid=-1 (panic on INVARIANTS kernels, silent OOB static access on production kernels)
sys/platform/pc64/x86_64/nexus.c:377 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5480 Low 4.7 EFI system-table / runtime-table ingestion is signature-only: th_crc32 never verified, efi_systbl_phys not range-checked before PHYS_TO_DMAP, st_rt never validated against the RT-mapped regions (firmware-fed ring-0 call targets), memory-map blob ingested without size cross-checks
sys/platform/pc64/x86_64/efirt.c:399 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5484 Low 4.7 Raw rdmsr/wrmsr on fixed P-state MSRs (0x1a0/0x198/0x199, 0xc001006x) gated only by CPUID: fatal kernel #GP on CPUID-lying VMMs — DF-4735/DF-5155/DF-5160 class, first transition fires unattended at boot
sys/platform/pc64/acpica/acpi_pstate_machdep.c:227 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5574 Low 4.7 ppb_MS_microseq() MS_OP_PUT/GET handler recurses with no depth limit — transfer loop containing MS_OP_PUT exhausts the kernel stack (DOUBLE FAULT)
sys/bus/ppbus/ppb_msq.c:296 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5576 Low 4.7 Interpreter panics instead of returning errors on unreachable states: MS_OP_GET without an initialized mode loop (ppb_msq.c:292) and mode2xfer() unknown-mode/EPP-protocol (:70/:93/:101, the latter also printing the wrong variable)
sys/bus/ppbus/ppb_msq.c:70 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5607 Low 4.7 Cothread signal-mask discipline leaves synchronous fault signals deliverable on %gs=0 threads — the file-owned enabling condition of the DF-5587 silent-recursion death, now proven on a real vkernel
sys/platform/vkernel64/platform/cothread.c:109 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5617 Low 4.7 ig4iic_acpi_attach()'s error unwinder re-enters the serializer leaked by ig4iic_attach()'s bus_setup_intr failure: pci_attached=1 set before ig4iic_attach(); on the setup-irq error path (serializer still held) the ACPI detach calls ig4iic_detach() whose first lwkt_serialize_enter re-enters the self-held, explicitly non-recursive serializer — boot/kldload-time kernel panic (INVARIANTS) / hard self-deadlock (release)
sys/bus/smbus/ichiic/ig4_acpi.c:127 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5638 Low 4.7 SMB_WAIT-only requesters park unkillably in smbreq: tsleep without PCATCH and without timeout (DF-5563/5564 twins at the smbus layer)
sys/bus/smbus/smbconf.c:92 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5775 Low 4.7 writepid() opens the -p pidfile without O_NOFOLLOW and truncates the symlink target with the launcher's privileges
sys/platform/vkernel64/platform/init.c:1390 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5524 Info 4.7 Unchecked device_add_child in iicsmb_attach: a failed smbus allocation leaves sc->smbus NULL and the next slave-mode interrupt dereferences it via smbus_intr(NULL,...)
sys/bus/iicbus/iicsmb.c:156 · pass 2 · new
 NULL-deref panic on slave interrupt / system-down on stray event untested not_testable untriaged — —
DF-5525 Info 4.7 iicsmb_intr panics the kernel on any iicbus event outside {INTR_GENERAL..INTR_NOACK} — one stray controller status code is a system-down failure
sys/bus/iicbus/iicsmb.c:242 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5248 Medium 4.6 run_drain_fifo() unbounded: loop exit depends on device-controlled VLD bit and run_read() failure value 0xffffffff has that bit set - permanent task wedge and device_detach hang
sys/bus/u4b/wlan/if_run.c:2513 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5261 Medium 4.6 mtw_drain_fifo() is unbounded and exits only on a device-controlled VLD bit; mtw_read() failure stores 0xffffffff which HAS that bit set - permanent taskqueue wedge with the driver lock held
sys/bus/u4b/wlan/if_mtw.c:2173 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5277 Medium 4.6 pci_freecfg() panics for any VPD-capable device: kfree(NULL) plus stale vpd_rocnt/vpd_wcnt NULL-derefs after parse-error cleanup
sys/bus/pci/pci.c:2146 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5278 Medium 4.6 pci_read_vpd() cannot terminate on hostile input: dead oversize check plus negative remain drive an endless allocation loop
sys/bus/pci/pci.c:1095 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5334 Medium 4.6 cdce_attach() failure paths call cdce_detach() on a never-attached usb_ether -> kernel panic at device plug-in (NULL lockmgr, then latent ifindex/ifnetlist corruption)
sys/bus/u4b/net/if_cdce.c:610 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5355 Medium 4.6 pccard_function_init partial-allocation retry across CIS config entries panics resource_list_add (crafted evil-card CIS)
sys/bus/pccard/pccard.c:429 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5362 Medium 4.6 CIS chain-graph cycles never terminate: pccard_scan_cis livelock (CPU burn, wedged socket thread, unreleased CIS window; unbounded leak amplifier)
sys/bus/pccard/pccard_cis.c:209 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5384 Medium 4.6 aue_attach() failure paths call aue_detach() on a never-attached usb_ether -> kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption)
sys/bus/u4b/net/if_aue.c:689 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5393 Medium 4.6 isa_find_memory unbounded candidate loop: PnP-supplied 32-bit memory window at align=1 grinds rman up to 2^32 allocations per descriptor (measured 757ms per 4MB; ~13 min per 4GB) — boot-time kernel lockup
sys/bus/isa/isa_common.c:128 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5395 Medium 4.6 axge_attach() failure paths call axge_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the second branch)
sys/bus/u4b/net/if_axge.c:557 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5453 Medium 4.6 kue_attach() failure paths call kue_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption on the third branch)
sys/bus/u4b/net/if_kue.c:481 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5486 Medium 4.6 cue_attach() failure paths call cue_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock; latent ether_ifdetach-on-unattached ifnet corruption) — 8th instance of the DF-5334 uether goto-detach class
sys/bus/u4b/net/if_cue.c:409 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5514 Medium 4.6 ipheth_attach() failure paths call ipheth_detach() on a never-attached usb_ether -> deterministic kernel panic at evil-USB plug-in (lockmgr through NULL ue_lock on branches 1-2; ether_ifdetach on never-if_attach()ed embedded ifnet on branches 3-4) — 9th and final instance of the DF-5334 uether goto-detach class
sys/bus/u4b/net/if_ipheth.c:231 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5603 Medium 4.6 Card-derived zero CMD6 switch timeout reaches live INVARIANTS KASSERT in mmc_switch()/mmc_switch_status() — guaranteed kernel panic at MMC card enumeration
sys/bus/mmc/mmc_subr.c:158 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5768 Medium 4.6 Card-derived erase_sector==0 from CSD WRITE_BL_LEN=0 causes integer divide-by-zero kernel panic in mmcsd_delete() on first TRIM
sys/bus/mmc/mmc.c:1476 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5769 Medium 4.6 mmc_discover_cards() has no host-side termination: a card that keeps answering CMD2 loops enumeration forever and (fresh CIDs) allocates mmc_ivars+bus children without bound
sys/bus/mmc/mmc.c:1413 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5265 Low 4.6 mtw_attach error path before MTW_LOCK jumps to 'detach:' which does MTW_UNLOCK of a never-acquired lock (plus usb_callout_drain of a never-initialized callout) - lockmgr assertion/panic on malformed USB device
sys/bus/u4b/wlan/if_mtw.c:541 · pass 2 · new
 none untested not_testable untriaged — —
DF-5542 Low 4.6 uep(4) reassembly state machine wedges permanently: sc->buf_len is never cleared on the bad-header continuation path, and the 1-byte stash that arms it is unvalidated
sys/bus/u4b/input/uep.c:222 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5388 Low 4.5 No bus arbitration across transactions: serializer is dropped during RX waits, so concurrent smbus callers interleave inside one transfer
sys/bus/smbus/ichiic/ig4_iic.c:197 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5374 Medium 4.4 NULL-periph deref panic: targwrite()/targread() before TARGIOCENABLE call cam_periph_lock(softc->periph) with periph==NULL
sys/bus/cam/scsi/scsi_target.c:566 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5377 Medium 4.4 Mapped CTIO bounce pbuf leaked forever by targdone()'s not-enabled free path and targdtor(): vm.pbuf_mem_count drain → permanent system-wide raw-I/O wedge (unkillable wswbuf5)
sys/bus/cam/scsi/scsi_target.c:541 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5560 Medium 4.4 iic_attach() never initializes sc->sc_dev — every iicread()/iicwrite()/iicioctl() dereferences NULL and panics the kernel
sys/bus/iicbus/iic.c:50 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5561 Medium 4.4 kdb_trap() longjmp re-entry double-increments db_active; the permanent leak routes every subsequent trap into trap_fatal()+kdb_trap() (all-CPU debugger wedge, cascades to panic: stop_cpus() failed)
sys/platform/pc64/x86_64/db_interface.c:152 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5661 Medium 4.4 vkernel's only host-SIGTERM shutdown path is a silent no-op whenever pid 1 does not catch SIGUSR2: 'Shutting down...' is printed and nothing stops
sys/platform/vkernel64/platform/shutdown.c:93 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5330 Low 4.4 resettodr() pre-epoch wall clock wraps the unsigned Y/M/D conversion into an unbounded loop under crit_enter() — permanent, silent, dump-less kernel hang
sys/platform/pc64/isa/clock.c:1158 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5352 Low 4.4 ioapic_abi_legacy_intr_config(): driver-facing ABI panics production kernels when called with a non-legacy IRQ (KKASSERT-only validation, void return)
sys/platform/pc64/apic/ioapic_abi.c:999 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5357 Low 4.4 pccard_driver_added NULL-deref panic (pf->dev) after a CIS-error card, via kldload of any pccard client driver
sys/bus/pccard/pccard.c:1081 · pass 2 · new
 panic untested not_testable untriaged — —
DF-5423 Low 4.4 Root-hub usbconfig reset never returns: unbounded uninterruptible wait on the root hub's never-serviced re_enumerate_wait — kill -9-immune D4 process and whole-USB-bus wedge until reboot (u4b core, reproduced through the uftdi rig; the D4 hang the umodem pass-2 observed)
sys/bus/u4b/serial/uftdi.c:315 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5430 Low 4.4 MADT BSP-entry omission passes madt_lapic_probe, then KKASSERT(arg.bsp_found) panics the boot (production kernels silently mis-map cpu0)
sys/platform/pc64/acpica/acpi_madt.c:375 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5431 Low 4.4 IOAPIC topology (overlapping GSI bases, duplicate addresses, >16 entries) unvalidated at probe -> unconditional ioapic_add/ioapic_config boot panics
sys/platform/pc64/acpica/acpi_madt.c:615 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5433 Low 4.4 No APIC-ID dedup in MADT CPU enumeration: duplicate entries create phantom AP slots and silently wedge SMP boot
sys/platform/pc64/acpica/acpi_madt.c:290 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5564 Low 4.4 IIC_NOINTR is 0, so WAIT-only requesters sleep without PCATCH and without timeout — unkillable indefinite park (ipmi_ssif/cyapa via SMB_WAIT passthrough), compounded by a lost-wakeup path that can strand sleepers on a free bus forever
sys/bus/iicbus/iiconf.c:66 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5565 Low 4.4 iicbus_request_bus's first do-while spins forever for IIC_DONTWAIT when the bridge callback persistently reports busy — unkillable tight kernel loop with no signal checkpoint (livelock)
sys/bus/iicbus/iiconf.c:92 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5619 Low 4.4 acpi_cst_md_cx_setup accepts SystemIO/SystemMemory C-state descriptors with no operational entry method: crafted _CST panics the kernel unattended at boot (KASSERT 'enter is not set' on INVARIANTS kernels; unconditional panic 'startup setup failed' + enter==NULL resident in the idle table on production kernels)
sys/platform/pc64/acpica/acpi_cstate_machdep.c:81 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5635 Low 4.4 iicbus_detach swallows bus_generic_detach()'s error: a child that fails to detach leaves the bus marked detached + driverless with its softc freed while the child is still attached — the child's next iicbus_request_bus faults on device_get_softc(bus)==NULL (sc->owner at NULL+8)
sys/bus/iicbus/iicbus.c:156 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5649 Low 4.4 SRAT subtable walk advances by firmware Length with no lower bound: zero-length entry wedges srat_probe in an infinite loop (silent boot hang)
sys/platform/pc64/acpica/acpi_srat.c:93 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5673 Low 4.4 /dev/io IOPL grant is unaccounted per-LWP trap-frame state: inherited verbatim across fork, never revoked on last fd close (cpu_clr_iopl clears whichever LWP closes, not the grantees), and survives setuid() privilege drop
sys/platform/pc64/x86_64/sysarch.c:52 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5722 Low 4.4 Resuming a DDB session entered from interrupt context (any breakpoint in clock/interrupt-path code) deterministically panics: td_critcount underflow at session exit
sys/platform/pc64/x86_64/db_interface.c:160 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-5482 Info 4.4 efi_enter()/efi_leave() are not re-entrancy-safe despite LK_CANRECURSE: nested entry clobbers the global efi_savevm and the outer efi_leave() then installs a NULL vmspace → pmap panic (latent landmine)
sys/platform/pc64/x86_64/efirt.c:352 · pass 2 · new
 none untested not_testable untriaged — —
DF-5257 Medium 4.3 Remote net80211 taskqueue wedge: urtwn_tsf_task_adhoc sleeps hz*ni_intval*5/1000 with attacker-controlled IBSS beacon interval
sys/bus/u4b/wlan/if_urtwn.c:2414 · pass 2 · new
 deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257) untested not_testable untriaged — —
DF-5571 Medium 4.2 kdb_trap() longjmp re-entry double-increments db_active (DF-5561 twin): the permanent leak routes every subsequent trap into trap_fatal()+kdb_trap() — permanent all-CPU ddb wedge of the whole vkernel, surviving even panic
sys/platform/vkernel64/x86_64/db_interface.c:150 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5364 Low 4.2 Unchecked kmalloc(M_NOWAIT) in CISTPL_FUNCID/CISTPL_CONFIG handlers: NULL-page write on allocation failure
sys/bus/pccard/pccard_cis.c:790 · pass 2 · new
 panic untested not_testable untriaged — —
DF-5586 Low 4.2 exc_segfault() tail splz() is unguarded: deferred IPIs/interrupt work dispatched inside the interrupted context's critical section and inside outer interrupt handlers — protocol divergence from pc64 doreti's explicit TD_CRITCOUNT gate
sys/platform/vkernel64/x86_64/exception.c:269 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5530 Medium 4.1 usbpf clone create/destroy race: half-published ifnet NULL-derefs in usbpf_clone_destroy (usb_pf.c:191) and bpfdetach (bpf.c:1574)
sys/bus/u4b/usb_pf.c:157 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5253 Low 4.1 uaudio_mixer_sysctl_handler uses sc->sc_mixer_lock across an unbounded user-copy window; a racing USB-audio detach NULLs and frees the lock before the sysctl OIDs are unregistered, causing lockmgr(NULL) -> kernel panic
sys/bus/u4b/audio/uaudio.c:2748 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5339 Low 4.1 probe/enumerate BSP-validation asymmetry: disabled second BSP entry passes probe then trips KKASSERT(!found_bsp) — deterministic boot-time kernel panic
sys/platform/pc64/x86_64/mptable.c:684 · pass 2 · new
 none untested not_testable untriaged — —
DF-5340 Low 4.1 mptable_search() base-memory scan: (base_memory-1)*1024 u_int underflow — KKASSERT(target!=0) boot panic (basemem==1) or mapdev scan of the top-of-4GB MMIO hole (basemem==0)
sys/platform/pc64/x86_64/mptable.c:284 · pass 2 · new
 none untested not_testable untriaged — —
DF-5342 Low 4.1 u_int truncation of the HT-fixup APIC-id mask for ids 32..63 silently corrupts the fixup decision — phantom logical CPUs enumerated, boot hangs on smp_startup_mask
sys/platform/pc64/x86_64/mptable.c:641 · pass 2 · new
 none untested not_testable untriaged — —
DF-5343 Low 4.1 HT-fixup synthetic processor entries inherit the BSP flag: lapic_set_cpuid(0, fake_id) clobbers cpu_id_to_apic_id[0] and unconditionally burned CPU slots leave phantom SIPI targets — SMP boot hang / permanent cpu-0 IPI mis-addressing
sys/platform/pc64/x86_64/mptable.c:702 · pass 2 · new
 none untested not_testable untriaged — —
DF-5345 Low 4.1 Unguarded rdmsr() in print_svm_info()/print_vmx_info(): CPUID-advertised VMX/SVM without MSR backing → ring-0 #GP → boot-time kernel panic
sys/platform/pc64/x86_64/identcpu.c:1279 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5346 Low 4.1 SMAP missing from the hypervisor CPUID-feature blacklist in identify_cpu() despite the blacklist's own CR4-activation rule (buggy-hypervisor boot #GP)
sys/platform/pc64/x86_64/identcpu.c:668 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5366 Low 4.1 cpu_id_to_apic_id[] lacks the -1 sentinel its sibling gets: lapic_config() initializes only apic_id_to_cpu_id[], so any unassigned forward mapping silently aliases APIC ID 0 (the BSP) — INIT/SIPI redirected at the running BSP
sys/platform/pc64/apic/lapic.c:1161 · pass 2 · new
 INIT IPI redirected at the BSP: boot-time reset loop / SMP bringup hang untested not_testable untriaged — —
DF-5459 Low 4.1 Single-caller assumption unenforced: ichsmb_callback no-ops bus request/release, so concurrent /dev/smb ioctls interleave in the transaction state machine and panic KASSERT(sc->ich_cmd == -1)
sys/bus/smbus/ichsmb/ichsmb.c:148 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5533 Low 4.1 usb_proc_drain() cold-path calls suspend_kproc() on a thread that can never acknowledge the stop request — the suspend check is #if 0'd out and its macro calls a function that does not exist in DragonFly — leaving drain asleep forever in suspkp while holding the USB bus lock (boot-time wedge on controller attach failure)
sys/bus/u4b/usb_process.c:86 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5577 Low 4.1 ppb_MS_microseq() discards the return values of its recursive self-calls — a mode-transfer loop that aborts on error is skipped and the whole MS_OP_PUT/GET reports success (initxfer's MS_RET(0) zeroes the error channel first)
sys/bus/ppbus/ppb_msq.c:301 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5583 Low 4.1 acpi_sci_test(): unchecked register_int() return passed to unregister_int() — kernel NULL-deref panic from crafted FADT SciInterrupt
sys/platform/pc64/acpica/acpi_fadt.c:198 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5601 Low 4.1 ig4 PCI attach-error unwinder re-enters the serializer leaked by ig4iic_attach()'s bus_setup_intr error path: ig4_pci.c:195 -> ig4_pci.c:208 -> ig4_iic.c:678 lwkt_serialize_enter on a self-held, explicitly non-recursive serializer — boot-time kernel panic (INVARIANTS) / hard self-deadlock (release)
sys/bus/smbus/ichiic/ig4_pci.c:193 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5622 Low 4.1 Reachable KKASSERT panic on firmware-supplied _PSS control values: endpoint P-states are never validated and vid>=rvo is never checked before amd0f_set_fidvid asserts
sys/platform/pc64/x86_64/cpufreq_machdep.c:92 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5637 Low 4.1 smbus_release_bus tears down the parent-bridge exclusion BEFORE validating ownership and wakes waiters on the EACCES path (DF-5566 twin) — non-owner release frees the iicbus under the real owner and can wedge the bus permanently
sys/bus/smbus/smbconf.c:160 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5640 Low 4.1 TSC cputimer registered with unvalidated tsc_frequency → integer division by zero (boot-time kernel panic)
sys/cpu/x86_64/misc/cputimer_tsc.c:145 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5527 Info 4.1 gpio_cherryview_unmap_intr never masks the IRQ line: GPIO_FREE_INTR without a preceding GPIO_TEARDOWN_INTR leaves an armed orphaned interrupt (latent irq-storm / hard-lockup DoS)
sys/bus/gpio/gpio_intel/gpio_cherryview.c:380 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5587 Info 4.1 Any fault in a vkernel cothread dies silently through unbounded exc_segfault recursion: SA_NODEFER + empty sa_mask re-entry on a %gs==0 thread hits kern_trap's mycpu load and recurses ~308k times until the host kills the vkernel — no panic, no dump, no diagnostic
sys/platform/vkernel64/x86_64/exception.c:222 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5623 Info 4.1 Unbounded FID/VID pending-bit spin and non-converging phase-2 ramp loop; success returned without completion verification
sys/platform/pc64/x86_64/cpufreq_machdep.c:53 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5298 Medium 4.0 umass CBI command-phase error path leaks the in-flight CCB when the device detaches during teardown (sense-fetch fallback is a silent no-op) — unkillable hung process + leaked kernel CCB
sys/bus/u4b/storage/umass.c:1871 · pass 2 · new
 none (demonstrated); claimed impact: local DoS - permanent unkillable D-state process plus leaked kernel CCB, triggered by an evil CBI USB device that hangs an ADSC control transfer and then self-disconnects while a user I/O command is in flight not_reproduced not_testable untriaged — —
DF-5311 Low 3.9 dagetcapacity() parses READ CAPACITY results from a non-zeroed heap buffer; short transfer with good status publishes stale kernel heap as disk geometry and prints it to console/dmesg
sys/bus/cam/scsi/scsi_da.c:2199 · pass 2 · new
 stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313) untested not_testable untriaged — —
DF-5595 Low 3.9 sim refcount release protocol is non-atomic and unenforced — asymmetric with its atomic acquisition side and its cmpset-loop neighbors
sys/bus/cam/cam_sim.c:246 · pass 2 · new
 none untested not_testable untriaged — —
DF-5312 Low 3.8 DA_CCB_TRIM completion decrements outstanding_cmds_rd that the TRIM start path never increments: permanent queue-accounting underflow disables read throttling and tps balancing
sys/bus/cam/scsi/scsi_da.c:1327 · pass 2 · new
 stale-heap geometry disclosure (DF-5311) / permanent throttle underflow (DF-5312) / root-gated ioctl panic (DF-5313) untested not_testable untriaged — —
DF-5470 Medium 3.6 Backtracer frame walk trusts stack content as frame pointers — INKERNEL() defined but never used; walk escapes into user-space, arbitrary mapped, and unmapped memory (attacker-steerable panic-time trace, msgbuf forensic eviction)
sys/platform/pc64/x86_64/db_trace.c:227 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5385 Low 3.6 SMBus block write transmits the command byte where the byte-count belongs — every Block Write is malformed on the wire
sys/bus/smbus/ichiic/ig4_iic.c:381 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5387 Low 3.6 Read pipeline issues STOP despite SMB_TRANS_NOSTOP — chained I2C reads of >=2 bytes are terminated early
sys/bus/smbus/ichiic/ig4_iic.c:440 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5389 Low 3.6 RX-timeout error path leaks queued read allowances and stale FIFO state into the next same-slave transaction
sys/bus/smbus/ichiic/ig4_iic.c:448 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5436 Low 3.6 ulpt(4): cross-cdev open/close TOCTOU on sc_fflags breaks exclusive open, kills a reader session, defeats the reset/status-poll guards
sys/bus/u4b/serial/ulpt.c:411 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5580 Low 3.6 __udivmodti4 masked-select init performs shift counts outside the 64-bit operand domain (count>=64 and unsigned-wrapped negative counts) at ten sites — formally UB, provably masked today, silent-miscompilation hazard for every in-kernel 128-bit division on any future compiler upgrade
sys/platform/pc64/x86_64/__udivti3.c:231 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5590 Low 3.6 isavga_attach() discards both bus_alloc_resource() returns and never unwinds the legacy VGA window claims on attach failure — permanent orphaned rman claims (I/O 0x3c0-0x3df, MEM 0xa0000-0xbffff) on VGA-less BIOS boots, plus leaked cdev under FB_INSTALL_CDEV
sys/bus/isa/vga_isa.c:144 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5290 Low 3.4 pmap_extract()/pmap_kextract() return (va & PAGE_MASK)-only garbage as a physical address when the PT exists but the PTE is empty — vkernel twin of pc64 DF-5245; live caller kvm_access_check() (/dev/kmem) then accepts unmapped KVA and mem I/O lands on guest-physical page 0
sys/platform/vkernel64/platform/pmap.c:662 · pass 2 · new
 wrong-page /dev/kmem I/O (DF-5290) / latent PDP reclaim (DF-5291) untested not_testable untriaged — —
DF-5458 Low 3.4 ichsmb_bread validates and transmits the caller's *count, but /dev/smb passes an uninitialized stack byte — SMB_BREAD deterministically fails EINVAL and garbage reaches the ICH_D0 device register
sys/bus/smbus/ichsmb/ichsmb.c:424 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5522 Low 3.4 SMBus block count byte is omitted in both directions: every Block Write through iicsmb is malformed on the wire and every Block Read returns one-byte-shifted data
sys/bus/iicbus/iicsmb.c:471 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5600 Low 3.4 ig4iic_pci_attach()'s bzero() wipes the sc->version stored by ig4iic_pci_probe(): every PCI ig4 controller (all 34 IDs incl. Skylake/Apollo Lake/Cannon Lake) is programmed as a Haswell — HSW-only SWMODE write to offset 0x808 on non-Haswell silicon, wrong LTR offsets, and the HSW/ATOM-only COMP_VER boot gate misapplied to newer generations
sys/bus/smbus/ichiic/ig4_pci.c:151 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5633 Low 3.4 iicbus_attach unconditionally re-creates the ic/iic/iicsmb trio on every attach: children survive driver teardown, so each detach+re-attach cycle leaks 3 struct bsd_device and mints duplicate iicN/iicsmbN units (duplicate /dev/iicN nodes on one physical bus)
sys/bus/iicbus/iicbus.c:144 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5422 Medium 3.3 ucom/uftdi TX close race: write(2) of more than one 64-byte transfer followed by close(2) wedges the closer in uninterruptible ttywait forever and silently drops all but the first bulk-OUT packet (deterministic with an evil FTDI that NAKs bulk-OUT)
sys/bus/u4b/serial/uftdi.c:390 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2612 Low 3.3 ses_getputstat swallows all decode/encode/device errors and returns 0 (fail-open enclosure status)
sys/bus/cam/scsi/scsi_ses.c:1268 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5264 Low 3.3 mtw_stop never frees the endpoint queues; the next mtw_init_locked memsets them via mtw_setup_tx_list, orphaning every queued mbuf and its ieee80211_node reference - repeatable kernel leak per down/up cycle
sys/bus/u4b/wlan/if_mtw.c:4647 · pass 2 · new
 none untested not_testable untriaged — —
DF-5279 Low 3.3 pci_get_vpd_readonly_method(): missing break discards every successful keyword match — lookup always returns ENXIO
sys/bus/pci/pci.c:1354 · pass 2 · new
 VPD lookup always ENXIO (DF-5279) / devq UAF read race (DF-5280) / boot-time off-by-one (DF-5281) untested not_testable untriaged — —
DF-5322 Low 3.3 struct tlabel leaked on every split-transaction timeout (firewire_xfer_timeout unlinks without kfree)
sys/bus/firewire/firewire.c:348 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5417 Low 3.3 Bind/xfer lifecycle leaks and open race: fw_bindadd failure leaks fwb+xfer, CBIND/close free binds without their xferlist xfers, fw_open si_drv1 check-then-set race double-allocates fw_drv1
sys/bus/firewire/fwdev.c:165 · pass 2 · new
 slow kernel memory exhaustion / open-race panic untested not_testable untriaged — —
DF-5428 Low 3.3 UVCIOC_CTRL_QUERY copyin()s the already-staged kernel ioctl buffer: the XU control-query ioctl unconditionally returns EFAULT (dead feature)
sys/bus/u4b/uvc/uvc_v4l2.c:677 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5534 Low 3.3 nfs_mount() swallows nfs_mountroot() failure: failed diskless NFS-root mount reported as success -> NULL mnt_data deref (Fatal trap 12) in nfs_root instead of clean 'Root mount failed' fallback
sys/platform/vkernel64/x86_64/autoconf.c:279 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5538 Low 3.3 vkernel64 fuwordadd32()/swapu32() page-tail straddle guard copy-pasted from the 64-bit twins (sizeof(uint64_t)): a 32-bit word at page offset 0xFFC that fits in-page is spuriously failed with the -1 fault sentinel — umtx_sleep(2) futexes at page tail never sleep on matching values and sleep full timeouts on a phantom -1
sys/platform/vkernel64/platform/copyio.c:165 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5608 Low 3.3 cothread_wakeup()'s SIGINT vector forces a process-wide empty-handler latch that permanently disables the vkernel console's ^C handling
sys/platform/vkernel64/platform/cothread.c:192 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5774 Low 3.3 -n ':' / -n '' : strtok() NULL fed to strtol() crashes the vkernel during option parsing
sys/platform/vkernel64/platform/init.c:394 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5517 Low 3.2 ubser can never clear a break: VENDOR_CLEAR_BREAK (ubser.c:102) is dead code — ubser_cfg_set_break only sends VENDOR_SET_BREAK inside 'if (onoff)', so TIOCCBRK and port close are silent no-ops and the device's line stays broken until power-cycle
sys/bus/u4b/serial/ubser.c:102 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5461 Low 3.0 ichsmb_wait timeout path never aborts the in-flight transaction — late completions are mis-attributed to the next command, which then returns success with stale/zero data
sys/bus/smbus/ichsmb/ichsmb.c:637 · pass 2 · new
 none untested not_testable untriaged — —
DF-5503 Low 3.0 ioapic.c parameter-validation gap cluster: containment-defeating overlap test, npin<=0 acceptance, negative-pin acceptance in ioapic_gsi(), and completely unvalidated pin/select in ioapic_pin_prog() (the sink of the ABI entry points DF-5351/5352 proved callable on production kernels)
sys/platform/pc64/apic/ioapic.c:236 · pass 2 · new
 nested-GSI-space misrouting + undefined IOAPIC register programming untested not_testable untriaged — —
DF-5506 Low 3.0 All three amdsmb poll-loop timeouts are dead code (post-decrement off-by-one): wedged EC/SMBus controller is reported as SMB_ENOERR success with the PREVIOUS transaction's data and count after a 5.4s lock-held busy spin; SMB_ETIMEOUT is unreachable
sys/bus/smbus/amdsmb/amdsmb.c:212 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5511 Low 3.0 ppb_release_bus() saves the device context after clearing ppb_owner and outside crit: cross-device chipset-mode context corruption race
sys/bus/ppbus/ppbconf.c:528 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5614 Low 3.0 fwdma_map_cb and both fwdma load call sites discard the bus_dmamap_load error — stale/garbage bus_addr would be programmed into OHCI DMA registers (latent protocol violation)
sys/bus/firewire/fwdma.c:53 · pass 2 · new
 none demonstrated (latent): garbage/stale fwdma bus_addr programmed into OHCI registers on any bus_dmamap_load failure -> hardware DMA against a wild physical address; unreachable on the current x86_64 busdma because loads of bus_dmamem_alloc'd memory cannot fail there untested not_testable untriaged — —
DF-5554 Low 2.9 cam_calc_geometry() truncates u64 volume_size into uint32_t math — silent modular wrap of C/H/S geometry for crafted-capacity devices
sys/bus/cam/cam.c:378 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5408 Low 2.8 sys_sigreturn installs raw mc_rflags — the PSL_VM_UNSUPP strip defangs EFL_SECURE (validate-vs-install mismatch; pc64 mirror)
sys/platform/vkernel64/x86_64/cpu_regs.c:366 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5589 Info 2.8 pmap_inval.c discards every madvise()/vmspace_mcontrol() return value — the vkernel's sole memory-revocation primitive fails silently, leaving stale (possibly writable) host PTEs with no diagnostic
sys/platform/vkernel64/platform/pmap_inval.c:85 · pass 2 · new
 silent loss of the sole memory-revocation primitive on any future failure untested not_testable untriaged — —
DF-5256 Low 2.5 DragonFly-only unlocked traversal of ifp->if_multiaddrs in urtwn_set_multi (upstream takes if_maddr_rlock)
sys/bus/u4b/wlan/if_urtwn.c:4898 · pass 2 · new
 deterministic 640KB/cycle kernel heap leak (DF-5255) / maddr list race panic (DF-5256) / remote taskqueue wedge (DF-5257) untested not_testable untriaged — —
DF-5333 Low 2.5 chdone() CH_CCB_PROBE reads and prints uninitialized stack announce_buf[80] to console/dmesg when cherror() returns 0 for a non-CAM_REQ_CMP completion (SCSI INTERMED / RECOVERED ERROR)
sys/bus/cam/scsi/scsi_ch.c:541 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5373 Low 2.5 bus_dmamap_create() leaks the freshly kmalloc'd map when the initial bounce-page allocation partially fails (vkernel never got pc64's kfree(*mapp) error-path fix)
sys/platform/vkernel64/platform/busdma_machdep.c:333 · pass 2 · new
 device-visible corrupted S/G lists (DF-5371) / 72B-per-failure leak (DF-5373) untested not_testable untriaged — —
DF-5386 Low 2.5 TX-abort condition is read and discarded — writes to a non-ACKing slave return SMB_ENOERR success (silent write failure)
sys/bus/smbus/ichiic/ig4_iic.c:482 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5418 Low 2.5 ppb_peripheral_negotiate() spin post-decrement off-by-one: Event-4 timeout detection is dead code and a handshake answered on the 10th poll spuriously fails with ENODEV
sys/bus/ppbus/ppb_1284.c:201 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5437 Low 2.5 ulpt(4): unprivileged open(/dev/ulptN) stalled ~4s uninterruptibly by an evil printer NAKing SOFT_RESET (SIGKILL-immune)
sys/bus/u4b/serial/ulpt.c:177 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5513 Low 2.5 ppb_request_bus() is not idempotent for the current owner: an owner re-request sleeps uninterruptibly forever on itself
sys/bus/ppbus/ppbconf.c:464 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5535 Low 2.5 minidump PDP-walk off-by-one: pages mapped in the last 1GB slot of kernel VA ([0xffffffffc0000000, KvaEnd)) are silently missing from every crash dump
sys/platform/pc64/x86_64/minidump_machdep.c:238 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5568 Low 2.5 vktimer_intr_reload(): wakeup CAS loop is dead code — unsigned (sysclock_t) delta cast makes the while-condition always false, disabling the atomic vktimer_target-lowering protocol
sys/platform/vkernel64/platform/systimer.c:301 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5609 Low 2.5 cothread_create/cothread_delete ignore pthread_create()/pthread_join() failure — EAGAIN leaves a registered virtual interrupt, a NULL pthread handle, and undefined pthread_kill/pthread_join on it
sys/platform/vkernel64/platform/cothread.c:110 · pass 2 · new
 vkernel host crash / dead device channel (5609); <=1s systimer latency spikes (5610) untested not_testable untriaged — —
DF-5610 Low 2.5 cothread_wakeup()'s vktimer_ts zeroing races vktimer_thread's reload store — wakeup can be silently consumed, delaying all systimers by up to the stale sleep
sys/platform/vkernel64/platform/cothread.c:188 · pass 2 · new
 vkernel host crash / dead device channel (5609); <=1s systimer latency spikes (5610) untested not_testable untriaged — —
DF-5526 Info 2.5 npxprobemask() lacks the mxcsr_mask==0 fallback guard: a non-conforming FXSAVE probe zeroes npx_mxcsr_mask, forcing MXCSR=0 (all SIMD FP exceptions unmasked) and a SIGFPE on every FPU restore
sys/platform/pc64/x86_64/npx.c:134 · pass 2 · new
 MXCSR=0 + SIGFPE on every restore on mxcsr_mask==0 hardware untested not_testable untriaged — —
DF-5557 Info 2.5 npxprobemask() lacks the mxcsr_mask==0 fallback guard — non-conforming FXSAVE probe zeroes npx_mxcsr_mask and SIGFPEs every FPU restore (DF-5526 twin)
sys/platform/vkernel64/x86_64/npx.c:112 · pass 2 · new
 none untested not_testable untriaged — —
DF-5407 Medium 2.4 uplcom_attach() pins the per-bus USB explore thread for up to ~70 s per insertion via 14 sequential synchronous 5 s-timeout EP0 vendor requests (uplcom_reset + uplcom_pl2303_init) that an evil PL2303 device stretches by answering each successfully at just-under-timeout
sys/bus/u4b/serial/uplcom.c:412 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5251 Low 2.4 run_stop early-return on failed USB read skips run_unsetup_tx_list; the next run_init_locked->run_setup_tx_list memsets the queues, orphaning all queued mbufs and node references (repeatable leak with a wedged/hostile device)
sys/bus/u4b/wlan/if_run.c:6201 · pass 2 · new
 UAF read/write on freed node (DF-5250) / repeatable mbuf+node leak DoS (DF-5251) / device-bound 4B OOB (DF-5252) untested not_testable untriaged — —
DF-5270 Low 2.4 Last-TRB TD Size clear masks only 4 of the 5 TDSZ field bits (15 instead of 31) — controller mispredicts remaining packets on large transfers
sys/bus/u4b/controller/xhci.c:2016 · pass 2 · new
 streams-endpoint transfer hangs (DF-5269) / large-transfer miscompletion (DF-5270) untested not_testable untriaged — —
DF-5359 Low 2.4 uipaq_attach() stalls the per-bus USB explore thread up to ~12.8s on an unresponsive crafted device: 64 unconditional retries of the magic SET_CONTROL_LINE_STATE request (100ms timeout + ~100ms pause each) with no early-out on stall or device-removal, while holding the device enum lock
sys/bus/u4b/serial/uipaq.c:1129 · pass 2 · new
 none untested not_testable untriaged — —
DF-5367 Low 2.4 ufoma mode-switch ACK waits are uninterruptible (1s link + 15s activate): unplug racing an open/close stalls ufoma_detach()'s usb_proc_drain on the USB hub event thread for up to ~16-18s per cycle
sys/bus/u4b/serial/ufoma.c:527 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5383 Low 2.4 umcs7840_cfg_open/cfg_close chain of 28/4 sequential synchronous 500ms EP0 requests: evil device stretches every port open to ~14 s and blocks close(2) and unplug (hub event thread) uninterruptibly for ~16 s per cycle
sys/bus/u4b/serial/umcs.c:410 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5421 Low 2.4 uchcom cfg callbacks chain 12+2 sequential 1000ms-timeout EP0 vendor requests with no error propagation: evil CH340/CH341 stretches every tcsetattr to ~12s of ucom-taskqueue occupancy, blocking close(2) uninterruptibly and stalling the USB hub event thread on unplug (user-amplifiable)
sys/bus/u4b/serial/uchcom.c:369 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5424 Low 2.4 uftdi cfg callbacks chain 2+3 sequential 1000 ms-timeout EP0 vendor requests with discarded errors: evil FTDI stretches every open(2) to ~5.2 s and every tcsetattr to ~3.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) and stalling the USB hub event thread on unplug (user-amplifiable)
sys/bus/u4b/serial/uftdi.c:369 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5425 Low 2.4 uslcom cfg callbacks chain 3+1+1 sequential 1000 ms-timeout EP0 vendor requests with discarded errors: evil CP210x stretches every tcsetattr to ~3.1 s and every open/param/close cycle to ~5.2 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) (~8.2 s with two queued tsetattrs) and stalling the USB hub event thread on unplug (user-amplifiable)
sys/bus/u4b/serial/uslcom.c:418 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5487 Low 2.4 uvisor cfg_close: one synchronous 1000 ms-timeout EP0 vendor control-IN with discarded error; an evil Handspring/Palm-VID:PID device stretches every close(2) to ~1 s of uninterruptible ucom-taskqueue occupancy and stalls the unplug (hub event thread) drain
sys/bus/u4b/serial/uvisor.c:529 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5488 Low 2.4 uvisor_attach/uvisor_init: up to 2× synchronous 5000 ms-timeout EP0 control requests on the per-bus USB explore thread before the port exists; an evil Visor/Palm/Clie VID:PID adapter pins bus-wide device enumeration for ~5 s (10 s for SONY CLIE_35) per insertion
sys/bus/u4b/serial/uvisor.c:326 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5496 Low 2.4 umct cfg callbacks chain sequential synchronous 1000 ms-timeout EP0 vendor requests with discarded errors: an evil MCT/Belkin/Sitecom adapter stretches the first-open cycle to ~4.0 s and every tcsetattr (any rate, incl. B0 — no branch) to ~2.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind the queue (measured 5.95 s with one queued tcsetattr, 8.05 s with a 5-burst; a sustained loop extends without bound) and stalling the USB hub event thread on unplug (user-amplifiable)
sys/bus/u4b/serial/umct.c:332 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5504 Low 2.4 ucycom cfg callbacks issue synchronous 1000 ms-timeout EP0 SET_REPORT requests with discarded errors: an evil DeLorme Earthmate stretches every open(2)/tcsetattr to ~1.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind the queue and stalling the USB hub event thread on unplug (user-amplifiable; smallest cfg-stall family member)
sys/bus/u4b/serial/ucycom.c:438 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5505 Low 2.4 ucycom_attach pins the per-bus USB explore thread ~5 s per insertion via the HID report-descriptor fetch: an evil Earthmate NAKing (or slowly answering) GET_DESCRIPTOR(REPORT) stalls bus-wide device enumeration for the full USB_DEFAULT_TIMEOUT (family minimum: exactly one request)
sys/bus/u4b/serial/ucycom.c:231 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5515 Low 2.4 ubser cfg-path stall: TIOCSBRK's single synchronous 1000 ms EP0 VENDOR_SET_BREAK request with discarded error pins the per-adapter ucom taskqueue 1 s per ioctl; close(2) blocks uninterruptibly behind it and unplug drains the same queue; sustained break loop = unbounded occupancy
sys/bus/u4b/serial/ubser.c:480 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5516 Low 2.4 ubser_attach GET_NUMSER: first bus transaction is a synchronous 5000 ms-timeout vendor control read on the per-bus USB explore thread — an evil BWCT-string adapter pins bus-wide device enumeration ~5 s per insertion (or ~4.9 s with every request succeeding)
sys/bus/u4b/serial/ubser.c:249 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5540 Low 2.4 uark cfg-chain synchronous-EP0 stall: uark_cfg_param chains six 1000 ms uninterruptible control writes whose errors are discarded — a silent/stalling ARK3116 (or unprivileged tcsetattr loop against one) parks the shared ucom taskqueue ~6.1 s per tcsetattr, blocking SIGKILL-immune close(2) behind it and stalling the USB hub event thread on unplug/detach drain (cfg-stall family, DF-5532 occupancy delta)
sys/bus/u4b/serial/uark.c:361 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5400 Info 2.4 mos_bulk_read_callback() passes actlen instead of pktlen to uether_rxbuf(): every received frame is delivered one byte too long (trailing device status byte included), and transfers of 2045..2056 bytes are silently dropped without ierrors
sys/bus/u4b/net/if_mos.c:817 · pass 2 · new
 non-canonical frames up the stack (DF-5400) / skewed interface stats (DF-5401) untested not_testable untriaged — —
DF-5402 Medium 2.3 sg(4) data-carrying SG_* ioctls are dead on DragonFly: IOC_VOID argument indirection misuse returns EFAULT for every SG_IO/SG_GET_VERSION_NUM/SG_SET_TIMEOUT/SG_GET_RESERVED_SIZE/SG_GET_SCSI_ID call
sys/bus/cam/scsi/scsi_sg.c:483 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5295 Low 2.3 rum_tx_mgt() pops a tx_free slot before validating the frame; the ENOENT/ENOBUFS error paths orphan it permanently - seven privileged raw injections wedge the TX path until down/up
sys/bus/u4b/wlan/if_rum.c:1478 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-5380 Low 2.3 usb_quirk_get_entry() all-zero key unconditionally aliases the last dynamic-quirk slot; slot allocation never clears quirks[] — dynamic quirk-table state corruption (stale quirks inherited by real device entries; all-zero ADD/REMOVE mutate live entries)
sys/bus/u4b/quirk/usb_quirk.c:786 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5468 Low 2.3 vga_pci_map_bios() ROM path is dead on spec-conformant devices: lazy pci_alloc_map() misclassifies the ROM BAR as I/O because the enable bit survives the sizing readback
sys/bus/pci/vga_pci.c:217 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5474 Low 2.3 Stock VKERNEL64 platform does not build: kern_mib.c's __build_id_start/__build_id_end are unresolvable — vkernel64's SYSTEM_LD override drops ${ELDFLAGS} (--build-id=sha1) and never uses the platform ldscript
sys/platform/vkernel64/x86_64/db_trace.c:75 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5523 Low 2.3 iicsmb block entry points perform zero count validation while the only /dev/smb caller passes an uninitialized stack byte: kernel-stack junk selects the on-wire transfer length (observed 0 and 255) and is disclosed back via smbcmd.rcount
sys/bus/iicbus/iicsmb.c:474 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5559 Low 2.3 iicbus_get_addr() returns uninitialized kernel stack — iic_probe() is a stack-garbage coin flip and /dev/iicN is dead-on-arrival
sys/bus/iicbus/iic.c:115 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5620 Low 2.3 acpi_cst_cx_mwait_setup executes global C3-preamble side effects (cpu_mwait_cx_no_bmsts/no_bmarb) on the rejected-descriptor error path: an invalid _CST MWAIT hint still disables the system-wide C3 BM_STS check and bus-master arbitration discipline
sys/platform/pc64/acpica/acpi_cstate_machdep.c:161 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5626 Low 2.3 ppb_poll_bus() PPB_POLL path busy-spins max*10000 DELAY(1) iterations with no sleep, no signal checkpoint and no clamp on max — unkillable CPU-livelock windows (measured ~20s for the in-tree max=100 call)
sys/bus/ppbus/ppb_base.c:60 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5776 Low 2.3 /dev/pci PCIOCREAD/PCIOCWRITE accept unbounded pi_reg and report success (rc=0, sentinel data) for config offsets no mechanism can decode; PCIOCGETBAR validates pbi_reg not at all
sys/bus/pci/pci_user.c:610 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5463 Info 2.3 PTIOCSETTIMEOUT signed-multiply overflow wraps softc->io_timeout negative (UB), consumed as u_int32_t CDB timeout
sys/bus/cam/scsi/scsi_pt.c:649 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5531 Info 2.3 Disabled bpf_peers_present early-out: tap kmallocs and copies every USB transfer payload even with no bpf listener (36-44x per-transfer overhead)
sys/bus/u4b/usb_pf.c:362 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5555 Info 2.3 DF-5553's CDC-renumber misfire confirmed on the audio template: usb_make_raw_desc()'s (bLength>=5, type 0x24, subtype in {1,6}) heuristic fires on 9 of the 22 raw tables — AS_GENERAL bDelay corrupted 3->4 (iface 1) and 1->3 (iface 2) in every generated descriptor set; 7 interface-0 hits (bcdADC-hi, bUnitID/bSourceID) at zero delta today are silent audio-graph corruption under any nonzero-interface rebase
sys/bus/u4b/template/usb_template_audio.c:96 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5447 Low 2.1 uvscom_pre_param() inverted switch: every baud rate — including all 11 supported ones — returns EINVAL; the port can never be programmed and uvscom_cfg_param() is unreachable
sys/bus/u4b/serial/uvscom.c:514 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5449 Low 2.1 uvscom cfg callbacks chain sequential 1000 ms-timeout EP0 vendor requests with discarded errors: an evil SUNTAC-VID:PID device stretches the open cycle to ~4.1 s and open+close to ~6.1 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune and stalling the USB hub event thread on unplug
sys/bus/u4b/serial/uvscom.c:640 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5456 Low 2.1 umoscom cfg callbacks chain 14 sequential 1000 ms-timeout EP0 vendor requests with discarded errors on first open (4 param + 5 open + 3 line-state + 2 status): evil MCS7703 stretches one open(2) to ~14.2 s of uninterruptible ucom-taskqueue occupancy, blocks close(2) SIGKILL-immune behind it, stalls the USB hub event thread on unplug; every later tcsetattr adds ~4.1 s (user-amplifiable)
sys/bus/u4b/serial/umoscom.c:368 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5476 Low 2.1 ubsa cfg callbacks chain synchronous 1000 ms-timeout EP0 vendor requests with discarded errors: an evil Belkin/eTek/GoHubs/Peracom adapter stretches every tcsetattr to 5.1 s (7.1 s for B0) and the first-open line-state cycle to 3.0 s of uninterruptible ucom-taskqueue occupancy, blocking close(2) SIGKILL-immune behind it (measured 9.97 s with one queued B0 tcsetattr) and stalling the USB hub event thread on unplug (user-amplifiable)
sys/bus/u4b/serial/ubsa.c:359 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5489 Info 2.1 uvisor VISOR GET_CONNECTION_INFORMATION: actlen never validated after a SHORT_XFER_OK control-IN into an 18-byte stack struct; the USB_DEBUG connection loop consumes uninitialized kernel stack when an evil Visor short-transfers (Info: no production consumer)
sys/bus/u4b/serial/uvisor.c:387 · pass 2 · new
 none untested not_testable untriaged — —
DF-5269 Low 2.0 xhci_check_transfer decodes a stream ID from the completion TRB, which per xHCI spec carries none — completions on streams endpoints are silently dropped (transfer hang/DoS)
sys/bus/u4b/controller/xhci.c:908 · pass 2 · new
 streams-endpoint transfer hangs (DF-5269) / large-transfer miscompletion (DF-5270) untested not_testable untriaged — —
DF-5494 Low 2.0 uether_ifdetach() never drains ue->ue_rxq — mbufs enqueued by a final RX callback that exits without flushing leak with the freed softc (live path: cdce bulk-read tr_stall skips uether_rxflush)
sys/bus/u4b/net/usb_ethernet.c:576 · pass 2 · new
 mbuf cluster leak per stall-unplug cycle (DF-5494) / future unguarded-len overflows (DF-5495) untested not_testable untriaged — —
DF-5770 Low 2.0 mmc_ivars leaked on every discovery error-break of a newly-allocated card (hostile card leaks ~0.7 kB per scan)
sys/bus/mmc/mmc.c:1440 · pass 2 · new
 slow kernel-memory leak (5770) / latent UAF (5771) untested not_testable untriaged — —
DF-5349 Low 1.9 bus_dmamap_load() with map==NULL silently disables the tag's bounce constraints (segments returned with out-of-window addresses)
sys/platform/pc64/x86_64/busdma_machdep.c:601 · pass 2 · new
 device-side out-of-window DMA (DF-5349) / segments leak + tag UAF window (DF-5350) untested not_testable untriaged — —
DF-5450 Low 1.9 nexus_activate_resource() is not idempotent: re-activation of an active MMIO resource double-maps and orphans kernel_map KVA + RW PTEs; no mapping rollback on activation failure
sys/platform/pc64/x86_64/nexus.c:427 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5512 Low 1.9 ppbus_setup_intr() accepts overlapping interrupt registrations and overwrites its cookie bookkeeping: forced unregistration on bus release orphans live handlers
sys/bus/ppbus/ppbconf.c:426 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5539 Low 1.9 iicbb_print_child discloses an uninitialized kernel stack byte (and 'restores' it as the bus address) whenever the parent reset returns non-IIC_ENOADDR — reachable in-tree via lpbb's ppbus-busy path
sys/bus/iicbus/iicbb.c:169 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-5545 Low 1.9 xhci_pci_detach() swallows device_delete_children() failure: unconditional IRQ/MMIO/DMA teardown and kfree'd softc under a still-attached child, with detach reporting success
sys/bus/u4b/controller/xhci_pci.c:355 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5546 Low 1.9 Forced-polling mode leaks the pci_alloc_1intr MSI allocation on every xhci attach/detach cycle (release gated on a never-created IRQ resource)
sys/bus/u4b/controller/xhci_pci.c:234 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5566 Low 1.9 iicbus ownership protocol is not MP-safe and mis-ordered: crit_enter gives no cross-CPU exclusion (double-acquire), and iicbus_release_bus frees the bridge resource BEFORE validating ownership (non-owner teardown of bridge exclusion)
sys/bus/iicbus/iiconf.c:100 · pass 2 · new
 double bus acquisition + non-owner bridge release -> external-device wire corruption untested not_testable untriaged — —
DF-5642 Low 1.9 smbus_attach unconditionally re-creates the generic child and the whole 96-address probe child set on every attach: children survive every teardown path, so each detach+re-attach cycle leaks the full set of struct bsd_device and mints duplicate remapped /dev/smbN[-XX] nodes whose forced-slave address encoding no longer matches the device it probed
sys/bus/smbus/smbus.c:94 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5653 Low 1.9 elcr_write_trigger(): unlocked read-modify-write of the global elcr_status shadow — concurrent legacy config_intr silently drops trigger-mode updates (measured 3,985 lost updates in a 2-second two-CPU run)
sys/platform/pc64/icu/elcr.c:103 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5310 Info 1.9 usb_open() error path after successful fifo opens leaks the opened fifos with curr_cpd pointing at the freed cpd (latent — devfs_set_cdevpriv cannot currently fail for a fresh open)
sys/bus/u4b/usb_dev.c:929 · pass 2 · new
 single-owner invariant break -> concurrent-setup entry / latent dangling curr_cpd untested not_testable untriaged — —
DF-5325 Info 1.9 ukbd_detach mutates keyboard state and runs ukbd_interrupt() without kb_lock, racing the kb_lock-holding ukbd_timeout callout (in-bounds input-ring corruption on unplug)
sys/bus/u4b/input/ukbd.c:1380 · pass 2 · new
 garbled trailing key events / ring count drift at unplug untested not_testable untriaged — —
DF-5331 Info 1.9 DELAY()/DRIVERSLEEP() do not clamp negative arguments — sign-extended usec count converts to a multi-hour (i8254: multi-month) kernel spin
sys/platform/pc64/isa/clock.c:386 · pass 2 · new
 none untested not_testable untriaged — —
DF-5353 Info 1.9 USB_TEMP_PHONE gadget template is compiled and advertised but unreachable: missing case in usb_temp_setup_by_index()
sys/bus/u4b/template/usb_template.c:1346 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5391 Info 1.9 No suspend/resume/shutdown lifecycle: controller loses programming across D3 while softc caches stay 'valid' — bus dead until reload
sys/bus/smbus/ichiic/ig4_iic.c:493 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5419 Info 1.9 ppb_1284_read_id() early error returns leave the *read out-parameter uninitialized (caller consumes kernel stack on any peer-driven negotiation failure)
sys/bus/ppbus/ppb_1284.c:589 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5460 Info 1.9 ichsmb_attach error path: lockuninit() runs while the interrupt handler is still registered and the smbus child is leaked
sys/bus/smbus/ichsmb/ichsmb.c:132 · pass 2 · new
 none untested not_testable untriaged — —
DF-5508 Info 1.9 amdsmb_detach performs no quiesce/drain: kldunload during an in-flight locked transaction runs lockuninit() on a held lock and releases the I/O resource under live bus_read_1/bus_write_1 (post-release port I/O)
sys/bus/smbus/amdsmb/amdsmb.c:175 · pass 2 · new
 none untested not_testable untriaged — —
DF-5529 Info 1.9 urio_open: WRITE-stall flag updated without sc_lock, asymmetric with the locked READ path
sys/bus/u4b/storage/urio.c:404 · pass 2 · new
 lost stall-flag update -> one spurious/missed ENDPOINT_HALT clear untested not_testable untriaged — —
DF-5567 Info 1.9 cb_dumpdata() has no PAGE_SIZE floor on di->maxiosize: a dump device reporting sub-page si_iosize_max makes chunk==0 and spins the panic-dump loop forever (no dump, silent hang)
sys/platform/pc64/x86_64/dump_machdep.c:168 · pass 2 · new
 silent panic-dump hang (no dump produced) untested not_testable untriaged — —
DF-5569 Info 1.9 DRIVERSLEEP() divides by its usec argument with no zero guard (latent SIGFPE/vkernel panic; vkernel64-only divergence from pc64 twin)
sys/platform/vkernel64/platform/systimer.c:358 · pass 2 · new
 none untested not_testable untriaged — —
DF-5575 Info 1.9 ppb_MS_loop() emits MS_DBRA(-1) whose branch lands on the DBRA itself — the loop body executes exactly once regardless of `iter`
sys/bus/ppbus/ppb_msq.c:160 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5598 Info 1.9 ichsmb_pci.c:175 wires device_detach to ichsmb_detach, whose device_delete_child() return is ignored (ichsmb.c:689) before unconditional IRQ/IO teardown, lockuninit and a lying success return — DF-5544/5545/5562 family residue, with every deterministic veto path caught one level up (live-proven)
sys/bus/smbus/ichsmb/ichsmb_pci.c:175 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5599 Info 1.9 ichsmb_pci_attach requests 16 I/O-port bytes first while ICH5+ SMBus BARs decode 32 (64 under QEMU's ICH9) — on BIOS-unprogrammed BARs pci_alloc_map under-claims the decode window, leaving the tail bytes hardware-decoded but rman-unowned
sys/bus/smbus/ichsmb/ichsmb_pci.c:233 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5606 Info 1.9 sys/bus/u4b/net/ruephy.c is an unbuildable FreeBSD-API orphan — dead weight carrying latent ifm_cur derefs (:145/:231) and the DF-5001 empty-media branch
sys/bus/u4b/net/ruephy.c:47 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5628 Info 1.9 ppb_poll_bus() sleep arithmetic hz/100 rounds to 0 when the boot tunable kern.hz < 100: tsleep receives timo=0 and arms NO timeout — permanent unkillable park for the documented PPB_NOINTR sleeping poll (proven against production code at hz=50)
sys/bus/ppbus/ppb_base.c:77 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5644 Info 1.9 smbus_attach mints NAMELESS wildcard children that any driver on the smbus bus with probe priority above GENERIC can hijack: ipmi_smbus_probe's unconditional BUS_PROBE_DEFAULT claims the generic child and all 96 address children — /dev/smbN disappears on non-SSIF platforms and duplicates the SSIF instance on SSIF ones
sys/bus/smbus/smbus.c:94 · pass 2 · new
 none untested not_testable untriaged — —
DF-5645 Info 1.9 smbus_attach's probe loop issues 96 real bus transactions without smbus_request_bus — the only transaction issuer in the tree that bypasses the sc->owner arbitration, interleaving with owned transfers on re-attach and stalling attach by ~96 controller timeouts
sys/bus/smbus/smbus.c:95 · pass 2 · new
 none untested not_testable untriaged — —
DF-5648 Info 1.9 Shared isab_devclass unit-0 theft: acpi_isab claims the ACPI Processor Container as isab0/isa0, silently renumbering the real PCI-ISA bridge to isab1/isa1 — phantom empty ISA bus at unit 0; 'at isa0' hint misdirection and duplicate-instance double enumeration on hint-compiled kernels
sys/bus/pci/isa_pci.c:60 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5651 Info 1.9 Proximity-domain association compares only ProximityDomainLo (ignores ProximityDomainHi and x2APIC entries): NUMA domains >= 256 silently dropped or organized under the wrong socket
sys/platform/pc64/acpica/acpi_srat.c:112 · pass 2 · new
 none untested not_testable untriaged — —
DF-5654 Info 1.9 elcr_resume() is dead code (zero callers) and no resync path exists — ELCR hardware state is never restored after a reset event nor re-read after probe; divergences are structurally invisible to the kernel
sys/platform/pc64/icu/elcr.c:75 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5553 Info 1.6 usb_make_raw_desc() CDC renumbering misclassifies the phone template's USB-Audio CS_INTERFACE descriptors: bDelay bytes rewritten 1->2 and 1->3 in generated descriptors
sys/bus/u4b/template/usb_template_phone.c:107 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5605 Info 1.1 ua_mixer_set/ua_mixer_setrecsrc reentrancy dance gates on lockowned(), which on DragonFly returns true for a lock held shared by ANY thread — under a foreign-shared holder the mixer callbacks run with zero exclusion (latent; DFly-specific divergence from FreeBSD mtx_owned)
sys/bus/u4b/audio/uaudio_pcm.c:139 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5671 Info 1.1 Stale MP-safety comment asserts a locked OR where code emits a nonlocked OR — safety of gd_spending pend path rests on an unstated, unenforced per-CPU invariant
sys/platform/vkernel64/platform/ipl_funcs.c:45 · pass 2 · new
 latent silently-lost soft interrupts if a future cross-CPU caller follows the comment untested not_testable untriaged — —
DF-5672 Info 1.1 Stale MP-safety comment asserts a locked OR and cross-CPU manipulation of gd_spending where the code emits a nonlocked OR — safety rests on an unstated per-CPU invariant (pc64 twin of DF-5671)
sys/platform/pc64/x86_64/ipl_funcs.c:38 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5245 Low 0.8 pmap_extract() KVA path duplicates the PDE validity check instead of testing the PTE — bogus non-zero physical address returned for unmapped kernel VA
sys/platform/pc64/x86_64/pmap.c:1739 · pass 2 · new
 none untested not_testable untriaged — —
DF-5243 Info 0.8 PROBE_SERIAL_NUM_0 frees the VPD page list with the wrong malloc type (M_DEVBUF vs allocation's M_CAMXPT) — per-type accounting corruption, upstream-corrected divergence
sys/bus/cam/cam_xpt.c:5922 · pass 2 · new
 heap OOB comparison oracle / race-gated UAF / accounting drift untested not_testable untriaged — —
DF-5405 Info 0.8 sgread() parses the 12-byte old-sg header with uiomove short-copy semantics: pack_len/reply_len/pack_id left uninitialized when read() supplies fewer than 12 bytes
sys/bus/cam/scsi/scsi_sg.c:764 · pass 2 · new
 UAF-read driven control flow (DF-5404) / uninit stack tag match (DF-5405) untested not_testable untriaged — —
DF-5549 Info 0.8 fwmem_close() frees the fwmem_softc with the wrong malloc type (M_FW instead of M_FWMEM) — per-type accounting corruption and wrong-type-free panic on debug builds
sys/bus/firewire/fwmem.c:272 · pass 2 · new
 corrupted per-type malloc accounting + wrong-type-free panic on debug builds untested not_testable untriaged — —
DF-5618 Info 0.8 ig4 ACPI glue hardcodes sc->version = IG4_ATOM for every matched HID under the false comment 'All the HIDs matched are Atom SOCs' — Haswell-LP (INT33C2/33C3), Broadwell (INT3432/33) and Apollo Lake (808622C1) silicon is mis-programmed: HSW-only SWMODE/LTR init and the SKL+-class LTR path in ig4_iic.c are skipped
sys/bus/smbus/ichiic/ig4_acpi.c:70 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5621 Info 0.8 MWAIT hint word validated only in its low 8 bits: firmware-supplied GAS.Address bits 31:8 forwarded verbatim to MWAIT EAX (and GAS BitWidth vendor field never checked)
sys/platform/pc64/acpica/acpi_cstate_machdep.c:50 · pass 2 · new
 forward-compat: reserved hint bits to MWAIT EAX untested not_testable untriaged — —
DF-5634 Info 0.8 No struct iicbus_ivar is ever allocated for children (DF-5559's root-cause file): with DF-5559's accessor fix applied, iicbus_write_ivar returns success while silently discarding every address write
sys/bus/iicbus/iicbus.c:44 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5670 Info 0.8 hw.acpi.reset_video is a dead control surface: sysctl+tunable registered by acpi_machdep_init() with zero consumers anywhere in sys/
sys/platform/pc64/acpica/acpi_machdep.c:49 · pass 2 · new
 none untested not_testable untriaged — —
DF-5398 Info 0.6 urndis(4) control channel: RNDIS response length never validated against the actually-transferred size — short device responses are parsed from stale sc_response_buf bytes
sys/bus/u4b/net/if_urndis.c:418 · pass 2 · new
 none untested not_testable untriaged — —
DF-5412 Info 0.6 udav_csr_read1() ignores control-request failure and returns an uninitialized stack byte (error-masking; device-register influence only)
sys/bus/u4b/net/if_udav.c:395 · pass 2 · new
 none untested not_testable untriaged — —
DF-5596 Low 0.5 genassym.c no longer emits GD_CURRENTLDT consumed by standard-built global.s — shipped kernel links with a dangling undefined symbol and silently exports no gd_currentldt (C-to-asm contract guard defeated)
sys/platform/pc64/x86_64/genassym.c:230 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5615 Low 0.5 fwdma_malloc leaks the dma_tag when bus_dmamem_alloc fails (the '/* XXX destory tag */' path)
sys/bus/firewire/fwdma.c:94 · pass 2 · new
 none (resource leak): one leaked bus_dma_tag (M_DEVBUF) per failed attach-time allocation; attach-error path only untested not_testable untriaged — —
DF-5658 Low 0.5 vkernel64 genassym.c emits only 5 of the 26 GD_* macros global.s consumes — 13 restorable per-CPU exports (gd_currentldt, gd_reqflags, gd_common_tss, gd_savefpu, gd_fpu_lock, gd_fpending/gd_ipending/gd_spending, gd_cnt, gd_ss_eflags, gd_intr_nesting_level, gd_common_tssd, gd_tss_gdt) silently vanish from every VKERNEL64 build (DF-5596 twin at 21x scale, task_log lead confirmed)
sys/platform/vkernel64/x86_64/genassym.c:77 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5275 Info 0.5 cdregister(): cdchanger leaked on camq_init failure and callout_init'd twice
sys/bus/cam/scsi/scsi_cd.c:889 · pass 2 · new
 CCB double-release UAF family (DF-5274) / attach-time leak (DF-5275) untested not_testable untriaged — —
DF-5291 Info 0.5 pmap_growkernel() PDP-page branch allocates the new PDP page without vm_page_wire() (the PT branch wires at :1623) — latent reclaim/reuse of an installed kernel page-directory-pointer page
sys/platform/vkernel64/platform/pmap.c:1584 · pass 2 · new
 wrong-page /dev/kmem I/O (DF-5290) / latent PDP reclaim (DF-5291) untested not_testable untriaged — —
DF-5354 Info 0.5 usb_temp_setup() correctness silently depends on scratch-union aliasing between temp_setup and hw_ep_scratch
sys/bus/u4b/template/usb_template.c:1247 · pass 2 · new
 refactor trap toward bad free / leak on gadget bring-up untested not_testable untriaged — —
DF-5390 Info 0.5 write_started/read_started are never set anywhere — the compensating-STOP cleanup in set_slave_addr() is dead code
sys/bus/smbus/ichiic/ig4_iic.c:266 · pass 2 · new
 SMBus/I2C wire-protocol corruption + silent write failures + lifecycle gaps untested not_testable untriaged — —
DF-5429 Info 0.5 Error-path hygiene in the v4l2 layer: uninitialized return + leak in uvc_v4l2_reg(), ignored devfs_set_cdevpriv() in open(), NULL check after deref in query_cap()
sys/bus/u4b/uvc/uvc_v4l2.c:125 · pass 2 · new
 defensive correctness only untested not_testable untriaged — —
DF-5441 Info 0.5 EVPD/page-code INQUIRY branch leaves descr->timeout stale (zero on first use), feeding an unconfigured timeout into the CTIO engine
sys/bus/cam/scsi/scsi_targ_bh.c:565 · pass 2 · new
 per-attach softc leak + speculative abort-refusing-SIM UAF (DF-5440) / stale CTIO timeout (DF-5441) untested not_testable untriaged — —
DF-5469 Info 0.5 lookup_res() rid aliasing: truncating PCI_RID2BAR division maps unaligned rids (0x11-0x13, 0x15-0x17, ...) onto the lower BAR's cache slot while bus_alloc_resource programs config space at the unaligned offset
sys/bus/pci/vga_pci.c:425 · pass 2 · new
 rid-alias cache confusion for buggy children untested not_testable untriaged — —
DF-5485 Info 0.5 GAS AccessWidth enumeration treated as a byte count: spec-legal dword _PCT GAS rejected ('Invalid control register GAS'), P-state domain permanently dead, cpufreq silently unavailable; qword misread as 4 bytes
sys/platform/pc64/acpica/acpi_pstate_machdep.c:564 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5492 Info 0.5 Lifecycle gaps: no device_detach/shutdown methods, probe-time resource allocation, and an attach-error path that permanently leaks the ISA ioport and IRQ
sys/bus/iicbus/pcf/pcf.c:104 · pass 2 · new
 none untested not_testable untriaged — —
DF-5570 Info 0.5 ECAM config path (pciereg_cfgread/cfgwrite) skips the bytes and alignment validation that the type-1 path enforces
sys/bus/pci/x86_64/pci_cfgreg.c:322 · pass 2 · new
 device-semantics confusion from a future buggy kernel caller; confined to ECAM mapping untested not_testable untriaged — —
DF-5572 Info 0.5 Latent NULL-deref and wrong-CPU binding in #ifdef notyet cpu attachment block (cpu_add_child)
sys/bus/pci/x86_64/legacy.c:316 · pass 2 · new
 wrong per-CPU device binding + NULL-write panic path when the block is ever enabled untested not_testable untriaged — —
DF-5597 Info 0.5 ioapic_irqs[] stride invariant (sizeof(struct ioapic_irqinfo) == 1 << IOAPIC_IRQI_SZSHIFT) enforced only by a comment while genassym publishes both halves to different assembly consumers
sys/platform/pc64/x86_64/genassym.c:273 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5602 Info 0.5 ig4_pci.c:236's device_detach wiring runs child deletion with unchecked device_delete_child() returns (ig4_iic.c:690/694) before unconditional IRQ/MSI/MMIO teardown and a success return — DF-5544/5545/5562/5598 detach-veto family residue; every deterministic veto is caught one level up in this driver
sys/bus/smbus/ichiic/ig4_pci.c:207 · pass 2 · new
 none untested not_testable untriaged — —
DF-5612 Info 0.5 cpu_enable_intr()/cpu_unmask_all_signals() implement 'restore' as an absolute sigsetmask(0) — not nesting-aware, silently discards any unrelated blocked-signal state
sys/platform/vkernel64/platform/machintr.c:198 · pass 2 · new
 none untested not_testable untriaged — —
DF-5616 Info 0.5 icu_ioapic_extint() accepts negative irq: guard lacks signed lower bound -> C-undefined shift feeds the live 8259 IMR; IMR written lockless and without icu_imen shadow sync (caller-gated, live-verified benign)
sys/platform/pc64/icu/icu.c:167 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5627 Info 0.5 ppb_get_epp_protocol() discards the BUS_READ_IVAR error and returns an uninitialized uintptr_t — stale kernel-stack bytes when the parent fails/omits the ivar (feeds mode2xfer's panic or wrong-protocol selection)
sys/bus/ppbus/ppb_base.c:100 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5659 Info 0.5 vkernel64 global.s:77-93 exports 8 gd_CMAP*/gd_PMAP1/gd_CADDR*/gd_PADDR1 aliases via GD_PRV_* macros for fields that DO NOT EXIST in the vkernel64 struct privatespace — un-restorable silent-vanish dangles (stale i386 lineage, absent even from the pc64 twin)
sys/platform/vkernel64/x86_64/genassym.c:77 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5667 Info 0.5 vkernel64 is_globaldata_space() blesses all SMP_MAXCPU(256) reserved per-CPU slots while only ncpus are ever mapped — kernacc() returns TRUE for ~7.9MB of unmapped KVA (latent panic landmine for any direct kernacc consumer; /dev/kmem saved only by kvm_access_check's PTE-loop ordering)
sys/platform/vkernel64/platform/globaldata.c:84 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5438 Info 0.4 ulpt_status_callback consumes uninitialized stack byte on short/zero-length status replies
sys/bus/u4b/serial/ulpt.c:295 · pass 2 · new
 none untested not_testable untriaged — —
DF-5439 Info 0.4 ulpt_attach alt-setting scan counter is uint8_t and wraps with >=256 crafted alt settings
sys/bus/u4b/serial/ulpt.c:523 · pass 2 · new
 none untested not_testable untriaged — —
DF-5410 Low — vkernel sys_sigreturn calls npxpop without the critical section pc64 has — FPU ownership-state race (npxdna panic class)
sys/platform/vkernel64/x86_64/cpu_regs.c:447 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2348 High 8.4 Dead unsigned comparison in mmap bounds check enables vtophys on wrapped ZERO_LENGTH_PTR - kernel panic / kernel memory exposure
sys/bus/u4b/uvc/uvc_buf.c:107
 none not_reproduced not_testable untriaged — —
DF-1008 Low 6.8 Async packet parser mishandles packets spanning >2 DMA buffers -> buffer leak + forged headers
sys/bus/firewire/fwohci.c:2650
 none reproduced fixed untriaged — —
DF-2274 High 6.5 Divide-by-zero panic from device-supplied block size of zero in READ CAPACITY
sys/bus/cam/scsi/scsi_da.c:2280
 none not_reproduced not_testable untriaged — —
DF-0999 Medium 6.5 Divide-by-zero in rum_set_sleep_time when associated AP advertises zero beacon interval
sys/bus/u4b/wlan/if_rum.c:2184
 none not_reproduced not_testable untriaged — —
DF-1039 Medium 6.2 NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote when CIS lacks VERS_1 tuple
sys/bus/pccard/pccard.c:1020
 none not_reproduced not_testable untriaged — —
DF-2317 Medium 6.2 Kernel panic on attacker-controlled SD CSD structure version
sys/bus/mmc/mmc.c:1056
 none not_reproduced not_testable untriaged — —
DF-2351 Medium 6.2 uint16_t to uint8_t truncation of nfmt/nfrm/nitv causes NULL-deref panic on device attach
sys/bus/u4b/uvc/uvc_drv.c:1737
 panic reproduced fixed untriaged — —
DF-2270 Medium 6.1 Missing bounds check on cesr_element_type in chgetelemstatus allows OOB array index into sc_firsts/sc_counts
sys/bus/cam/scsi/scsi_ch.c:1066
 dos reproduced not_testable untriaged — —
DF-0988 Medium 5.7 cdsize accepts blksize=0 from READ_CAPACITY, cdstart divide-by-zero panics on read
sys/bus/cam/scsi/scsi_cd.c:3058
 none not_reproduced not_testable untriaged — —
DF-2297 High 5.5 Divide-by-zero in fwdma_malloc_multiseg when esize is zero
sys/bus/firewire/fwdma.c:153
 panic reproduced fixed untriaged — —
DF-0996 Medium 5.5 pmap_unwire dereferences NULL pte when page table page does not exist -> vkernel crash
sys/platform/vkernel64/platform/pmap.c:2637
 none not_reproduced not_testable untriaged — —
DF-1059 Medium 5.5 FW_SBINDADDR / FW_CBINDADDR dereference ir (= d->ir) without NULL check — local kernel NULL-deref DoS
sys/bus/firewire/fwdev.c:600
 none not_reproduced not_testable untriaged — —
DF-1096 Medium 5.5 Unvalidated XSAVE header in npxpop allows unprivileged user to panic kernel via XRSTOR #GP
sys/platform/pc64/x86_64/npx.c:416
 panic reproduced fixed untriaged — —
DF-1113 Medium 5.5 Unbounded ACPI table Length in sdt_sdth_map enables deterministic boot-time panic DoS
sys/platform/pc64/acpica/acpi_sdt.c:137
 none not_reproduced not_testable untriaged — —
DF-2293 Medium 5.5 Zero bufreq.psize passed to FW_STSTREAM/FW_SRSTREAM causes divide-by-zero panic in fwdma_malloc_multiseg
sys/bus/firewire/fwdev.c:458
 dos reproduced fixed untriaged — —
DF-2294 Medium 5.5 FW_SBINDADDR / FW_CBINDADDR NULL-pointer dereference when receive xferq is uninitialized (local DoS)
sys/bus/firewire/fwdev.c:617
 dos reproduced fixed untriaged — —
DF-2318 Medium 5.5 NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote on cards lacking a valid CISTPL_VERS_1
sys/bus/pccard/pccard.c:1001
 panic reproduced fixed untriaged — —
DF-2352 Medium 5.5 Division by zero in uvc_drv_try_frame_interval for continuous-interval frames (bFrameIntervalType==0)
sys/bus/u4b/uvc/uvc_drv.c:1922
 panic reproduced fixed untriaged — —
DF-0979 Low 5.5 Multiple error paths use tsleep(0) infinite-hang instead of panic, enabling silent kernel DoS
sys/platform/pc64/x86_64/pmap.c:2908
 none reproduced fixed untriaged — —
DF-1092 Low 5.5 Unbounded EHCI extended-capability chain traversal allows malicious PCI controller to hang the kernel
sys/bus/u4b/controller/ehci_pci.c:517
 dos reproduced fixed untriaged — —
DF-1021 Low 5.3 Sleeping allocation M_WAITOK inside critical section in fw_get_tlabel -> panic under memory pressure
sys/bus/firewire/firewire.c:1647
 none reproduced fixed untriaged — —
DF-2279 Info 5.1 CAMIOCOMMAND accepts kernel-internal XPT function codes that operate on kernel-only objects
sys/bus/cam/scsi/scsi_pass.c:474
 leak reproduced not_testable untriaged — —
DF-1003 Low 4.7 usb_make_dev creates visible cdev before setting si_drv1 -> NULL-deref race in usb_open
sys/bus/u4b/usb_device.c:1991
 none reproduced fixed untriaged — —
DF-1024 Low 4.7 NULL-deref panic in cam_periph_alloc failure path when xpt_create_path fails
sys/bus/cam/cam_periph.c:219
 none reproduced fixed untriaged — —
DF-2299 Low 4.7 Missing NULL check on kmalloc return in fwdma_malloc_multiseg
sys/bus/firewire/fwdma.c:162
 none not_reproduced not_testable untriaged — —
DF-2302 Low 4.7 NULL pointer dereference in fwohci_db_free when bus_dmamap_create fails partway through initialization
sys/bus/firewire/fwohci.c:1236
 panic reproduced fixed untriaged — —
DF-2329 Low 4.7 Lost-wakeup race in ppb_request_bus() can permanently hang a process opening a parallel port device
sys/bus/ppbus/ppbconf.c:464
 denial_of_service reproduced fixed untriaged — —
DF-2355 Low 4.7 Unbounded linear search in mt7601_set_chan reads past mt7601_rf_chan[14]
sys/bus/u4b/wlan/if_mtw.c:3693
 none reproduced not_testable untriaged — —
DF-1017 High 4.6 Untrusted READ_CAPACITY block_len=0 causes kernel divide-by-zero panic (secsize used as divisor without validation)
sys/bus/cam/scsi/scsi_da.c:2280
 none inconclusive not_testable untriaged — —
DF-0990 Medium 4.6 PCI capability-list walk has no cycle detection, malicious device hangs kernel forever
sys/bus/pci/pci.c:847
 none not_reproduced not_testable untriaged — —
DF-1023 Medium 4.6 Kernel panic on unrecognized SD CSD version from malicious SD card (csd_structure=2 or 3 triggers panic not graceful error)
sys/bus/mmc/mmc.c:1056
 none not_reproduced not_testable untriaged — —
DF-1038 Medium 4.6 NULL pointer dereference in wsp_intr_callback when ntouch==0 (malicious USB / TYPE1 regression)
sys/bus/u4b/input/wsp.c:845
 none not_reproduced not_testable untriaged — —
DF-1093 Medium 4.6 NULL pointer dereference in ppb_pnp_detect via crafted IEEE 1284 PnP string
sys/bus/ppbus/ppbconf.c:242
 none not_reproduced fixed untriaged — —
DF-2319 Medium 4.6 NULL pointer dereference in CISTPL_CFTABLE_ENTRY handler when no CISTPL_CONFIG precedes it
sys/bus/pccard/pccard_cis.c:907
 panic reproduced fixed untriaged — —
DF-2324 Medium 4.6 Capability list traversal lacks cycle detection - infinite loop DoS from malicious device with circular capability chain
sys/bus/pci/pci.c:877
 panic reproduced not_testable untriaged — —
DF-2338 Medium 4.6 NULL-deref in wsp_intr_callback when first HID report yields ntouch=0 (always for TYPE1 devices)
sys/bus/u4b/input/wsp.c:884
 none not_reproduced not_testable untriaged — —
DF-0991 Low 4.6 EHCI/XHCI early-takeover extended-capability walks have no cycle bound (hang + OOB MMIO reads)
sys/bus/pci/pci.c:2900
 none reproduced fixed untriaged — —
DF-0992 Low 4.6 VPD parser calls krealloc with M_ZERO, panicking INVARIANTS kernels (krealloc explicitly asserts M_ZERO unsupported)
sys/bus/pci/pci.c:1150
 none reproduced fixed untriaged — —
DF-2327 Low 4.6 NULL+1 pointer dereference in ppb_pnp_detect() via malformed PnP string from malicious peripheral
sys/bus/ppbus/ppbconf.c:242
 panic reproduced fixed untriaged — —
DF-2335 Low 4.6 Unbounded unvalidated PCI extended-capability loop in ehci_pci_take_controller (DoS via malicious/fuzzed controller)
sys/bus/u4b/controller/ehci_pci.c:517
 dos reproduced not_testable untriaged — —
DF-2341 Low 4.6 NULL-deref panic in if_detach when async PHY-probe attach fails (ether_ifdetach on never-attached ifnet)
sys/bus/u4b/net/usb_ethernet.c:232
 panic reproduced not_testable untriaged — —
DF-2272 Info 4.5 TOCTOU on user-supplied chio.h ioctl structs enables re-validation bypass in move/exchange/position/setvoltag
sys/bus/cam/scsi/scsi_ch.c:805
 none not_reproduced not_testable untriaged — —
DF-1051 Medium 4.4 sgopen unlocks an unheld lock and releases a periph reference that was never acquired
sys/bus/cam/scsi/scsi_sg.c:388
 panic reproduced fixed untriaged — —
DF-1095 Medium 4.4 iicsmb_bwrite leaves I2C bus in STARTED state on write failure — permanent SMBus bridge lockup
sys/bus/iicbus/iicsmb.c:462
 none not_reproduced fixed untriaged — —
DF-2275 Medium 4.4 KKASSERT panic in DAIOCTRIM from non-512-aligned user-supplied offsets
sys/bus/cam/scsi/scsi_da.c:443
 panic reproduced fixed untriaged — —
DF-2276 Medium 4.4 Infinite loop / negative b_bcount in DAIOCTRIM from negative user-supplied length
sys/bus/cam/scsi/scsi_da.c:436
 dos reproduced fixed untriaged — —
DF-2309 Medium 4.4 I2CRDWR ioctl leaks usrbufs array on copyin failure (kernel memory exhaustion DoS)
sys/bus/iicbus/iic.c:351
 dos reproduced fixed untriaged — —
DF-1004 Low 4.4 usb_config_parse INIT zeros target interface endpoints before verifying alt exists -> stale pointers on failure
sys/bus/u4b/usb_device.c:717
 none reproduced fixed untriaged — —
DF-1019 Low 4.4 daioctl uses KKASSERT (debug-only macro) to validate user-controlled DAIOCTRIM alignment -> panic on INVARIANTS, silent bypass on production
sys/bus/cam/scsi/scsi_da.c:443
 none reproduced fixed untriaged — —
DF-1114 Low 4.4 RSDP accepted without checksum or Length validation (firmware-integrity hardening gap)
sys/platform/pc64/acpica/acpi_sdt.c:120
 dos reproduced fixed untriaged — —
DF-2267 Low 4.4 CAMGETPASSTHRU can spin forever holding the SIM lock (privileged local DoS)
sys/bus/cam/cam_periph.c:901
 denial_of_service reproduced fixed untriaged — —
DF-2312 Low 4.4 I2CRDWR: no upper-bound validation on nmsgs allows massive kernel allocations (DoS)
sys/bus/iicbus/iic.c:351
 panic reproduced fixed untriaged — —
DF-2360 Low 4.4 Unbounded f_reg()/f_rm() indexing crashes DDB: NULL-deref in Grp7 dispatch and wild-pointer deref via REX.R into 8-element tables
sys/cpu/x86_64/misc/db_disasm.c:908
 panic reproduced not_testable untriaged — —
DF-1034 Low 4.1 Boot-time kernel panic on malformed MP-table INT entry (dst_apic_int >= IO-APIC pin count)
sys/platform/pc64/x86_64/mptable.c:1296
 none reproduced fixed untriaged — —
DF-1044 Low 4.1 vkernel busdma bounce-wait path panics via #ifdef notyet stub; return_bounce_pages wakes wrong map
sys/platform/vkernel64/platform/busdma_machdep.c:1094
 panic reproduced not_testable untriaged — —
DF-1049 Low 4.1 Serializer leak on bus_setup_intr failure in ig4iic_attach causes self-deadlock during cleanup
sys/bus/smbus/ichiic/ig4_iic.c:648
 none reproduced fixed untriaged — —
DF-2313 Info 3.9 IIC_LOCK/IIC_UNLOCK are empty no-op macros - all shared state access is unsynchronized
sys/bus/iicbus/iic.c:60
 — not_reproduced not_testable untriaged — —
DF-1009 Low 3.5 Driver enables FireWire physical-request DMA into host memory by default (PhysUpperBound=0x10000)
sys/bus/firewire/fwohci.c:1864
 none reproduced fixed untriaged — —
DF-1115 Low 3.5 Dead switch-error check in mmc_switch_status compares a status field to a raw bit value
sys/bus/mmc/mmc_subr.c:211
 none reproduced fixed untriaged — —
DF-1026 Info 3.4 cam_periph_unmapbufs silently drops copyout errors -> data loss / inconsistent result
sys/bus/cam/cam_periph.c:829
 none reproduced not_testable untriaged — —
DF-1015 Low 3.3 usb_kqfilter leaks FIFO refcount on filter/mode-mismatch EOPNOTSUPP paths -> permanent USB device detach hang
sys/bus/u4b/usb_dev.c:1175
 none reproduced fixed untriaged — —
DF-1031 Low 3.3 NULL pointer dereference in init_disk makes -c (CD image) always crash the vkernel
sys/platform/vkernel64/platform/init.c:487
 none reproduced fixed untriaged — —
DF-1069 Low 3.3 host_pcib_get_busno returns success without writing *busnum for Intel 82454NX at unexpected slot
sys/bus/pci/pci_pci.c:707
 none reproduced fixed untriaged — —
DF-2283 Low 3.3 sgread: tsleep on local stack address &hstat has no wakeup source; read() blocks indefinitely (local DoS)
sys/bus/cam/scsi/scsi_sg.c:763
 denial_of_service reproduced fixed untriaged — —
DF-2287 Low 3.3 Memory leak of targ_cmd_descr in targread abort_queue drain loop
sys/bus/cam/scsi/scsi_target.c:921
 leak reproduced fixed untriaged — —
DF-1014 Low 2.5 sescleanup leaks ses_objmap/ses_private/ses_typidx/ses_eltmap on device removal -> memory exhaustion DoS
sys/bus/cam/scsi/scsi_ses.c:231
 none reproduced fixed untriaged — —
DF-1036 Low 2.5 return_bounce_pages wakes wrong map (typo: passes map instead of wait_map to add_map_callback)
sys/platform/pc64/x86_64/busdma_machdep.c:1306
 none reproduced fixed untriaged — —
DF-2305 Low 2.5 bus_dma_tag_create failure returns without cleanup: leaks BAR IRQ and leaves interrupt handler registered
sys/bus/firewire/fwohci_pci.c:320
 leak reproduced not_testable untriaged — —
DF-1053 Low 2.3 SG_DXFER_TO_FROM_DEV silently maps to CAM_DIR_NONE, passing unmapped user pointer to the HBA
sys/bus/cam/scsi/scsi_sg.c:527
 none reproduced fixed untriaged — —
DF-1054 Low 2.3 sgoninvalidate does not abort pending I/O or wake blocked readers, causing permanent hang on device removal
sys/bus/cam/scsi/scsi_sg.c:169
 none reproduced fixed untriaged — —
DF-2311 Low 2.3 iicread() leaks I2C bus lock on iicbus_block_read failure
sys/bus/iicbus/iic.c:253
 denial_of_service reproduced fixed untriaged — —
DF-2265 Info 2.3 sasetparams ENODEV early return leaks ccomp allocation
sys/bus/cam/scsi/scsi_sa.c:2757
 dos reproduced fixed untriaged — —
DF-2325 Low 2.0 Signed left-shift undefined behavior in BAR resource sizing when ln2size == 31
sys/bus/pci/pci.c:2644
 none reproduced not_testable untriaged — —
DF-0977 Low 1.9 pmap_change_attr non-atomic read-modify-write on DMAP PDEs (lost A-bit updates, stale cache attr window)
sys/platform/pc64/x86_64/pmap.c:6279
 none reproduced fixed untriaged — —
DF-2344 Info 1.5 Unchecked register read uses uninitialized stack for port-count decision in attach
sys/bus/u4b/serial/umcs.c:301
 none reproduced not_testable untriaged — —
DF-1022 Info 1.1 Integer truncation in fw_xfer_alloc_buf (int -> u_int16_t pay_len) -> length/buffer mismatch for len > 0xFFFF (latent)
sys/bus/firewire/firewire.c:949
 none reproduced not_testable untriaged — —
DF-0976 Info 0.5 pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
sys/platform/pc64/x86_64/pmap.c:5074
 none reproduced not_testable untriaged — —
DF-1089 Info 0.5 ioapic_intsrc() indexes ioc_intsrc[] with only a debug-compiled-out bounds guard
sys/platform/pc64/apic/ioapic.c:274
 none reproduced not_testable untriaged — —

Base system — crypto 13

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-3561 Medium 6.1 Software XTS (aes/twofish/serpent) mutates the shared per-session tweak: concurrent cryptoapi_cipher_crypt on one session tears the tweak and silently corrupts dm-crypt data at rest
sys/crypto/cryptoapi/cryptoapi.c:370 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3563 Info 4.7 chacha_encrypt_bytes() leaves final partial-block plaintext in tmp[64] on the kernel stack (wg outbound packet tails via chachapoly)
sys/crypto/chacha20/chacha.c:116 · pass 2 · new
 latent stack plaintext residue (wg outbound tails) untested — untriaged — —
DF-3566 Low 4.1 SipHash24_TestVectors passes len=0 to SipHash_Update for the empty-message vector, panicking INVARIANTS kernels
sys/crypto/siphash/siphash_test.c:121 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3564 Low 1.9 SipHash_SetKey retains verbatim 128-bit key on the stack without zeroization
sys/crypto/siphash/siphash.c:71 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3560 Info 1.9 Camellia derived key material (subL/subR schedule words, setup192's kk[32] 256-bit folded key, Encrypt/DecryptBlock tmp[4] block data) left unzeroed on the kernel stack; keyBitLength validated only by KASSERT, so production kernels would run on an uninitialized subkey schedule if a non-{128,192,256} length ever reached these entry points (latent: no in-tree callers)
sys/crypto/camellia/camellia.c:445 · pass 2 · new
 latent key-material stack residue + KASSERT-only key-size validation untested not_testable untriaged — —
DF-3565 Info 1.9 Kernel DES weak/semi-weak key and parity checking disabled by default (des_check_key=0)
sys/crypto/des/des_setkey.c:65 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3569 Info 0.5 camellia_set_key() performs no key-length validation: on production kernels any invalid bits is silently accepted, the schedule is never generated, and camellia_encrypt/camellia_decrypt degenerate to the identity function
sys/crypto/camellia/camellia-api.c:37 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2367 Medium 4.7 AES T-table lookups are data-dependent leaking key material via cache timing (CCMP always dm-crypt/IPsec on non-AES-NI)
sys/crypto/rijndael/rijndael-alg-fst.c:56
 leak reproduced not_testable untriaged — —
DF-0969 Low 3.6 rijndael_padDecrypt MODE_ECB accepts invalid padLen==0 and rejects valid padLen==16 (asymmetric with CBC path, padding-oracle-prone)
sys/crypto/rijndael/rijndael-api-fst.c:390
 none reproduced not_testable untriaged — —
DF-2364 Low 3.6 Silent 64-bit->32-bit length truncation when invoking chacha_encrypt_bytes
sys/crypto/chachapoly.c:127
 none reproduced not_testable untriaged — —
DF-2365 Info 2.9 Decrypted but unauthenticated plaintext written back to mbuf before tag check
sys/crypto/chachapoly.c:349
 — reproduced not_testable untriaged — —
DF-0970 Info 1.9 Poly1305 one-time key (poly_key) left unzeroed on stack after _chacha20poly1305_init returns
sys/crypto/chachapoly.c:52
 none reproduced fixed untriaged — —
DF-2366 Info 1.9 rc4_init lacks keylen>0 validation reading key[0] 256 times for non-positive keylen
sys/crypto/rc4/rc4.c:58
 — reproduced not_testable untriaged — —

Base system — libkern / libprop / ddb 46

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5678 Medium 6.3 prop_array_set/prop_array_remove enforce index bounds only via INVARIANTS-gated assert: stock-kernel panic (reproduced live), silent heap OOB write + prop_object_release of an OOB-read pointer on non-INVARIANTS kernels
sys/libprop/prop_array.c:648 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5701 Low 6.3 bcmp.c:58 `int len = length` size_t-to-int truncation: bcmp(a,b,2^32)==0 false-equal with zero bytes compared; prefix-only compare at 2^32+k; signed-overflow unbounded forward walk at 2^31
sys/libkern/bcmp.c:58 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5680 Medium 6.0 Unbounded kmalloc(len+1, M_PROP_DATA, M_WAIT) from the attacker-controlled <data size="N"> plist attribute in _prop_data_internalize: deterministic kernel panic (size beyond kernel_map KVA) and non-interruptible system-wide vm_wait wedge (size > RAM); strtoul ERANGE guard compiled out in-kernel
sys/libprop/prop_data.c:572 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5724 Medium 6.0 Unvalidated $tabstops DDB variable: rounddown(x,0) divide-by-zero trap cascade bricks the kernel; negative tabstops spin db_force_whitespace forever with all CPUs stopped
sys/ddb/db_output.c:65 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5725 Low 6.0 DDB db_set_breakpoints() fault-abort orphans live INT3s and poisons the saved original byte — permanent kernel-text corruption at an unrelated address plus unrecoverable crit-section panic
sys/ddb/db_break.c:161 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5675 High 5.5 Recursive proplib externalize vs. iterative internalize: DM ioctl plist echo exhausts the 16KB kernel thread stack (Fatal double fault at ~192 nesting levels)
sys/libprop/prop_object.c:617 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5681 Low 5.3 Kernel _PROP_ONCE_RUN cmpset-once has no completion barrier: first concurrent prop_number use races the interned-tree lazy init (lockmgr on mid-lockinit lock, rbt_ops still NULL)
sys/libprop/prop_number.c:167 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-5693 Low 5.3 prop_bool singleton lazy-init shares the kernel cmpset-once with no completion barrier: concurrent first-ever <true/> internalize can hand out a NULL-typed, stale-valued, or refcount-corrupted TRUE/FALSE singleton (DF-2225/DF-5681 class, third instance)
sys/libprop/prop_bool.c:111 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-5755 Medium 5.2 No overlong (non-shortest) UTF-8 form validation in utf8_to_ucs4 → arbitrary character synthesis into converted filenames (U+002F '/' into FAT LFN and 8.3 metadata via msdosfs KICONV) and encode_surrogate uint32 wrap for 4-byte overlongs
sys/libiconv/iconv_ucs.c:419 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5694 Medium 5.1 karc4random64() upper 32 bits pinned to 0xffffffff on half of all draws — int-overflow left shift sign-extends into the 64-bit accumulator (UB), collapsing the exported kernel CSPRNG word from 64 bits of entropy to ~32.5
sys/libkern/arc4random.c:129 · pass 2 · new
 rng_bias_aslr_entropy_loss reproduced fixed untriaged — —
DF-5728 Low 4.4 DDB db_expression unbounded parenthesis recursion overflows the 16 KB kernel stack — deterministic double fault / panic from one console line
sys/ddb/db_expr.c:84 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-5712 Low 4.2 index/rindex omit the ISO C char conversion of the search argument: never match for ch outside [-128,127], diverging from strchr/strrchr (backs every kernel strchr/strrchr via libkern.h)
sys/libkern/index.c:46 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5732 Low 3.4 DDB trap funnel defeats the db_nofault guard: recoverable DDB memory probes — including show registers' unconditional disasm of the DDB-writable $rip at db_print.c:68 — are routed through trap_fatal(), producing a spurious 'Fatal trap' crash banner with kernel state disclosure, a leaked gd_trap_nesting_level, and corrupted session-resume state
sys/ddb/db_print.c:46 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-5756 Low 3.3 Asymmetric unpaired-surrogate validation: lone low surrogates (U+DC00-DFFF) accepted as ordinary characters and re-encoded as CESU-8 (invalid UTF-8) when the output buffer permits; silent '?' substitution instead of EILSEQ-equivalent via msdosfs
sys/libiconv/iconv_ucs.c:255 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5708 Low 2.9 skrandom() lacks seed-domain validation: seeds congruent to 0 mod (2^31-1) — reachable via oce's skrandom(karc4random()) at p=3/2^32 — park the kernel PRNG on an absorbing fixed point returning the constant 0x7fffffff for the lifetime of the boot
sys/libkern/random.c:38 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5677 Low 2.5 prop_object_release_emergency dispatches pot_emergency_free on a NULL parent when the first walk iteration breaks (CWE-476; kernel-unreachable today, userland malloc-failure edge)
sys/libprop/prop_object.c:1048 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5695 Low 2.5 Per-CPU RC4 state machine is completely unsynchronized under LWKT preemption — the #if 0'd crit section's premise ('no one calls in ISR/ithread') is false, so syscall-context and netisr/TCP-thread consumers interleave keystream generation, producing values outside any serialized RC4 evolution
sys/libkern/arc4random.c:101 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5702 Low 2.5 Kernel strtoq/strtouq take the 0x/0X prefix without a following hex digit, violating the C99 strtol endptr contract and diverging from DragonFly's own userland libc on the same input
sys/libkern/strtoq.c:72 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5705 Low 2.5 _prop_stack_push growth allocation is kmalloc(M_WAITOK) executed while callers hold the global proplib dictionary lockmgr (release walk) or deep per-object mtx chains (equals walk); and push-failure handling is kernel-dead code since M_WAITOK never returns NULL on DragonFly
sys/libprop/prop_stack.c:50 · pass 2 · new
 none untested not_testable untriaged — —
DF-5687 Info 2.5 _prop_object_copyout() leaks the vm_mmap()ed user region when copyout() fails (no vm_map_remove on the error path)
sys/libprop/prop_kern.c:526 · pass 2 · new
 see summary untested not_testable untriaged — —
DF-5721 Low 2.3 DDB software watchpoints (watch) are inert on x86_64 — pmap protection silently evaporates, watchpoint trap classification is dead code
sys/ddb/db_run.c:199 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5726 Low 2.3 DDB 'b addr,count' silently truncates the skip count (radix-16 lexer + int struct fields) — breakpoint armed but can never fire, garbage negative Count displayed
sys/ddb/db_break.c:106 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5703 Low 1.9 Kernel strtol/strtoul take the 0x/0X prefix without a following hex digit, violating the C99 strtol endptr contract and diverging from DragonFly's own userland libc on the same input (int-width twins of DF-5702; DF-5702's fix covered only the quad twins)
sys/libkern/strtol.c:70 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5679 Info 1.9 iscsi_crc32()/iscsi_crc32_ext() silently truncate size_t length to unsigned int — data-integrity contract violation for >=4GiB requests
sys/libkern/icrc32.c:763 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5714 Info 1.9 libkern/ffs.c is dead code — absent from conf/files, superseded by the cpufunc.h __builtin_ffs inline, and non-compilable in-kernel (#include <string.h> under -nostdinc); latent body machine-proven correct over the full 2^32 domain (ffsl.c twin equally dead)
sys/libkern/ffs.c:33 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5715 Info 1.9 sys/libkern/ffsl.c is dead, unlistable, and shadowed code (ffs-family tail, DF-5714 class)
sys/libkern/ffsl.c:32 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5716 Info 1.9 sys/libkern/flsl.c is dead, unlistable, and shadowed code (find-LAST-set, long)
sys/libkern/flsl.c:32 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5717 Info 1.9 sys/libkern/flsll.c is dead, unlistable, and shadowed code (find-LAST-set, long long)
sys/libkern/flsll.c:32 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5713 Low 1.1 Kernel stack-smashing protection is a no-op: canary is an unseeded compile-time constant (0x00000aff) from a dead ABI, __stack_chk_guard/__stack_chk_fail absent from the kernel, and -fno-stack-protector is forced for all kernel/KLD code
sys/libkern/stack_protector.c:36 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5727 Low 0.8 DDB 'watch addr[,size]' — the syntax documented in ddb(4) — silently drops the size argument and always watches 4 bytes
sys/ddb/db_watch.c:192 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5697 Info 0.8 kqsort with caller-supplied es == 0 never terminates (partition loop advances by +0) and performs an out-of-contract 8-byte access at the zero-length array's base (swapcode do-while executes once at n == 0)
sys/libkern/qsort.c:48 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-5720 Info 0.8 ddb '/'-modifier parsing copies stale db_tok_string for numeric modifier tokens — the typed modifier is silently substituted with the previously lexed identifier (deterministically the command's own name)
sys/ddb/db_command.c:364 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5698 Info 0.5 Kernel inet_ntop never sets errno — its own documented 'NULL (see errno)' contract is unimplemented
sys/libkern/inet_ntop.c:51 · pass 2 · new
 none reproduced fixed untriaged — —
DF-5730 Info 0.5 $radix/$maxoff/$maxwidth FCN_NULL writes accept any 64-bit value unvalidated — silent semantic corruption of the DDB expression language and symbol attribution (beyond DF-5724)
sys/ddb/db_variables.c:48 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-5731 Info 0.5 db_get_value/db_put_value clamp only the upper bound of size; size<=0 would wrap to a huge size_t in db_read_bytes/db_write_bytes' unbounded byte loops
sys/ddb/db_access.c:79 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-5704 Medium — equals-walk type-mismatch early return abandons the _prop_stack: every ancestor's rwlock leaks permanently and (>=17 deep) each kmalloc'd extern element leaks — violation of the stack's pop-to-empty/pot_equals_finish contract
sys/libprop/prop_stack.c:49 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2251 Medium 6.5 Fully reversible non-cryptographic MINSTD PRNG is sole source of randomness for security-sensitive kernel values
sys/libkern/random.c:36
 leak reproduced fixed untriaged — —
DF-2229 Medium 5.5 prop_array_iterator and 3 siblings lack prop_object_is_array NULL/type guard enabling kernel panic via DM ioctl
sys/libprop/prop_array.c:538
 panic reproduced fixed untriaged — —
DF-2230 Medium 5.5 Kernel plist integer parsing silently saturates decimal values exceeding INT64_MAX (unsigned fallback is dead code)
sys/libprop/prop_number.c:519
 none reproduced fixed untriaged — —
DF-2237 Medium 5.5 iconv_xlat16_conv dereferences d_table[c1] without NULL check after case-conversion mutates c1/c2
sys/libiconv/iconv_xlat16.c:155
 panic reproduced fixed untriaged — —
DF-2250 Medium 4.5 Unsynchronized read-modify-write race on global PRNG state randseed (SMP)
sys/libkern/random.c:36
 none reproduced fixed untriaged — —
DF-2254 Low 4.1 kqsort_r recurses without depth bound: latent stack-exhaustion DoS (sibling of DF-2245 via shared qsort.c body)
sys/libkern/qsort_r.c:7
 panic reproduced fixed untriaged — —
DF-2243 Info 4.0 Early-boot RC4 stream keyed with uninitialized kernel stack because read_random() returns 0 before CSPRNG initialized
sys/libkern/arc4random.c:53
 none not_reproduced not_testable untriaged — —
DF-2242 Info 3.9 Right-shift operator truncates operand to 32 bits (LP64 porting bug)
sys/ddb/db_expr.c:216
 — reproduced not_testable untriaged — —
DF-2240 Info 1.1 prop_array_add_uint{8 16 32 64} stores unsigned values via signed creator breaking roundtrip semantics
sys/libprop/prop_array_util.c:187
 — reproduced not_testable untriaged — —
DF-2244 Info 0.5 karc4random_buf charges only one run regardless of buffer length defeating keystream-limit reseed invariant
sys/libkern/arc4random.c:152
 none reproduced not_testable untriaged — —

Base system — other 1

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5745 Low 4.1 apple_gmux: second-instance attach clobbers the shared apple_gmux_softc_data global → NULL-deref panic in vga_switcheroo dispatch (spontaneous at i915 load)
sys/gnu/dev/misc/apple_gmux/apple-gmux.c:511 · pass 2 · new
 panic reproduced fixed untriaged — —

Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred 75

PPP, iSCSI, NTFS, SMB and other ancient subsystems. Real but deliberately deferred — not on the first sift.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-5710 Medium 8.2 smbfs_mount: strncpy budget 'pe - pc - 2' can be -1, wrapping to (size_t)-1 — unbounded kernel heap copy during smbfs mount
sys/vfs/smbfs/smbfs_vfsops.c:170 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-1869 Critical 9.8 Remote kernel heap overflow in scsi_decap via attacker-controlled Data-In buffer offset (write-what-where)
sys/dev/disk/iscsi/initiator/iscsi_subr.c:566
 corruption reproduced fixed untriaged — —
DF-2458 Critical 9.8 Target-controlled buffer offset in scsi_decap gives malicious iSCSI target an arbitrary-offset kernel heap write
sys/dev/disk/iscsi/initiator/isc_sm.c:143
 panic reproduced fixed untriaged — —
DF-1870 High 9.1 Remote kernel heap OOB read / info leak in iscsi_r2t via attacker-controlled R2T transfer length
sys/dev/disk/iscsi/initiator/iscsi_subr.c:79
 leak reproduced fixed untriaged — —
DF-0677 High 8.8 sl_compress_init heap overflow via unvalidated max_state from PPP IPCP negotiation
sys/net/ppp_layer/slcompress.c:69
 corruption reproduced fixed untriaged — —
DF-0624 High 8.1 OOB heap read in smb_t2_placedata via malicious TRANS2 response byte counts
sys/netproto/smb/smb_rq.c:436
 panic reproduced fixed untriaged — —
DF-2566 High 8.1 smb_t2_placedata corrupts mbuf m_len on oversized TRANS2 count causing kernel heap OOB read and panic
sys/netproto/smb/smb_rq.c:424
 panic reproduced fixed untriaged — —
DF-0641 High 7.8 Heap buffer overflow in smb_smb_ssnsetup: ntencpass sized from charset-converted password but filled from original
sys/netproto/smb/smb_smb.c:255
 none not_reproduced not_testable untriaged — —
DF-0785 High 7.8 Heap buffer overflow in ntfs_ntlookupfile: rdbuf allocated to ir_size but filled with va_datalen bytes
sys/vfs/ntfs/ntfs_subr.c:867
 uid0 → root reproduced fixed untriaged — —
DF-0871 High 7.8 Heap overflow in $AttrDef name copy via unbounded wchar-to-char do/while walk
sys/vfs/ntfs/ntfs_vfsops.c:444
 panic reproduced fixed untriaged — —
DF-0873 High 7.8 Stack buffer overflow in ntfs_readdir convname via double-wide NTFS_U28 expansion of crafted ie_fnamelen
sys/vfs/ntfs/ntfs_vnops.c:517
 uid0 → root reproduced fixed untriaged — —
DF-0901 High 7.8 Unlocked hash-bucket traversal in smbfs_node_alloc races with smbfs_reclaim freeing smbnode (UAF read)
sys/vfs/smbfs/smbfs_node.c:203
 panic reproduced fixed untriaged — —
DF-2461 High 7.8 i_prepPDU truncates PDU length to u_int and maxBurstLength accepts negative values enabling kernel heap overflow via ISCSISEND
sys/dev/disk/iscsi/initiator/isc_sm.c:291
 panic reproduced fixed untriaged — —
DF-2459 High 7.5 Re-queued NOP-IN PDU in _nop_in causes bcopy(NULL) panic in isc_sendPDU
sys/dev/disk/iscsi/initiator/isc_sm.c:212
 panic reproduced fixed untriaged — —
DF-2460 High 7.5 _reject dereferences pq->mp without NULL check panicking on data-less REJECT from malicious target
sys/dev/disk/iscsi/initiator/isc_sm.c:87
 panic reproduced fixed untriaged — —
DF-1828 Medium 7.5 isc_soc: NULL deref in so_input pdu_alloc retry uses M_NOWAIT (comment says WAITOK) derefs unchecked
sys/dev/disk/iscsi/initiator/isc_soc.c:540
 none inconclusive — untriaged — —
DF-0932 High 7.1 LZ77 back-reference offset not bounded to current output position - heap OOB read before output buffer in NTFS decompression
sys/vfs/ntfs/ntfs_compr.c:74
 leak reproduced fixed untriaged — —
DF-0787 Medium 7.1 Unbounded attribute walk in ntfs_loadntnode: OOB read + infinite loop via fr_attroff/reclen==0
sys/vfs/ntfs/ntfs_subr.c:305
 panic reproduced fixed untriaged — —
DF-0789 Medium 7.1 ntfs_runtovrun walks attacker run buffer with no length bound — OOB read
sys/vfs/ntfs/ntfs_subr.c:582
 panic reproduced fixed untriaged — —
DF-0791 Medium 7.1 Subnode dive in ntfs_ntlookupfile reads 8 bytes OOB when iep->reclen < sizeof(cn_t) or entry straddles buffer end
sys/vfs/ntfs/ntfs_subr.c:900
 leak reproduced fixed untriaged — —
DF-0874 Medium 7.1 Unbounded attr_indexentry walk in ntfs_readdir inner loop reads kernel heap past f_dirblbuf
sys/vfs/ntfs/ntfs_vnops.c:577
 oob_read reproduced fixed untriaged — —
DF-2555 Medium 7.1 Heap buffer overflow in $AttrDef name copy via unterminated wchar name
sys/vfs/ntfs/ntfs_vfsops.c:444
 none reproduced fixed untriaged — —
DF-0884 High 7.0 Use-after-free in smbfs_readvdir via dead-code vnode lock upgrade on read(2) of directory
sys/vfs/smbfs/smbfs_io.c:202
 panic reproduced fixed untriaged — —
DF-0930 Medium 7.0 ntfs_nthashlookup returns unreferenced ntnode after releasing token - UAF in NTFS inode lookup
sys/vfs/ntfs/ntfs_ihash.c:90
 panic reproduced fixed untriaged — —
DF-2462 Medium 7.0 ism_stop frees session while CAM/ic_action and sysctl handlers can still dereference it (UAF)
sys/dev/disk/iscsi/initiator/isc_sm.c:752
 leak reproduced fixed untriaged — —
DF-1827 High 6.7 isc_soc: heap overflow in isc_sendPDU MH_ALIGN misuse leaves no room for AHS or header digest
sys/dev/disk/iscsi/initiator/isc_soc.c:111
 panic reproduced fixed untriaged — —
DF-1703 Medium 6.7 iscsi initiator: heap overflow in i_send via 32-bit truncation in i_prepPDU + signedness bypass of maxBurstLength check
sys/dev/disk/iscsi/initiator/iscsi.c:454
 none inconclusive — untriaged — —
DF-2602 Medium 6.7 Heap buffer overflow in smb_smb_ssnsetup plaintext-password path via iconv length mismatch
sys/netproto/smb/smb_smb.c:268
 panic reproduced fixed untriaged — —
DF-2464 Low 6.6 Unbounded attacker-controlled buffer offset (bo) in so_recv douio path - latent OOB write + latent stack overflow same defect class as scsi_decap DF-2458
sys/dev/disk/iscsi/initiator/isc_soc.c:450
 none not_reproduced not_testable untriaged — —
DF-0627 High 6.5 mbuf chain leak on duplicate SMB responses enables remote kernel memory-exhaustion DoS
sys/netproto/smb/smb_iod.c:363
 none not_reproduced not_testable untriaged — —
DF-0671 High 6.5 Unbounded recursion in NetBIOS retarget handling causes kernel stack overflow / panic
sys/netproto/smb/smb_trantcp.c:263
 panic reproduced fixed untriaged — —
DF-0673 Medium 6.5 nbssn_recv() leaks mbufs on receive error and on inner-loop sbinit() reset
sys/netproto/smb/smb_trantcp.c:345
 none not_reproduced not_testable untriaged — —
DF-0907 High 6.4 Heap overflow in smbfs_mount: signed underflow in strncpy length when SMB username >= 76 chars
sys/vfs/smbfs/smbfs_vfsops.c:170
 panic reproduced not_testable untriaged — —
DF-0628 Medium 6.4 Use-after-free of struct smbiod on shutdown: destroyer frees iod without waiting for the iod kthread to exit
sys/netproto/smb/smb_iod.c:675
 panic reproduced fixed untriaged — —
DF-1759 Medium 6.4 isc_sm: UAF on pduq via early pdu_free in proc_out racing network-stack ext_free
sys/dev/disk/iscsi/initiator/isc_sm.c:530
 none inconclusive — untriaged — —
DF-1829 Medium 6.4 isc_soc: UAF/refcount corruption via ext_free on reused pduq in send path
sys/dev/disk/iscsi/initiator/isc_soc.c:70
 none inconclusive — untriaged — —
DF-1871 Low 6.4 scsi_encap overflows cmd->cdb on oversized inline CDB from CAM pass-through
sys/dev/disk/iscsi/initiator/iscsi_subr.c:494
 panic reproduced fixed untriaged — —
DF-2171 Low 6.4 i_setopt free-and-reassign of sp->opt strings is unlocked; concurrent ISCSISETOPT ioctls race into double-free / UAF
sys/dev/disk/iscsi/initiator/isc_subr.c:104
 corruption reproduced fixed untriaged — —
DF-0786 Medium 6.3 Off-by-one heap overflow in ntfs_ntlookupattr: NUL terminator written one byte past kmalloc(namelen)
sys/vfs/ntfs/ntfs_subr.c:826
 corruption reproduced not_testable untriaged — —
DF-0934 Medium 6.1 Accumulated input offset never bounded - heap OOB read of compressed input buffer (cup) in NTFS decompression
sys/vfs/ntfs/ntfs_compr.c:55
 panic reproduced fixed untriaged — —
DF-0734 High 6.0 Negative ioc_setupcnt bypasses signed upper-bound check — >131KB kernel stack OOB read exfiltrated to SMB server
sys/netproto/smb/smb_usr.c:299
 panic reproduced fixed untriaged — —
DF-2010 Low 5.8 Lockless read of isp->sessions[] in ic_action allows use-after-free of iSCSI session being torn down
sys/dev/disk/iscsi/initiator/isc_cam.c:210
 none reproduced not_testable untriaged — —
DF-0598 Medium 5.5 smb_sm_lookupint leaks a VC reference on every failed lookup, pinning VCs and hanging teardown
sys/netproto/smb/smb_conn.c:124
 dos reproduced fixed untriaged — —
DF-0599 Medium 5.5 smb_vc_create error path NULL-deferences vc_iod via smb_vc_disconnect (trivially-triggerable kernel panic via invalid charset name)
sys/netproto/smb/smb_conn.c:460
 panic reproduced fixed untriaged — —
DF-0790 Medium 5.5 ATTRLIST parsing DoS in ntfs_ntvattrget: reclen==0 infinite loop or reclen>len NULL deref panic
sys/vfs/ntfs/ntfs_subr.c:186
 dos reproduced fixed untriaged — —
DF-0872 Medium 5.5 Divide-by-zero and undefined-shift in BPB bpmftrec computation from crafted boot sector
sys/vfs/ntfs/ntfs_vfsops.c:343
 panic reproduced fixed untriaged — —
DF-2463 Medium 5.5 NULL-deref panic in so_input: pdu_alloc retry uses M_NOWAIT instead of M_WAITOK then dereferences pq unconditionally
sys/dev/disk/iscsi/initiator/isc_soc.c:540
 none inconclusive not_testable untriaged — —
DF-2554 Medium 5.5 Divide-by-zero kernel panic from unvalidated boot sector bf_bps=0 during mount
sys/vfs/ntfs/ntfs_vfsops.c:331
 panic reproduced fixed untriaged — —
DF-0672 Medium 5.4 Uninitialized struct sockaddr_in passed to soconnect() in retarget path
sys/netproto/smb/smb_trantcp.c:206
 none reproduced not_testable untriaged — —
DF-2567 Low 5.4 Use-after-free read of rqp->sr_flags in smb_t2_request_int error path
sys/netproto/smb/smb_rq.c:740
 none reproduced not_testable untriaged — —
DF-1761 Medium 5.3 isc_sm: remote memory leak / pdu-pool exhaustion via TASK_RSP/default cases never freeing received pduq
sys/dev/disk/iscsi/initiator/isc_sm.c:451
 none inconclusive — untriaged — —
DF-2468 Medium 5.3 getSenseData leaks kernel heap into CCB sense buffer via unvalidated wire sense_len and mis-sized scratch buffer
sys/dev/disk/iscsi/initiator/iscsi_subr.c:152
 leak reproduced not_testable untriaged — —
DF-0718 Medium 5.1 smb_dev2share type-confuses non-vnode fd (socket/pipe/kqueue) as vnode via unchecked fp->f_data cast — kernel panic
sys/netproto/smb/smb_dev.c:395
 panic reproduced fixed untriaged — —
DF-0835 Medium 4.4 smbfs_advlock unconditionally overwrites lock type to SMB_LOCK_EXCL — shared locks become exclusive, unlocks acquire new locks
sys/vfs/smbfs/smbfs_vnops.c:927
 logic/auth violation + remote DoS ceiling reproduced fixed untriaged — —
DF-0674 Low 4.4 nb_put_name() unbounded NetBIOS-name walk: infinite loop on 0xFF and heap OOB read
sys/netproto/smb/smb_trantcp.c:122
 panic reproduced fixed untriaged — —
DF-0715 Low 4.4 smb_memdupin signed-length validation accepts zero (ZERO_LENGTH_PTR panic) and negative (huge kmalloc panic) lengths
sys/netproto/smb/smb_subr.c:136
 panic reproduced fixed untriaged — —
DF-0836 Low 4.4 smbfs_advlock missing break: SEEK_END always returns EINVAL, SEEK_CUR treated as SEEK_SET
sys/vfs/smbfs/smbfs_vnops.c:905
 none reproduced not_testable untriaged — —
DF-2169 Low 4.4 maxluns clamp is a dead store; user-controlled value flows unfiltered into CAM cpi->max_lun, enabling local LUN-scan DoS
sys/dev/disk/iscsi/initiator/isc_subr.c:123
 none reproduced fixed untriaged — —
DF-2466 Low 4.4 Heap overflow in i_send via ahs_len/ds_len padding mismatch with i_prepPDU
sys/dev/disk/iscsi/initiator/iscsi.c:454
 panic reproduced fixed untriaged — —
DF-0737 Low 3.7 Non-constant-time SMB1 signature verification via bcmp — timing side channel for byte-by-byte signature forgery
sys/netproto/smb/smb_crypt.c:304
 leak reproduced not_testable untriaged — —
DF-1830 Low 3.7 isc_soc: so_recv douio block stores stale stack pointer and OOB SCSI buffer offset in pq->iov
sys/dev/disk/iscsi/initiator/isc_soc.c:446
 none reproduced not_testable untriaged — —
DF-0885 Low 3.6 TOCTOU on np->n_fid/n_opencount in smbfs_getpages/smbfs_putpages fid confusion
sys/vfs/smbfs/smbfs_io.c:455
 none reproduced not_testable untriaged — —
DF-0788 Medium 3.3 Heap info leak via resident attribute data offset in ntfs_attrtontvattr — a_dataoff past record boundary
sys/vfs/ntfs/ntfs_subr.c:536
 leak reproduced fixed untriaged — —
DF-0933 Medium 3.3 Compressed NTFS block leaves output tail uninitialized - stale kernel-heap info leak
sys/vfs/ntfs/ntfs_compr.c:70
 leak:4088 reproduced fixed untriaged — —
DF-0837 Low 3.3 smbfs_strategy silently drops async buffer IO returning success without doing work
sys/vfs/smbfs/smbfs_vnops.c:796
 none reproduced not_testable untriaged — —
DF-0916 Low 3.3 smb_time_unix2dos year-computation loop unbounded allows kernel livelock DoS via crafted timestamps
sys/vfs/smbfs/smbfs_subr.c:170
 dos reproduced fixed untriaged — —
DF-1704 Low 3.0 iscsi initiator: heap OOB write of 1-3 NUL bytes in i_send due to padding-calc mismatch when ahs_len not multiple of 4
sys/dev/disk/iscsi/initiator/iscsi.c:461
 panic reproduced fixed untriaged — —
DF-2467 Low 3.0 TOCTOU in i_create_session: sc->sessions[n] assigned outside the search lock
sys/dev/disk/iscsi/initiator/iscsi.c:623
 corruption reproduced fixed untriaged — —
DF-0600 Low 2.5 Unvalidated sa_len in dup_sockaddr callers enables heap OOB read of up to ~250 bytes
sys/netproto/smb/smb_conn.c:462
 leak:251 reproduced fixed untriaged — —
DF-1760 Low 2.3 isc_sm: memory leak - proc_out default-error branch leaks non-CCB pduq on any non-EAGAIN/EPIPE send error
sys/dev/disk/iscsi/initiator/isc_sm.c:549
 dos reproduced fixed untriaged — —
DF-2170 Low 2.3 headerDigest/dataDigest strcmp on stack buffer left non-NUL-terminated by ENAMETOOLONG copyinstr
sys/dev/disk/iscsi/initiator/isc_subr.c:85
 none reproduced fixed untriaged — —
DF-2465 Low 2.3 Stack over-read via strcmp/kprintf on non-NUL-terminated copyinstr result in i_setopt digest handling
sys/dev/disk/iscsi/initiator/isc_subr.c:85
 none reproduced not_testable untriaged — —
DF-0716 Low 1.9 smb_strdupin ignores copyin return value — TOCTOU race leaks uninitialized kernel heap memory to SMB server via TRANS2 name
sys/netproto/smb/smb_subr.c:113
 leak:8 reproduced fixed untriaged — —
DF-0719 Low 1.9 nsmb_dev_open races si_drv1 allocation outside any lock — memory leak / stale-pointer window
sys/netproto/smb/smb_dev.c:104
 panic reproduced fixed untriaged — —
DF-0738 Low 1.9 NTLM hashes DES key schedule MD4 state cleartext Unicode password not zeroized after use
sys/netproto/smb/smb_crypt.c:70
 leak reproduced not_testable untriaged — —

Vendored third-party (contrib) 5

Vendored code; fix owner is the upstream project.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2255 Medium 6.8 Stack buffer overflow in ar9300_eeprom_restore_internal_address via unchecked EEPROM compression length field
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3892
 dos reproduced not_testable untriaged — —
DF-2256 Low 3.5 ar9300_calibration_data_read_array silently ignores read failures leaving stack buffer uninitialized
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3697
 none reproduced not_testable untriaged — —
DF-2258 Low 2.4 OOB read: gain_table_entries[32] via unclamped gain_index in ar9300_paprd_setup_gain_table
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:2003
 leak reproduced fixed untriaged — —
DF-2259 Low 2.4 Uninitialized stack reads in create_pa_curve when training bins lack samples
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:1398
 leak reproduced fixed untriaged — —
DF-2257 Info 1.6 Unbounded while(1) loop in ar9300_rf_gain_cap_apply can walk past rx_gain_table[256] (defense-in-depth; not exploitable with current static data)
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_attach.c:3397
 — not_reproduced not_testable untriaged — —