⬢ DragonFlyBSD Kernel Audit
← full dashboard

Triage — Dillon priority

Every finding grouped in the order the project asked to sift them: Hammer2 first, then kernel memory corruption (UAF-style), privilege escalations on general-use paths, and kernel leaks; ancient subsystems (PPP, iSCSI, NTFS, SMB) are grouped last and deferred. Triage state, owner and comments are shared with the team via the collaboration API.

3069
findings
475
pass 2 · new
3067
untriaged
2
touched

Hammer2 82

Dillon's first ask: anything in sys/vfs/hammer2.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2647 High 8.2 hammer2_ioctl_pfs_get trusts on-media uint16 name_len past a KKASSERT — production kernels get a controlled kernel heap OOB write up to ~64KB
sys/vfs/hammer2/hammer2_ioctl.c:494 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2616 High 7.8 No radix-alignment/64KB-window validation of on-disk data_off — chain->data + chain->bytes overruns the DIO buffer (OOB read/write)
sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2620 High 7.8 Crafted on-disk pfs_nmasters drives OOB thread-array access and arbitrary kfree in hammer2 unmount (xop_helper_cleanup)
sys/vfs/hammer2/hammer2_vfsops.c:527 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2619 High 7.1 Dirent namlen unbounded by chain->bytes: OOB read past 64KB DIO buffer in dirent_test AND 127-byte kernel-memory disclosure to userspace via getdents
sys/vfs/hammer2/hammer2_chain.c:5781 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2618 Medium 6.6 Overlapping key ranges in on-disk blockref arrays unvalidated — chain-insert collision panic or RB_REMOVE wipes the parent's rbtree root
sys/vfs/hammer2/hammer2_chain.c:313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2621 High 6.3 hammer2_xop_helper_create() re-kmallocs pmp->xop_groups unconditionally — leaked thread array and orphaned threads that use-after-free the pmp
sys/vfs/hammer2/hammer2_admin.c:431 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2645 Medium 6.3 Flush-driven indirect collapse contradicts its own skip guard: concurrent child COW-modify during hammer2_chain_indirect_maintenance leaves a live child, tripping the unconditional repchange emptiness KKASSERT (panic) or orphaning the subtree (silent data loss)
sys/vfs/hammer2/hammer2_flush.c:1039 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2658 Medium 6.0 hammer2_sync_replace() resize is a guaranteed no-op (radix of chain->bytes instead of focus->bytes): heap OOB read persisted to media / silent truncation / NULL-source bcopy for embedded dirents
sys/vfs/hammer2/hammer2_synchro.c:939 · pass 2 · new
 none untested not_testable untriaged — —
DF-2617 Medium 5.5 Zero-offset data_off on data-requiring bref types silently yields chain->data==NULL with error==0 — NULL panic or unkillable while(1) tsleep hang
sys/vfs/hammer2/hammer2_chain.c:938 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2626 Medium 5.5 hammer2_read_file ignores uiomovebp() error: user-triggered unkillable in-kernel infinite loop (read/readlink EFAULT livelock)
sys/vfs/hammer2/hammer2_vnops.c:983 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2630 Medium 5.5 hammer2 VFS_ROOT quorum wedge: pfs_nmasters > nchains pins mount forever and holds the namecache lock
sys/vfs/hammer2/hammer2_vfsops.c:1966 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2633 Medium 5.5 hammer2 write() silently succeeds while backend allocation fails on full PFS (ENOSPC never reaches the writer)
sys/vfs/hammer2/hammer2_strategy.c:1310 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2640 Medium 5.5 Unguarded hammer2_chain_dirent_test() calls in the xop backend lookup loops are the first dereference of a NULL-data chain — unprivileged post-mount kernel panic (survives DF-2617's fix)
sys/vfs/hammer2/hammer2_xops.c:282 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2651 Medium 5.5 NULL-pointer dereference in hammer2_freemap_adjust() when the freemap leaf is absent — mount-time panic from crafted image
sys/vfs/hammer2/hammer2_freemap.c:1013 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2655 Medium 5.5 hammer2 ZLIB decompression failure returns zero-filled SUCCESS (b_error never set) — silent data substitution on malformed compressed blocks
sys/vfs/hammer2/hammer2_strategy.c:258 · pass 2 · new
 — — — untriaged — —
DF-2657 Medium 5.5 Sync-thread xop quorum counts the excluded node: hammer2_xop_collect() can never reach quorum, permanently parking every sync thread (h2coll) — precise fixable root cause of the DF-2631 umount -f wedge family
sys/vfs/hammer2/hammer2_synchro.c:411 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2662 Medium 5.5 hammer2_update_spans() dereferences chain->data of an EIO-failed inode chain (NULL deref panic, unmasked by DF-2661's fix)
sys/vfs/hammer2/hammer2_iocom.c:313 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2652 High 5.3 Wrong bitmap-pair index (& 15 instead of 5-bit mask) in hammer2_freemap_adjust() DORECOVER — live blocks left marked free, overlapping allocations and silent cross-file data corruption
sys/vfs/hammer2/hammer2_freemap.c:1073 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2624 Medium 5.1 hammer2_pfsalloc kstrdup(ripdata->filename) with no NUL bound overreads the 64KB DIO buffer (mount-time panic / silent adjacent-heap overread)
sys/vfs/hammer2/hammer2_vfsops.c:495 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2635 Medium 5.1 iroot meta.inum overwritten from media after inum-hash insertion — hammer2_inode_drop walks off the wrong bucket (NULL-deref panic at unmount plus in-memory inode aliasing)
sys/vfs/hammer2/hammer2_inode.c:617 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2627 Medium 4.7 hammer2_vop_readdir reads uninitialized stack (bref) on first-xop-error and discloses it to userspace via the directory cookie/offset
sys/vfs/hammer2/hammer2_vnops.c:745 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2632 Medium 4.7 hammer2 flusher panics on dense dirent packing: 'insert base overlapping elements' (unprivileged local DoS)
sys/vfs/hammer2/hammer2_chain.c:5308 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2642 Medium 4.7 zero_write() drops hammer2_chain_delete() failure: all-zero block overwrite silently succeeds while the old data chain survives the topology — reads resurrect pre-overwrite content after buffer-cache eviction
sys/vfs/hammer2/hammer2_strategy.c:1298 · pass 2 · new
 none reproduced inconclusive untriaged — —
DF-2644 Medium 4.7 hammer2_xop_inode_flush NULL-derefs the PFS-root chain during sync when its media re-read fails (kernel panics on a recoverable I/O error)
sys/vfs/hammer2/hammer2_flush.c:1334 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2646 Medium 4.7 hammer2_flush_core LOST CHILD3 panics on the NULL->non-NULL parent transition (unconditional KKASSERT / hammer2_chain_unlock(NULL))
sys/vfs/hammer2/hammer2_flush.c:681 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2649 Medium 4.7 NULL parent->data dereference in hammer2_bulkfree_scan's PFSROOT kprintfs when a PFS-root chain fails to load with a non-CHECK error
sys/vfs/hammer2/hammer2_bulkfree.c:143 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2660 Medium 4.7 hammer2_sync_insert() TOCTOU re-lookup races concurrent same-key creates on mounted rw clusters: KKASSERT(chain == NULL) panics INVARIANTS kernels (duplicate-key chain_create on production)
sys/vfs/hammer2/hammer2_synchro.c:741 · pass 2 · new
 none untested not_testable untriaged — —
DF-2661 Medium 4.7 hammer2 DIO error path leaves stale dio->bp with DIO_GOOD cleared; concurrent accessor trips KKASSERT(dio->bp == NULL) and panics
sys/vfs/hammer2/hammer2_io.c:350 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2663 Medium 4.7 hammer2 mount-time volume-size containment check silently skipped when DIOCGPART fails; forged volu_size beyond backing media accepted, short-read media-EOF semantics then serve uninitialized kernel memory as file data
sys/vfs/hammer2/hammer2_ondisk.c:283 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2638 Low 4.7 hammer2_inode_chain_sync clears RESIZED/MODIFIED before the backend sync and never restores them on error — silent metadata loss
sys/vfs/hammer2/hammer2_inode.c:1718 · pass 2 · new
 none untested not_testable untriaged — —
DF-2641 Low 4.7 Latent unguarded chain->data derefs in xop_nrename/xop_unlink/chain_sync (539 lacks even the error check its siblings have; 670-678/1618 are NULL-offset WRITE variants after modify-succeeds-with-NULL)
sys/vfs/hammer2/hammer2_xops.c:539 · pass 2 · new
 none untested not_testable untriaged — —
DF-2643 Low 4.7 hammer2_xop_strategy_write dereferences the inode chain without the NULL check the read xop performs — NULL-deref panic if the inode's cluster chain is concurrently gone
sys/vfs/hammer2/hammer2_strategy.c:623 · pass 2 · new
 — — — untriaged — —
DF-2901 Low 4.7 hammer2 bulkfree scan uses kmem_alloc_swapbacked() result unchecked — NULL bitmap reaches bzero(NULL, size) panic in cbinfo_bmap_init; path is unprivileged via the ungated HAMMER2IOC_BULKFREE_SCAN/ASYNC ioctls
sys/vfs/hammer2/hammer2_bulkfree.c:569 · pass 2 · new
 — — — untriaged — —
DF-2636 Medium 4.4 hammer2_igetv panics on unhandled on-media objtype (0,3,8,10,11..255) — crafted-image kernel DoS at mount/first access
sys/vfs/hammer2/hammer2_inode.c:791 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2653 Medium 4.4 sub_key-derived bitmap index overflows the 64-bit element in hammer2_bmap_alloc() for non-radix-aligned crafted DATA bref keys — KKASSERT panic (INVARIANTS) / truncated mask with overlapping 64K allocations (noinv)
sys/vfs/hammer2/hammer2_freemap.c:663 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2631 Medium 4.1 umount -f of a same-clid multi-device hammer2 cluster hangs in hammer2_thr_wait (h2twait) on unmodified images
sys/vfs/hammer2/hammer2_admin.c:461 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-2659 Low 4.1 NULL column chain during sync: hammer2_inode_chain_and_parent() cannot return NULL (panics at chain->parent first) and synchro.c evaluates chain->bref.modify_tid BEFORE its own if (chain) guard
sys/vfs/hammer2/hammer2_synchro.c:417 · pass 2 · new
 none untested not_testable untriaged — —
DF-2648 Low 3.8 HAMMER2IOC_VERSION_GET and HAMMER2IOC_INODE_GET ignore the caps_priv_check result (privilege gate bypass)
sys/vfs/hammer2/hammer2_ioctl.c:86 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2614 Low 3.6 Debug kprintf's in hammer2 cluster message path leak kernel heap pointer to msgbuf and allow peer-driven console flooding
sys/vfs/hammer2/hammer2_iocom.c:135 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2622 Low 3.3 One-byte stack out-of-bounds read in hammer2_vfs_mount label parsing for empty or '@'-only device strings
sys/vfs/hammer2/hammer2_vfsops.c:1012 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2629 Low 3.3 hammer2_vop_setattr applies va_mtime with no owner/VA_UTIMES_NULL privilege check (divergence from the VFS contract UFS enforces)
sys/vfs/hammer2/hammer2_vnops.c:561 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2637 Low 3.3 Kernel heap-pointer (%p) kprintf disclosures on four hammer2 inode error paths
sys/vfs/hammer2/hammer2_inode.c:711 · pass 2 · new
 none untested not_testable untriaged — —
DF-2628 Low 2.5 hammer2_vop_nlink increments meta.nlinks even when hammer2_dirent_create fails — permanent link-count inflation and unfreeable inodes
sys/vfs/hammer2/hammer2_vnops.c:1599 · pass 2 · new
 none inconclusive — untriaged — —
DF-2639 Low 2.3 hammer2_inode_create_pfs never sets *errorp on its done2 error paths — snapshot ioctl silently succeeds without creating anything
sys/vfs/hammer2/hammer2_inode.c:1042 · pass 2 · new
 none untested not_testable untriaged — —
DF-2623 Low 1.9 hammer2_fixup_pfses kprintf uses ripdata captured before hammer2_chain_modify COW'd and released the buffer
sys/vfs/hammer2/hammer2_vfsops.c:2399 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2664 Low 1.9 Vendored LZ4 r97: LZ4_decompress_safe() reads one byte past the source buffer when inputSize==0 (upstream r96/v1.9.4 guard missing)
sys/vfs/hammer2/hammer2_lz4.c:407 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2666 Low 1.9 HAMMER2IOC_RECLUSTER leaks the holdfp() file reference on both error returns in hammer2_ioctl_recluster() — permanent struct-file pin per failing call
sys/vfs/hammer2/hammer2_ioctl.c:212 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2656 Info 1.1 hammer2 zlib port drops zcalloc's zero-initialization: deflate window/state kmalloc'd unzeroed, leaving stale-heap reads whose output-independence rests on subtle invariants
sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:239 · pass 2 · new
 — — — untriaged — —
DF-2665 Info 1.1 Vendored LZ4 is upstream r97 (2013) — 13 years of upstream hardening absent (cross-reference; upstream-owned history)
sys/vfs/hammer2/hammer2_lz4.c:372 · pass 2 · new
 — — — untriaged — —
DF-2650 Medium — KKASSERT(radix != 0) in h2_bulkfree_callback — deterministic unprivileged kernel panic from a radix-0 on-disk data_off
sys/vfs/hammer2/hammer2_bulkfree.c:847 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-0763 High 7.8 Missing on-disk radix validation in chain allocation — malicious filesystem image radix 17-31 causes heap OOB read/write via bcopy/hash/CRC/array iteration
sys/vfs/hammer2/hammer2_chain.c:189 · 📝
 panic reproduced fixed triaged P0 dillon 1
DF-0821 High 7.8 OOB kernel heap read/write via crafted signed bmap->linear from filesystem image
sys/vfs/hammer2/hammer2_freemap.c:616
 panic reproduced fixed untriaged — —
DF-2583 High 7.8 Unvalidated parent->bytes yields OOB blockref array access during flush
sys/vfs/hammer2/hammer2_flush.c:1094
 panic reproduced fixed untriaged — —
DF-2605 High 7.8 Missing radix validation in hammer2_chain_alloc causes OOB read/write from crafted filesystem image
sys/vfs/hammer2/hammer2_chain.c:189
 panic reproduced fixed untriaged — —
DF-2562 High 7.1 readdir trusts on-media name length as bcopy length -> kernel heap OOB read (info leak + panic)
sys/vfs/hammer2/hammer2_vnops.c:702
 leak:65535 reproduced fixed untriaged — —
DF-2585 Medium 7.0 Cluster array chain pointer read without cluster_spin UAF in volume dedup check
sys/vfs/hammer2/hammer2_flush.c:1377
 — — — untriaged — —
DF-0823 High 6.7 hammer2_xop_helper_cleanup stops only MASTER-indexed threads — leaks survivors into freed heap UAF on unmount of multi-chain PFS
sys/vfs/hammer2/hammer2_admin.c:437
 panic reproduced fixed untriaged — —
DF-0805 Low 6.3 LZ4 read path compressed_size bounds checked only by KKASSERT — heap OOB read on non-INVARIANTS kernels
sys/vfs/hammer2/hammer2_strategy.c:197
 panic reproduced fixed untriaged — —
DF-0815 Medium 6.1 Missing privilege check on BULKFREE_SCAN/ASYNC and DEBUG_DUMP ioctls — unprivileged DoS + kernel address leak via msgbuf
sys/vfs/hammer2/hammer2_ioctl.c:83
 leak:kernel_ptrs reproduced fixed untriaged — —
DF-0777 Medium 5.5 hammer2_vop_readdir leaks kernel heap via unvalidated on-disk name_len/namlen — OOB read past inode/data buffer into heap
sys/vfs/hammer2/hammer2_vnops.c:706
 leak:65535 reproduced fixed untriaged — —
DF-0796 Medium 5.5 NULL deref in hammer2_inode_chain_and_parent when cluster has NULL chain slot — sibling hammer2_inode_chain handles correctly this does not
sys/vfs/hammer2/hammer2_inode.c:436
 panic reproduced fixed untriaged — —
DF-0804 Medium 5.5 Panic / NULL deref via crafted HAMMER2 image in strategy_read_completion — unknown bref.type/methods from media
sys/vfs/hammer2/hammer2_strategy.c:441
 panic reproduced fixed untriaged — —
DF-0817 Medium 5.5 NULL deref in h2_bulkfree_sync freemap lookup error path — live_chain->error deref when live_chain is NULL
sys/vfs/hammer2/hammer2_bulkfree.c:1046
 panic reproduced fixed untriaged — —
DF-0822 Medium 5.5 Sustained CPU-burn DoS via unchecked radix in hammer2_freemap_adjust count calculation
sys/vfs/hammer2/hammer2_freemap.c:977
 panic reproduced fixed untriaged — —
DF-0842 Medium 5.5 Missing sliding-window allocation in inflate updatewindow() — NULL-pointer-write panic on malformed HAMMER2 zlib block
sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c:373
 panic reproduced fixed untriaged — —
DF-0875 Medium 5.5 hammer2_get_volume unconditional panic on out-of-range data_off from crafted filesystem image
sys/vfs/hammer2/hammer2_ondisk.c:731
 panic reproduced fixed untriaged — —
DF-0904 Medium 5.5 Infinite kernel-thread loop in hammer2_update_spans when non-inode chain under super-root
sys/vfs/hammer2/hammer2_iocom.c:313
 dos reproduced fixed untriaged — —
DF-2568 Medium 5.5 NULL-deref panic in hammer2_flush retry loop when chain loses parent during flush
sys/vfs/hammer2/hammer2_flush.c:404
 panic not_reproduced not_testable untriaged — —
DF-2584 Medium 5.5 Flush depth limit panics instead of deferring DoS via deeply nested crafted image
sys/vfs/hammer2/hammer2_flush.c:56
 — — — untriaged — —
DF-0762 Medium 4.7 NULL deref in hammer2_chain_lastdrop no-parent retry path — parent->core.spin released when parent is NULL
sys/vfs/hammer2/hammer2_chain.c:646
 dos reproduced fixed untriaged — —
DF-0813 Medium 4.7 NULL deref in hammer2_flush() retry loop when chain->parent becomes NULL during concurrent flush — missing NULL guards present in setup/teardown
sys/vfs/hammer2/hammer2_flush.c:397
 none not_reproduced not_testable untriaged — —
DF-0800 Low 4.7 Missing NULL check on hammer2_inode_chain in truncation reset path — panic + %s OOB read on crafted image filename
sys/vfs/hammer2/hammer2_xops.c:1600
 none not_reproduced fixed untriaged — —
DF-0818 Low 4.7 Integer divide-by-zero in bulkfree_pass progress computation for total_size<10000 (crafted image volu_size=0)
sys/vfs/hammer2/hammer2_bulkfree.c:727
 none not_reproduced fixed untriaged — —
DF-0772 Medium 4.4 Infinite loop in hammer2_fixup_pfses on non-INODE blockref under super-root — system-wide HAMMER2 mount/unmount hang
sys/vfs/hammer2/hammer2_vfsops.c:2389
 dos reproduced fixed untriaged — —
DF-2606 Medium 4.4 Unvalidated bref->keybits from disk causes undefined behavior in shift operations throughout chain lookups
sys/vfs/hammer2/hammer2_chain.c:109
 — — — untriaged — —
DF-2569 Low 4.4 Unconditional kernel panic on flush recursion depth limit instead of documented deferral
sys/vfs/hammer2/hammer2_flush.c:580
 — — — untriaged — —
DF-0801 Info 4.1 Missing NULL check on hammer2_inode_chain in xop_inode_connect — latent dead-code NULL deref
sys/vfs/hammer2/hammer2_xops.c:1488
 none reproduced not_testable untriaged — —
DF-0826 Info 3.0 deflate() emits zlib header and resets adler unconditionally — stream corruption for any non-single-shot caller
sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391
 none reproduced not_testable untriaged — —
DF-0905 Low 2.5 iroot inode lock leaked on early-exit path in hammer2_update_spans
sys/vfs/hammer2/hammer2_iocom.c:303
 dos reproduced not_testable untriaged — —
DF-0906 Low 2.5 TOCTOU on iocom conn_state in hammer2_volconf_update (XXX comment flags missing interlock)
sys/vfs/hammer2/hammer2_iocom.c:375
 panic reproduced not_testable untriaged — —
DF-0816 Low 2.3 Heap over-read in volume_list bcopy of kstrdup strings — leaks kernel heap via copyout
sys/vfs/hammer2/hammer2_ioctl.c:1439
 leak reproduced not_testable untriaged — —
DF-0936 Info 0.5 NUL-termination write underflows when aux_size==0 (latent OOB write, dead code today; live twin at hammer2_iocom.c:149)
sys/vfs/hammer2/hammer2_msgops.c:72
 none reproduced fixed untriaged — —

Kernel memory corruption (UAF / OOB write) 955

Use-after-free, double-free, OOB/heap/stack writes, integer overflow into a write, type confusion — the corruption bugs that become user→root escalations.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2748 High 9.1 Full-duplex journal ack-path loss permanently wedges all writers in uninterruptible, SIGKILL-immune kernel sleep — and mountctl -d frees the journal out from under the sleepers (demonstrated wake-through-reuse UAF)
sys/kern/vfs_journal.c:330 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2675 Critical 8.8 allocbuf() maps 17 pages into the 16-page MAXBSIZE per-header KVA slot when (loffset & PAGE_MASK)+size > MAXBSIZE — PTE written into the next buffer header's slot, aliasing one page between two live kernel buffers (cross-buffer R/W, info leak, panic)
sys/kern/vfs_bio.c:3039 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2707 High 8.8 Duplicate transmitted DELETE re-runs the state close sequence: double RB_REMOVE on a stale node plus phantom rbtree refcount drop — state-tree corruption and premature kdmsg_state_free (UAF), peer-driven on production kernels
sys/kern/kern_dmsg.c:1667 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2755 High 8.8 TIOCSCTTY reassignment performs unsynchronized read-modify-write of session->s_ttyvp in vn_ioctl/devfs_fo_ioctl: racing twins double-vrele() the old controlling-tty vnode → v_refcnt underflow → premature vnode destruction → use-after-free
sys/kern/vfs_vnops.c:1049 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2922 High 8.8 proplib type confusion: unvalidated "arguments" object mtx_lock()ed as an array before type check → unprivileged kernel corruption / panic / livelock
sys/kern/vfs_quota.c:242 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3015 High 8.8 ufs_symlink controlled kernel heap overflow via unvalidated on-disk fs_maxsymlinklen — bcopy of up to 1023 attacker bytes into the 60-byte i_shortlink, ~919 bytes past the struct inode slab chunk
sys/vfs/ufs/ufs_vnops.c:1562 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3003 High 8.2 hammer_update_itimes() in-place atime/mtime update writes past the inode record's 16KB block on crafted HAMMER1 images — no data_len validation at extraction and hammer_crc_test_leaf() accepts any wrong-length INODE record via the 0-return CRC bypass
sys/vfs/hammer/hammer_inode.c:1446 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3078 High 8.2 ffs_reload (MNT_RELOAD) adopts the re-read superblock's geometry without validating it against the mount-time allocations — heap OOB write with attacker-controlled length and content, divide-by-zero, and heap OOB read disclosed to the media
sys/vfs/ufs/ffs_vfsops.c:484 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2739 Medium 8.2 linker_file_unload() veto path drops the caller's reference on a failed unload — refcount underflow on a live linker_file → premature teardown under a live dependent → use-after-free
sys/kern/kern_linker.c:514 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3035 High 8.1 FFS allocator uses unvalidated on-disk cylinder-group header fields as kernel-memory offsets/indexes — crafted image gives attacker-offset OOB read/write on first allocation
sys/vfs/ufs/ffs_alloc.c:1010 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2875 High 8.0 Pipelined BLK_WRITE in one transaction: single-slot iost->data aux tracking frees the most-recent aux while its bio is still in flight (deterministic UAF on bp->b_data) and leaks all earlier aux
sys/kern/subr_diskiocom.c:440 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2687 High 7.9 TIOCSCTTY reassignment orphans the old tty's t_session, yielding an unprivileged use-after-free of struct session (deterministic panic; ctty hijack of recycled sessions)
sys/kern/tty.c:1190 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2857 High 7.9 shm_deallocate_segment keeps the segment findable during its own blocking teardown: racing IPC_RMID double-deallocates the vm_object (guaranteed panic; kfree double-free door)
sys/kern/sysv_shm.c:180 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2691 High 7.8 EVFILT_SIGNAL knote use-after-free: knote stays linked into struct proc after the target is reaped; kqueue teardown runs SLIST_REMOVE on freed kernel memory
sys/kern/kern_sig.c:2667 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2778 High 7.8 mq_notify_proc is an unreferenced struct proc *: registrant exit with an inherited descriptor leaves a dangling pointer consumed by mq_send1 (PHOLD + ksignal on freed kernel heap) — deterministic UAF with cross-process signal injection
sys/kern/sys_mqueue.c:988 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2826 High 7.8 elf_getfiles() drops an unowned reference on the checkpoint file when fdalloc() fails: struct file refcount underflow, premature fo_close/vrele/ffree, UAF, success-masking, tempfp leak
sys/kern/kern_checkpoint.c:664 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2869 High 7.8 tq_running single-slot with unlocked clear breaks taskqueue_cancel/drain under concurrent runners → premature-free UAF
sys/kern/subr_taskqueue.c:407 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2996 High 7.8 nfs_sillyrename consumes nfs_lookitup() result with no error check, uninitialized np, and no identity/type validation — wild-pointer write and VDIR n_cookies type confusion; deterministic kernel panic from unprivileged unlink() against a mounted share
sys/vfs/nfs/nfs_vnops.c:3036 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2949 Medium 7.8 cttyclose() takes its tty-vnode reference with vref() racing the terminal vrele() of concurrent ctty teardowns — vref: bad refcnt panic (INVARIANTS) / freelist vnode resurrection (stock)
sys/kern/tty_tty.c:153 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3017 High 7.7 devfs node/cdev lifetime hole: nresolve→devfs_allocv drops devfs_lock on a raw devfs_node; concurrent unpriv pty teardown frees node+cdev → UAF write + sysref_get on freed cdev (proven panic 2/2)
sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2902 High 7.6 mbrinit/mbr_extended trust device-reported d_media_blksize — up to 2 GiB synchronous read into a MAXPHYS (128 KB) pbuf: assertion-cast bypass (all kernels) or INVARIANTS panic; proven OOB write with attacker-controlled content/length
sys/kern/subr_diskmbr.c:127 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2998 High 7.5 Server attributes freely retype live vnodes in nfs_loadattrcache (VREG→VDIR observed live; VCHR/VBLK with server-chosen rdev via addaliasu + v_ops switch) — device-node injection and buffer-cache type confusion through every attribute load in this file
sys/vfs/nfs/nfs_vnops.c:2903 · pass 2 · new
 — — — untriaged — —
DF-3061 High 7.5 nfs_namei() retry protocol leaks locked namecache state and nfsrv_rename()'s retry drives double-releases — remote NFS client can panic the kernel
sys/vfs/nfs/nfs_subs.c:1003 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2740 Low 7.5 Inconsistent locking of linker shared state: sys_kldload userrefs++/id read outside kld_lock (UAF-write window), unlocked refs mutations, and unlocked linker_files/found_modules traversals racing KPI loaders
sys/kern/kern_linker.c:814 · pass 2 · new
 none untested not_testable untriaged — —
DF-3018 Low 7.2 spec VOP dispatch (devfs_spec_read/write/ioctl/kqfilter, D_QUICK close) calls dev_d* on vp->v_rdev with no cdev reference and the vnode unlocked — vfs_timestamp(&node->atime) after teardown is a UAF write if the device dies during the dispatch
sys/vfs/devfs/devfs_vnops.c:1099 · pass 2 · new
 — — — untriaged — —
DF-2920 High 7.1 Beyond-EOF VM pages retained for the last buffer remain faultable: nvnode_pager_setsize()'s unmap is the only EOF enforcement, so mmap reads/writes past EOF succeed on every filesystem, pre-truncate content (incl. recycled disk-block residue) is served during the truncate zero-fill window, and on tmpfs beyond-EOF writes become file data
sys/kern/vfs_vm.c:42 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2940 High 7.1 mpipe_done() tears down the malloc pipeline with no synchronization against in-flight users — its only teardown caller (dm-crypt) destroys tables while bios still hold mpipe buffers: KKASSERT panic / UAF write on production kernels / reproduced permanent kernel wedge
sys/kern/kern_mpipe.c:122 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3011 High 7.1 btree_remove() unbounded recursion — kernel stack overflow from crafted deep B-trees with all-valid counts/types/CRCs (bypasses DF-0776 hardening)
sys/vfs/hammer/hammer_btree.c:1979 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2853 High 7.0 rman_reserve_resource alignment-roundup unsigned wrap grants resources outside the scanned free fragment — overlapping allocations with live owners and free-fragment inflation across neighbors
sys/kern/subr_rman.c:247 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2938 High 7.0 OBJT_DEVICE pager objects never reference the cdev: device teardown while a mapping persists leaves a dangling object->handle → cdev use-after-free in old_dev_pager_fault (indirect call via freed si_ops) and old_dev_pager_dtor (assert + NULL write)
sys/vm/device_pager.c:124 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2990 High 7.0 newblk hash chains mutated without the softdep lock: lock-free insert/lookup races locked remove+kfree on shared chains (list corruption, UAF write into freed M_NEWBLK, 'lost block' panics)
sys/vfs/ufs/ffs_softdep.c:1003 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2692 Medium 7.0 lwpsignal() writes p->p_sigacts->ps_frominfo[] on the token-swapped delivery path holding only the lwp token, racing kern_execve()'s sigacts replacement/free (UAF write)
sys/kern/kern_sig.c:1425 · pass 2 · new
 none untested not_testable untriaged — —
DF-2842 Medium 7.0 vnode_pager_reference() lacks the vp↔object interlock — TOCTOU use-after-free on vm_object ref_count
sys/vm/vnode_pager.c:203 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2872 Medium 7.0 taskqueue_free() ignores the write-only tq_callouts counter: armed timeout callout fires into freed/reallocated queue (UAF)
sys/kern/subr_taskqueue.c:150 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2959 Low 7.0 ucom_get_data TX path passes unclamped request length to clist_qtob — latent heap OOB write past USB page-cache segment (consumer-side defect found in tty_subr.c pass-2 API sweep)
sys/bus/u4b/serial/usb_serial.c:1898 · pass 2 · new
 none untested not_testable untriaged — —
DF-2961 Low 7.0 kobj_class_free() reclaims the compiled ops table with no grace period while the lock-free dispatch hot path reads it (force multiplier turning any consumer refcount slip into a freed function-pointer table call)
sys/kern/subr_kobj.c:179 · pass 2 · new
 — — — untriaged — —
DF-2904 Low 6.8 mbr_extended()'s signed int slice counter can wrap negative after 2^31 accepted EBR entries, defeating the `slice >= MAX_SLICES` guard → OOB write of attacker-controlled ds_offset/ds_size before dss_slices[]
sys/kern/subr_diskmbr.c:423 · pass 2 · new
 none untested not_testable untriaged — —
DF-2741 High 6.7 DIOCGSLICEINFO: dsioctl bcopy uses runtime dss_nslices (GPT disks: up to 130) against the 16-record ioctl type — 29,184-byte kernel heap OOB write per ioctl
sys/kern/subr_disk.c:1196 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2808 Medium 6.7 Cross-segment mapsize under-sizing: mapsize derives only from segs[0]'s start and segs[1]'s end, so segs[0]'s extent is never covered → file-controlled kernel heap overflow (DF-2771 analogue in the EXEC loader)
sys/kern/link_elf.c:541 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2832 Medium 6.7 Syncer-trigger API (trigger_syncer*/speedup_syncer) has no lifetime interlock against vn_syncer_thr_stop — UAF atomic-write on freed syncer ctx (and NULL-ctx / freed-mount reads)
sys/kern/vfs_sync.c:561 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2894 Medium 6.7 kenv_init() ingests unbounded bootloader env strings; kgetenv() strcpy() overflows a 258-byte kernel stack buffer, detonable by any unprivileged user via kenv(2) KENV_GET
sys/kern/kern_environment.c:580 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2984 Medium 6.7 syscall_deregister() writes sysent[*offset] through an unvalidated index with an unvalidated value: MOD_LOAD-failure rollback destroys a live syscall slot (EEXIST) → any unprivileged user's syscall(N) is a kernel NULL function call — deterministic persistent panic; EINVAL variant = arbitrary-index 24-byte kernel zero-write; ENFILE variant = sysent[-1] OOB write
sys/kern/kern_syscalls.c:72 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2745 High 6.6 exit1() p_peers unlink race: lost unlink leaves leader permanently wedged in uninterruptible exit (pre-fdfree, pinning fds+vmspace) and members freed while still linked — kernel heap UAF read/write
sys/kern/kern_exit.c:384 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3047 High 6.6 MNT_RELOAD adopts new group geometry without resizing the cluster-summary arrays — heap OOB write, bzero()/free() of OOB-read pointers, and per-reload gd leak
sys/vfs/ext2fs/ext2_vfsops.c:620 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2828 Medium 6.6 Multi-threaded CKPT_THAW violates vmspace_exec()/pmap_replacevm()'s single-thread contract: deterministic INVARIANTS panic; released-vmspace UAF for other LWPs on production kernels
sys/kern/kern_checkpoint.c:556 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2905 High 6.5 md_done() leaks every pending m_nextpkt record of an mdchain — remote mbuf-pool exhaustion DoS by a malicious SMB server
sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3028 Medium 6.5 Daemon LOOKUP reply with S_IFMT-clear mode yields vtyp=VBAD → fuse_node_vn KKASSERT(0) panic (INVARIANTS force-enabled module-wide)
sys/vfs/fuse/fuse_vnops.c:554 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2845 Medium 6.4 sbuf_drain() does not validate the drain callback's return value — a drain returning 0 yields a silent, unbounded, content-controlled linear kernel-heap overflow on production kernels
sys/kern/subr_sbuf.c:324 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2775 Medium 6.3 sysctl_intrnames traverses every CPU's interrupt-handler lists unsynchronized → use-after-free read / kernel heap disclosure via hw.intrnames
sys/kern/kern_intr.c:1100 · pass 2 · new
 — — — untriaged — —
DF-2725 Low 6.3 cluster_rbuild() under-counts component pages vs the pbuf's embedded xio_pages[]/KVA window — latent OOB pointer write + PTE install past MAXPHYS window for non-page-tiling VFS geometry
sys/kern/vfs_cluster.c:954 · pass 2 · new
 — — — untriaged — —
DF-2668 Medium 6.0 fhstatfs(2)/fhstatvfs(2) overwrite the vfs_getvfs()-held mount with vp->v_mount: nullfs pass-through FHTOVP causes mnt_hold underflow — KKASSERT panic on INVARIANTS, kfree() of a live struct mount (UAF) on release kernels
sys/kern/vfs_syscalls.c:5074 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2771 Low 6.0 mapsize 64-bit accumulation overflow in link_elf_obj_load_file sizes the KVA mapping below the per-section bzero/read lengths → wild zero-fill past the mapping
sys/kern/link_elf_obj.c:621 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2973 Low 6.0 eventhandler_deregister() performs no tag/list validation — wrong-list or stale tag deterministically corrupts both lists' tail sentinels (write-after-free, cross-list handler aliasing, double free); tag==NULL silently frees an entire shared list
sys/kern/subr_eventhandler.c:123 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3074 Low 5.9 nfs_mountdiskless() double-frees the dup_sockaddr() on mountnfs() failure (mountnfs's bad: path frees nm_nam via nfs_free_mount, then haderror kfrees it again)
sys/vfs/nfs/nfs_vfsops.c:767 · pass 2 · new
 — — — untriaged — —
DF-2679 High 5.8 NEWBUS device teardown races unprivileged sysctl readers: use-after-free read in sysctl_devices()/device_sysctl_handler() (panic + permanent hang from uid!=0)
sys/kern/subr_bus.c:3858 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2694 High 5.8 sorflush() frees the receive sockbuf underneath sleeping sorecvtcp()/soreceive() copiers — UAF race, unprivileged kernel panic on both TCP and AF_UNIX/UDP paths
sys/kern/uipc_socket.c:1953 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2786 Medium 5.8 mtx_abort_link stale-state double-unlink: mtx_delete_link leaves MTX_LINK_LINKED_* set on an unlinked link until an unlocked IDLE reset, letting a racing abort write through dangling next/prev (UAF-write / wait-queue poisoning)
sys/kern/kern_mutex.c:914 · pass 2 · new
 none not_reproduced inconclusive untriaged — —
DF-2896 Medium 5.8 cnwrite() constty use-after-free: unsynchronized constty->t_dev captured without a reference and dispatched through dev_doperate() after a sleepable log_console() walk, while an unprivileged user (default UCONSOLE) controls the cdev's lifetime
sys/kern/tty_cons.c:465 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2923 Medium 5.8 vq_vptomp check-then-use race on vp->v_pfsmp → mount use-after-free with indirect call through freed memory
sys/kern/vfs_quota.c:420 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2802 Medium 5.7 jail(2) id >= 100000 shares per-prison sysctl nodes (DF-0054 truncation at scale): silent loss of all per-jail capability controls + sysctl_oid freed-under-reference UAF at teardown
sys/kern/kern_jail.c:992 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2680 Low 5.6 /dev/devctl FIOASYNC stores unreferenced curproc in devsoftc.async_proc; devclose never clears it -> ksignal() on freed struct proc (UAF write)
sys/kern/subr_bus.c:412 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2921 Medium 5.5 Signed integer overflow in nvtruncbuf()/nvnode_pager_setsize() at file lengths within blksize of 2^63 → ~2^63-iteration unmap loop holding the vnode token and object lock: unprivileged, unkillable, permanent kernel livelock on HAMMER2 (guest becomes unshut-downable)
sys/kern/vfs_vm.c:145 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2999 Medium 5.5 hammer(1) setattr/write have no va_size clamp: DF-2921-class nvtruncbuf/nvnode_pager_setsize signed-overflow → unprivileged permanent kernel livelock on any HAMMER1 mount
sys/vfs/hammer/hammer_vnops.c:670 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2682 High 5.3 sigio use-after-free: funsetown() kfrees struct sigio still dereferenced by lockless pgsigio() readers (socket/tty/kqueue SIGIO wakeups)
sys/kern/kern_descrip.c:1245 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2719 Medium 5.3 Coredump each_segment traverses the vm_map RB-tree unlocked while a pre-counted-'stopped' sibling LWP can still be mutating it (UAF read race)
sys/kern/imgact_elf.c:1193 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2918 Medium 5.3 Unsynchronized vfsconf registry: sys_mount vs kldunload TOCTOU — UAF write/call through unloaded module (reproduced as irrecoverable kernel deadlock of the mount/linker subsystem)
sys/kern/vfs_init.c:264 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2985 Low 5.3 sysent[] entry swaps are unsynchronized against unlocked syscall dispatch: non-atomic 24-byte struct assignment (register/deregister) races trap.c's separate sy_narg/sy_call loads (torn dispatch), and deregister has no in-flight quiesce — kldunload frees module text while a victim thread executes inside sy_call (UAF execution)
sys/kern/kern_syscalls.c:67 · pass 2 · new
 — — — untriaged — —
DF-2988 Low 5.3 RB_SCAN concurrency contract overstates the machinery: deleting a node that is another concurrent scan's in-flight element is an unguarded use-after-free
sys/kern/subr_rbtree.c:302 · pass 2 · new
 — — — untriaged — —
DF-3072 Low 5.3 tmpfs_alloc_vp KKASSERT(!TMPFS_VNODE_DOOMED) at subr.c:402 is an unguarded race window: NFS fhtovp lookups on an unlinked file during inactive's DOOMED..reclaim interval panic INVARIANTS kernels
sys/vfs/tmpfs/tmpfs_subr.c:395 · pass 2 · new
 — — — untriaged — —
DF-2820 Info 5.3 Double-free containment in _kfree_obj is INVARIANTS-only: the compiled-in KMALLOC_CHECK_DOUBLE_FREE bitmap and all ring-sanity checks are no-ops in production kernels, so a double free silently duplicates or drops free-ring pointers
sys/kern/kern_kmalloc.c:959 · pass 2 · new
 — — — untriaged — —
DF-2811 Low 5.1 SHT_SYMTAB/SHT_STRTAB sh_size truncated into signed int symcnt/strcnt → negative kmalloc()/vn_rdwr() lengths → kmem_slab_alloc panic; modulo-wrap and short-read/uninitialized-buffer variants
sys/kern/link_elf.c:590 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2751 Medium 4.7 funsetown() KKASSERT race: pre-token *sigiop load dereferenced after concurrent fsetown() frees and slab-recycles the sigio — unprivileged kernel panic on INVARIANTS (stock) builds via pipe F_SETOWN/close/exit (DF-2682 sibling)
sys/kern/sys_pipe.c:1023 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2831 Medium 4.7 dssize()/diskpsize consume dp->d_slice without ds_token — use-after-free walk of struct diskslices/disklabel during forced reprobe, and DSO_RAWPSIZE fallback silently substitutes whole-disk size for partition devices
sys/kern/subr_diskslice.c:849 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2908 Medium 4.7 varsymset lifetime race at process exit: sibling LWP uses p_varsymset after final varsymset_clean/lockuninit — permanent unprivileged M_VARSYM kernel-memory leak (plus INVARIANTS panic window in lockuninit)
sys/kern/kern_varsym.c:437 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2610 Low 4.7 icmp6_redirect_input dereferences stale ip6/nd_rd pointers after IP6_EXTHDR_CHECK may reallocate the mbuf (latent UAF read)
sys/netinet6/icmp6.c:2160 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2688 Low 4.7 OOM kill block operates on bigproc without p_token and without liveness revalidation (TOCTOU vs concurrent exit)
sys/vm/vm_pageout.c:1826 · pass 2 · new
 none untested not_testable untriaged — —
DF-2763 Low 4.7 journal_mountctl journal lifecycle is lock-free: concurrent install/remove double-detach panics on INVARIANTS and double-kfrees/UAF-writes mnt_jbitmap on release kernels
sys/kern/vfs_jops.c:162 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2951 Low 4.7 sysctl_hostname dereferences p->p_ucred up to four times with no p_spin/crhold and not via td_ucred — racy freed-credential read (cratom_proc can crfree the cred between load and deref), wild pr_host[256] copyout; DF-2868-class sibling with a jailed-root trigger
sys/kern/kern_mib.c:221 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2953 Low 4.7 logtimeout() use-after-free read of sc_sigio: pgsigio() on a struct sigio freed by a concurrent FIOSETOWN ioctl
sys/kern/subr_log.c:247 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2992 Low 4.7 flush_pagedep_deps: bwrite(inodedep->id_buf) dereferences id_buf after dropping the softdep lock — diverges from the file's own copy-first discipline (softdep_update_inodeblock), micro-window UAF read / NULL deref
sys/vfs/ufs/ffs_softdep.c:4655 · pass 2 · new
 — — — untriaged — —
DF-2768 Medium 4.4 Off-by-one in unix98 pty clone limit: unit==MAXPTYS accepted, ptis[MAXPTYS] out-of-bounds read (uninitialized pointer) + out-of-bounds pointer write
sys/kern/tty_pty.c:176 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2774 Medium 4.4 mountlist_exists() provides no lifetime guarantee: stale vp->v_pfsmp used after nullfs unmount for VFS accounting and quota enforcement — wrong-mount EDQUOT/negative usage (deterministic), struct mount UAF window (racy)
sys/kern/vfs_mount.c:692 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3073 Medium 4.4 nfs_unmount() continues teardown after vflush(FORCECLOSE) fails on a busy device vnode: frees the nfsmount and destroys the nfsnode objcache with a live nfsnode (UAF condition, allocator-confirmed) and dounmount() then panics deterministically ('unmount: dangling vnode')
sys/vfs/nfs/nfs_vfsops.c:1217 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2744 Low 4.4 disk_dumpcheck(): media_blocks − reserved_blocks unsigned underflow defeats the crash-dump bounds check; DEV_BSIZE unit mismatch for non-512B media
sys/kern/subr_disk.c:909 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2946 Low 4.4 kern.stathz boot tunable ingested with no validation → kernel integer-divide fault at statclock systimer registration (unbootable system)
sys/kern/subr_param.c:201 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2948 Low 4.4 kern.ncallout fetched after the only clamp → int-overflowed callwheel sizing in swi_softclock_setup: zero-byte per-CPU allocations panic vm_map (latent 2^30-iteration OOB init loop; infinite boot loop on ≤2-CPU)
sys/kern/subr_param.c:327 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3084 Low 4.4 doff_t (int32) truncation of crafted directory i_size >= 2^31 yields negative dp->i_offset -> ext2_write KASSERT panic on INVARIANTS kernels (EINVAL elsewhere)
sys/vfs/ext2fs/ext2_lookup.c:424 · pass 2 · new
 — — — untriaged — —
DF-2848 Low 4.2 taskqgroup_create() heap OOB write: unvalidated cnt writes struct taskqgroup_cpu slots past the fixed tqg_queue[MAXCPU] array
sys/kern/subr_gtaskqueue.c:788 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2907 Low 4.2 md_get_mbuf() ignores md_get_mem() failure (silent short copy / INVARIANTS panic) and md_done() leaves md_cur/md_pos dangling
sys/kern/libmchain/subr_mchain.c:323 · pass 2 · new
 — — — untriaged — —
DF-3090 Low 4.2 NFSSVC_MNTD path type-confuses any filesystem's mount into struct nfsmount: VROOT check without vfstype check before VFSTONFS(vp->v_mount)
sys/vfs/nfs/nfs_syscalls.c:175 · pass 2 · new
 — — — untriaged — —
DF-2814 Low 4.1 objcache_destroy() purges remote CPUs' per-cpu magazines under only a local critical section — no cross-CPU exclusion (contract-reliant teardown; KKASSERT panic / magazine UAF if any in-flight get/put exists)
sys/kern/kern_objcache.c:929 · pass 2 · new
 — — — untriaged — —
DF-3045 Low 4.1 bootpc trusts interface sdl_alen without bounding it to chaddr[16]/hexstr[64] — over-long link address from an IFT_ETHER driver overflows the outgoing packet in-struct and smashes a 64-byte stack buffer via hexncpy
sys/vfs/nfs/bootp_subr.c:718 · pass 2 · new
 — — — untriaged — —
DF-2960 Info 4.1 kcollect_register pins no caller-module lifetime; kcollect_unregister unenforced — latent UAF (indirect call + strlen) for loadable-module consumers
sys/kern/kern_collect.c:81 · pass 2 · new
 — — — untriaged — —
DF-2830 Medium 4.0 Off-by-one NUL-terminator clobber in sysctl_vm_zone name padding causes kernel-stack OOB read in unprivileged vm.zone output (13+ char zone names, in-tree trigger rfcomm_credit)
sys/vm/vm_zone.c:835 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2742 Low 3.9 diskstrategy consumes dp->d_slice with no serialization while disk_probe/disk_invalidate replace and free it — use-after-free window for every in-flight bio
sys/kern/subr_disk.c:1246 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2931 Medium 3.8 if_getanyethermac() type-confusion via uuid_node() leaks kernel driver-softc memory into unprivileged uuidgen(2) output (and returns wrong 'MAC' on vtnet/ena/oce)
sys/kern/kern_uuid.c:86 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2717 Medium 3.6 nlookup_init()/retry path read the shared fd_ncdir/fd_nrdir nchandle pairs without fd_spin while sibling threads swap them — torn (ncp,mount) pairs and hold-after-drop race on the jail '..'-gate comparison inputs
sys/kern/vfs_nlookup.c:149 · pass 2 · new
 — — — untriaged — —
DF-2760 Low 3.6 sys_getsid reads the p_pgrp->pg_session chain without pt->p_token; sys_setpgid reads curp->p_session unlocked — lifetime race vs. enterpgrp's pgrp free (stale/UAF read)
sys/kern/kern_prot.c:153 · pass 2 · new
 — — — untriaged — —
DF-2855 Low 3.6 rman_reserve_resource window arithmetic wraps when count-1 > end: allocation escapes the caller's [start,end] window (and can produce an inverted r_end < r_start node when start+count-1 overflows)
sys/kern/subr_rman.c:224 · pass 2 · new
 — — — untriaged — —
DF-2735 Low 3.3 socket_wait() leaks one file descriptor into the caller's fd table on every call (and on its error path)
sys/kern/sys_generic.c:1699 · pass 2 · new
 — — — untriaged — —
DF-2746 Low 3.3 sys_mincore() off-by-one: kernel writes one NUL byte below the user-supplied vec pointer; vecindex/lastvecindex truncate at 8TB ranges
sys/vm/vm_mmap.c:829 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2819 Low 3.3 kmalloc_obj zone-limit accounting uses cacheline-aligned ks_objsize while callers must derive limits from unaligned sizeof — tmpfs inode quota exhausts (ENOSPC) at ~85% of the configured cap
sys/kern/kern_kmalloc.c:899 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2956 Low 3.3 timespec2fattime: post-2107 timestamps silently wrap the 7-bit FAT year field and truncate t2 64→32 bits — far-future utimes() persisted as arbitrary plausible dates (year-4.4M stored as 2023-11-23)
sys/kern/subr_fattime.c:157 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3051 Info 3.3 statfs/statvfs accounting overflow and unvalidated compat feature bits (has_journal RW without replay)
sys/vfs/ext2fs/ext2_vfsops.c:296 · pass 2 · new
 — — — untriaged — —
DF-2704 Low 3.0 vop_cache_operate_ap dispatches through mnt_vn_journal_ops unsynchronized against journal_detach kfree (UAF window, root-gated)
sys/kern/vfs_vopops.c:1781 · pass 2 · new
 none untested not_testable untriaged — —
DF-2936 Low 3.0 module_register_init MOD_LOAD-failure path destroys the module registry entry while kldload(2) reports success — module lifecycle desynchronized from linker-file lifecycle (zombie module, teardown-order inversion)
sys/kern/kern_module.c:110 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2969 Low 3.0 suspend_kproc holds no reference on the target thread: concurrent kthread_exit yields use-after-free read/write on a recycled struct thread and an unkillable sleeper
sys/kern/kern_kthread.c:188 · pass 2 · new
 — — — untriaged — —
DF-2970 Low 3.0 linesw[] registry accepts conflicting registrations and deregisters in-use disciplines with no validation — dual NETGRAPHDISC(6) registration by netgraph and netgraph7 tty modules silently aliases/strands live ttys
sys/kern/tty_conf.c:105 · pass 2 · new
 — — — untriaged — —
DF-2885 Low 2.5 kern_ptrace permission checks dereference tracer (and pre-token target) ucred pointers with no crhold and no token — freed-cred read racing cratom_proc (DF-2868 analog in sys_process.c)
sys/kern/sys_process.c:153 · pass 2 · new
 — — — untriaged — —
DF-3071 Low 2.5 tmpfs memory/node limit enforcement is check-then-act: tm_pages_used ENOSPC test races its atomic_add (and tm_nodes_inuse check races the TMPFS_LOCK'd increment) — concurrent growth can overshoot tmpfs limits
sys/vfs/tmpfs/tmpfs_subr.c:1007 · pass 2 · new
 — — — untriaged — —
DF-2701 Info 2.5 swap_pager_getpage() 20-second timeout diagnostic dereferences the completed-and-released pbuf (use-after-free read in console path)
sys/vm/swap_pager.c:1527 · pass 2 · new
 none untested not_testable untriaged — —
DF-2913 Info 2.5 plimit COW swap stores p->p_limit without p->p_spin, leaving a theoretical ref-acquisition race window against cross-process readers (schedcpu)
sys/kern/kern_plimit.c:189 · pass 2 · new
 — — — untriaged — —
DF-3005 Low 1.9 Read-after-free of cdev->si_name in devfs_destroy_related_without_flag_worker after devfs_destroy_dev_worker frees the device
sys/vfs/devfs/devfs_core.c:1508 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3041 Low 1.9 hammer_install_volume dereferences the volume header after brelse(bp) — buffer-cache use-after-release read of vol0_stat_bigblocks into f_blocks
sys/vfs/hammer/hammer_ondisk.c:250 · pass 2 · new
 — — — untriaged — —
DF-2726 Info 1.9 cluster_write() reads bp->b_bio2.bio_offset after bdwrite()/bawrite() released the buffer — type-stable use-after-free reads corrupting write-clustering heuristics
sys/kern/vfs_cluster.c:1340 · pass 2 · new
 — — — untriaged — —
DF-2942 Info 1.9 sysref_activate's negative-space gate is ambiguous between initializing and terminating: an activate during the termination window resurrects the object and drives double (or unbounded) termination with zero layer diagnostics
sys/kern/kern_sysref.c:164 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3008 Low 1.1 devfs_find_device_by_devid/name return an unreferenced cdev: kern.devname sysctl (CTLFLAG_ANYBODY) reads si_name after devfs_lock is released — microscopic UAF-read race
sys/vfs/devfs/devfs_core.c:910 · pass 2 · new
 — — — untriaged — —
DF-2893 Info 1.1 sockbuf drop/flush family ignores M_SOLOCKED — latent use-after-free window against sorecvtcp's token-released uiomove loop
sys/kern/uipc_sockbuf.c:473 · pass 2 · new
 — — — untriaged — —
DF-2954 Info 1.1 vfs_unmount tears down quota accounting (VFS_ACDONE) before the filesystem unmount commits — failed unmounts leave a live mount with accounting already 'done'
sys/kern/vfs_vfsops.c:131 · pass 2 · new
 — — — untriaged — —
DF-2982 Info 1.1 Stale comments describe retired page-swapblk design, misdocumenting the OBJT_DEFAULT no-swap-metadata invariant that three files silently depend on
sys/vm/default_pager.c:33 · pass 2 · new
 — — — untriaged — —
DF-2737 Info 0.8 Dead code: oid_running is never incremented, so the dynamic-oid teardown drain and CTLFLAG_DYING machinery in sysctl_remove_oid_locked are inoperative
sys/kern/kern_sysctl.c:384 · pass 2 · new
 none untested not_testable untriaged — —
DF-2690 Info 0.5 m_extadd() lacks the M_EXT precondition guard m_mclget() has — calling it on a cluster mbuf yields m_sharecount()/m_free() type confusion and a wrong-cache objcache_put
sys/kern/uipc_mbuf.c:1477 · pass 2 · new
 — — — untriaged — —
DF-2790 Info 0.5 blist API performs no domain validation: count==0 triggers shift-by-64 UB that can clear a whole leaf or poison a live node as a terminator (bm_bighint = -1); blist_create lacks a BLIST_MAXBLKS guard (int64 radix wrap → infinite loop)
sys/kern/subr_blist.c:188 · pass 2 · new
 — — — untriaged — —
DF-2817 Info 0.5 lwkt_token_swap() lower-bound-only KKASSERTs: <2-token invocation corrupts memory before td_toks_array in non-INVARIANTS kernels
sys/kern/lwkt_token.c:952 · pass 2 · new
 — — — untriaged — —
DF-2919 Info 0.5 vfs_register() walks sysctl__vfs_children without SYSCTL_XLOCK while unlinking/relinking the iterated oid mid-loop
sys/kern/vfs_init.c:338 · pass 2 · new
 — — — untriaged — —
DF-2987 Info 0.5 refcount_release/_n have no underflow floor or INVARIANTS assert — double-release silently wraps the count to 0xFFFFFFFF and hides DF-2941-class double-put/double-free bugs at runtime
sys/kern/kern_refcount.c:54 · pass 2 · new
 — — — untriaged — —
DF-3089 Info 0.5 nfs_getauth()/nfs_savenickauth() take NFSKERBKEY_T (u_char[2]) as a parameter but bcopy sizeof(NFSKERBKEY_T) == 8 bytes into/out of 2-byte struct members — padding-absorbed today, latent overflow on any layout change
sys/vfs/nfs/nfs_syscalls.c:1075 · pass 2 · new
 — — — untriaged — —
DF-2864 Info 0.3 Per-candidate struct mount + syncer-thread leak and permanent vfc_refcount leak on failed root-mount attempts (mp overwritten next iteration; error path never drops mp->mnt_vfc->vfc_refcount)
sys/kern/vfs_conf.c:435 · pass 2 · new
 — — — untriaged — —
DF-3060 Low — dm_fdlist is walked and mutated without any common lock — nresolve's TAILQ scan races dirfs_node_setpassive's INSERT/REMOVE on SMP vkernels (UAF / list corruption)
sys/vfs/dirfs/dirfs_vnops.c:171 · pass 2 · new
 — — — untriaged — —
DF-0569 High 9.8 Heap OOB write via byte-swapped alias_port used as array index: every NAT deployment corrupts heap ~1.6% of connections
sys/net/ipfw3_nat/ip_fw3_nat.c:436
 panic reproduced fixed untriaged — —
DF-2597 High 9.8 TCP-MD5 signature option writes past 40-byte opt[] stack buffer with no bounds check
sys/netinet/tcp_output.c:186
 none not_reproduced not_testable untriaged — —
DF-0393 Critical 9.6 Remote heap buffer overflow via oversized Mesh ID IE in sta_add: memcpy 2+meshid[1] into se_meshid[34] with no bounds check
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:310
 panic reproduced fixed untriaged — —
DF-0285 High 9.6 Remote heap overflow via unchecked MESHID IE length in ieee80211_parse_meshid
sys/netproto/802_11/wlan/ieee80211_mesh.c:3456
 Real CWE-787 heap OOB write in ieee80211_parse_meshid (up to 223 bytes) reaching ni_mltimer.toc / ni_mlhtimer.toc pointers => indirect function-pointer-control RCE surface on wifi-equipped MBSS hosts; NOT runtime-triggerable on this KVM guest (no wifi hardware). inconclusive — untriaged — —
DF-0326 High 9.6 Remote heap overflow: unbounded SSID IE length copied into fixed 32-byte ni_essid
sys/netproto/802_11/wlan/ieee80211_node.c:815
 remote-unauth heap overflow corrupting ni_chan kernel pointer (panic/DoS minimum, code-exec plausible) on any host with a wlan radio inconclusive — untriaged — —
DF-0631 High 9.0 Use-after-free on ipfw3_state->stub after the owning rule is deleted
sys/net/ipfw3_basic/ip_fw3_state.c:210
 dos reproduced fixed untriaged — —
DF-1215 Critical 8.8 METEORSVIDEO ioctl allows unprivileged user to set arbitrary physical DMA target address
sys/dev/video/bktr/bktr_core.c:1396
 none inconclusive not_testable untriaged — —
1083 High 8.8 Off-by-one in CROM_MAX_DEPTH check in crom_next() allows stack OOB write of 12 bytes
sys/bus/firewire/fwcrom.c:115
 panic reproduced fixed untriaged — —
DF-0616 High 8.8 Heap buffer overflow in generic_netmap_rxsync: unbounded m_copydata into fixed-size netmap buffer
sys/net/netmap/netmap_generic.c:669
 heap-oob-write reproduced fixed untriaged — —
DF-0753 High 8.8 Stale mbuf pointer after mpls_output may reallocate — use-after-free/double-free when route has PUSH op
sys/netproto/mpls/mpls_input.c:208
 panic reproduced fixed untriaged — —
DF-0981 High 8.8 Heap buffer overflow in run_bulk_rx_callback aggregated-frame path (m_getcl cluster too small for device-controlled dmalen)
sys/bus/u4b/wlan/if_run.c:2989
 heap-oob-write (hardware-gated on this guest; up to ~2035B on a run(4)-equipped host) reproduced fixed untriaged — —
DF-0987 High 8.8 cdcheckmedia unbounded TOC entry count overflows softc->toc.entries[100] -> heap corruption
sys/bus/cam/scsi/scsi_cd.c:2947
 panic reproduced fixed untriaged — —
DF-1020 High 8.8 OOB heap write in fw_bus_explore_callback via wire-controlled ongoaddr jump -> arbitrary 4-byte kernel heap write
sys/bus/firewire/firewire.c:1500
 none inconclusive not_testable untriaged — —
DF-1216 High 8.8 METEORSETGEO + METEORSACTPIXFMT pixel-format mismatch yields OOB DMA write and OOB uiomove heap info-leak
sys/dev/video/bktr/bktr_core.c:1084
 leak:4177936 reproduced not_testable untriaged — —
DF-1410 High 8.8 Unauthenticated remote heap overflow in xe RX: missing upper-bound check on frame length before copying into 2KB mbuf cluster
sys/dev/netif/xe/if_xe.c:752
 leak:heap reproduced not_testable untriaged — —
DF-0269 Medium 8.8 Stack buffer overflow in sppp_print_bytes: VLA sized len but hexncpy writes 3*len bytes
sys/net/sppp/if_spppsubr.c:5290
 panic not_reproduced not_testable untriaged — —
DF-0289 Medium 8.8 UAF/TOCTOU: mesh route pointers returned unreferenced, forward_to_gates drops lock mid-traversal
sys/netproto/802_11/wlan/ieee80211_mesh.c:230
 dos inconclusive not_testable untriaged — —
DF-2012 Medium 8.8 Integer overflow in GART table_size yields undersized VRAM table and OOB write via amdgpu_gart_bind/unbind
sys/dev/drm/amd/amdgpu/amdgpu_gart.c:362
 panic reproduced fixed untriaged — —
DF-0053 High 8.4 Heap buffer overflow in sysctl_jail_list (kern.jail.list) via unsigned underflow in size arithmetic
sys/kern/kern_jail.c:671
 panic reproduced fixed untriaged — —
DF-1264 High 8.4 drm_dp_sideband_msg_build OOB write past chunk[48] via unchecked msg_len from malicious MST hub
sys/dev/drm/drm_dp_mst_topology.c:349
 none inconclusive not_testable untriaged — —
DF-1314 High 8.4 Off-by-one in btc_copy_vbios_mc_reg_table + post-write bound check in btc_set_mc_special_registers allows VBIOS OOB write
sys/dev/drm/radeon/btc_dpm.c:1992
 none inconclusive not_testable untriaged — —
DF-1319 High 8.4 Unvalidated DisplayPort lane_count from malicious sink causes stack buffer overflow in link-training helpers
sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1784
 none inconclusive not_testable untriaged — —
DF-1437 High 8.4 Heap OOB write in sumo_construct_vid_mapping_table via unchecked VBIOS usVoltageIndex
sys/dev/drm/radeon/sumo_dpm.c:1624
 panic reproduced fixed untriaged — —
DF-1483 High 8.4 Integer overflow in user-fence offset check allows OOB GPU memory write
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:59
 panic reproduced fixed untriaged — —
DF-1837 High 8.4 Heap buffer overflow in dm_helpers_read_local_edid via uncapped EDID extension count
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:583
 panic reproduced fixed untriaged — —
DF-2349 High 8.4 uint8_t loop index in uvc_ctrl_init_dev wraps causing infinite loop and heap OOB write on malicious UVC descriptor
sys/bus/u4b/uvc/uvc_ctrls.c:925
 none not_reproduced not_testable untriaged — —
DF-2354 High 8.4 txd_fw buffer overflow on firmware load: 6 KB heap overflow + kernel-memory leak to USB device on every attach
sys/bus/u4b/wlan/if_mtw.c:128
 none not_reproduced not_testable untriaged — —
DF-1526 Medium 8.3 Missing RX length bounds check + RX buffer-length misprogramming allows heap OOB read (info leak) and DMA heap overflow write
sys/dev/netif/sf/if_sf.c:883
 none inconclusive — untriaged — —
DF-0291 High 8.2 Heap buffer overflow in setmlme_assoc_adhoc: unbounded im_ssid_len into 32-byte buffers
sys/netproto/802_11/wlan/ieee80211_ioctl.c:1568
 none observed; real shipped heap+stack overflow (CWE-787) unreachable on this guest (no wlan vap possible without a wifi radio) inconclusive — untriaged — —
DF-0362 High 8.2 pfr_fix_anchor unbounded slash-count loop causes size_t wraparound in bcopy/memset: kernel panic via DIOCRGETTABLES
sys/net/pf/pf_table.c:1740
 panic reproduced fixed untriaged — —
DF-0401 High 8.2 Heap buffer overflow via unchecked slot->len in VALE bridge forwarding: pkt_copy up to 65536 bytes into 2048-byte buffer
sys/net/netmap/netmap_vale.c:988
 none not_reproduced not_testable untriaged — —
DF-0449 High 8.2 Heap buffer overflow in ng_string_parse: missing *buflen bounds check before bcopy of user-supplied string
sys/netgraph/netgraph/ng_parse.c:704
 panic reproduced fixed untriaged — —
DF-1356 High 8.2 Heap overflow in AMR_CMD_PASS ioctl via unchecked cdb length
sys/dev/raid/amr/amr.c:825
 panic reproduced not_testable untriaged — —
DF-1499 High 8.2 Heap buffer overflow in NGM_TEXT_STATUS via status_chans + status_8370
sys/dev/misc/musycc/musycc.c:443
 leak:heap reproduced not_testable untriaged — —
1085 High 8.1 crom_parse_text() write-underflow when text leaf crc_len < 2 corrupts memory before the caller buffer
sys/bus/firewire/fwcrom.c:215
 panic reproduced fixed untriaged — —
DF-0492 High 8.1 Lockless race on L2TP seq/window state: concurrent timer + remote packet processing -> UAF on xwin[] mbufs and node private data
sys/netgraph/l2tp/ng_l2tp.c:1126
 panic reproduced not_testable untriaged — —
DF-0640 High 8.1 ieee80211_crypto_decap minimum-length check ignores hdrlen, causing OOB-read panic or mbuf double-free on crafted encrypted frames
sys/netproto/802_11/wlan/ieee80211_crypto.c:587
 none inconclusive not_testable untriaged — —
DF-0733 High 8.1 acl_check walks ACL hash without lock — UAF race vs concurrent acl_remove/acl_free_all from receive path (unauth remote)
sys/netproto/802_11/wlan_acl/ieee80211_acl.c:161
 dos reproduced fixed untriaged — —
DF-0767 High 8.1 nfs_lookitup returns uninitialized nfsnode pointer when server echoes parent filehandle — wild-pointer deref in create/mkdir/mknod/symlink
sys/vfs/nfs/nfs_vnops.c:3061
 panic reproduced fixed untriaged — —
DF-0117 High 8.0 UAF on kdmsg state in diskiodone: state refcount not held across async I/O
sys/kern/subr_diskiocom.c:372
 panic reproduced fixed untriaged — —
DF-1213 High 8.0 Unchecked device-supplied rxcd->rxd_idx yields OOB array access, OOB write, arbitrary-pointer write, and infinite loop in RX completion path
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2056
 none not_reproduced not_testable untriaged — —
DF-2575 High 8.0 ip_fw3_dummynet_io caches rule pointer in dn_pkt->dn_priv with no refcount rule deletion during pipe transit causes UAF read+write on reinject
sys/net/ipfw3/ip_fw3.c:630
 panic reproduced fixed untriaged — —
DF-0320 Medium 8.0 Reorder buffer rxa_m[] mutated without dedicated lock: RX races timer flush and ADDBA re-init (double-free/UAF)
sys/netproto/802_11/wlan/ieee80211_ht.c:780
 none inconclusive not_testable untriaged — —
DF-0783 Critical 7.8 ext2_rename writes 24 attacker-controlled bytes onto kernel stack via (caddr_t)&dirbuf — stack overflow corrupted ptr deref arbitrary free + info leak (CRITICAL)
sys/vfs/ext2fs/ext2_vnops.c:693
 panic reproduced fixed untriaged — —
DF-1171 Critical 7.8 Intel MatrixRAID parser: OOB heap write on ar_softc via unclamped map->total_disks
sys/dev/disk/nata/ata-raid.c:2165
 corruption reproduced not_testable untriaged — —
DF-1326 Critical 7.8 Stack buffer overflow in mpr_user_pass_thru: copyin of user-controlled RequestSize into 12-byte MPI2_REQUEST_HEADER before bounds check
sys/dev/raid/mpr/mpr_user.c:742
 none inconclusive not_testable untriaged — —
DF-1359 Critical 7.8 Stack buffer overflow in mps_user_pass_thru via unbounded copyin into 12-byte tmphdr
sys/dev/raid/mps/mps_user.c:747
 none inconclusive not_testable untriaged — —
DF-2132 Critical 7.8 dma_buf_get returns unrefcounted pointer; caller dma_buf_put over-drops f_count causing UAF (local unpriv->root)
sys/dev/drm/linux_dma-buf.c:174
 none not_reproduced not_testable untriaged — —
DF-0509 High 7.8 Stack buffer overflow in ng_ksocket_sockaddr_unparse via negative pathlen (PF_LOCAL sun_len underflow)
sys/netgraph7/ksocket/ng_ksocket.c:323
 none not_reproduced — untriaged — —
DF-0676 High 7.8 Double-free of mbuf in XMIT_ALL error path via NG_FREE_ITEM + NG_FREE_M on a peeked (non-detached) mbuf
sys/netgraph7/one2many/ng_one2many.c:425
 corruption reproduced fixed untriaged — —
DF-0754 High 7.8 mpls_output() takes mbuf by-value but helpers silently reallocate head — root cause of DF-0753, also manifests in mpls_output_process double-free/leak + ip_output stale-m
sys/netproto/mpls/mpls_output.c:50
 panic reproduced fixed untriaged — —
DF-0776 High 7.8 Missing production bounds validation on B-tree node count/type — crafted image heap OOB read/write via bcopy element shift
sys/vfs/hammer/hammer_btree.c:818
 panic reproduced fixed untriaged — —
DF-0780 High 7.8 Heap buffer overflow in fuse_io_execute READ from oversized daemon reply — memcpy daemon-chosen size into fixed buffer
sys/vfs/fuse/fuse_vnops.c:2048
 panic reproduced fixed untriaged — —
DF-0803 High 7.8 Integer truncation in e2fs_gcount computation bypasses overflow check — heap OOB from crafted ext2 64bit image
sys/vfs/ext2fs/ext2_vfsops.c:620
 panic reproduced fixed untriaged — —
DF-0859 High 7.8 Unbounded ab_busycnt in hpfs_splitalsec/hpfs_concatalsec/hpfs_alblk2alsec bcopy overflows alsec heap buffer
sys/vfs/hpfs/hpfs_alsubr.c:225
 corruption reproduced fixed untriaged — —
DF-0861 High 7.8 hpfs_cpinit unbounded code-page inner loop writes attacker data past hpm_cpdblk allocation (heap overflow)
sys/vfs/hpfs/hpfs_subr.c:274
 panic reproduced fixed untriaged — —
DF-0887 High 7.8 Heap overflow in ffs_truncate symlink fast-path via unbounded bzero of attacker-controlled di_size
sys/vfs/ufs/ffs_inode.c:159
 panic reproduced fixed untriaged — —
DF-0894 High 7.8 Crafted fs_nindir in superblock causes OOB read/write of indirect-block buffers in ffs_balloc
sys/vfs/ufs/ffs_balloc.c:291
 panic reproduced fixed untriaged — —
DF-0903 High 7.8 Heap OOB write in ffs_write via crafted fs_qbmask (missing xfersize bounds check present in ffs_read)
sys/vfs/ufs/ufs_readwrite.c:292
 panic reproduced fixed untriaged — —
DF-0915 High 7.8 fuse_device_write trusts daemon ohd->len over actual write size yielding heap OOB read and overflow write
sys/vfs/fuse/fuse_device.c:182
 panic reproduced fixed untriaged — —
DF-0994 High 7.8 sastart ERR_PENDING drain uses stale bio pointer after goto again -> double biodone, queue corruption, bio UAF
sys/bus/cam/scsi/scsi_sa.c:1601
 panic reproduced fixed untriaged — —
DF-1057 High 7.8 FW_ASYREQ bcopy writes payload into &xfer->send.payload (field address) instead of xfer->send.payload (buffer) — kernel heap overflow + arbitrary kfree
sys/bus/firewire/fwdev.c:558
 none inconclusive not_testable untriaged — —
DF-1058 High 7.8 fw_write trusts user-supplied stream packet header len field for the second uiomove, overflowing the per-packet DMA buffer slot
sys/bus/firewire/fwdev.c:388
 none inconclusive not_testable untriaged — —
DF-1065 High 7.8 Use-after-free: bq->mem kfree()d while userspace mmap mappings keep wired fictitious pages pointing at freed memory
sys/bus/u4b/uvc/uvc_buf.c:517
 none not_reproduced not_testable untriaged — —
DF-1076 High 7.8 Slave-controlled block-read count overflows fixed 32-byte sc->block_data buffer in ISR
sys/bus/smbus/ichsmb/ichsmb.c:575
 panic reproduced not_testable untriaged — —
DF-1081 High 7.8 Stack buffer overflow in cue_setmulti: 8-byte hashtbl for 64-byte (512-bit) multicast hash table
sys/bus/u4b/net/if_cue.c:273
 none inconclusive not_testable untriaged — —
DF-1141 High 7.8 Heap OOB write in ci_setup_default_dpm_tables: VBIOS counts index fixed-size dpm_levels[8] unchecked
sys/dev/drm/amd/amdgpu/ci_dpm.c:3593
 none inconclusive not_testable untriaged — —
DF-1142 High 7.8 Heap OOB write in ci_populate_smc_uvd/vce/acp/samu_level: VBIOS counts index fixed-size SMU7 level arrays unchecked
sys/dev/drm/amd/amdgpu/ci_dpm.c:2791
 none inconclusive not_testable untriaged — —
DF-1146 High 7.8 i915_gem_fault missing offset bounds check and partial-view GMADR misaddressing allow cross-object GPU memory read/write
sys/dev/drm/i915/i915_gem.c:2229
 none inconclusive not_testable untriaged — —
DF-1149 High 7.8 Heap OOB write in SMC UVD/VCE/ACP/SAMU level population from unbounded VBIOS count
sys/dev/drm/radeon/ci_dpm.c:2689
 none inconclusive not_testable untriaged — —
DF-1150 High 7.8 Heap OOB write in ci_setup_default_dpm_tables from unbounded VBIOS dependency-table counts
sys/dev/drm/radeon/ci_dpm.c:3514
 none inconclusive not_testable untriaged — —
DF-1166 High 7.8 Heap overflow: unvalidated VBIOS dependency-table count overflows fixed dpm_levels[8] array
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:784
 none inconclusive not_testable untriaged — —
DF-1172 High 7.8 LSI v2 parser: OOB write on static ata_raid_arrays[] via unvalidated meta->raid_number
sys/dev/disk/nata/ata-raid.c:2802
 corruption reproduced not_testable untriaged — —
DF-1189 High 7.8 ciss_notify_logical: unbounded bus/target from controller notify event yields kernel OOB read/write
sys/dev/raid/ciss/ciss.c:3931
 corruption reproduced not_testable untriaged — —
DF-1190 High 7.8 ciss_init_logical: unbounded CISS_LUN_TO_BUS/TARGET at attach yields kernel OOB write of pointers and objects
sys/dev/raid/ciss/ciss.c:1386
 panic reproduced not_testable untriaged — —
DF-1191 High 7.8 ciss_cam_complete: controller-supplied sense_length overflows fixed-size csio->sense_data on CHECK_CONDITION
sys/dev/raid/ciss/ciss.c:3248
 panic reproduced not_testable untriaged — —
DF-1198 High 7.8 Heap buffer overflow via state_index/i index mismatch in radeon_atombios_parse_power_table_6
sys/dev/drm/radeon/radeon_atombios.c:2704
 panic reproduced not_testable untriaged — —
DF-1209 High 7.8 r100_packet3_load_vbpntr unsigned underflow on c==0 yields unbounded heap OOB writes via CS ioctl
sys/dev/drm/radeon/r100.c:1315
 panic reproduced fixed untriaged — —
DF-1258 High 7.8 Heap buffer overflow / OOB read in MFI_CMD and MFI_LINUX_CMD_2 ioctl SGL copyin/copyout
sys/dev/raid/mfi/mfi.c:2991
 none inconclusive not_testable untriaged — —
DF-1271 High 7.8 VBIOS-controlled mm_dep_table->count drives heap overflow in UVD/VCE/ACP SMC level population
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1320
 none inconclusive not_testable untriaged — —
DF-1272 High 7.8 VBIOS-controlled vdd_dep_on_sclk->count drives Sclk_voltageOffset[8] heap overflow in clock stretcher
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1584
 none inconclusive not_testable untriaged — —
DF-1282 High 7.8 OOB heap write via unchecked firmware-controlled DeviceIndex in _mapping_process_dpm_pg0
sys/dev/raid/mpr/mpr_mapping.c:2251
 panic reproduced not_testable untriaged — —
DF-1283 High 7.8 OOB heap write via unsigned underflow in slot arithmetic in _mapping_add_new_device/_mapping_add_new_pcie_device
sys/dev/raid/mpr/mpr_mapping.c:1637
 panic reproduced not_testable untriaged — —
DF-1284 High 7.8 Unbounded scatter-gather loop overflows pmap->psg[17], tmpSg[512] stack, and PRD heap table
sys/dev/raid/hptmv/entry.c:2800
 panic reproduced not_testable untriaged — —
DF-1311 High 7.8 Stack buffer overflow in hptiop_post_req_itl via unbounded SG list (HIGH_MEM_ACESS path)
sys/dev/raid/hptiop/hptiop.c:2417
 none inconclusive not_testable untriaged — —
DF-1337 High 7.8 Use-after-free write in chn_write (and UAF read in chn_read) via concurrent chn_resizebuf during uiomove unlock window
sys/dev/sound/pcm/channel.c:502
 none inconclusive not_testable untriaged — —
DF-1340 High 7.8 u32 integer overflow in CB/DB size validation bypasses BO bounds check (cross-process GPU memory corruption)
sys/dev/drm/radeon/r600_cs.c:430
 none inconclusive not_testable untriaged — —
DF-1342 High 7.8 r600_dma_cs_parse reads/writes IB past length_dw (heap OOB via DMA packet at IB end)
sys/dev/drm/radeon/r600_cs.c:2388
 none inconclusive not_testable untriaged — —
DF-1374 High 7.8 Unvalidated firmware DeviceIndex in _mapping_process_dpm_pg0 causes heap OOB write into mapping_table
sys/dev/raid/mps/mps_mapping.c:1495
 panic reproduced not_testable untriaged — —
DF-1375 High 7.8 Unvalidated slot arithmetic in topology-event handling causes heap OOB write (underflow + num_slots overflow)
sys/dev/raid/mps/mps_mapping.c:968
 panic reproduced not_testable untriaged — —
DF-1442 High 7.8 INQUIRY TRIM status writes past short inquiry buffer (heap overflow during DV probe)
sys/dev/disk/ahci/ahci_cam.c:1134
 panic reproduced fixed untriaged — —
DF-1470 High 7.8 VBIOS-supplied table offsets never validated against firmware image size
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:61
 panic reproduced fixed untriaged — —
DF-1534 High 7.8 Unbounded recursion in atom_op_calltable causes kernel stack overflow
sys/dev/drm/radeon/atom.c:624
 panic reproduced not_testable untriaged — —
DF-1535 High 7.8 Integer overflow in FB scratch bounds check enables heap OOB read/write
sys/dev/drm/radeon/atom.c:281
 panic reproduced not_testable untriaged — —
DF-1536 High 7.8 Unbounded PS operand index causes kernel stack OOB read/write via caller buffer
sys/dev/drm/radeon/atom.c:224
 panic reproduced not_testable untriaged — —
DF-1542 High 7.8 amdgpu atom_op_calltable unbounded recursion causes kernel stack overflow
sys/dev/drm/amd/amdgpu/atom.c:610
 panic reproduced not_testable untriaged — —
DF-1543 High 7.8 amdgpu atom FB scratch bounds check integer overflow enables heap OOB read/write
sys/dev/drm/amd/amdgpu/atom.c:270
 panic reproduced not_testable untriaged — —
DF-1544 High 7.8 amdgpu atom PS operand index unbounded -> kernel stack OOB read/write via caller buffer
sys/dev/drm/amd/amdgpu/atom.c:213
 panic reproduced not_testable untriaged — —
DF-1556 High 7.8 mps_config_get_raid_volume_pg0 missing MIN() guard on final bcopy — heap overflow from firmware-supplied PageLength
sys/dev/raid/mps/mps_config.c:1084
 panic reproduced not_testable untriaged — —
DF-1557 High 7.8 mps_wd_config_pages writes DD_column_map via firmware-supplied PhysDiskMap with no bounds check — heap OOB write past end of mps_softc
sys/dev/raid/mps/mps_config.c:460
 panic reproduced not_testable untriaged — —
DF-1574 High 7.8 Heap OOB write in get_vddc_lookup_table: buffer sized for 16 records, loop walks up to 255
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:168
 none not_reproduced not_testable untriaged — —
DF-1585 High 7.8 Use-after-free of fbc->compressed_llb on second cleanup / driver unload
sys/dev/drm/i915/intel_fbc.c:559
 panic reproduced not_testable untriaged — —
DF-1586 High 7.8 Heap buffer overflow in get_vddc_lookup_table: VBIOS ucNumEntries > caller max_levels writes ~2.5KB past slab object
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1026
 none not_reproduced not_testable untriaged — —
DF-1606 High 7.8 Kernel heap overflow via fixed-size cmi_order[128] array in /dev/hpcmi read path
sys/dev/acpica/acpi_hp/acpi_hp.c:147
 panic reproduced not_testable untriaged — —
DF-1662 High 7.8 i915: GEM context destroy ioctl double-close race -> refcount underflow -> UAF
sys/dev/drm/i915/i915_gem_context.c:278
 panic reproduced not_testable untriaged — —
DF-1664 High 7.8 twa: unbounded kvsprintf+strcpy into 98-byte parameter_data -> stack/heap overflow + format-string
sys/dev/raid/twa/tw_cl_misc.c:505
 panic reproduced not_testable untriaged — —
DF-1676 High 7.8 nvme: unvalidated device-controlled indices in nvme_poll_completions -> OOB write + RIP hijack
sys/dev/disk/nvme/nvme.c:713
 panic reproduced not_testable untriaged — —
DF-1692 High 7.8 amdgpu_debugfs: heap OOB read+write in amdgpu_debugfs_gpr_read via byte-offset/dword-index unit confusion
sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:701
 panic reproduced not_testable untriaged — —
DF-1702 High 7.8 scmouse: heap buffer overflow in mouse_cut - per-line \r bytes not accounted for in cut_buffer sizing
sys/dev/misc/syscons/scmouse.c:92
 panic reproduced not_testable untriaged — —
DF-1719 High 7.8 amdgpu_gem: GEM_VA ioctl passes unchecked offset_in_bo/map_size into amdgpu_vm_bo_map enabling offset+size wrap to corrupt GPU page tables
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:644
 leak reproduced fixed untriaged — —
DF-1753 High 7.8 radeon_vce: OOB read and OOB write of IB buffer in cs_parse/cs_reloc via unchecked multi-dword command fields
sys/dev/drm/radeon/radeon_vce.c:565
 panic reproduced fixed untriaged — —
DF-1797 High 7.8 smu_helper: heap OOB write in phm_get_svi2_*_voltage_table and phm_trim_voltage_table via unchecked VBIOS count
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:244
 panic reproduced fixed untriaged — —
DF-1805 High 7.8 bktr_os: bktr_filter_detach calls knote_insert instead of knote_remove -> UAF via corrupted klist
sys/dev/video/bktr/bktr_os.c:724
 panic reproduced fixed untriaged — —
DF-1880 High 7.8 Heap OOB write in oce_hw_update_multicast: loop guard uses 64 but mac[] array has 32 slots
sys/dev/netif/oce/oce_hw.c:568
 panic reproduced fixed untriaged — —
DF-1881 High 7.8 UAF / double-free in reservation RCU readers via unsafe dma_fence_get_rcu shim and non-RCU dma_fence_free
sys/dev/drm/linux_reservation.c:357
 panic reproduced fixed untriaged — —
DF-1891 High 7.8 Unbounded ctlr->channels from AHCI CAP/PI registers: source-side of interrupt[] OOB (variant of DF-1716)
sys/dev/disk/nata/chipsets/ata-ahci.c:101
 panic reproduced not_testable untriaged — —
DF-1912 High 7.8 mdstrategy_preload uses stale buf pointer across biodone: UAF + OOB bcopy on preloaded md image
sys/dev/disk/md/md.c:349
 panic reproduced fixed untriaged — —
DF-1917 High 7.8 Unbounded sgl_off yields OOB SGE write into cmd->frame DMA allocation
sys/dev/raid/mrsas/mrsas_ioctl.c:219
 panic reproduced fixed untriaged — —
DF-1918 High 7.8 Unbounded sense_off yields OOB pointer-sized write into cmd->frame
sys/dev/raid/mrsas/mrsas_ioctl.c:266
 panic reproduced fixed untriaged — —
DF-1919 High 7.8 Integer truncation size_t->int in iov_len splits DMA alloc size from copyin size: heap overflow
sys/dev/raid/mrsas/mrsas_ioctl.c:161
 panic reproduced fixed untriaged — —
DF-2002 High 7.8 Forged EEPROM pwr_table_offset drives OOB write/read in ar9280AdjustPDADCValues (up to 64KB overflow)
sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c:188
 none inconclusive not_testable untriaged — —
DF-2028 High 7.8 Use-after-free in GDT_IOCTL_GENERAL: framework-owned ioctl buffer queued into persistent controller command list
sys/dev/raid/iir/iir_ctrl.c:245
 none inconclusive — untriaged — —
DF-2051 High 7.8 DFS_GET_THRESH writes sizeof(HAL_PHYERR_PARAM) into outdata without validating allocation or size (heap overflow / NULL-deref write)
sys/dev/netif/ath/ath_dfs/null/dfs_null.c:268
 panic reproduced fixed untriaged — —
DF-2059 High 7.8 Missing privilege check on SIOCGATHDIAG/SIOCGATHPHYERR/SIOCGATHSPECTRAL exposes raw HAL diagnostic surface to unprivileged users
sys/dev/netif/ath/ath/if_ath_ioctl.c:299
 none reproduced not_testable untriaged — —
DF-2079 High 7.8 Heap buffer overflow and NULL-deref panic in SPECTRAL_CONTROL_GET_PARAMS due to missing output-buffer validation
sys/dev/netif/ath/ath/if_ath_spectral.c:218
 none not_reproduced not_testable untriaged — —
DF-2145 High 7.8 tasklet_kill() UAF: premature return on TASKLET_STATE_RUN leaves dangling tasklet_entry; runner later calls t->func from freed memory
sys/dev/drm/linux_tasklet.c:170
 none not_reproduced not_testable untriaged — —
DF-2174 High 7.8 __hrtimer_task epilogue unconditionally clears timer->active, defeating callback re-arm via hrtimer_start + NORESTART — un-cancellable timer leading to UAF
sys/dev/drm/linux_hrtimer.c:59
 none not_reproduced not_testable untriaged — —
DF-2195 High 7.8 kthread_stop() frees the LWKT thread via a bogus timed tsleep, causing use-after-free / double-free of struct thread
sys/dev/drm/linux_kthread.c:97
 corruption reproduced fixed untriaged — —
DF-2268 High 7.8 Heap overflow in cdcheckmedia via uncapped num_entries from device-supplied TOC header
sys/bus/cam/scsi/scsi_cd.c:2947
 none not_reproduced not_testable untriaged — —
DF-2282 High 7.8 sgopen: missing cam_periph_acquire plus cam_periph_unlock-without-lock in securelevel path (lock/refcount protocol violation; refcount underflow->UAF)
sys/bus/cam/scsi/scsi_sg.c:385
 none not_reproduced not_testable untriaged — —
DF-2332 High 7.8 Stack buffer overflow in ACPI SMBus handler: buf[32] vs attacker-controlled GSBUS lengths
sys/bus/smbus/smbacpi/smbacpi.c:137
 none not_reproduced not_testable untriaged — —
DF-2339 High 7.8 Stack buffer overflow in cue_setmulti: 8-byte hashtbl indexed by 9-bit multicast hash
sys/bus/u4b/net/if_cue.c:273
 none not_reproduced not_testable untriaged — —
DF-2346 High 7.8 SIGIO recipient stored as raw unreferenced struct proc pointer -> use-after-free after fork+exit
sys/bus/u4b/usb_dev.c:1044
 none not_reproduced not_testable untriaged — —
DF-2389 High 7.8 Heap out-of-bounds write in link_add_prs when _PRS has more IRQ resources than _CRS
sys/dev/acpica/acpi_pci_link.c:311
 none not_reproduced not_testable untriaged — —
DF-2424 High 7.8 Scatter/gather list heap overflow via unchecked sglist_cnt in amdexecutesrb
sys/dev/disk/amd/amd.c:455
 none not_reproduced not_testable untriaged — —
DF-2425 High 7.8 CDB heap overflow via unchecked cdb_len into 12-byte CmdBlock
sys/dev/disk/amd/amd.c:399
 — — — untriaged — —
DF-2428 High 7.8 Unbounded scatter/gather copy in btexecuteccb via CAM_SCATTER_VALID CCB (kernel heap overflow)
sys/dev/disk/buslogic/bt.c:1055
 none not_reproduced not_testable untriaged — —
DF-2446 High 7.8 dm_message_ioctl frees and dereferences an uninitialized stack msg pointer
sys/dev/disk/dm/dm_ioctl.c:1006
 panic reproduced fixed untriaged — —
DF-2488 High 7.8 Stack buffer overflow/underflow in ad_describe via unterminated model string
sys/dev/disk/nata/ata-disk.c:508
 none not_reproduced not_testable untriaged — —
DF-2493 High 7.8 Heap OOB write via untrusted disk index in ATA RAID metadata parsers
sys/dev/disk/nata/ata-raid.c:1806
 none not_reproduced not_testable untriaged — —
DF-2494 High 7.8 BSS out-of-bounds write on global ata_raid_arrays[] via untrusted LSI v2 raid_number
sys/dev/disk/nata/ata-raid.c:2802
 — — — untriaged — —
DF-2495 High 7.8 Kernel stack/heap OOB write via untrusted total_disks in ata_raid_create and ata_raid_status ioctls
sys/dev/disk/nata/ata-raid.c:1051
 — — — untriaged — —
DF-2506 High 7.8 TOCTOU kernel heap overflow in acd_send_cue via double-fetch of cuesheet->len
sys/dev/disk/nata/atapi-cd.c:1318
 none not_reproduced not_testable untriaged — —
DF-2510 High 7.8 Unbounded ctlr->channels (up to 32) overflows the fixed interrupt[8] dispatch array causing heap OOB write of function pointers and OOB indirect call on every IRQ
sys/dev/disk/nata/chipsets/ata-ahci.c:101
 none not_reproduced not_testable untriaged — —
DF-2517 High 7.8 Heap OOB write in sili_load_prb_callback via unchecked DMA segment count
sys/dev/disk/sili/sili.c:1245
 none not_reproduced not_testable untriaged — —
DF-2520 High 7.8 trm_ExecuteSRB writes user-controlled nseg SG entries into 32-slot pSRBSGL with no bounds check (heap overflow via pass(4) SCATTER_VALID)
sys/dev/disk/trm/trm.c:433
 none not_reproduced not_testable untriaged — —
DF-2521 High 7.8 trm_action bcopy of user-controlled cdb_len into 12-byte CmdBlock overflows the SRB struct (pass(4)-reachable heap corruption)
sys/dev/disk/trm/trm.c:591
 none not_reproduced not_testable untriaged — —
DF-2580 High 7.8 Missing bounds check on table id gives controlled kernel heap OOB read/write on every ipfw3 table opcode
sys/net/ipfw3_basic/ip_fw3_table.c:92
 panic reproduced fixed untriaged — —
DF-0547 Medium 7.8 Ring cleanup trusts userspace-writable buf_idx: cross-adapter double-free / buffer aliasing
sys/net/netmap/netmap_mem2.c:995
 corruption not_reproduced not_testable untriaged — —
DF-1235 Medium 7.8 Unbounded CDB copy into fixed 12-byte SRB CmdBlock overwrites SRB pointer fields
sys/dev/disk/trm/trm.c:591
 none not_reproduced not_testable untriaged — —
DF-1454 Medium 7.8 Heap buffer overflow in autosense data copy - missing sizeof(sense_data) bound
sys/dev/virtual/vmware/pvscsi/pvscsi.c:945
 none inconclusive — untriaged — —
DF-1848 Medium 7.8 ENA LLQ bounce buffer heap overflow via descs_left_in_line u16 underflow when device reports descs_num_before_header=0
sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:150
 none inconclusive — untriaged — —
DF-2469 Medium 7.8 Heap OOB write via double channel offset in RQCS_SYNCXFER_FAILED status handler
sys/dev/disk/isp/isp.c:6282
 none not_reproduced not_testable untriaged — —
DF-2492 Medium 7.8 OOB heap write/read on interrupt[8] via AHCI controllers with >8 ports
sys/dev/disk/nata/ata-pci.c:383
 none not_reproduced not_testable untriaged — —
DF-1046 High 7.6 uint8_t loop-counter wrap in uvc_ctrl_init_dev causes unbounded kernel heap overflow from malicious USB descriptor
sys/bus/u4b/uvc/uvc_ctrls.c:917
 corruption reproduced fixed untriaged — —
DF-2490 High 7.6 ATAPI PIO heap OOB write/read via unvalidated device byte_count_limit
sys/dev/disk/nata/ata-lowlevel.c:329
 none not_reproduced not_testable untriaged — —
DF-0017 High 7.5 Unbounded recursion in kdmsg_simulate_failure overflows the kernel thread stack (remote DoS)
sys/kern/kern_dmsg.c:1321
 panic reproduced fixed untriaged — —
DF-0417 High 7.5 Use-after-free race on nd_defrouter: defrtrlist_update returns unreferenced pointer consumed unlocked across RA prefix loop
sys/netinet6/nd6_rtr.c:285
 panic reproduced fixed untriaged — —
DF-0580 High 7.5 ieee80211_defrag UAF/dangling-pointer: DragonFly m_cat frees fragment but code reads wh + m_pkthdr.len after
sys/netproto/802_11/wlan/ieee80211_input.c:248
 none inconclusive not_testable untriaged — —
DF-0617 High 7.5 Use-after-free in ng_ether_rcv_upper: bridge_input_p() return value discarded, freed mbuf fed to ether_demux_oncpu
sys/netgraph7/ether/ng_ether.c:657
 dos reproduced fixed untriaged — —
DF-0740 High 7.5 gre_input2 missing packet length validation — m_len/m_pkthdr.len underflow from crafted GRE option flags (no checksum verification)
sys/netinet/ip_gre.c:148
 panic reproduced fixed untriaged — —
DF-0945 High 7.5 swapoff_one mutates global swapblist without vm_token, racing with concurrent page-out (blist corruption / UAF on resize)
sys/vm/swap_pager.c:536
 dos reproduced fixed untriaged — —
DF-1184 High 7.5 Heap buffer overflow in arcmsr_Read_iop_rqbuffer_data_D: 128-byte kmalloc overwritten by firmware-controlled data_len
sys/dev/raid/arcmsr/arcmsr.c:1446
 corruption reproduced not_testable untriaged — —
DF-1381 High 7.5 vge_newbuf RX-ring refill loop writes OOB when idx<VGE_RXCHUNK due to non-modular signed decrement
sys/dev/netif/vge/if_vge.c:1162
 panic reproduced not_testable untriaged — —
DF-2358 High 7.5 Heap buffer overflow in USB RX frame aggregation: m_getcl (2048B) too small for m_copydata of up to 4080B
sys/bus/u4b/wlan/if_run.c:3013
 none not_reproduced not_testable untriaged — —
DF-0533 Medium 7.5 Unsynchronized sc->inq/outq between hard ISR and netgraph forward: ifqueue corruption / UAF
sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:939
 none not_reproduced not_testable untriaged — —
DF-0581 Medium 7.5 ieee80211_setup_rates trusts attacker-controlled IE length byte: latent heap overflow of rs_rates[15]
sys/netproto/802_11/wlan/ieee80211_input.c:420
 none not_reproduced not_testable untriaged — —
DF-0730 Medium 7.5 ra_rate_thresh[3][8] heap OOB read/write — indexed up to rs_nrates-1(14) from remote peer rates IE
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:241
 heap-oob-rw (latent) reproduced fixed untriaged — —
DF-1060 Medium 7.5 FW_GTPMAP bcopy uses (topology_map->crc_len + 1) * 4 as the count — attacker-inflatable crc_len drives unbounded kernel OOB read up to 256 KB
sys/bus/firewire/fwdev.c:657
 none not_reproduced not_testable untriaged — —
DF-1249 Medium 7.5 dc_pnic_rx_bug_war unbounded copy loop - heap overflow if PNIC produces >5 descriptors
sys/dev/netif/dc/if_dc.c:2414
 none inconclusive not_testable untriaged — —
DF-1352 Medium 7.5 Heap overflow via unbounded device-supplied event_info_size in virtio-scsi
sys/dev/virtual/virtio/scsi/virtio_scsi.c:301
 panic reproduced fixed untriaged — —
DF-2285 Medium 7.5 Use-after-free in target teardown: fixed 500ms sleep before kfree(softc) does not drain in-flight CTIOs
sys/bus/cam/scsi/scsi_targ_bh.c:402
 — — — untriaged — —
DF-0572 High 7.4 Per-CPU cfg_nat pointer cached in shared firewall rule: cross-CPU RB-tree races -> corruption
sys/net/ipfw3_nat/ip_fw3_nat.c:158
 dos reproduced fixed untriaged — —
DF-1236 High 7.4 Extended SCSI message accumulation overflows MsgInBuf[6] into adjacent SRB pointer fields
sys/dev/disk/trm/trm.c:1832
 none not_reproduced not_testable untriaged — —
DF-1395 High 7.4 Firmware-controlled size_of_struct in oce_read_mac_addr drives unbounded bcopy (heap overflow into softc)
sys/dev/netif/oce/oce_mbox.c:447
 panic reproduced not_testable untriaged — —
DF-1716 High 7.4 ata-pci: out-of-bounds interrupt[] write/read when AHCI reports >8 channels -> kernel heap corruption + RIP control on next IRQ
sys/dev/disk/nata/ata-pci.c:230
 panic reproduced fixed untriaged — —
DF-1737 High 7.4 ata-lowlevel: heap OOB write via unchecked ATAPI byte-count register polluting request->donecount
sys/dev/disk/nata/ata-lowlevel.c:329
 panic reproduced fixed untriaged — —
DF-0083 Medium 7.4 OOB write into cpu_topology_nodes[MAXCPU] during boot topology construction on high-CPU-count systems
sys/kern/subr_cpu_topology.c:115
 panic reproduced not_testable untriaged — —
DF-1385 Medium 7.4 Unbounded VBIOS num_entries overflows MC register table arrays (heap OOB write+read)
sys/dev/drm/radeon/cypress_dpm.c:1052
 none inconclusive — untriaged — —
DF-1950 Medium 7.4 Unvalidated ACPI ATRM return object: heap buffer overflow and type confusion in amdgpu_atrm_call
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:264
 none inconclusive — untriaged — —
DF-2484 Medium 7.4 Untrusted IOC-supplied indices index raid_disks/raid_volumes arrays without bounds checks (OOB read/write of kernel heap)
sys/dev/disk/mpt/mpt_raid.c:414
 none not_reproduced not_testable untriaged — —
DF-0074 High 7.3 DIOCGSLICEINFO heap buffer overflow via crafted GPT disk image (dss_nslices > MAX_SLICES)
sys/kern/subr_diskslice.c:556
 panic reproduced fixed untriaged — —
DF-0795 High 7.3 Stack buffer overflow in VFAT long-filename reassembly via crafted FAT directory entry — no kernel stack canary
sys/vfs/msdosfs/msdosfs_vnops.c:1662
 corruption reproduced fixed untriaged — —
DF-0806 High 7.3 dirfs_readlink off-by-one heap overflow and OOB read via truncated symlink target
sys/vfs/dirfs/dirfs_vnops.c:1328
 corruption reproduced not_testable untriaged — —
DF-2060 High 7.3 Invalid free / non-heap kfree in ath_ioctl_diag when HAL diagcode replaces result pointer (ATH_DIAG_DYN + HAL_DIAG_REVS/FATALERR)
sys/dev/netif/ath/ath/if_ath_ioctl.c:201
 panic reproduced not_testable untriaged — —
DF-2322 High 7.3 MSI-X table/PBA out-of-bounds MMIO read/write - no BAR-size validation against attacker-controlled table offset and vector count
sys/bus/pci/pci.c:1431
 none not_reproduced not_testable untriaged — —
DF-2356 High 7.3 Unvalidated hardware frame length in RX path allows heap OOB read / uninitialized-memory info leak
sys/bus/u4b/wlan/if_rum.c:1146
 none not_reproduced not_testable untriaged — —
DF-2401 High 7.3 intel_gtt_insert_page swaps index/physical arguments causing out-of-bounds MMIO write into Intel IGD BAR
sys/dev/agp/intel-gtt.c:1407
 none not_reproduced not_testable untriaged — —
DF-2114 Medium 7.3 ata_serialize() clobbers PCI bus pci_devinfo ivar on controller device -- heap OOB read + cross-device PCI config corruption on ATP850R
sys/dev/disk/nata/chipsets/ata-acard.c:206
 corruption reproduced fixed untriaged — —
DF-2522 Medium 7.3 trm_SRBdone auto-sense bcopy uses user-controlled sense_len to copy out of 32-byte DMA slot and into 32-byte csio field (heap OOB read+write via pass(4))
sys/dev/disk/trm/trm.c:2529
 — — — untriaged — —
DF-0275 Medium 7.2 Heap buffer overflow in WPA/RSN IE construction: variable-length IE written into fixed sizeof(ieee80211_ie_wpa)=100 slot
sys/netproto/802_11/wlan/ieee80211_output.c:1976
 none inconclusive not_testable untriaged — —
DF-2357 Medium 7.2 Wrong TX frame-size bound causes 16-byte overflow of USB DMA buffer
sys/bus/u4b/wlan/if_rum.c:438
 — — — untriaged — —
DF-0638 High 7.1 Decompress path avail_in integer underflow feeds OOB heap reads to inflate() from crafted PPP frame
sys/netgraph7/deflate/ng_deflate.c:539
 leak reproduced fixed untriaged — —
DF-0700 High 7.1 User-controlled edge count not bounded by MAX_EDGES — BSS OOB array write/read on centre_socks[]
sys/net/ipfw3_basic/ip_fw3_sync.c:143
 none not_reproduced not_testable untriaged — —
DF-0701 High 7.1 Heap OOB read in centre_conf bcopy and integer overflow in size math
sys/net/ipfw3_basic/ip_fw3_sync.c:143
 none not_reproduced not_testable untriaged — —
DF-0702 High 7.1 Mbuf UAF and double-free in centre_test and send_state (sosend consumes m, loop reuses it)
sys/net/ipfw3_basic/ip_fw3_sync.c:339
 none not_reproduced not_testable untriaged — —
DF-0766 High 7.1 Heap OOB write in NFS READDIR/READDIRPLUS reply XDR null-padding — missing nfsm_clget before pad bytes
sys/vfs/nfs/nfs_serv.c:3186
 none not_reproduced fixed untriaged — —
DF-0781 High 7.1 Kernel heap info leak via unvalidated namelen in fuse_vop_readdir — bcopy past reply buffer + len underflow wild ptr
sys/vfs/fuse/fuse_vnops.c:1066
 leak reproduced fixed untriaged — —
DF-0811 High 7.1 OOB kernel heap write in ext2_cg_block_bitmap_init via buggy ext2_block_in_group divisor — setbit at wild offset
sys/vfs/ext2fs/ext2_alloc.c:856
 panic reproduced fixed untriaged — —
DF-0820 High 7.1 ffs_mountfs performs no validation of superblock geometry (fs_ncg/fs_ipg/fs_fpg/fs_fsize/fs_frag/fs_sbsize) — crafted image causes div-by-zero/infinite-loop/heap-overflow/bzero-corruption/OOB-read
sys/vfs/ufs/ffs_vfsops.c:642
 panic reproduced fixed untriaged — —
DF-0831 High 7.1 Heap overflow in udf_getfid via negative frag_size from 4-byte FID alignment — size_t(-3) bcopy
sys/vfs/udf/udf_vnops.c:543
 panic reproduced fixed untriaged — —
DF-0888 High 7.1 ext2_indirtrunc bzero heap OOB write via ftruncate past indirect-block structural limit
sys/vfs/ext2fs/ext2_inode.c:138
 panic reproduced fixed untriaged — —
DF-1179 High 7.1 Heap OOB write in DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8]
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1200
 corruption reproduced not_testable untriaged — —
DF-1180 High 7.1 Heap OOB write in voltage-table builders: unbounded dep_table->count overflows entries[32]
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1026
 corruption reproduced not_testable untriaged — —
DF-1227 High 7.1 mpr_build_nvme_prp heap overflow via unbounded user-supplied data length
sys/dev/raid/mpr/mpr.c:2716
 none not_reproduced not_testable untriaged — —
DF-1259 High 7.1 mfi_stp_cmd unbounded SGE loop corrupts mfi_softc via size-[2] DMA arrays and STP frame SGL
sys/dev/raid/mfi/mfi.c:2724
 none inconclusive not_testable untriaged — —
DF-1754 High 7.1 radeon_vce: OOB read of p->relocs[] and wild pointer deref via non-multiple-of-4 chunk_relocs length_dw
sys/dev/drm/radeon/radeon_vce.c:470
 leak reproduced fixed untriaged — —
DF-1795 High 7.1 plip: heap overflow / OOB-read in lp_intr racing SIOCSIFMTU buffer swap
sys/dev/netif/plip/if_plip.c:348
 panic reproduced not_testable untriaged — —
DF-1818 High 7.1 sckmsrndr: fill_rect24 slow path over-advances draw_pos by 3*width per row writing past framebuffer mapping
sys/dev/misc/syscons/sckmsrndr.c:438
 panic reproduced fixed untriaged — —
DF-2133 High 7.1 dma_buf_export never initializes dmabuf->resv; GPU drivers dereference uninitialized slab pointer
sys/dev/drm/linux_dma-buf.c:127
 none not_reproduced not_testable untriaged — —
DF-2419 High 7.1 Heap OOB write in INQUIRY handler when data buffer length is 36..95 bytes
sys/dev/disk/ahci/ahci_cam.c:1109
 none not_reproduced not_testable untriaged — —
DF-0706 Medium 7.1 Lifecycle bugs in edge handler cleanup: UAF on replaced edge_sock, missing thread join, soclose+sofree imbalance
sys/net/ipfw3_basic/ip_fw3_sync.c:195
 none not_reproduced not_testable untriaged — —
DF-0998 Medium 7.1 TX DMA buffer overflow: mbuf length clamp uses wrong bound -> 16-byte heap overwrite past USB DMA buffer
sys/bus/u4b/wlan/if_rum.c:438
 none not_reproduced not_testable untriaged — —
DF-1197 Medium 7.1 2-byte DMA heap overflow in RX buffer when ETHER_ALIGN applied with jumbo MTU
sys/dev/netif/emx/if_emx.c:2918
 none not_reproduced not_testable untriaged — —
DF-1237 Medium 7.1 Scatter/gather list copy has no bounds vs the 32-entry hardware SG buffer
sys/dev/disk/trm/trm.c:434
 none not_reproduced not_testable untriaged — —
DF-1476 Medium 7.1 intel_gtt_insert_page swaps (index, physical) arguments to install_gtt_pte causing OOB MMIO write past BAR
sys/dev/agp/intel-gtt.c:1406
 none inconclusive — untriaged — —
DF-1551 Medium 7.1 snread subtracts 6 from u_short packet_length with no bound: underflow -> ~63KB kernel heap overflow write via insw into 2KB mbuf cluster
sys/dev/netif/sn/if_sn.c:983
 none inconclusive — untriaged — —
DF-2142 Medium 7.1 Unbounded wire-controlled pos in dcons_checkc allows kernel OOB read / panic via FireWire peer
sys/dev/misc/dcons/dcons.c:96
 panic reproduced fixed untriaged — —
DF-0315 High 7.0 UAF: wg_peer_destroy frees peer struct while data-plane paths access it without peer refcount
sys/net/wg/if_wg.c:589
 none observed dynamically (code-level UAF real + reachable; race window too narrow to panic on GENERIC) not_reproduced — untriaged — —
DF-0590 High 7.0 No serialization of bridge state in legacy netgraph/ng_bridge -- UAF in rehash, OOB heap write in GET_TABLE, deterministic KASSERT panics under concurrent traffic
sys/netgraph/bridge/ng_bridge.c:297
 none not_reproduced — untriaged — —
DF-0636 High 7.0 ngt_rcvdata accesses sc->outq without tp->t_token, racing with ngt_start (UAF write / queue corruption)
sys/netgraph7/tty/ng_tty.c:591
 none not_reproduced — untriaged — —
DF-0691 High 7.0 UAF / NULL-deref in mld6_input MLD_LISTENER_QUERY path: in6m freed concurrently with iteration
sys/netinet6/mld6.c:280
 none not_reproduced not_testable untriaged — —
DF-0692 High 7.0 UAF and unsynchronized list walk in mld6_fasttimeo over global in6_multihead
sys/netinet6/mld6.c:382
 panic not_reproduced not_testable untriaged — —
DF-0745 High 7.0 Dead callout_active guard + callback-owns-free design causes double-free / TAILQ corruption race in l2cap_request_free
sys/netbt/l2cap_misc.c:168
 panic reproduced fixed untriaged — —
DF-0843 High 7.0 Missing global lock on dirhash list enables use-after-free and list corruption across concurrent directory operations
sys/vfs/ufs/ufs_dirhash.c:302
 panic reproduced fixed untriaged — —
DF-0917 High 7.0 Use-after-free on fuse_ipc during tx completion (daemon read/write drops lock before fip access)
sys/vfs/fuse/fuse_ipc.c:112
 panic reproduced fixed untriaged — —
DF-0925 High 7.0 UAF in fuse_alloc_node races vnode reclaim (no refcount on fuse_node)
sys/vfs/fuse/fuse_node.c:106
 panic reproduced fixed untriaged — —
DF-1136 High 7.0 Heap buffer overflow in si_get_svi2_voltage_table: unbounded VBIOS count writes past entries[32]
sys/dev/drm/radeon/si_dpm.c:3939
 panic inconclusive not_testable untriaged — —
DF-1192 High 7.0 ciss_filter_physical: bus=CISS_EXTRA_BUS2(ea)-1 can be -1 -> OOB pointer write via ciss_physical[-1][target]
sys/dev/raid/ciss/ciss.c:1551
 panic reproduced not_testable untriaged — —
DF-1246 High 7.0 OOB read/write past IB end in evergreen_dma_cs_parse (no per-packet bounds check)
sys/dev/drm/radeon/evergreen_cs.c:2806
 none not_reproduced not_testable untriaged — —
DF-1296 High 7.0 Unchecked VBIOS UVD/VCE/ACP level counts cause heap OOB write past fixed-size SMC arrays
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1525
 panic reproduced not_testable untriaged — —
DF-1298 High 7.0 Heap overflow in update_slot_layout_info via unchecked ucConnNum
sys/dev/drm/amd/display/dc/bios/bios_parser.c:2634
 none inconclusive not_testable untriaged — —
DF-1305 High 7.0 Heap OOB write/read in kv_init_graphics_levels via unbounded VBIOS table->count
sys/dev/drm/radeon/kv_dpm.c:2355
 none inconclusive not_testable untriaged — —
DF-1416 High 7.0 Heap OOB write in power-state callback via unbounded ucNumDPMLevels
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1355
 panic reproduced fixed untriaged — —
DF-1487 High 7.0 Out-of-bounds descriptor write in wb_encap when TX chain fills all 16 fragments under minimum frame length
sys/dev/netif/wb/if_wb.c:1221
 leak:heap reproduced not_testable untriaged — —
DF-1640 High 7.0 Use-after-free + double-free of DM_TABLE_PARAMS string across table entries
sys/dev/disk/dm/dm_ioctl.c:688
 panic reproduced fixed untriaged — —
DF-1749 High 7.0 amdgpu_acpi: UAF - ACPI notify handler never removed on device detach
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:369
 panic reproduced fixed untriaged — —
DF-1843 High 7.0 UAF in device-mapper open path: dmopen releases busy reference before open lifetime, racing dm_dev_remove_ioctl
sys/dev/disk/dm/device-mapper.c:209
 panic reproduced fixed untriaged — —
DF-1863 High 7.0 TOCTOU in amdgpu_ctx_add_fence: concurrent CS double dma_fence_put -> UAF/double-free
sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:445
 panic reproduced fixed untriaged — —
DF-1927 High 7.0 UAF race in drm_sched_entity_fini: broken kthread_park allows concurrent scheduler pop_job during entity teardown
sys/dev/drm/scheduler/sched_entity.c:273
 panic reproduced fixed untriaged — —
DF-2146 High 7.0 Unbounded AUX reply byte count causes heap/stack OOB write on DP read path
sys/dev/drm/radeon/radeon_dp_auxch.c:177
 none not_reproduced not_testable untriaged — —
DF-2188 High 7.0 vmap_list traversed and mutated without consistent lock; races yield list corruption UAF and double-free
sys/dev/drm/linux_vmalloc.c:64
 corruption reproduced fixed untriaged — —
DF-2206 High 7.0 iounmap() walks the global iomap_list without iomap_lock, racing concurrent inserters/removers into UAF read, double-free and NULL-deref panic
sys/dev/drm/linux_iomapping.c:68
 panic reproduced fixed untriaged — —
DF-2292 High 7.0 FW_ASYREQ response copy overflows ioctl heap buffer with oversized FireWire RRESB payload
sys/bus/firewire/fwdev.c:576
 none not_reproduced not_testable untriaged — —
DF-2298 High 7.0 Heap OOB read/write via zero-length segment array from integer overflow in n
sys/bus/firewire/fwdma.c:145
 — — — untriaged — —
DF-2435 High 7.0 Heap buffer overflow in status_str via ksprintf of negative strtouq offsets
sys/dev/disk/dm/crypt/dm_target_crypt.c:462
 panic reproduced fixed untriaged — —
DF-2443 High 7.0 UAF / double-free race in dm_dev_remove lifecycle (no-ref-held precondition)
sys/dev/disk/dm/dm_dev.c:65
 panic reproduced fixed untriaged — —
DF-2447 High 7.0 dm_dev_remove_ioctl / dm_dev_resume_ioctl use-after-free: dmv operated on after dm_dev_unbusy drops the last reference
sys/dev/disk/dm/dm_ioctl.c:349
 panic reproduced fixed untriaged — —
DF-2476 High 7.0 mdstrategy_preload processes every queued bio against a stale bio_buf (UAF / cross-request kernel memory corruption / OOB write to preload image)
sys/dev/disk/md/md.c:349
 none not_reproduced not_testable untriaged — —
DF-0003 Medium 7.0 Negative unit number in devclass_alloc_unit causes heap OOB write via dc->devices[]
sys/kern/subr_bus.c:1064
 panic reproduced fixed untriaged — —
DF-0033 Medium 7.0 Unsynchronized fdtol->fdl_refcount ++ / list splice in rfork fdshare path (UAF via refcount race)
sys/kern/kern_fork.c:568
 panic reproduced fixed untriaged — —
DF-0420 Medium 7.0 Use-after-free in SCO reassembly buffer: sc_isoc_in_buffer retains dangling pointer after mbuf forwarded and realloc fails
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1103
 none inconclusive not_testable untriaged — —
DF-0497 Medium 7.0 TOCTOU use-after-free on rtentry in ng_btsocket_l2cap_raw_bind: releases rt_lock before storing pointer
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:690
 none inconclusive not_testable untriaged — —
DF-0513 Medium 7.0 Rule-chain mutation raced with concurrent ip6_fw_chk: lock-free linked list + kfree after crit_exit -> UAF on SMP
sys/net/ip6fw/ip6_fw.c:856
 none not_reproduced not_testable untriaged — —
DF-0521 Medium 7.0 PF_LOCAL sockaddr unparse: sun_len<pathoff underflow -> giant bcopy -> stack OOB write (DF-0509 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:321
 none not_reproduced not_testable untriaged — —
DF-0586 Medium 7.0 Lockless global hci_pcb list allows use-after-free during concurrent socket teardown and packet tap
sys/netbt/hci_socket.c:87
 none not_reproduced not_testable untriaged — —
DF-0589 Medium 7.0 sc->outq mbuf-queue race in ng_h4: IF_DEQUEUE in ng_h4_start (tty ctx) vs IF_DRAIN in disconnect/shutdown (netgraph ctx); NG_H4_LOCK is only per-CPU crit_enter
sys/netgraph7/bluetooth/drivers/h4/ng_h4.c:88
 dos inconclusive not_testable untriaged — —
DF-0755 Medium 7.0 Unlocked global trace index tcp_debx races into runaway out-of-bounds write (TCPDEBUG-only)
sys/netinet/tcp_debug.c:84
 none reproduced not_testable untriaged — —
DF-0774 Medium 7.0 Use-after-free in devfs_clone — clone handler freed during lock release window before nhandler call
sys/vfs/devfs/devfs_core.c:2322
 panic reproduced fix_failed untriaged — —
DF-0793 Medium 7.0 Use-after-free in async TRIM block-free path — ffs_blkfree stores unrefcounted mount/device pointers in deferred task
sys/vfs/ufs/ffs_alloc.c:1633
 none not_reproduced fixed untriaged — —
DF-1061 Medium 7.0 LOOPRECOVER watchdog silently abandons unacknowledged TLB invalidations, enabling stale-TLB use-after-free / info leak
sys/platform/pc64/x86_64/pmap_inval.c:342
 none not_reproduced not_testable untriaged — —
DF-1153 Medium 7.0 Use-after-free in reset functions when kzalloc fails (connector/crtc/plane state)
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:3190
 none not_reproduced not_testable untriaged — —
DF-1289 Medium 7.0 Heap overflow of CAM CCB sense buffer from untrusted controller sense_length
sys/dev/raid/mly/mly.c:2356
 none not_reproduced not_testable untriaged — —
DF-1290 Medium 7.0 OOB write on softc via untrusted controller event channel/target/lun in mly_process_event
sys/dev/raid/mly/mly.c:1323
 none not_reproduced not_testable untriaged — —
DF-1295 Medium 7.0 METEORSSIGNAL stores curproc without reference causing UAF via fork+child-exit+DMA interrupt
sys/dev/video/cxm/cxm.c:2760
 none not_reproduced not_testable untriaged — —
DF-1300 Medium 7.0 dc_add_all_planes_for_stream writes plane_states[MAX_SURFACES=3] with unchecked plane_count (dead API, latent stack overflow)
sys/dev/drm/amd/display/dc/core/dc_resource.c:1564
 panic reproduced fixed untriaged — —
DF-1358 Medium 7.0 Stack buffer overflow in amr_quartz_get_work via controller-supplied completion count
sys/dev/raid/amr/amr.c:2095
 panic reproduced fixed untriaged — —
DF-1366 Medium 7.0 Heap OOB write in vegam_populate_smc_vce_level via unbounded VBIOS mm_dep_table->count
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1217
 none inconclusive — untriaged — —
DF-1367 Medium 7.0 Heap OOB write in vegam_populate_smc_uvd_level via unbounded VBIOS mm_dep_table->count
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1330
 none inconclusive — untriaged — —
DF-1368 Medium 7.0 Heap+stack OOB writes in clock-stretcher/AVFS/CAC table population via unbounded VBIOS counts
sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:515
 none inconclusive — untriaged — —
DF-1411 Medium 7.0 DragonFly sysctl backlight handler captures drm_connector_state before modeset lock enabling UAF
sys/dev/drm/i915/intel_panel.c:1815
 none inconclusive — untriaged — —
DF-1417 Medium 7.0 Stack/heap OOB write in smu8_get_clock_by_type from unbounded SMU-derived count
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1613
 none inconclusive — untriaged — —
DF-1449 Medium 7.0 Unvalidated firmware-reported disk/volume indices cause OOB read/write in RAID arrays and IOC page buffers
sys/dev/disk/mpt/mpt_raid.c:414
 none inconclusive — untriaged — —
DF-1758 Medium 7.0 ips: card-controlled command_id indexes commandarray[] with no bounds check in both interrupt handlers -> OOB r/w + indirect call
sys/dev/raid/ips/ips.c:567
 none inconclusive — untriaged — —
DF-1911 Medium 7.0 r600_audio_update_hdmi walks encoder_list without mode_config.mutex: UAF race vs modeset/unload (variant of DF-1878)
sys/dev/drm/radeon/r600_hdmi.c:114
 none inconclusive — untriaged — —
DF-1959 Medium 7.0 dm_dev_remove use-after-free via concurrent stale-pointer removal: operator-group to root heap corruption
sys/dev/disk/dm/dm_dev.c:305
 none inconclusive — untriaged — —
DF-2041 Medium 7.0 Imported GEM obj->resv set to uninitialized dma_buf->resv heap memory
sys/dev/drm/i915/i915_gem_dmabuf.c:322
 panic reproduced fixed untriaged — —
DF-2072 Medium 7.0 Signed table_id bounds check allows OOB heap read/write in SMU10 table copy
sys/dev/drm/amd/powerplay/smumgr/smu10_smumgr.c:116
 none reproduced fixed untriaged — —
DF-2086 Medium 7.0 Double-free of ch->dma in ata_dmaalloc error path
sys/dev/disk/nata/ata-dma.c:151
 dos reproduced fixed untriaged — —
DF-2125 Medium 7.0 Lockless segment read in vm_phys_fictitious_to_vm_page races unreg->kfree yielding NULL-deref panic or UAF of vm_page array
sys/dev/drm/drm_vm.c:152
 corruption reproduced fixed untriaged — —
DF-2128 Medium 7.0 Multi-page sg entry OOB read/write in sg_pcopy_from_buffer / sg_pcopy_to_buffer via DMAP
sys/dev/drm/linux_scatterlist.c:167
 corruption reproduced fixed untriaged — —
DF-2189 Medium 7.0 vmap() computes allocation size in 32-bit arithmetic; large count overflows and maps count pages into undersized VA
sys/dev/drm/linux_vmalloc.c:55
 corruption reproduced fixed untriaged — —
DF-2191 Medium 7.0 UAF: sio_pccard_detach does not stop/drain dtr_ch and busy_ch callouts before softc is freed
sys/dev/serial/sio/sio_pccard.c:117
 corruption reproduced fixed untriaged — —
DF-2304 Medium 7.0 Double-free / UAF in fwohci_pci_add_child error path: detach deletes child then caller deletes it again
sys/bus/firewire/fwohci_pci.c:446
 — — — untriaged — —
DF-2331 Medium 7.0 Slave-controlled block-read byte count overflows sc->block_data[32] in interrupt handler
sys/bus/smbus/ichsmb/ichsmb.c:575
 none not_reproduced not_testable untriaged — —
DF-2353 Medium 7.0 Use-after-free on device disconnect: sc->data freed before /dev/videoX cdev is destroyed
sys/bus/u4b/uvc/uvc_drv.c:2493
 — — — untriaged — —
DF-2382 Medium 7.0 Heap OOB write in cmi_order[] when BIOS exposes >128 CMI instances
sys/dev/acpica/acpi_hp/acpi_hp.c:1165
 none not_reproduced not_testable untriaged — —
DF-2414 Medium 7.0 Unvalidated 32-bit ccb_index read from firmware LRAM used to index ccb_infos[] in all four halt/error paths - OOB read NULL-deref and UAF
sys/dev/disk/advansys/advlib.c:1005
 none not_reproduced not_testable untriaged — —
DF-2453 Medium 7.0 Use-after-free of target config in async read iodone callback
sys/dev/disk/dm/flakey/dm_target_flakey.c:303
 none not_reproduced not_testable untriaged — —
DF-2474 Medium 7.0 Stale base pointer in isp_pci_mbxdma error cleanup causes kernel-heap multi-free
sys/dev/disk/isp/isp_pci.c:1600
 none not_reproduced not_testable untriaged — —
DF-2552 Medium 7.0 Integer overflow in sbuf_extend/sbuf_extendsize yields undersized reallocation and ~2GiB heap overflow
sys/kern/subr_sbuf.c:131
 none reproduced fixed untriaged — —
DF-2553 Medium 7.0 sbuf_uionew truncates ssize_t uio_resid to int length then uiomove()s full original size into undersized buffer
sys/kern/subr_sbuf.c:237
 — — — untriaged — —
DF-0105 Low 7.0 DT_CALLOUT_ARMED set before callout_reset creates enqueue/cancel race (panic or tq_callouts underflow + spurious UAF)
sys/kern/subr_taskqueue.c:355
 none reproduced fixed untriaged — —
DF-0557 Low 7.0 Callout UAF race on hook disconnect/node shutdown: callout_stop doesnt drain ticker
sys/netgraph/lmi/ng_lmi.c:1062
 panic reproduced fixed untriaged — —
DF-1001 Low 7.0 INQUIRY EVPD Unit Serial Number pre-fill writes past short CAM buffer
sys/bus/u4b/storage/umass.c:2326
 none reproduced fixed untriaged — —
DF-1002 Low 7.0 INQUIRY EVPD Supported Page List augmentation trusts device-supplied length against unvalidated buffer
sys/bus/u4b/storage/umass.c:2578
 none reproduced fixed untriaged — —
DF-1016 Low 7.0 FIOASYNC stores raw struct proc pointer without PHOLD -> kernel heap UAF on process exit via fork
sys/bus/u4b/usb_dev.c:1044
 none reproduced fixed untriaged — —
DF-1154 Low 7.0 Unbounded per-CRTC plane count can overflow MAX_SURFACES stack/heap buffers
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4496
 panic reproduced fixed untriaged — —
DF-1435 Low 7.0 DVDIOCREADSTRUCTURE BCA/MANUFACT heap overflow via device-controlled length field
sys/dev/disk/nata/atapi-cd.c:1582
 none reproduced fixed untriaged — —
DF-2034 Low 7.0 Signed table_id comparison allows OOB array index in vega10_copy_table_from_smc / _to_smc
sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:37
 panic reproduced fixed untriaged — —
DF-2209 Low 7.0 Stale pointer after kfree in drm_sysfs_connector_remove -- connector->kdev not NULLed, creating latent UAF via drm_sysfs_connector_add early-return guard
sys/dev/drm/drm_sysfs.c:35
 — — — untriaged — —
DF-2234 Low 7.0 iconv_add() and iconv_register_cspair() accept unbounded charset names; iconv_sysctl_cslist() strcpy overflows 31-byte stack buffer
sys/libiconv/iconv.c:179
 — — — untriaged — —
DF-2248 Low 7.0 min() truncates 64-bit size_t to 32-bit u_int then stores in signed int: negative loop count unbounded buffer overrun
sys/libiconv/iconv_xlat.c:86
 — — — untriaged — —
DF-2249 Low 7.0 convchar==1 path converts one byte without checking inbytesleft/outbytesleft > 0: 1-byte OOB read/write
sys/libiconv/iconv_xlat.c:92
 — — — untriaged — —
DF-0490 High 6.8 Type confusion in in_lifaddr_ioctl: AF_INET6 check matches IPv6 addresses cast to in_ifaddr — unpriv heap OOB read/info leak via SIOCGLIFADDR
sys/netinet/in.c:908
 leak:0 reproduced fixed untriaged — —
DF-0983 High 6.8 Heap overflow in urtwn_efuse_read_data via crafted efuse extended header on RTL8188EU
sys/bus/u4b/wlan/if_urtwn.c:1755
 panic reproduced fixed untriaged — —
DF-1011 High 6.8 Integer overflow in nitv (uint16_t) during UVC descriptor parsing -> ~250KB heap buffer overflow
sys/bus/u4b/uvc/uvc_drv.c:1674
 panic reproduced fixed untriaged — —
DF-2288 High 6.8 OOB heap write/read in fw_bus_explore_callback via unchecked ongoaddr (Config ROM parser)
sys/bus/firewire/firewire.c:1500
 none not_reproduced not_testable untriaged — —
DF-2289 High 6.8 Off-by-one stack buffer overflow in crom_next depth guard allows kernel stack corruption
sys/bus/firewire/fwcrom.c:115
 none not_reproduced not_testable untriaged — —
DF-2359 High 6.8 urtwn_efuse_read_data writes past sc->rom union on malicious USB device (RTL8188EU extended efuse header)
sys/bus/u4b/wlan/if_urtwn.c:1756
 none not_reproduced not_testable untriaged — —
DF-1097 Medium 6.8 Use-after-free and double-free in fwohci_pci_add_child error path
sys/bus/firewire/fwohci_pci.c:442
 none not_reproduced not_testable untriaged — —
DF-1268 Medium 6.8 Unbounded VBIOS dependency-table counts overflow fixed SMU7 level arrays (heap OOB write)
sys/dev/drm/amd/amdgpu/kv_dpm.c:2422
 none inconclusive not_testable untriaged — —
DF-1280 Medium 6.8 Unchecked reply-frame offset in mpt_intr allows OOB read/write via malicious IOC address reply
sys/dev/disk/mpt/mpt.c:734
 none inconclusive not_testable untriaged — —
DF-1767 Medium 6.8 virtqueue: host-controlled descriptor indices used without runtime bounds validation cause OOB read/write
sys/dev/virtual/virtio/virtio/virtqueue.c:559
 none inconclusive — untriaged — —
DF-1868 Medium 6.8 Write-reply stack buffer overflow in aux_engine: missing bound of returned_byte against reply_data[16]
sys/dev/drm/amd/display/dc/i2caux/aux_engine.c:415
 none inconclusive — untriaged — —
DF-1882 Medium 6.8 Stack buffer overflow/underflow in ad_describe via non-NUL-terminated IDENTIFY model string
sys/dev/disk/nata/ata-disk.c:508
 none inconclusive — untriaged — —
DF-1938 Medium 6.8 Write-reply stack overflow via self-comparing bound check in read_channel_reply (cross-file with DF-1868)
sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:316
 none inconclusive — untriaged — —
DF-2361 Medium 6.8 P packet out-of-bounds stack write via NUM_REGS/struct mismatch and missing lower bound
sys/cpu/x86_64/misc/x86_64-gdbstub.c:438
 — — — untriaged — —
DF-2362 Medium 6.8 m/M packets accept unbounded length overflowing 400-byte static I/O buffers
sys/cpu/x86_64/misc/x86_64-gdbstub.c:118
 — — — untriaged — —
DF-1694 Low 6.8 dce_aux: stack buffer overflow in AUX write-reply path (bound check compares HW field against itself)
sys/dev/drm/amd/display/dc/dce/dce_aux.c:285
 panic reproduced fixed untriaged — —
DF-0410 High 6.7 Heap buffer overflow in ng_encode_string: buffer allocated by strlen(raw) but loop iterates attacker-controlled slen
sys/netgraph7/netgraph/ng_parse.c:919
 none reproduced not_testable untriaged — —
DF-0472 High 6.7 ip_fw3_ctl_add_rule missing cmd_len validation: heap over-read + info leak + OOB function pointer call
sys/net/ipfw3/ip_fw3.c:950
 leak:~1KB reproduced fixed untriaged — —
DF-0668 High 6.7 Unbounded table id in all dispatch/ioctl handlers -> per-CPU heap OOB write, OOB read, and wild function-pointer call
sys/net/ipfw3_basic/ip_fw3_table.c:92
 panic reproduced fixed untriaged — —
DF-0720 High 6.7 Heap overflow: if_alloc(IFT_PPP) returns sizeof(struct ifnet) but sppp_attach writes ~1KB of struct sppp fields past allocation (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:249
 none not_reproduced not_testable untriaged — —
DF-0897 High 6.7 Stack buffer overflow via non-NUL-terminated name/linkname in devfs_rule_ioctl
sys/vfs/devfs/devfs_rules.c:104
 panic reproduced fixed untriaged — —
DF-1064 High 6.7 Unbounded CPU counter in MADT LAPIC/x2APIC enumeration causes out-of-bounds kernel BSS writes
sys/platform/pc64/acpica/acpi_madt.c:274
 panic reproduced fixed untriaged — —
DF-1066 High 6.7 Integer underflow in uvc_buf_queue_mmap_locked bounds check allows out-of-bounds vtophys() when buf_size==0
sys/bus/u4b/uvc/uvc_buf.c:107
 none not_reproduced not_testable untriaged — —
DF-1133 High 6.7 RLC v2.0 firmware register-list parsing: integer-overflow kmalloc + unvalidated offset to heap OOB write/read
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1106
 panic inconclusive not_testable untriaged — —
DF-1134 High 6.7 cz_init_cp_jump_table: unvalidated jt_offset/jt_size from CE/PFP/ME/MEC fw headers -> OOB read/write
sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1301
 panic inconclusive not_testable untriaged — —
DF-1163 High 6.7 gfx_v7_0_init_cp_pg_table heap OOB write+read via untrusted firmware jt_offset/jt_size
sys/dev/drm/amd/amdgpu/gfx_v7_0.c:3788
 none inconclusive not_testable untriaged — —
DF-1203 High 6.7 Heap buffer overflow via unbounded ucStateEntrySize in power table parsing
sys/dev/drm/radeon/ni_dpm.c:3927
 none not_reproduced not_testable untriaged — —
DF-1407 High 6.7 Unbounded i2c_bus[i] write via BIOS-controlled num_indices in amdgpu_atombios_i2c_init
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:140
 panic reproduced fixed untriaged — —
DF-1503 High 6.7 SETFKEY signed-flen heap/static overflow via imin(-1, MAXFK) wrapped into u_char .len
sys/dev/misc/kbd/kbd.c:1090
 leak:heap reproduced not_testable untriaged — —
DF-1529 High 6.7 hpt_create_array_v2 dereferences unvalidated Members[1..nDisk-1] as kernel pointers (arbitrary kernel memory write)
sys/dev/raid/hptmv/gui_lib.c:571
 leak:heap reproduced not_testable untriaged — —
DF-1539 High 6.7 Heap buffer overflow in NGM_TEXT_STATUS handler via unbounded ksprintf into 1024-byte response
sys/dev/netif/mn/if_mn.c:352
 leak:heap reproduced not_testable untriaged — —
DF-1560 High 6.7 Heap buffer overflow in pp_dpm_set_pp_table via sysfs pp_table write
sys/dev/drm/amd/powerplay/amd_powerplay.c:676
 panic reproduced not_testable untriaged — —
DF-1563 High 6.7 Heap overflow via unbounded CAM scatter-gather count in hpt_scsi_io
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:715
 leak:heap reproduced not_testable untriaged — —
DF-1578 High 6.7 Heap OOB write in INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN via missing dxfer_len check
sys/dev/raid/hptrr/hptrr_osm_bsd.c:582
 none not_reproduced not_testable untriaged — —
DF-1732 High 6.7 vinumio: heap buffer overflow - unbounded config-line copy in vinum_scandisk reads attacker-controlled disk data into 2KB buffer
sys/dev/raid/vinum/vinumio.c:763
 panic reproduced fixed untriaged — —
DF-1851 High 6.7 32-bit integer overflow in hptmv HPT_IOCTL_PARAM size check enables kernel heap overflow
sys/dev/raid/hptmv/hptproc.c:292
 panic reproduced fixed untriaged — —
DF-1894 High 6.7 Integer overflow in dmc_header->fw_size*4 causes unbounded heap OOB read in intel_csr_load_program
sys/dev/drm/i915/intel_csr.c:404
 panic reproduced fixed untriaged — —
DF-1946 High 6.7 amdgpu_ucode_validate only checks datasize==size_bytes: no minimum size, no header cross-validation (root of DF-1838 family)
sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251
 leak:24+ reproduced fixed untriaged — —
DF-1947 High 6.7 Integer underflow + missing bounds in amdgpu_ucode_init_single_fw/patch_jt memcpy: heap OOB write
sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:347
 panic reproduced fixed untriaged — —
DF-0056 Medium 6.7 Heap overflow via unchecked p_filesz > p_memsz in PT_LOAD segment loading
sys/kern/link_elf.c:507
 panic reproduced fixed untriaged — —
DF-0402 Medium 6.7 Direct kernel dereference of user-controlled pointer in netmap_bdg_learning before copyin: panic or kernel info-leak
sys/net/netmap/netmap_vale.c:994
 none not_reproduced not_testable untriaged — —
DF-0573 Medium 6.7 Unvalidated ioc->id used as nats[] index: OOB read/write of pointer array
sys/net/ipfw3_nat/ip_fw3_nat.c:745
 panic reproduced fixed untriaged — —
DF-1112 Medium 6.7 Stack buffer overflow: 32-byte buf[] used for GSBUS BLOCK/BYTES transfers carrying up to 255 bytes
sys/bus/smbus/smbacpi/smbacpi.c:137
 none not_reproduced not_testable untriaged — —
DF-1128 Medium 6.7 Zero-level power state: OOB read performance_levels[-1] and integer underflow memset overflow in SMC state upload
sys/dev/drm/amd/amdgpu/si_dpm.c:5662
 leak:4 reproduced fixed untriaged — —
DF-1176 Medium 6.7 Unvalidated RLC firmware header fields cause integer overflow in kmalloc and OOB heap read/write
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:691
 panic reproduced not_testable untriaged — —
DF-1178 Medium 6.7 gfx_v9_1_parse_ind_reg_list: stack buffer overflow on indirect_start_offsets[10] and unbounded OOB read
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:2084
 none not_reproduced not_testable untriaged — —
DF-1185 Medium 6.7 arcmsr_iop_message_xfer writes up to 1031 bytes past CAM buffer sized by dxfer_len
sys/dev/raid/arcmsr/arcmsr.c:2604
 none not_reproduced fixed untriaged — —
DF-1221 Medium 6.7 RX completion req_id used as array index without bounds check (OOB read/write/panic)
sys/dev/virtual/amazon/ena/ena.c:1450
 none inconclusive not_testable untriaged — —
DF-1820 Medium 6.7 amr_pci: UAF - amr_pci_intr runs concurrently with DMA/command teardown in amr_pci_free; interrupt torn down LAST
sys/dev/raid/amr/amr_pci.c:477
 none inconclusive — untriaged — —
DF-1854 Medium 6.7 Heap overflow in psp_asd_load via unvalidated asd_ucode_size from PSP ASD firmware header
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:254
 none inconclusive — untriaged — —
DF-1933 Medium 6.7 Heap OOB write in dm_target_stripe_table via unchecked ksnprintf return value
sys/dev/disk/dm/striped/dm_target_striped.c:208
 none inconclusive — untriaged — —
DF-1955 Medium 6.7 Unvalidated firmware header fields enable heap overflow in ASD firmware copy (variant of DF-1838/1854/1875)
sys/dev/drm/amd/amdgpu/psp_v10_0.c:142
 none inconclusive — untriaged — —
DF-2015 Medium 6.7 vce_v1_0_load_fw trusts unvalidated firmware-blob fields (num/len/datasize) causing kernel heap OOB write and OOB read
sys/dev/drm/radeon/vce_v1_0.c:158
 none reproduced not_testable untriaged — —
DF-2104 Medium 6.7 radeon ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> kernel heap OOB read and arbitrary SMC SRAM write (radeon twin of DF-2096)
sys/dev/drm/radeon/ci_smc.c:186
 none reproduced fixed untriaged — —
DF-2119 Medium 6.7 Double dma_fence_put on normal benchmark completion (heap double-free / UAF)
sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:36
 corruption reproduced fixed untriaged — —
DF-2156 Medium 6.7 _alloc_safe_mem size math is broken: heap underflow on small req_sz and integer overflow on huge req_sz
sys/dev/misc/tbridge/safe_mem.c:80
 corruption reproduced fixed untriaged — —
DF-0480 Low 6.7 TCP-MD5 signature option construction overflows 40-byte opt[] stack buffer (disabled by default)
sys/netinet/tcp_output.c:779
 dos reproduced fixed untriaged — —
DF-1007 Low 6.7 fwohci_rx_enable ignores fwohci_add_rx_buf allocation failure -> db[-1] OOB write
sys/bus/firewire/fwohci.c:1406
 none reproduced fixed untriaged — —
DF-1482 Low 6.7 vr_encap copies m_pkthdr.len bytes into fixed MCLBYTES TX buffer without bounds check: heap overflow when MTU raised
sys/dev/netif/vr/if_vr.c:1288
 panic reproduced fixed untriaged — —
DF-1823 Low 6.7 aac_cam: unbounded sense-data bcopy heap overflow in aac_cam_complete (min(sense_len,sense_returned) not bounded to sizeof(sense_data)=32)
sys/dev/raid/aac/aac_cam.c:608
 none reproduced not_testable untriaged — —
DF-1825 Low 6.7 evdev_mt: unbounded match_slot in SYN_MT_REPORT path causes OOB heap read/write and KKASSERT panic
sys/dev/misc/evdev/evdev_mt.c:416
 none reproduced not_testable untriaged — —
DF-2084 Low 6.7 mpu401_un_init frees mpu401 struct without stopping/draining the live callout (use-after-free via mpu401_timeout)
sys/dev/sound/midi/mpu401.c:103
 dos reproduced fixed untriaged — —
DF-0797 High 6.6 Unvalidated vol_no from crafted volume header causes kernel heap OOB write in volume_map bitmap
sys/vfs/hammer/hammer_ondisk.c:210
 panic reproduced fixed untriaged — —
DF-1320 High 6.6 Unbounded MST stream_count overflows stack work_table[MAX_CONTROLLER_NUM=6] in update_mst_stream_alloc_table
sys/dev/drm/amd/display/dc/core/dc_link.c:2322
 none inconclusive not_testable untriaged — —
DF-1400 High 6.6 Stack buffer overflow in wi_write_wep LUCENT WEP-key load (wk_keylen up to 16 copied into wi_keydat[14])
sys/dev/netif/wi/if_wi.c:1751
 panic reproduced not_testable untriaged — —
DF-1781 High 6.6 drm_crtc: uninitialized heap read in drm_mode_setcrtc cleanup derefs garbage connector pointers
sys/dev/drm/drm_crtc.c:713
 panic reproduced fixed untriaged — —
DF-1243 Medium 6.6 mrsas_get_pd_list indexes local_pd_list with unchecked firmware deviceId (OOB write)
sys/dev/raid/mrsas/mrsas.c:3307
 none not_reproduced not_testable untriaged — —
DF-1244 Medium 6.6 mrsas_get_ld_list indexes ld_ids with unchecked firmware targetId (OOB byte write)
sys/dev/raid/mrsas/mrsas.c:3380
 none inconclusive not_testable untriaged — —
DF-1561 Medium 6.6 Stack OOB write in pp_dpm_get_pp_num_states when hwmgr->num_ps > 16
sys/dev/drm/amd/powerplay/amd_powerplay.c:619
 none inconclusive — untriaged — —
DF-1625 Medium 6.6 Integer overflow in VCE create-command img_size bypasses BO size validation
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:823
 panic reproduced fixed untriaged — —
DF-2507 Medium 6.6 afd_reinit frees softc without destroying disk orphaning device with freed memory (UAF / NULL-deref panic)
sys/dev/disk/nata/atapi-fd.c:176
 none not_reproduced not_testable untriaged — —
DF-0489 High 6.5 Neighbor Advertisement handler leaks route refcount on every received NA: remote kernel memory exhaustion DoS
sys/netinet6/nd6_nbr.c:734
 none not_reproduced not_testable untriaged — —
DF-0508 High 6.5 L2CAP ConfigReq unknown-option echo inflates m_pkthdr.len past mbuf data -> remote kernel heap info leak
sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c:599
 leak:252 reproduced not_testable untriaged — —
DF-0594 High 6.5 TKIP RX length underflow on too-short frames -> OOB read and KASSERT panic in wep_decrypt/michael_mic/m_copydata
sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:266
 panic reproduced fixed untriaged — —
DF-0596 Medium 6.5 Unsynchronized SMP race on xmitWin causes heap OOB write on timeSent[] in ng_pptpgre
sys/netgraph/pptpgre/ng_pptpgre.c:121
 dos reproduced fixed untriaged — —
DF-1646 Medium 6.5 bre() plex_concat builds rqe with negative sdoffset for subdisk-gap plexes, corrupting/arbitrary-leaking drive data outside the subdisk
sys/dev/raid/vinum/vinumrequest.c:494
 panic reproduced fixed untriaged — —
DF-2541 Medium 6.5 Network input paths X_ipip_input and pim_input dereference viftable/last_encap_vif without mroute_token racing vif teardown to NULL deref or 5.5MB OOB read
sys/net/ip_mroute/ip_mroute.c:1716
 panic reproduced fix_failed untriaged — —
DF-0524 High 6.4 Stored raw pointer to member ifnet with no refcount: UAF when member interface destroyed
sys/netgraph/fec/ng_fec.c:408
 panic reproduced fix_failed untriaged — —
DF-0525 High 6.4 ng_fec_tick iterates port list with no list lock: UAF race vs addport/delport
sys/netgraph/fec/ng_fec.c:579
 none not_reproduced not_testable untriaged — —
DF-0662 High 6.4 Use-after-free of readq: ng_device_disconnect frees readq BEFORE destroy_dev drains in-flight operations
sys/netgraph/ng_device.c:407
 none not_reproduced not_testable untriaged — —
DF-0732 High 6.4 TOCTOU in MACCMD_LIST: as_nacls read without lock before buffer sizing — heap OOB write (grow) and uninit heap info leak (shrink)
sys/netproto/802_11/wlan_acl/ieee80211_acl.c:313
 panic reproduced fixed untriaged — —
DF-1018 High 6.4 TRIM req->data heap buffer overflow and OOB DMA read via device-controlled small secsize
sys/bus/cam/scsi/scsi_da.c:1341
 none inconclusive not_testable untriaged — —
DF-1109 High 6.4 TOCTOU double-fetch of d->nmsgs in I2CRDWR ioctl causes kernel heap buffer overflow
sys/bus/iicbus/iic.c:291
 none not_reproduced not_testable untriaged — —
DF-1346 High 6.4 Heap buffer overflow populating VCE/UVD SMC levels from unclamped VBIOS MM-dependency count
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1298
 none inconclusive not_testable untriaged — —
DF-1496 High 6.4 Unbounded VBIOS ucSclkEntryNum overflows fixed 8-entry stack table in atomctrl_get_smc_sclk_range_table
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1368
 panic reproduced fixed untriaged — —
DF-1783 High 6.4 radeon_bios: heap buffer overflow in radeon_atrm_call - unbounded memcpy of ACPI-returned buffer into 256K BIOS buffer
sys/dev/drm/radeon/radeon_bios.c:183
 panic reproduced fixed untriaged — —
DF-0246 Medium 6.4 UAF: eventhandler dispatch traverses entry list without token while deregister frees entries
sys/kern/subr_eventhandler.c:114
 panic not_reproduced not_testable untriaged — —
DF-0296 Medium 6.4 UAF/cross-node races: peer hooks/nodes dereferenced without reference or peer-token
sys/netgraph7/netgraph/ng_base.c:1092
 dos inconclusive not_testable untriaged — —
DF-0306 Medium 6.4 UAF in add_bw_upcall: mfc pointer used after mroute_token released across blocking kmalloc
sys/net/ip_mroute/ip_mroute.c:2285
 none inconclusive not_testable untriaged — —
DF-0355 Medium 6.4 nd6_sysctl_drlist/prlist iterate defrouter/prefix lists without nd6_mtx: UAF race with RA processing
sys/netinet6/nd6.c:2168
 none inconclusive not_testable untriaged — —
DF-0503 Medium 6.4 ifnet locking-contract violation and stored-pointer UAF on member ifnets
sys/netgraph7/ng_fec.c:370
 none not_reproduced not_testable untriaged — —
DF-0529 Medium 6.4 Double-kfree/interior-pointer kfree in ng_fec_constructor error paths: heap corruption
sys/netgraph/fec/ng_fec.c:1085
 panic reproduced fix_failed untriaged — —
DF-0605 Medium 6.4 Use-after-free in pfi_get_ifaces() RB tree walk under concurrent interface detach
sys/net/pf/pf_if.c:763
 panic reproduced fixed untriaged — —
DF-0609 Medium 6.4 Missing return after m_freem in netisr_characterize causes UAF read and NULL-deref panic
sys/net/netisr.c:515
 panic reproduced fixed untriaged — —
DF-0664 Medium 6.4 Missing locking enables TOCTOU/UAF races across all device entry points
sys/netgraph/ng_device.c:309
 none not_reproduced not_testable untriaged — —
DF-0712 Medium 6.4 Undersized kmalloc in ieee80211_alloc_countryie: 3-byte heap overflow when channel list has >=84 distinct power runs
sys/netproto/802_11/wlan/ieee80211_regdomain.c:248
 none_observable_intra_object_padding reproduced fixed untriaged — —
DF-0735 Medium 6.4 ip_input/ip_output called from netgraph thread context: ASSERT_NETISR_NCPUS panic (INVARIANTS) and PFIL list UAF (production)
sys/netgraph7/ng_ipfw.c:245
 panic reproduced fixed untriaged — —
DF-0949 Medium 6.4 sys_mlockall use-after-free: stale vm_map_entry pointer held across vm_fault_wire which releases the map lock
sys/vm/vm_mmap.c:1066
 panic reproduced fixed untriaged — —
DF-1045 Medium 6.4 UAF in targclose: softc kfree'd before periph's targdtor runs
sys/bus/cam/scsi/scsi_target.c:207
 none not_reproduced not_testable untriaged — —
DF-1294 Medium 6.4 Unvalidated hypervisor sq_idx causes stack buffer overflow in ena_com_ind_tbl_convert_from_device
sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1156
 none not_reproduced not_testable untriaged — —
DF-1404 Medium 6.4 cuse_server_open re-initializes global cuse_global_mtx on every /dev/cuse open corrupting lock state
sys/dev/misc/cuse/cuse.c:791
 none inconclusive — untriaged — —
DF-1502 Medium 6.4 Lockless driver: interrupt handler races musycc_disconnect freeing tx/rx descriptor rings (UAF)
sys/dev/misc/musycc/musycc.c:1341
 none inconclusive — untriaged — —
DF-1609 Medium 6.4 Heap OOB write in PowerPlay table entry callback via unbounded levels[index]
sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:736
 panic reproduced fixed untriaged — —
DF-1667 Medium 6.4 ath EDMA: m_rxpending use-after-free / double-free in ath_edma_stoprecv vs deferred tasklet
sys/dev/netif/ath/ath/if_ath_rx_edma.c:188
 panic reproduced fixed untriaged — —
DF-1685 Medium 6.4 agp: UAF / TOCTOU race between agp_find_memory and AGP_{BIND,UNBIND,FREE}_MEMORY
sys/dev/agp/agp.c:488
 panic reproduced fixed untriaged — —
DF-1768 Medium 6.4 ar9285_reset: unbounded EEPROM pwrPdg delta causes OOB write/read in GetGainBoundariesAndPdadcs
sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:650
 none inconclusive — untriaged — —
DF-1961 Medium 6.4 Heap OOB write in k8pnow_decode_pst insertion sort from unchecked pst->n_states>16
sys/dev/powermng/powernow/powernow.c:99
 none inconclusive — untriaged — —
DF-2157 Medium 6.4 Global safe_mem list has no concurrency protection: concurrent alloc/free corrupts linkage (UAF / double-unlink)
sys/dev/misc/tbridge/safe_mem.c:55
 corruption reproduced fixed untriaged — —
DF-2159 Medium 6.4 Unlocked traversal of irq_list in disable_irq/enable_irq and free_irq lookup yields UAF, double-free and SLIST_REMOVE NULL-deref panic
sys/dev/drm/linux_irq.c:116
 corruption reproduced fixed untriaged — —
DF-2233 Medium 6.4 Lockless list traversal in iconv_open/iconv_lookupcs/iconv_lookupconv allows use-after-free via concurrent module unload
sys/libiconv/iconv.c:146
 — — — untriaged — —
DF-2380 Medium 6.4 Missing AcpiRemoveNotifyHandler in acpi_dock_detach causes UAF / NULL-deref panic on ACPI notify after detach
sys/dev/acpica/acpi_dock/acpi_dock.c:518
 — — — untriaged — —
DF-2383 Medium 6.4 Use-after-free of softc in acpi_hp_notify vs. acpi_hp_detach (DF-2381 AcpiOsWaitEventsComplete no-op)
sys/dev/acpica/acpi_hp/acpi_hp.c:591
 — — — untriaged — —
DF-2397 Medium 6.4 Unsynchronized AGP memory list operations enable UAF and TAILQ corruption via concurrent ioctls
sys/dev/agp/agp.c:455
 none not_reproduced not_testable untriaged — —
DF-2499 Medium 6.4 TAILQ_FOREACH iterates pending_hcbs while freeing each element use-after-free read
sys/dev/disk/nata/atapi-cam.c:885
 none not_reproduced not_testable untriaged — —
DF-2500 Medium 6.4 In-flight ATA requests outlive atapi_cam_detach atapi_cb dereferences freed hcb and destroyed state_lock
sys/dev/disk/nata/atapi-cam.c:619
 none not_reproduced not_testable untriaged — —
DF-2536 Medium 6.4 Sense-data bcopy length not capped to 32-byte sense buffer kernel heap overflow into CCB and info leak of request-frame memory
sys/dev/disk/mpt/mpt_cam.c:3141
 none not_reproduced not_testable untriaged — —
DF-0679 Low 6.4 Use-after-free: dangling match/nomatch hook pointers when ng_bpf_setprog fails in newhook
sys/netgraph7/bpf/ng_bpf.c:280
 none reproduced fixed untriaged — —
DF-0694 Low 6.4 wep_setkey missing upper-bound key length validation allows stack overflow in RC4 key buffer
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:122
 panic reproduced fixed untriaged — —
DF-1068 Low 6.4 pci_token does not serialize ioctl against kernel-side pci_devq mutation -> UAF/double-free window
sys/bus/pci/pci_user.c:59
 none reproduced fixed untriaged — —
DF-1394 Low 6.4 Heap OOB write in seq_open when more than 32 MIDI devices registered
sys/dev/sound/midi/sequencer.c:541
 none reproduced not_testable untriaged — —
DF-1501 Low 6.4 Heap OOB write in musycc_attach when PCI device reports nchan > NPORT
sys/dev/misc/musycc/musycc.c:1494
 panic reproduced fixed untriaged — —
DF-1649 Low 6.4 acpi_ec: EcSpaceHandler missing Width<=64 bound -> OOB past UINT64 Value buffer
sys/dev/acpica/acpi_ec.c:818
 panic reproduced fixed untriaged — —
DF-1670 Low 6.4 if_vke: select()/FD_SET stack buffer overflow when sc_fd >= FD_SETSIZE
sys/dev/virtual/vkernel/net/if_vke.c:631
 panic reproduced fixed untriaged — —
DF-1779 Low 6.4 radeon_dp_mst: latent unbounded idx into new_attribs[6]/cur_stream_attribs[6] + ignored VCPI alloc failure
sys/dev/drm/radeon/radeon_dp_mst.c:114
 panic reproduced fixed untriaged — —
DF-2113 Low 6.4 Use-after-free: unimplemented led_detach leaves dangling gpio pointer in surviving LED cdevs
sys/dev/misc/gpio/gpio_led.c:206
 none reproduced fixed untriaged — —
DF-2115 Low 6.4 Double dma_fence_put (UAF / double-free) on self-test copy-mismatch or kmap-failure paths
sys/dev/drm/amd/amdgpu/amdgpu_test.c:140
 none reproduced fixed untriaged — —
DF-2599 Low 6.4 output_ifp stored without ifnet lifetime protection UAF on interface detach
sys/netgraph7/ng_source.c:623
 — — — untriaged — —
DF-0593 Info 6.4 Latent UAF: fairq_class_destroy does not clear dangling pif_default pointer (currently unreachable via pf ioctls)
sys/net/altq/altq_fairq.c:428
 none not_reproduced not_testable untriaged — —
DF-1491 Info 6.4 Missing MIN() bound in mpr_config_get_raid_volume_pg0 allows firmware-controlled heap-buffer overrun into caller struct
sys/dev/raid/mpr/mpr_config.c:1295
 none reproduced not_testable untriaged — —
DF-0764 Medium 6.3 Stale worklist_tail in add_to_worklist — process_worklist_item LK_NOWAIT can free the tail causing UAF write + orphaned items + unmount panic
sys/vfs/ufs/ffs_softdep.c:462
 dos reproduced fixed untriaged — —
DF-0974 Medium 6.3 xpt_action_sasync_cb use-after-free race on async_node during concurrent register/unregister
sys/bus/cam/cam_xpt.c:3353
 none not_reproduced not_testable untriaged — —
DF-1194 Medium 6.3 ciss_init_logical and ciss_free use <= instead of < on ciss_logical array (off-by-one OOB write/kfree)
sys/dev/raid/ciss/ciss.c:1376
 none not_reproduced not_testable untriaged — —
DF-1285 Medium 6.3 INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN write fixed-size replies past dxfer_len-sized kernel buffer
sys/dev/raid/hptmv/entry.c:2709
 none inconclusive not_testable untriaged — —
DF-1398 Medium 6.3 Off-by-one OOB array access in all four remove_*_entry functions (index==allocated passes > check)
sys/dev/raid/vinum/vinumconfig.c:1728
 none inconclusive — untriaged — —
DF-1475 Medium 6.3 Off-by-one in PhyNum target-ID fallback allows heap OOB write past sassc->targets[]
sys/dev/raid/mpr/mpr_sas_lsi.c:885
 none inconclusive — untriaged — —
DF-1814 Medium 6.3 tw_cl_init: tw_cli_init_connection double-inserts req into FREE_Q on any submit_and_poll failure -> queue list corruption
sys/dev/raid/twa/tw_cl_init.c:677
 none inconclusive — untriaged — —
DF-2214 Medium 6.3 32-bit integer overflow in DMA copy size (num_gpu_pages << 12) silently truncates copy
sys/dev/drm/radeon/rv770_dma.c:44
 — — — untriaged — —
DF-1255 Low 6.3 vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:466
 none reproduced fixed untriaged — —
DF-1384 Low 6.3 TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers
sys/dev/netif/nge/if_nge.c:1148
 none reproduced not_testable untriaged — —
DF-1637 Low 6.3 Double-free of crypto_session on cryptoapi_cipher_setkey failure
sys/dev/disk/dm/crypt/dm_target_crypt.c:559
 panic reproduced fixed untriaged — —
DF-2153 Low 6.3 Unchecked integer overflow in dma_fence_array_create size computation yields heap OOB write (latent, EXPORT_SYMBOL)
sys/dev/drm/linux_fence-array.c:173
 corruption reproduced fixed untriaged — —
DF-1413 High 6.1 Unchecked VBIOS conn_num drives OOB write past connectors[16] in update_slot_layout_info
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1732
 panic reproduced fixed untriaged — —
DF-1473 High 6.1 u16 truncation in EventDataLength*4 size computation causes zero-size alloc panic and undersized-buffer OOB read
sys/dev/raid/mpr/mpr_sas_lsi.c:136
 panic reproduced not_testable untriaged — —
DF-1642 High 6.1 kfree of uninitialized msg pointer in dm_message_ioctl when DM_MESSAGE_STR absent
sys/dev/disk/dm/dm_ioctl.c:1006
 panic reproduced fixed untriaged — —
DF-1696 High 6.1 mps_sas_lsi: u16 truncation of EventDataLength*4 panics on kmalloc(0) and yields OOB heap read
sys/dev/raid/mps/mps_sas_lsi.c:128
 panic reproduced not_testable untriaged — —
DF-2024 High 6.1 size_t underflow in multi-part SSIF write loop causes unbounded kernel heap OOB read and DoS
sys/dev/misc/ipmi/ipmi_ssif.c:126
 none inconclusive not_testable untriaged — —
DF-2227 High 6.1 Unbounded while(*cp!="\"") scan in XML attribute-value parser causes heap OOB read / kernel panic
sys/libprop/prop_object.c:484
 panic reproduced fixed untriaged — —
DF-0862 Medium 6.1 hpfs_bminit integer overflow in hpm_dbnum computation undersizes bitmap arrays OOB read/write
sys/vfs/hpfs/hpfs_subr.c:109
 panic reproduced fixed untriaged — —
DF-1012 Medium 6.1 Heap underflow write when VS_COLORFORMAT or VS_FRAME precedes any VS_FORMAT descriptor
sys/bus/u4b/uvc/uvc_drv.c:1836
 none not_reproduced not_testable untriaged — —
DF-1223 Medium 6.1 XPT_RESET_DEV frees a regular-pool command via the high-priority free list, corrupting command-pool accounting
sys/dev/raid/mpr/mpr_sas.c:3351
 none inconclusive not_testable untriaged — —
DF-1547 Medium 6.1 Missing cdb_len bounds check overflows the LRAM queue slot (sibling of DF-1356)
sys/dev/disk/advansys/advansys.c:548
 none inconclusive — untriaged — —
DF-2594 Medium 6.1 Unvalidated redo_data_bytes and REDO record size in recovery cause OOB kernel-memory read on mount of crafted image
sys/vfs/hammer/hammer_recover.c:1225
 panic reproduced fixed untriaged — —
DF-2595 Medium 6.1 Missing zero-length packet guard causes type confusion in bpf_filter OOB read panic
sys/netgraph/bpf/ng_bpf.c:403
 none reproduced fixed untriaged — —
DF-0471 High 6.0 ip_fw3_ctl_x: size_t underflow in sopt_valsize when <4 causes unbounded bcopy heap corruption/panic
sys/net/ipfw3/ip_fw3.c:1038
 panic reproduced fixed untriaged — —
DF-0661 High 6.0 Kernel stack overflow via unchecked user-controlled VLA in ngdread/ngdwrite
sys/netgraph/ng_device.c:509
 panic reproduced fixed untriaged — —
DF-1397 High 6.0 Heap overflow in plex/subdisk auto-naming via strcat past filled 64-byte name field
sys/dev/raid/vinum/vinumconfig.c:1455
 panic reproduced fixed untriaged — —
DF-0476 Medium 6.0 ip_fw3_register_module: strncpy bounded by strlen(src) not sizeof(dst): buffer overflow + missing NUL
sys/net/ipfw3/ip_fw3.c:180
 leak:22bytes reproduced fixed untriaged — —
DF-1177 Medium 6.0 rv_init_cp_jump_table: unbounded jt_size OOB write + NULL deref on missing mec2 firmware
sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1078
 panic reproduced not_testable untriaged — —
DF-1733 Medium 6.0 vinumio: heap overflow on drivelist[] - DRIVEPARTS(35) smaller than loop bound (240) in vinum_scandisk
sys/dev/raid/vinum/vinumio.c:678
 none inconclusive — untriaged — —
DF-1750 Medium 6.0 amdgpu_acpi: heap OOB read and ACPI_OBJECT type confusion in 4 ATIF/ATCS return buffer parsers
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:199
 none inconclusive — untriaged — —
DF-1769 Medium 6.0 ar9285_reset: chain loop uses AR5416_MAX_CHAINS=3 on 4k EEPROM struct with calPierData2G[1][3] -> OOB type-confusion via txMask
sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:607
 none inconclusive — untriaged — —
DF-1858 Medium 6.0 Negative framebuffer offset in bmp_SetPix via RLE delta-move: OOB write below va_window
sys/dev/video/fb/bmp/splash_bmp.c:258
 none inconclusive — untriaged — —
DF-1875 Medium 6.0 Unvalidated PSP firmware header fields cause heap OOB write in fw_pri_buf (sysdrv + sos load) — variant of DF-1838 for Vega20/Navi10
sys/dev/drm/amd/amdgpu/psp_v11_0.c:122
 none inconclusive — untriaged — —
DF-1964 Medium 6.0 Orphaned worker thread / use-after-free when write-side _init fails in dm_target_delay_init
sys/dev/disk/dm/delay/dm_target_delay.c:104
 none inconclusive — untriaged — —
DF-2039 Medium 6.0 Use-after-free: discard_buffer_callout not drained before freeing sc->buf and destroying dev_lock in tpm20_release
sys/dev/crypto/tpm/tpm20.c:137
 panic reproduced fixed untriaged — —
DF-2065 Medium 6.0 si_load_smc_ucode ignores limit and trusts firmware header offset/size fields without bounds checking -- heap OOB read and unbounded SMC SRAM write
sys/dev/drm/radeon/si_smc.c:211
 panic reproduced not_testable untriaged — —
DF-2078 Medium 6.0 goto restart_search reads OOB past power-state array returning OOB pointer used to program SMC
sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:214
 dos reproduced fixed untriaged — —
DF-2105 Medium 6.0 Integer overflow in u32 bounds checks in ci_set_smc_sram_address and ci_copy_bytes_to_smc (wraparound defeats SMC SRAM upper bound)
sys/dev/drm/radeon/ci_smc.c:36
 none reproduced fixed untriaged — —
DF-2141 Medium 6.0 tokenize() writes token pointers with no bounds check -> static-BSS OOB write via VINUM_CREATE ioctl
sys/dev/raid/vinum/vinumparser.c:162
 corruption reproduced fixed untriaged — —
DF-2207 Medium 6.0 Signed 32-bit overflow in iounmap() byte-size math (npages * PAGE_SIZE) yields OOB pmap_unmapdev / wrong phys_avail match for >=2 GB mappings
sys/dev/drm/linux_iomapping.c:80
 panic reproduced fixed untriaged — —
DF-2262 Medium 6.0 XPT_DEV_MATCH trusts user-supplied EDT cookie kernel pointers: arbitrary kernel-address deref UAF KASLR leak
sys/bus/cam/cam_xpt.c:2446
 panic reproduced fixed untriaged — —
DF-0042 Low 6.0 Relocation r_offset never bounds-checked against target section size (OOB / wild kernel write)
sys/kern/link_elf_obj.c:940
 none reproduced fixed untriaged — —
DF-0061 Low 6.0 Relocation r_offset never bounds-checked against module size (DF-0042 analogue, wild write)
sys/kern/link_elf.c:714
 none reproduced fixed untriaged — —
DF-0072 Low 6.0 Missing sign/upper-bound validation on cfh_nfiles before heap alloc + file read (DoS; 32-bit integer-overflow heap OOB)
sys/kern/kern_checkpoint.c:596
 none reproduced fixed untriaged — —
DF-0975 Low 6.0 XPT_DEV_MATCH cookie fields are user-controlled kernel pointers blindly dereferenced (arbitrary kread / panic)
sys/bus/cam/cam_xpt.c:2444
 none reproduced fixed untriaged — —
DF-1313 Low 6.0 Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field
sys/dev/raid/hptiop/hptiop.c:1085
 none reproduced not_testable untriaged — —
DF-1317 Low 6.0 Heap buffer overflow in sbp_fix_inq_data via short INQUIRY data buffer
sys/dev/disk/sbp/sbp.c:1504
 none reproduced fixed untriaged — —
DF-1533 Low 6.0 Unbounded cmd_7k->generic.size used as SG-list write offset in 9K_SA passthru
sys/dev/raid/twa/tw_cl_io.c:295
 panic reproduced fixed untriaged — —
DF-1684 Low 6.0 scvidctl: integer overflow in sc_set_pixel_mode bounds check allows OOB video-memory write via KDRASTER
sys/dev/misc/syscons/scvidctl.c:318
 panic reproduced fixed untriaged — —
DF-2047 Low 6.0 tbridge_printf size_t underflow yields OOB kernel write once 128kB buffer fills
sys/dev/misc/tbridge/tbridge.c:139
 panic reproduced fixed untriaged — —
DF-0423 Medium 5.9 Stale reg_mif_num after MRT6_DEL_MIF: remote NULL-deref panic via PIM REGISTER to freed register mif
sys/netinet6/ip6_mroute.c:642
 panic inconclusive not_testable untriaged — —
DF-0741 Medium 5.9 gre_mobile_input bcopy size underflow (m_len-msiz-ip_hl*4) — huge overwrite when mobile header larger than mbuf
sys/netinet/ip_gre.c:223
 panic reproduced fixed untriaged — —
DF-1155 Medium 5.9 Heap overflow in isp_handle_platform_atio CDB copy (parallel SCSI target mode)
sys/dev/disk/isp/isp_freebsd.c:1926
 none not_reproduced not_testable untriaged — —
DF-0356 Low 5.9 nd6_resolve ln_hold mbuf accessed without nd6_mtx: UAF race with nd6_timer
sys/netinet6/nd6.c:2078
 dos reproduced fixed untriaged — —
DF-0486 Low 5.9 syncache_insert dereferences possibly-uninitialized sc2 in cache-overflow path when cachelimit=0
sys/netinet/tcp_syncache.c:359
 dos reproduced fixed untriaged — —
DF-0657 Low 5.9 ccmp_decrypt block-straddle path bounds-checked only by KASSERT (OOB read+write on oddly fragmented RX mbuf chains)
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:619
 panic reproduced fixed untriaged — —
DF-0044 Medium 5.8 mount_get_by_nc returns struct mount without a hold -> use-after-free via cache_fullpath racing dounmount
sys/kern/vfs_mount.c:1235
 none on this non-INVARIANTS kernel (race too tight); theoretical local DoS / info-leak if the race is won (unprivileged if vfs.usermount=1, else races a privileged unmount) not_reproduced — untriaged — —
DF-0137 Medium 5.8 Unlocked TAILQ traversal in varsymset_init() during fork: data race/UAF
sys/kern/kern_varsym.c:519
 panic reproduced fixed untriaged — —
DF-0565 Medium 5.8 Callout lifetime: ng_uncallout non-synchronizing + nglmi_shutdown omits ng_uncallout — ng7 twin of DF-0557
sys/netgraph7/lmi/ng_lmi.c:1053
 panic not_reproduced not_testable untriaged — —
DF-0725 Medium 5.8 if_clone_destroy UAF: drops ifnet_lock before dereferencing ifp->if_dname/if_dunit — concurrent destroy frees ifnet
sys/net/if_clone.c:110
 panic reproduced fixed untriaged — —
DF-1383 Medium 5.8 Out-of-bounds write in tl_encap when TX mbuf chain has exactly TL_MAXFRAGS non-empty mbufs totaling <64 bytes
sys/dev/netif/tl/if_tl.c:1794
 none inconclusive — untriaged — —
DF-2087 Medium 5.8 acpi_mapbase tracking list is mutated without any lock; concurrent AcpiOsMapMemory/UnmapMemory race into UAF and list corruption
sys/dev/acpica/Osd/OsdMemory.c:59
 dos reproduced fixed untriaged — —
DF-2252 Medium 5.8 Off-by-one NUL write before caller buffer when inlen <= 0
sys/libkern/hexncpy.c:52
 — — — untriaged — —
DF-2417 Medium 5.8 ADW_TARGET_GROUP macro off-by-factor-4 causes heap OOB write/read on user_sdtr[4] for all wide-SCSI targets (tid >= 4)
sys/dev/disk/advansys/adwlib.c:754
 none not_reproduced not_testable untriaged — —
DF-0380 Low 5.8 Non-atomic refcount --node->refs/--hook->refs under crit_enter only: cross-CPU UAF/double-free race
sys/netgraph/netgraph/ng_base.c:473
 dos reproduced fixed untriaged — —
DF-0395 Low 5.8 sta_lookup returns entry with table lock released: callers dereference unlocked TOCTOU use-after-free window
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1283
 dos reproduced fixed untriaged — —
DF-1916 Low 5.8 QCB free-list and queue manipulation race on SMP: crit_enter does not block cross-CPU ida_intr
sys/dev/raid/ida/ida.c:118
 panic reproduced fixed untriaged — —
DF-0195 High 5.7 Unlocked devstat list: concurrent device detach vs sysctl walk yields UAF (world-readable sysctl)
sys/kern/subr_devstat.c:268
 leak reproduced fixed untriaged — —
DF-2572 High 5.7 Use-after-free / NULL-deref: connection list mutated and traversed with no synchronization
sys/netgraph/ng_device.c:309
 none not_reproduced not_testable untriaged — —
DF-0965 Medium 5.7 twofish_set_key performs no key-length validation, allowing OOB stack writes and ctx corruption if reached with unsupported keylen
sys/crypto/twofish/twofish.c:425
 none not_reproduced not_testable untriaged — —
DF-1072 Medium 5.7 pnp_create_devices ANSI tag trim loop reads/writes stack below buf[0] with no lower bound
sys/bus/isa/pnp.c:398
 none not_reproduced not_testable untriaged — —
DF-1090 Medium 5.7 pnp_parse_desc accesses fixed descriptor offsets without validating payload length, causing heap OOB read and OOB byte-write
sys/bus/isa/pnpparse.c:90
 none not_reproduced fixed untriaged — —
DF-1464 Medium 5.7 Unbounded scatter/gather list copy overflows per-CCB sg_list when CAM_SCATTER_VALID is set
sys/dev/raid/dpt/dpt_scsi.c:730
 none inconclusive — untriaged — —
DF-1709 Medium 5.7 iwm_scan: integer overflow in iwm_scan_size()/iwm_config_umac_scan via unbounded firmware n_scan_channels -> heap OOB write
sys/dev/netif/iwm/if_iwm_scan.c:486
 none inconclusive — untriaged — —
DF-1713 Medium 5.7 evdev: use-after-free race on ev_absinfo/ev_mt vs concurrent device detach in unlocked ioctls
sys/dev/misc/evdev/cdev.c:351
 none inconclusive — untriaged — —
DF-2000 Medium 5.7 UAF race in icioctl SIOCSIFMTU vs concurrent icoutput (TX) and icintr (RX)
sys/dev/netif/ic/if_ic.c:205
 none inconclusive not_testable untriaged — —
DF-2263 Medium 5.7 EOF drain loop in sastart re-processes freed bio (double biodone / kernel hang)
sys/bus/cam/scsi/scsi_sa.c:1603
 — — — untriaged — —
DF-2336 Medium 5.7 Unbounded MMIO read/write in xHCI extended-capability list traversal
sys/bus/u4b/controller/xhci_pci.c:398
 none not_reproduced not_testable untriaged — —
DF-0088 Low 5.7 No runtime validation in free_unrl against out-of-range/double-free (KASSERT-only, defense-in-depth)
sys/kern/subr_unit.c:556
 none reproduced fixed untriaged — —
DF-0280 Low 5.7 Integer overflow in ptr_array allocation in pf_setup_pfsync_matching (32-bit only theoretical)
sys/net/pf/pf_ioctl.c:942
 none reproduced fixed untriaged — —
DF-0578 Low 5.7 SLIOCSUNIT struct-assigns embedded callout nodes: callout queue corruption
sys/net/sl/if_sl.c:365
 panic reproduced fixed untriaged — —
DF-1187 Low 5.7 arcmsr_build_srb 4GB-boundary split can overflow ARCMSR_CDB.u scatter list
sys/dev/raid/arcmsr/arcmsr.c:974
 panic reproduced not_testable untriaged — —
DF-1466 Low 5.7 Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data)
sys/dev/raid/dpt/dpt_scsi.c:858
 none reproduced fixed untriaged — —
DF-1477 Low 5.7 agp_i810_bind_memory offset check bypassed via 64-bit integer wraparound -> OOB GTT writes
sys/dev/agp/intel-gtt.c:1259
 panic reproduced fixed untriaged — —
DF-2007 Low 5.7 amdgpu_sa_bo_manager_fini mutates lists without acquiring sa_manager->wq.lock -- UAF / list-corruption race with concurrent reader
sys/dev/drm/amd/amdgpu/amdgpu_sa.c:77
 none reproduced not_testable untriaged — —
DF-2049 Low 5.7 No synchronization: concurrent LOADTEST frees tbridge_testcase out from under running test kthread (UAF)
sys/dev/misc/tbridge/tbridge.c:240
 panic reproduced not_testable untriaged — —
DF-2117 Low 5.7 drm_scdc_read/drm_scdc_write accept size_t but assign to uint16_t i2c_msg.len with no bounds check; drm_scdc_write can overflow 1+size before kmalloc/memcpy
sys/dev/drm/drm_scdc_helper.c:66
 none reproduced fixed untriaged — —
DF-2376 Low 5.7 Fire-and-forget AcpiOsExecute battery tasks can run after detach using freed softc (UAF)
sys/dev/acpica/acpi_cmbat.c:154
 — — — untriaged — —
DF-1042 Medium 5.6 lapic_set_cpuid missing bounds validation allows OOB write to APIC ID mapping arrays via crafted MADT
sys/platform/pc64/apic/lapic.c:1212
 panic reproduced fixed untriaged — —
DF-1884 Medium 5.6 Missing bounds check on plexno in parityops allows OOB read/write on PLEX array
sys/dev/raid/vinum/vinumrevive.c:259
 none inconclusive — untriaged — —
DF-1506 Low 5.6 Missing emu_intr_unregister on detach and attach-failure leaves dangling IRQ consumer pointing at freed emu_pcm_info (UAF)
sys/dev/sound/pci/emu10kx-pcm.c:1453
 panic reproduced fixed untriaged — —
DF-0807 High 5.5 dirfs_readdir for-loop increment uses already-advanced dp — heap OOB read and memory disclosure
sys/vfs/dirfs/dirfs_vnops.c:1277
 leak reproduced not_testable untriaged — —
DF-0923 High 5.5 UAF of vm_map_backing and vm_map across per-iteration unlock in /proc/<pid>/map
sys/vfs/procfs/procfs_map.c:65
 panic reproduced fixed untriaged — —
DF-1329 High 5.5 Integer overflow in mpr_diag_read_buffer bounds check allows OOB read of diag DMA buffer
sys/dev/raid/mpr/mpr_user.c:1772
 none inconclusive not_testable untriaged — —
DF-2231 High 5.5 Unbounded attacker-controlled pref_len in _prop_object_copyin causes kernel panic / memory exhaustion (prop_object_copyin_limit dead variable)
sys/libprop/prop_kern.c:383
 dos reproduced fixed untriaged — —
DF-2281 High 5.5 sgwrite: size_t->int truncation of uio_resid into buf_len plus unchecked kmalloc/M_ZERO memset-on-NULL yields local kernel panic
sys/bus/cam/scsi/scsi_sg.c:648
 none not_reproduced not_testable untriaged — —
DF-0782 Medium 5.5 Integer overflow in fuse_vop_write at offset near INT64_MAX triggers KKASSERT panic via negative newsize
sys/vfs/fuse/fuse_vnops.c:1469
 panic reproduced fixed untriaged — —
DF-0919 Medium 5.5 Unvalidated fs->fs_frag causes kernel panic and OOB array access in FFS bitmap/fragacct helpers
sys/vfs/ufs/ffs_subr.c:195
 panic reproduced fixed untriaged — —
DF-0926 Medium 5.5 Type-confusion panic in fuse_alloc_node when daemon reuses nodeid with conflicting type
sys/vfs/fuse/fuse_node.c:106
 panic reproduced fixed untriaged — —
DF-1537 Medium 5.5 Unbounded WS operand index and NULL dereference when ws=0
sys/dev/drm/radeon/atom.c:233
 none inconclusive — untriaged — —
DF-1559 Medium 5.5 Signedness bug in copy_batch min_t causes kernel heap overflow with large batch_len
sys/dev/drm/i915/i915_cmd_parser.c:1104
 none inconclusive — untriaged — —
DF-1944 Medium 5.5 afd_reinit frees softc without destroying disk cdev: orphan /dev/afd* NULL-deref/UAF on next I/O
sys/dev/disk/nata/atapi-fd.c:168
 none inconclusive — untriaged — —
DF-1981 Medium 5.5 Missing feature-arg-count validation in _init_features allows kernel panic via crafted dmsetup table string
sys/dev/disk/dm/flakey/dm_target_flakey.c:131
 none inconclusive — untriaged — —
DF-2035 Medium 5.5 Divide-by-zero kernel panic in vega20_fan_ctrl_set_fan_speed_rpm via 8*speed uint32 wraparound
sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:186
 panic reproduced fixed untriaged — —
DF-2215 Medium 5.5 Unconditional memset on FREEBLKS bios writes to unmapped KVA causing kernel panic
sys/dev/disk/dm/dm_target_zero.c:43
 none not_reproduced not_testable untriaged — —
DF-2232 Medium 5.5 Signed integer overflow in idr_grow() growth loop causes kernel hang or panic-sized kmalloc
sys/libkern/linux_idr.c:427
 — — — untriaged — —
DF-2245 Medium 5.5 Unbounded recursion in kqsort causes kernel stack overflow on adversarial input
sys/libkern/qsort.c:173
 none not_reproduced not_testable untriaged — —
DF-2561 Medium 5.5 Accept-filter NULL-deref/UAF race in soisconnected vs do_setopt_accept_filter
sys/kern/uipc_socket2.c:252
 none not_reproduced not_testable untriaged — —
DF-1309 Low 5.5 Static buffer overflow in ath_ee_FillVpdTable via crafted EEPROM pdg power range >126
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2427
 none reproduced not_testable untriaged — —
DF-0612 Medium 5.4 ieee80211_parse_tdma() join path skips IE length and tdma_slot validation, enabling heap OOB write via setbit() from crafted beacon
sys/netproto/802_11/wlan/ieee80211_tdma.c:645
 oob_write reproduced fixed untriaged — —
DF-2578 Medium 5.4 OOB heap write via unchecked tdma_slot in ieee80211_parse_tdma
sys/netproto/802_11/wlan/ieee80211_tdma.c:657
 none not_reproduced not_testable untriaged — —
DF-0103 Medium 5.3 p_tracenode/p_traceflag mutated without target p_token -> refcount double-drop/UAF and NULL-deref TOCTOU
sys/kern/kern_ktrace.c:506
 panic reproduced fixed untriaged — —
DF-0162 Medium 5.3 Global modules TAILQ mutated without mod_token: unpriv readers race with privileged kldload/unload
sys/kern/kern_module.c:141
 none not_reproduced fixed untriaged — —
DF-0176 Medium 5.3 cttyioctl forwards ioctls to ttyvp without vnode reference (UAF race)
sys/kern/tty_tty.c:238
 none not_reproduced fixed untriaged — —
DF-1070 Medium 5.3 Teardown race in scsi_targ_bh: fixed hz/2 sleep with no wakeup allows CTIO completion after softc kfree (UAF)
sys/bus/cam/scsi/scsi_targ_bh.c:342
 none not_reproduced not_testable untriaged — —
DF-1120 Medium 5.3 Buddy allocator unbounded merge in ___sym_mfree causes heap OOB write past h[] array
sys/dev/disk/sym/sym_hipd.c:408
 panic reproduced not_testable untriaged — —
DF-1231 Medium 5.3 Use-after-free race in aac_getnext_aif: AIF context list traversed and dereferenced without aac_aifq_lock
sys/dev/raid/aac/aac.c:3519
 none not_reproduced not_testable untriaged — —
DF-1492 Medium 5.3 Missing minimum COUNT validation in r300_packet3_check allows OOB read/write past IB buffer
sys/dev/drm/radeon/r300.c:1176
 none inconclusive — untriaged — —
DF-1909 Medium 5.3 acp_hw_fini frees genpd without pm_genpd_remove: dangling UAF in global genpd list
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:217
 none inconclusive — untriaged — —
DF-2167 Medium 5.3 Integer overflow in evergreen_copy_dma size computation (sibling of DF-2091)
sys/dev/drm/radeon/evergreen_dma.c:115
 corruption reproduced fixed untriaged — —
DF-0021 Low 5.3 Signed-int overflow in oversized kmalloc size reconstruction (*kup << PAGE_SHIFT)
sys/kern/kern_slaballoc.c:1202
 leak reproduced fixed untriaged — —
DF-1082 Low 5.3 miibus device_t UAF race between uether_ifdetach and unprivileged SIOCGIFMEDIA ioctl
sys/bus/u4b/net/usb_ethernet.c:289
 panic reproduced fixed untriaged — —
DF-1101 Low 5.3 Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len, enabling OOB read via dup_sockaddr
sys/platform/vkernel64/x86_64/autoconf.c:351
 panic reproduced fixed untriaged — —
DF-1900 Low 5.3 Integer overflow in last_valid_bit can drive clear_bit with negative index into stack bitmap (latent: CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:127
 panic reproduced fixed untriaged — —
DF-2253 Low 5.3 sep==NULL misplaces NUL terminator and truncates output
sys/libkern/hexncpy.c:56
 — — — untriaged — —
DF-2534 Low 5.3 xa_strategy / xa_size dereference sc without lifetime lock racing xa_terminate_check free
sys/dev/disk/xdisk/xdisk.c:801
 — — — untriaged — —
DF-0365 Medium 5.2 ieee80211_media_setup unbounded rate-set merge overflows stack buffer rs_rates[15]: 17 unique rates across 11a/b/g/HALF/QUARTER
sys/netproto/802_11/wlan/ieee80211.c:1564
 none not_reproduced not_testable untriaged — —
DF-0633 Medium 5.2 ip_fw3_ctl_state_get reads every other CPU RB tree without synchronization
sys/net/ipfw3_basic/ip_fw3_state.c:422
 none not_reproduced not_testable untriaged — —
DF-0683 Medium 5.2 hci_disable modifies queues and link list without hci_devlock, racing with hci_intr (panic / mbuf UAF)
sys/netbt/hci_unit.c:250
 none not_reproduced not_testable untriaged — —
DF-0689 Medium 5.2 Unsynchronized encaptab list yields use-after-free in encap4_input/encap6_input dispatch
sys/netinet/ip_encap.c:174
 none not_reproduced not_testable untriaged — —
DF-1804 Medium 5.2 snp: UAF / infinite-loop race between snpclose and concurrent snplwrite/snp_in on snooped tty
sys/dev/misc/snp/snp.c:484
 none inconclusive — untriaged — —
DF-0248 Low 5.2 Lockless SLIST traversal in accept_filt_get races with crit_enter-only add/del -> UAF
sys/kern/uipc_accf.c:99
 none reproduced fixed untriaged — —
DF-2204 Low 5.2 No device-removal path and non-idempotent add: stale/UAF list nodes and list corruption on re-add
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85
 panic reproduced fixed untriaged — —
DF-0477 Medium 5.1 ip_fw3_ctl_get_modules: bcopy without checking strlen(module_str) <= sopt_valsize: buffer overflow
sys/net/ipfw3/ip_fw3.c:985
 dos reproduced fixed untriaged — —
DF-1540 Medium 5.1 Use-after-free read of dangling sch->hook in NGM_TEXT_STATUS after hook disconnect
sys/dev/netif/mn/if_mn.c:474
 none inconclusive — untriaged — —
DF-1989 Medium 5.1 No BAR bounds validation on TPM-reported buffer offsets and sizes
sys/dev/crypto/tpm/tpm_crb.c:187
 none inconclusive not_testable untriaged — —
DF-2110 Medium 5.1 Negative PCX width/height passes mode-match and drives a multi-exabyte bcopy -> kernel panic / OOB write past the video window
sys/dev/video/fb/pcx/splash_pcx.c:176
 panic reproduced fixed untriaged — —
DF-2121 Medium 5.1 Unsigned integer underflow in EFI variable name NUL-terminator check causes OOB read / kernel panic
sys/dev/misc/efirt/efidev.c:110
 panic reproduced fixed untriaged — —
DF-2410 Medium 5.1 TPM-reported CRB buffer offsets/sizes used as BAR offsets without any BAR bounds check (and off-by-one in offset normalization)
sys/dev/crypto/tpm/tpm_crb.c:188
 none not_reproduced not_testable untriaged — —
DF-0008 Low 5.1 vfs_setpublicfs() use-after-vput of root vnode + refcount leak on VFS_VPTOFH error
sys/kern/vfs_subr.c:2255
 none not_reproduced — untriaged — —
DF-0024 Low 5.1 Heap overflow in linker_search_path() via over-long kldload module name
sys/kern/kern_linker.c:1458
 corruption reproduced fixed untriaged — —
DF-0426 Low 5.1 MFC table protected only by crit_enter (local-CPU) not token/lock: cross-CPU UAF race
sys/netinet6/ip6_mroute.c:359
 dos reproduced fixed untriaged — —
DF-0726 Low 5.1 if_cloners list and if_cloners_count accessed without synchronization — unprivileged SIOCIFGCLONERS races module load/unload UAF
sys/net/if_clone.c:43
 none not_reproduced fixed untriaged — —
DF-1186 Low 5.1 arcmsr_handle_virtual_command INQUIRY always writes 36 bytes regardless of CAM dxfer_len
sys/dev/raid/arcmsr/arcmsr.c:2947
 panic reproduced fixed untriaged — —
DF-2303 Low 5.1 Latent negative-length bcopy in fwohci_arcv split-header reassembly can cause kernel panic
sys/bus/firewire/fwohci.c:2729
 — — — untriaged — —
DF-2407 Low 5.1 Signed/unsigned promotion in tpm_tis12_write makes a zero-length write read past the stack buffer into the TPM
sys/dev/crypto/tpm/tpm.c:821
 — — — untriaged — —
DF-0106 Medium 5.0 dkcksum32 OOB read via crafted disklabel in writedisklabel path
sys/kern/subr_disklabel32.c:358
 no observable runtime panic/leak on the writedisklabel path (bug real in source); sibling DF-0107 demonstrates the shared root-cause panic not_reproduced — untriaged — —
DF-0262 Low 4.8 IPv6 NAT destination-translation corrupts source address (copy-paste bug)
sys/net/pf/pf.c:3896
 none reproduced fixed untriaged — —
DF-0615 Medium 4.7 Unsynchronized address-selection policy table: UAF race between unprivileged sysctl reader and privileged ioctl mutator
sys/netinet6/in6_src.c:728
 leak:3384 reproduced fixed untriaged — —
DF-0696 Medium 4.7 Missing return after NG_FREE_DATA in ng_etf_rcvdata turns discard path into NULL-deref panic
sys/netgraph/etf/ng_etf.c:381
 none not_reproduced not_testable untriaged — —
DF-1035 Medium 4.7 bus_dmamap_load_uio uses stale absolute segment index after advancing segs pointer -> KKASSERT panic or OOB write
sys/platform/pc64/x86_64/busdma_machdep.c:961
 none not_reproduced not_testable untriaged — —
DF-2026 Medium 4.7 Multi-part SSIF response read loop has no iteration cap -- infinite-loop DoS via malicious BMC
sys/dev/misc/ipmi/ipmi_ssif.c:255
 none inconclusive not_testable untriaged — —
DF-0076 Low 4.7 soisconnected derefs head->so_accf based on inherited child SO_ACCEPTFILTER flag (NULL-deref/UAF race)
sys/kern/uipc_socket2.c:252
 none reproduced fixed untriaged — —
DF-0108 Low 4.7 Unvalidated d_secsize in writedisklabel enables oversized I/O transfer
sys/kern/subr_disklabel32.c:336
 panic reproduced fixed untriaged — —
DF-0367 Low 4.7 lagg_input dereferences ifp->if_lagg unlocked: UAF during concurrent port detach
sys/net/lagg/if_lagg.c:1442
 dos reproduced fixed untriaged — —
DF-0396 Low 4.7 sta_iterate drops table lock across user callback: entry can be freed concurrently use-after-free
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:1413
 dos reproduced fixed untriaged — —
DF-0891 Low 4.7 tmpfs_mount dereferences uninitialized root pointer before error check
sys/vfs/tmpfs/tmpfs_vfsops.c:212
 panic reproduced not_testable untriaged — —
DF-0935 Low 4.7 Stack buffer overflow via unbounded ksprintf into psbuf[512] in /proc/<pid>/rlimit
sys/vfs/procfs/procfs_rlimit.c:64
 none not_reproduced not_testable untriaged — —
DF-0978 Low 4.7 pmap_remove_all/pmap_remove_specific: pv_entry accessed without hold after releasing pm_spin (speculative UAF)
sys/platform/pc64/x86_64/pmap.c:4840
 none reproduced fixed untriaged — —
DF-1422 Low 4.7 isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters
sys/dev/disk/isp/isp_pci.c:1629
 none reproduced not_testable untriaged — —
DF-1425 Low 4.7 Unchecked HBA-controlled msg_len in screen-service writes NUL byte at arbitrary scratch offset
sys/dev/raid/iir/iir.c:1717
 none reproduced fixed untriaged — —
DF-1601 Low 4.7 ks_kbds slave list torn down without kbd_token in kbdmux_term, racing KBDIO_UNLOADING callback (UAF / list corruption)
sys/dev/misc/kbdmux/kbdmux.c:452
 panic reproduced fixed untriaged — —
DF-1986 Low 4.7 Missing cleanup on agp_via_attach failure leaks /dev/agpgart with freed softc -> NULL-deref kernel panic
sys/dev/agp/agp_via.c:180
 none reproduced not_testable untriaged — —
DF-1988 Low 4.7 radeon_sa_bo_manager_fini manipulates SA lists without holding wq.lock (race condition / potential UAF)
sys/dev/drm/radeon/radeon_sa.c:82
 none reproduced not_testable untriaged — —
DF-2074 Low 4.7 mlxd_strategy dereferences stale/uninitialized bio_driver_info instead of dev->si_drv1
sys/dev/raid/mlx/mlx_disk.c:161
 panic reproduced not_testable untriaged — —
DF-2147 Low 4.7 Unguarded aux_offset[instance] array index from firmware-derived i2c_id
sys/dev/drm/radeon/radeon_dp_auxch.c:63
 corruption reproduced fixed untriaged — —
DF-2158 Low 4.7 _free_safe_mem dereferences hdr->alloc_sz to compute tail/mem before any integrity check (OOB read)
sys/dev/misc/tbridge/safe_mem.c:116
 corruption reproduced fixed untriaged — —
DF-2396 Low 4.7 UAF: sysctl sensor read races kfree of sensor arrays in detach
sys/dev/acpica/aibs/atk0110.c:268
 — — — untriaged — —
DF-2544 Low 4.7 Missing bounds check in devclass_alloc_unit permits heap underflow write / NULL-deref panic for negative non-wildcard unit
sys/kern/subr_bus.c:1067
 — — — untriaged — —
DF-2565 Low 4.7 in_delayed_cksum writes through unchecked m_pullup return and silently drops the (possibly reallocated) mbuf pointer
sys/netinet/ip_output.c:949
 — — — untriaged — —
DF-2340 High 4.6 Multicast filter buffer allocated before device descriptor is fetched -> write through ZERO_LENGTH_PTR in kue_setmulti
sys/bus/u4b/net/if_kue.c:488
 — — — untriaged — —
DF-1040 Medium 4.6 Unvalidated 32-bit CIS longlink/MFC target address causes wild bus_space_read_1 and kernel panic
sys/bus/pccard/pccard_cis.c:386
 panic inconclusive not_testable untriaged — —
DF-1278 Medium 4.6 Infinite recursion in mpt_configure_ioc due to tn++ post-increment bypasses retry limit -> stack overflow
sys/dev/disk/mpt/mpt.c:2630
 none inconclusive not_testable untriaged — —
DF-1626 Medium 4.5 VCE IB parser lacks per-field dword bounds, enabling OOB read (pass 1) and OOB write (pass 2) into shared SA BO pool
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:724
 panic reproduced fixed untriaged — —
DF-0434 Low 4.5 bpf_filter_read (knote f_event) reads bd_* state and re-arms callout without bpf_token: race
sys/net/bpf.c:1206
 dos reproduced fixed untriaged — —
DF-0511 Low 4.5 UAF/stale-socket race in deferred upcall ng_ksocket_incoming2: queued so pointer may be freed by shutdown
sys/netgraph7/ksocket/ng_ksocket.c:985
 none reproduced fixed untriaged — —
DF-0951 Low 4.5 Missing vm_token on LIST_REMOVE in zinitna ZONE_INTERRUPT error path allows zlist corruption race with sysctl_vm_zone
sys/vm/vm_zone.c:358
 panic reproduced not_testable untriaged — —
DF-0968 Low 4.5 rijndael_blockEncrypt CBC mode reads/writes full 16-byte block even when numBlocks==0 (non-block-aligned inputLen)
sys/crypto/rijndael/rijndael-api-fst.c:93
 leak reproduced not_testable untriaged — —
DF-1679 Low 4.5 drm_open updates dev->open_count without drm_global_mutex (documented lock contract violation)
sys/dev/drm/drm_file.c:330
 none reproduced fixed untriaged — —
DF-1878 Low 4.5 radeon_dp_work_func walks connector_list without mode_config mutex (acknowledged in source)
sys/dev/drm/radeon/radeon_irq_kms.c:98
 panic reproduced fixed untriaged — —
DF-2126 Low 4.5 Legacy DMA mmap path returns a kernel virtual address where a page-frame-number is required (type confusion in a_result)
sys/dev/drm/drm_vm.c:66
 leak reproduced fixed untriaged — —
DF-2473 Low 4.5 isp_handle_platform_atio copies firmware CDB length into 16-byte cdb_bytes without bound (target-mode heap overflow)
sys/dev/disk/isp/isp_freebsd.c:1926
 — — — untriaged — —
DF-0895 High 4.4 OOB heap read via unvalidated FUSE daemon reply size in INIT/STATFS/STATVFS
sys/vfs/fuse/fuse_vfsops.c:216
 leak:80bytes reproduced fixed untriaged — —
DF-2571 High 4.4 Kernel stack overflow via user-controlled VLA in ngdread() and ngdwrite()
sys/netgraph/ng_device.c:509
 none not_reproduced not_testable untriaged — —
DF-0055 Medium 4.4 Use-after-free of shared udev event dictionary in udev_event_externalize (multi-reader)
sys/kern/kern_udev.c:540
 panic reproduced fixed untriaged — —
DF-0502 Medium 4.4 ng_fec_shutdown infinite loop when member interface destroyed: dangling pointer + unkillable loop
sys/netgraph7/ng_fec.c:1335
 dos inconclusive not_testable untriaged — —
DF-0528 Medium 4.4 ng_fec_rmnode infinite loop when member interface vanished: dangling ptr + unkillable loop
sys/netgraph/fec/ng_fec.c:1224
 none not_reproduced not_testable untriaged — —
DF-1423 Medium 4.4 Integer overflow in raw-service ioctl bounds check bypasses scratch-size guard
sys/dev/raid/iir/iir.c:1036
 none inconclusive — untriaged — —
DF-1516 Medium 4.4 Integer overflow in buffer bounds check bypasses offset validation in check_overlay_src
sys/dev/drm/i915/intel_overlay.c:1033
 none inconclusive — untriaged — —
DF-2081 Medium 4.4 Missing privilege check on SIOCGATHSPECTRAL allows unprivileged radio reconfiguration and enables memory bugs
sys/dev/netif/ath/ath/if_ath_spectral.c:181
 dos reproduced fixed untriaged — —
DF-2203 Medium 4.4 Unbounded write to stack array tmp_topology overflows when hive exceeds 4 nodes
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:66
 panic reproduced fixed untriaged — —
DF-2592 Medium 4.4 Kernel heap memory disclosure via ip_fw3_ctl_set_get unbounded bcopy from 4-byte field
sys/net/ipfw3/ip_fw3_set.c:206
 leak:4088 reproduced fixed untriaged — —
DF-0059 Low 4.4 Uninitialized segs[1]/segs[0] dereference when fewer than 2 PT_LOAD segments
sys/kern/link_elf.c:399
 none reproduced fixed untriaged — —
DF-0642 Low 4.4 Signed nssid bypass in ieee80211_scan_copy_ssid causes heap buffer overflow and kernel panic
sys/netproto/802_11/wlan/ieee80211_scan.c:296
 panic reproduced fixed untriaged — —
DF-0746 Low 4.4 Use-after-free in l2cap_rtx: req->lr_id read after zfree in DPRINTF
sys/netbt/l2cap_misc.c:190
 none reproduced fixed untriaged — —
DF-0853 Low 4.4 high_sierra flag is sticky — type confusion when descriptors are mixed in crafted ISO
sys/vfs/isofs/cd9660/cd9660_vfsops.c:334
 none reproduced fixed untriaged — —
DF-1304 Low 4.4 mlx_user_command DCDB fixup writes dcdb_physaddr past undersized heap buffer
sys/dev/raid/mlx/mlx.c:1872
 none reproduced not_testable untriaged — —
DF-1372 Low 4.4 oce_handle_passthrough writes through direct user-pointer dereference (SMAP panic)
sys/dev/netif/oce/oce_if.c:1806
 none reproduced not_testable untriaged — —
DF-1592 Low 4.4 Unvalidated csio->cdb_len overflows cmd_pkt->cmd.pkt_a.cdb[16] in tws_execute_scsi
sys/dev/raid/tws/tws_cam.c:757
 panic reproduced fixed untriaged — —
DF-1651 Low 4.4 sbsh: SIOCLOADFIRMW firmware pointer dereferenced in kernel without copyin -> fatal page fault
sys/dev/netif/sbsh/if_sbsh.c:409
 panic reproduced fixed untriaged — —
DF-1700 Low 4.4 vn: signed integer overflow in file-backed disk-size math (vn->sc_size = vn_size * PAGE_SIZE / DEV_BSIZE)
sys/dev/disk/vn/vn.c:559
 panic reproduced fixed untriaged — —
DF-1838 Low 4.4 PSP firmware header fields used without bounds validation: heap overflow and OOB read on corrupt SOS/ASD firmware
sys/dev/drm/amd/amdgpu/psp_v3_1.c:126
 none reproduced not_testable untriaged — —
DF-1905 Low 4.4 Missing AcpiRemoveNotifyHandler in detach leaves dangling ACPI notify handler: UAF/freed-text jump after kldunload
sys/dev/acpica/acpi_dock/acpi_dock.c:518
 panic reproduced fixed untriaged — —
DF-1915 Low 4.4 ida_detach frees DMA maps and QCB memory while I/O may be in flight: UAF/panic
sys/dev/raid/ida/ida.c:276
 panic reproduced fixed untriaged — —
DF-2009 Low 4.4 Negative uio_resid in led_write causes guaranteed kernel panic (OOB write to non-canonical address)
sys/dev/misc/led/led.c:232
 none reproduced not_testable untriaged — —
DF-2150 Low 4.4 dm-linear loads tables with no offset/length bounds check; offset arithmetic overflows and breaks device confinement
sys/dev/disk/dm/linear/dm_target_linear.c:75
 none reproduced fixed untriaged — —
DF-2347 Low 4.4 Lockless check/use race on bus->ifp between usbpf_xfertap and clone/teardown causes NULL-deref/UAF panic
sys/bus/u4b/usb_pf.c:362
 — — — untriaged — —
DF-2381 Low 4.4 Use-after-free in detach: deferred ACPI notify callback runs on freed softc (AcpiOsWaitEventsComplete is a no-op in DragonFly)
sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:331
 — — — untriaged — —
DF-2515 Low 4.4 SCSI CDB heap buffer overflow past orb[7] into ind_ptr on 16-byte CDBs
sys/dev/disk/sbp/sbp.c:2337
 — — — untriaged — —
DF-1075 Medium 4.3 Multicast filter buffer allocated before device descriptor is read -> OOB write / kernel panic on interface up
sys/bus/u4b/net/if_kue.c:488
 panic reproduced not_testable untriaged — —
DF-0394 Low 4.3 SSID/rates/xrates copies rely solely on upstream parse_beacon validation: KASSERT is no-op on production kernels
sys/netproto/802_11/wlan/ieee80211_scan_sta.c:282
 none reproduced fixed untriaged — —
DF-1073 Low 4.3 pnp_check_quirks PNP_QUIRK_EXTRA_IO writes past ic_port[ISA_NPORT] without bounds check
sys/bus/isa/pnp.c:335
 none reproduced fixed untriaged — —
DF-1121 Low 4.3 Extended SCSI message with length=7 causes 1-byte DMA write past msgin[8] into lastmsg
sys/dev/disk/sym/sym_hipd.c:1652
 panic reproduced fixed untriaged — —
DF-1654 Medium 4.2 sbsh: RX descriptor length=0 with only 2046 bytes after m_adj(m,2) -> heap overflow
sys/dev/netif/sbsh/if_sbsh.c:767
 panic reproduced fixed untriaged — —
DF-1968 Medium 4.2 Integer overflow in radeon fbcon size math yields undersized GEM object with stale full pitch
sys/dev/drm/radeon/radeon_fb.c:154
 none inconclusive — untriaged — —
DF-0119 Info 4.2 Latent OOB write if aux_data/aux_size invariant breaks
sys/kern/subr_diskiocom.c:207
 none reproduced fixed untriaged — —
DF-1699 Medium 4.1 vn: unsynchronized UAF race between vnstrategy I/O path and VNIOCDETACH/vnclear
sys/dev/disk/vn/vn.c:260
 none inconclusive — untriaged — —
DF-1744 Medium 4.1 mpt_pci: use-after-free - DMA request pool freed before interrupt handler torn down
sys/dev/disk/mpt/mpt_pci.c:657
 none inconclusive — untriaged — —
DF-2607 Medium 4.1 TOCTOU/UAF on bus->ifp between usbpf_xfertap (bus-locked) and usbpf_clone_destroy (unlocked)
sys/bus/u4b/usb_pf.c:362
 none not_reproduced not_testable untriaged — —
DF-0298 Low 4.1 ng_type->refs refcount mutated without typelist lock
sys/netgraph7/netgraph/ng_base.c:636
 none reproduced fixed untriaged — —
DF-0523 Low 4.1 Deferred INTERNAL_UPCALL re-invokes upcall against torn-down node/socket: UAF/NULL deref (DF-0511 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:623
 none reproduced fixed untriaged — —
DF-0637 Low 4.1 ngt_close frees sc while ngt_timeout callout can still reference it (UAF / deadlock)
sys/netgraph/tty/ng_tty.c:256
 none not_reproduced — untriaged — —
DF-0985 Low 4.1 mtw_ucode_write heap overflow via oversized firmware ILM/DLM lengths (firmware-supplied metadata overflows txd_fw->buf[])
sys/bus/u4b/wlan/if_mtw.c:1056
 none reproduced fixed untriaged — —
DF-1094 Low 4.1 Use-after-free of acpi_event_info during detach races in-flight AcpiOsExecute event work
sys/bus/gpio/gpio_acpi/gpio_acpi.c:341
 panic reproduced fixed untriaged — —
DF-1100 Low 4.1 Unsynchronized use-after-free of bus->ifp in usbpf_xfertap (DONE tap path)
sys/bus/u4b/usb_pf.c:362
 panic reproduced fixed untriaged — —
DF-1220 Low 4.1 acpi_eval_osc() dereferences _OSC return without validating it is a Buffer
sys/dev/acpica/acpi.c:1326
 none reproduced fixed untriaged — —
DF-1303 Low 4.1 mlx_getslot uses firmware-reported me_max_commands as array bound without clamping to MLX_NSLOTS
sys/dev/raid/mlx/mlx.c:1962
 none reproduced fixed untriaged — —
DF-1701 Low 4.1 vn: unlocked SLIST vn_list mutations vs SLIST_FOREACH in vnget -> list corruption / UAF
sys/dev/disk/vn/vn.c:137
 panic reproduced fixed untriaged — —
DF-1831 Low 4.1 ichwd_attach fail path dereferences ZERO_LENGTH_PTR softc, panicking on attach failure
sys/dev/misc/ichwd/ichwd.c:603
 panic reproduced fixed untriaged — —
DF-1842 Low 4.1 amr_cam_attach overflows amr_cam_sim[] if controller reports more than AMR_MAX_CHANNELS channels
sys/dev/raid/amr/amr_cam.c:170
 panic reproduced fixed untriaged — —
DF-1906 Low 4.1 UAF on clockmod_dom in clockmod_dom_sysctl_select across sysctl_handle_string sleep
sys/dev/powermng/clockmod/clockmod.c:430
 panic reproduced fixed untriaged — —
DF-1963 Low 4.1 Use-after-free in MOD_UNLOAD: kfree(k8pnow_current_state) before sysctl_ctx_free
sys/dev/powermng/powernow/powernow.c:322
 panic reproduced fixed untriaged — —
DF-2082 Low 4.1 amrd_detach runs without synchronizing in-flight bios UAF in amrd_intr after controller detach
sys/dev/raid/amr/amr_disk.c:276
 dos reproduced fixed untriaged — —
DF-2116 Low 4.1 UAF/TOCTOU race: IRQ handler dereferences sc->mpu while detach frees it (mpu401_uninit runs before emu_intr_unregister)
sys/dev/sound/pci/emu10kx-midi.c:223
 corruption reproduced fixed untriaged — —
DF-2143 Low 4.1 splash_unregister leaves stale decoder pointers in decoder_set (use-after-unload)
sys/dev/video/fb/splash.c:146
 corruption reproduced fixed untriaged — —
DF-2228 Low 4.1 ACPI notify-handler use-after-free in detach via DragonFly no-op AcpiOsWaitEventsComplete stub
sys/gnu/dev/misc/apple_gmux/apple-gmux.c:919
 none not_reproduced not_testable untriaged — —
DF-2261 Low 4.1 PROBE_SERIAL_NUM_1 OOB-read of VPD 0x80 response and XPT_GDEV_TYPE overflow of cgd->serial_num[252]
sys/bus/cam/cam_xpt.c:6335
 — — — untriaged — —
DF-2307 Low 4.1 UAF race in gpio_acpi_unmap_aei: deferred AEI event handler dereferences freed info struct
sys/bus/gpio/gpio_acpi/gpio_acpi.c:347
 — — — untriaged — —
DF-2326 Low 4.1 pci_devq traversal in PCIOCGETCONF is unprotected: pci_token is single-taker races pci_freecfg (UAF)
sys/bus/pci/pci_user.c:59
 — — — untriaged — —
DF-2374 Low 4.1 Use-after-free race between acpiioctl() hook dispatch and acpi_deregister_ioctl()
sys/dev/acpica/acpi.c:3407
 — — — untriaged — —
DF-2393 Low 4.1 Use-after-free of softc in notify handler during detach (AcpiOsWaitEventsComplete is a no-op) DF-2381 class
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:273
 — — — untriaged — —
DF-2409 Low 4.1 Use-after-free via un-drained discard_buffer_callout on device detach
sys/dev/crypto/tpm/tpm20.c:138
 — — — untriaged — —
DF-2454 Low 4.1 Buggy ksnprintf length tracking in dm_target_stripe_table/info overruns heap params buffer when output is truncated
sys/dev/disk/dm/striped/dm_target_striped.c:170
 — — — untriaged — —
DF-2457 Low 4.1 fd_detach stops only two of fd three callouts leaving fd_iotimeout armed over freed softc
sys/dev/disk/fd/fd.c:1090
 — — — untriaged — —
DF-2526 Low 4.1 trm_detach tears down DMA/IOPORT resources before bus_teardown_intr interrupt handler can execute against freed memory during detach
sys/dev/disk/trm/trm.c:3696
 — — — untriaged — —
DF-2528 Low 4.1 Unlocked vn_softc state in vnstrategy/vnget races vnclear -> NULL deref or UAF
sys/dev/disk/vn/vn.c:272
 — — — untriaged — —
DF-2530 Low 4.1 Unclamped sense_len overflows 32-byte inline sense_data buffer on CHECK CONDITION
sys/dev/disk/vpo/vpo.c:266
 — — — untriaged — —
DF-0368 Info 4.1 lagg_clone_create error path calls if_free on embedded ifnet: latent double-free if protocol attach ever fails
sys/net/lagg/if_lagg.c:304
 none reproduced not_testable untriaged — —
DF-0385 Info 4.1 config_red kfrees caller-owned possibly-embedded struct on red_lookup_depth==0 path: latent UAF — same as v1
sys/net/dummynet3/ip_dummynet3.c:1364
 none reproduced not_testable untriaged — —
DF-1710 Info 4.1 amdgpu_vcn: firmware header fields used without bounds checks - heap overflow via crafted firmware (defense-in-depth)
sys/dev/drm/amd/amdgpu/amdgpu_vcn.c:126
 panic reproduced fixed untriaged — —
DF-1904 Info 4.1 snprintf_count returns UINT_MAX when called with bufSize==0 risking wild-pointer writes (latent: no caller in tree)
sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer_debug.c:48
 none reproduced not_testable untriaged — —
DF-2314 Medium 4.0 Missing large_len>0 guard in ANSI-string trim walks buf[] backwards (OOB stack read + NUL write + stack info-leak via device desc)
sys/bus/isa/pnp.c:399
 — — — untriaged — —
DF-2315 Low 4.0 pnp_check_quirks PNP_QUIRK_EXTRA_IO writes ic_port[] past ISA_NPORT without bounds check
sys/bus/isa/pnp.c:335
 — — — untriaged — —
DF-2525 Low 4.0 trm_check_eeprom default-load writes 8-byte u_long into 4-byte field schema 122-byte OOB write of static trm_eepromBuf[] on x86_64 at attach
sys/dev/disk/trm/trm.c:3304
 — — — untriaged — —
DF-0095 Low 3.9 Per-process shmmap_state sized at alloc-time shmseg but all loops re-read LIVE root-writable shminfo.shmseg - OOB when raised
sys/kern/sysv_shm.c:284
 none reproduced fixed untriaged — —
DF-0295 Low 3.9 UAF race in setappie: non-atomic pointer swap/free vs concurrent beacon/IE readers
sys/netproto/802_11/wlan/ieee80211_ioctl.c:2272
 none reproduced fixed untriaged — —
DF-0597 Low 3.9 Use-after-free in ng_pptpgre (netgraph7) session timer callbacks after hook disconnect frees hpriv
sys/netgraph7/pptpgre/ng_pptpgre.c:494
 panic reproduced fixed untriaged — —
DF-0629 Low 3.9 ng_ether_rcv_upper skips bridge_input_p handoff, bypassing bridge input filtering on upper-hook-injected packets
sys/netgraph/ether/ng_ether.c:582
 none reproduced fixed untriaged — —
DF-2014 Low 3.9 radeon_gart_unbind GPU-page index t desyncs from CPU-page index p when a page slot is NULL, leaving stale DMA mappings in the GART table
sys/dev/drm/radeon/radeon_gart.c:254
 none reproduced not_testable untriaged — —
DF-0413 Info 3.9 Primitive parse functions write to output buffer without checking *buflen: missing defense-in-depth bounds check
sys/netgraph7/netgraph/ng_parse.c:332
 none reproduced not_testable untriaged — —
DF-2101 Low 3.7 DSCSR_10FDX status branch sets IFM_HDX instead of IFM_FDX (duplex misreport -> duplex-mismatch DoS)
sys/dev/netif/mii_layer/amphy.c:268
 none reproduced fixed untriaged — —
DF-0147 Low 3.6 Signed/unsigned accounting: int64_t delta added to uint64_t ac_bytes can wrap
sys/kern/vfs_quota.c:160
 none reproduced fixed untriaged — —
DF-0209 Low 3.6 clist_nextc trusts caller cp without validating within live ring window
sys/kern/tty_subr.c:229
 none reproduced fixed untriaged — —
DF-0537 Low 3.6 TOCTOU race on priv->datasock in ng_connect_data: check unlocked, set under lock
sys/netgraph7/socket/ng_socket.c:790
 dos reproduced fixed untriaged — —
DF-0549 Low 3.6 netmap_obj_offset returns 0 on error indistinguishable from valid offset 0: masks failures
sys/net/netmap/netmap_mem2.c:227
 none reproduced fixed untriaged — —
DF-0639 Low 3.6 Compress path avail_in integer underflow (avail_in = inlen - 1) on 0-length mbuf
sys/netgraph7/deflate/ng_deflate.c:451
 panic reproduced fixed untriaged — —
DF-0851 Low 3.6 Stale dereference of rootp after pribp released — use-after-free style read on buffer cache recycle
sys/vfs/isofs/cd9660/cd9660_vfsops.c:435
 none not_reproduced fixed untriaged — —
DF-1005 Low 3.6 usbd_get_phys strlen(phys)-1 underflows to 255 when phys empty -> OOB null-byte write at phys[255] (latent)
sys/bus/u4b/usb_device.c:2273
 none reproduced fixed untriaged — —
DF-1043 Low 3.6 ufoma sysctl handlers access freed sc_modetable after detach (UAF)
sys/bus/u4b/serial/ufoma.c:453
 none not_reproduced not_testable untriaged — —
DF-1525 Low 3.6 Unbounded channel index causes OOB write past openedaudio[] in sound_oss_sysinfo
sys/dev/sound/pcm/sound.c:1308
 dos reproduced fixed untriaged — —
DF-0099 Low 3.4 Off-by-one heap NUL-byte overflow in vfs_mountroot_try via ksscanf width/buffer-size mismatch
sys/kern/vfs_conf.c:419
 none reproduced fixed untriaged — —
DF-0462 Low 3.4 bzero targets wrong field (&conf not &stats) with wrong size (session_stats=32 not sess_config=8): 24-byte intra-struct overflow
sys/netgraph7/l2tp/ng_l2tp.c:748
 none reproduced fixed untriaged — —
DF-0722 Low 3.4 Unit-number bitmap length tracked in unsigned char: truncates after ~2040 nodes causing duplicate unit allocation (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:103
 dos inconclusive — untriaged — —
DF-1241 Low 3.4 iwi_cmd uint8_t len truncates iv_appie_wpa length, allowing up to 135-byte overflow of cmd descriptor ring
sys/dev/netif/iwi/if_iwi.c:1784
 none reproduced fixed untriaged — —
DF-1686 Low 3.4 agp: off-by-one in agp_mmap aperture bounds check exposes one physical page past the AGP aperture
sys/dev/agp/agp.c:860
 none reproduced fixed untriaged — —
DF-2205 Low 3.4 Error path leaves half-initialized device on hive list and masks subsequent failures
sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85
 none reproduced fixed untriaged — —
DF-2238 Low 3.4 Off-by-two OOB write when full input line terminated with Enter
sys/ddb/db_input.c:264
 — — — untriaged — —
DF-2399 Low 3.4 as_isopen boolean refcount mismatch causes cross-process memory wipe and device_unbusy on still-open device
sys/dev/agp/agp.c:781
 — — — untriaged — —
DF-1078 Medium 3.3 vkernel DDB backtrace leaks kernel addresses to world-readable msgbuf (DF-1077 class) + missing Xfast_syscall boundary stop
sys/platform/vkernel64/x86_64/db_trace.c:280
 none not_reproduced not_testable untriaged — —
DF-0216 Low 3.3 sysctl_kcollect_data copies past user buffer (unsigned underflow in bounds check)
sys/kern/kern_collect.c:235
 none reproduced fixed untriaged — —
DF-1232 Low 3.3 Kernel heap address leak to userspace via fibctx->unique in aac_open_aif
sys/dev/raid/aac/aac.c:3451
 leak:4 reproduced fixed untriaged — —
DF-1275 Low 3.3 VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:341
 none reproduced fixed untriaged — —
DF-1321 Low 3.3 OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25]
sys/dev/sound/pci/envy24.c:2038
 none reproduced fixed untriaged — —
DF-1602 Low 3.3 draw_txtmouse reads/writes scp->scr past vtb_size on the bottom screen row (FIXME-acknowledged)
sys/dev/misc/syscons/scvgarndr.c:340
 panic reproduced fixed untriaged — —
DF-2129 Low 3.3 apple_smc_mmio_key_read silently under-fills caller buffer, leaking kernel stack via sysctl
sys/dev/apple/smc/smc_mmio.c:75
 none reproduced fixed untriaged — —
DF-2284 Low 3.3 sgwrite/sgread leak sg_rdwr + ccb + buf when read() is never matched; sgoninvalidate/sgcleanup never drain rdwr_done (memory exhaustion + invalidation UAF surface)
sys/bus/cam/scsi/scsi_sg.c:169
 — — — untriaged — —
DF-0169 Info 3.3 sysref_get has no refcount overflow guard
sys/kern/kern_sysref.c:66
 none reproduced not_testable untriaged — —
DF-0517 Info 3.3 IPV6_FW_GET leaks one unused mbuf per call + walks chain without lock
sys/net/ip6fw/ip6_fw.c:1101
 none reproduced not_testable untriaged — —
DF-0140 Low 3.0 Unchecked queue argument -> OOB write on wc_blocked[queue]
sys/kern/subr_sleepqueue.c:266
 none reproduced fixed untriaged — —
DF-0620 Low 3.0 Off-by-one OOB write in IPV6_CHECKSUM offset validation in rip6_output
sys/netinet6/raw_ip6.c:403
 dos reproduced fixed untriaged — —
DF-0728 Low 3.0 CHANNEL/XCHANNEL priority inversion between attachv and chan_change — 4-byte overflow if driver sets both bits
sys/netproto/802_11/wlan/ieee80211_radiotap.c:103
 leak reproduced fixed untriaged — —
DF-1108 Low 3.0 Off-by-one write in decode_nfshandle corrupts root_saddr.sin_len (pc64 sibling of DF-1101)
sys/platform/pc64/x86_64/autoconf.c:274
 panic reproduced fixed untriaged — —
DF-1348 Low 3.0 Unbounded bcopy of CDB into CmdBlock[12] overflows SRB on >12-byte CDBs
sys/dev/disk/amd/amd.c:399
 none reproduced fixed untriaged — —
DF-1531 Low 3.0 hpt_get_logical_devices writes one DEVICEID before the count check (4-byte heap overflow when nMaxCount=0)
sys/dev/raid/hptmv/gui_lib.c:479
 panic reproduced fixed untriaged — —
DF-1736 Low 3.0 vinumio: sappend in format_config writes 1-2 bytes past malloc config buffer when text reaches end
sys/dev/raid/vinum/vinumio.c:415
 panic reproduced fixed untriaged — —
DF-1771 Low 3.0 intel_dsi_vbt: unbounded attacker-controlled len in mipi_exec_send_packet causes heap OOB read (v3 sequences)
sys/dev/drm/i915/intel_dsi_vbt.c:124
 panic reproduced fixed untriaged — —
DF-1772 Low 3.0 intel_dsi_vbt: integer overflow in DSI timing math writes wrong DPHY/Hs-to-Lp register values
sys/dev/drm/i915/intel_dsi_vbt.c:566
 panic reproduced fixed untriaged — —
DF-1833 Low 3.0 amdpm_bread returns unbounded slave-supplied block count, enabling OOB read and kernel-stack info leak
sys/dev/powermng/amdpm/amdpm.c:613
 none reproduced not_testable untriaged — —
DF-1962 Low 3.0 Undersized freqs_available[80] overflows when formatting 16-state list (80 chars + NUL = 81)
sys/dev/powermng/powernow/powernow.c:343
 panic reproduced fixed untriaged — —
DF-0112 Info 3.0 __sccl scanset range-fill writes tab[256] when range endpoint is 0xFF
sys/kern/subr_scanf.c:605
 none reproduced fixed untriaged — —
DF-0154 Info 3.0 KKASSERT-only invariants vanish on production kernels (UAF/queue-corruption risk)
sys/kern/kern_systimer.c:148
 none reproduced not_testable untriaged — —
DF-1378 Low 2.9 Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach
sys/dev/disk/buslogic/bt.c:420
 none reproduced fixed untriaged — —
DF-2345 Low 2.9 INQUIRY EVPD response fabrication writes to CCB data buffer without validating dxfer_len
sys/bus/u4b/storage/umass.c:2326
 — — — untriaged — —
DF-0335 Info 2.9 in_pcbportrange can invert hi<lo causing u_short underflow and out-of-range port binds
sys/netinet/in_pcb.c:2533
 none reproduced not_testable untriaged — —
DF-1792 Info 2.7 puc: dangling ivars pointer in attach error path - use-after-free of puc_device
sys/dev/misc/puc/puc.c:327
 panic reproduced not_testable untriaged — —
DF-0177 Low 2.5 cttykqfilter forwards knote to ttyvp with no token and no reference
sys/kern/tty_tty.c:284
 none reproduced fixed untriaged — —
DF-0360 Low 2.5 nm_dump_buf writes unbounded hex dump into fixed 8 KiB static buffer _dst
sys/net/netmap/netmap.c:322
 none reproduced fixed untriaged — —
DF-0512 Low 2.5 Unbounded sockaddr stored into fixed-size struct sockaddr in accept response: type confusion latent
sys/netgraph7/ksocket/ng_ksocket.c:1250
 panic reproduced fixed untriaged — —
DF-0635 Low 2.5 Pred1Compress outbuf overflow: input size bound check off by 6, up to 7-byte heap OOB write
sys/netgraph7/ng_pred1.c:397
 panic reproduced fixed untriaged — —
DF-1338 Low 2.5 SGE scatter/gather table bounds mismatch allows latent OOB write in sili_load_prb_callback
sys/dev/disk/sili/sili.c:1245
 none reproduced fixed untriaged — —
DF-1365 Low 2.5 fd_detach does not stop fd->tohandle callout (UAF on detach race)
sys/dev/disk/fd/fd.c:1090
 none reproduced fixed untriaged — —
DF-1571 Low 2.5 xa_size dereferences sc with no lock; UAF if xa_terminate_check runs concurrently
sys/dev/disk/xdisk/xdisk.c:828
 panic reproduced fixed untriaged — —
DF-1928 Low 2.5 Off-by-one NUL byte write in acpi_battery_clean_str past struct acpi_bif / ioctl union
sys/dev/acpica/acpi_battery.c:326
 panic reproduced fixed untriaged — —
DF-2375 Low 2.5 Off-by-one NUL heap write in acpi_battery_clean_str past the _BIF oeminfo field
sys/dev/acpica/acpi_battery.c:321
 — — — untriaged — —
DF-2433 Low 2.5 TOCTOU on CCDF_INITED allows concurrent CCDIOCSET to leak memory and vnodes
sys/dev/disk/ccd/ccd.c:1310
 — — — untriaged — —
DF-2563 Low 2.5 Compress path heap buffer overflow via incorrect worst-case expansion bound
sys/netgraph7/ng_pred1.c:397
 — — — untriaged — —
DF-0539 Info 2.5 ieee80211_node_dectestref implements non-atomic decrement-and-test: latent UAF trap
sys/netproto/802_11/wlan/ieee80211_dragonfly.c:497
 none reproduced not_testable untriaged — —
DF-0601 Info 2.5 ng_source_rcvdata races unsynchronized on snd_queue (latent: file is orphaned and non-compiling)
sys/netgraph7/ng_source.c:270
 none not_reproduced not_testable untriaged — —
DF-0717 Info 2.5 Memory leak in netmap_open when devfs_set_cdevpriv fails — kfree missing on error path
sys/net/netmap/netmap_freebsd.c:382
 none reproduced fixed untriaged — —
DF-2192 Info 2.5 GEM object leak on pin_pages failure in batch pool create path
sys/dev/drm/i915/i915_gem_batch_pool.c:133
 none reproduced fixed untriaged — —
DF-1790 Medium 2.4 amdgpu_atombios_dp: OOB kernel-stack read in DP link training via malicious sink MAX_LANE_COUNT > 4
sys/dev/drm/amd/amdgpu/atombios_dp.c:264
 none inconclusive — untriaged — —
DF-0450 Medium 2.3 OOB kernel heap read in ng_string_unparse via unbounded strlen on binary data without NUL terminator
sys/netgraph/netgraph/ng_parse.c:722
 leak:2 reproduced fixed untriaged — —
DF-0846 Low 2.3 Credential and vnode-reference leak when Q_QUOTAON re-enables quotas on same vnode
sys/vfs/ufs/ufs_quota.c:437
 leak reproduced fixed untriaged — —
DF-0869 Low 2.3 Missing bounds validation in hammer_format_volume_header allows signed-int64 overflow in vol_buf_beg/end
sys/vfs/hammer/hammer_volume.c:652
 panic reproduced fixed untriaged — —
DF-0957 Low 2.3 kmem_alloc3/kmem_alloc_attr ignore vm_map_insert return; round_page() overflow to size=0 yields bogus non-zero addr
sys/vm/vm_kern.c:219
 panic reproduced not_testable untriaged — —
DF-1079 Low 2.3 Unbounded length in m/M GDB commands overflows remcomOutBuffer / reads remcomInBuffer out of bounds
sys/cpu/x86_64/misc/x86_64-gdbstub.c:313
 none reproduced fixed untriaged — —
DF-1080 Low 2.3 P command register-index check (regno < NUM_REGS=22) allows stack OOB write past the registers struct
sys/cpu/x86_64/misc/x86_64-gdbstub.c:438
 none reproduced fixed untriaged — —
DF-1270 Low 2.3 Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame
sys/dev/raid/mps/mps_sas.c:1685
 none reproduced fixed untriaged — —
DF-1500 Low 2.3 Unbounded ksprintf into fixed 8-byte schan.hookname in musycc_newhook
sys/dev/misc/musycc/musycc.c:167
 none reproduced not_testable untriaged — —
DF-1688 Low 2.3 agp: signed-int loop variable in agp_generic_unbind_memory overflows for >2 GB allocations
sys/dev/agp/agp.c:609
 panic reproduced fixed untriaged — —
DF-1803 Low 2.3 snp: SNPGTTY writes 8-byte cdev_t into 4-byte dev_t user buffer - kernel pointer leak + 4-byte overrun
sys/dev/misc/snp/snp.c:582
 leak:4 reproduced fixed untriaged — —
DF-1816 Low 2.3 ppatomfwctrl: off-by-one stride in GPIO-pin lookup causes unconditional 7-byte OOB read past table allocation
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:183
 none reproduced not_testable untriaged — —
DF-2416 Low 2.3 Heap OOB read+write via unbounded sense_len in autosense bcopy
sys/dev/disk/advansys/adwcam.c:1321
 — — — untriaged — —
DF-0085 Low 1.9 taskqgroup_drain_all uses wrong loop bound (ncpus instead of tqg_cnt) - latent UAF if API adopted
sys/kern/subr_gtaskqueue.c:806
 none reproduced fixed untriaged — —
DF-0183 Low 1.9 UAF of tsleep wait channel when racing unregister of in-flight resident image
sys/kern/imgact_resident.c:291
 none reproduced fixed untriaged — —
DF-0336 Low 1.9 tcp6_getcred hands live cred pointer to blocking copyout (UAF window) unlike IPv4 path
sys/netinet/tcp_subr.c:1366
 leak reproduced fixed untriaged — —
DF-0381 Low 1.9 NGM_LISTHOOKS dereferences hook->peer without lock or ref: TOCTOU NULL-deref/UAF vs concurrent disconnect
sys/netgraph/netgraph/ng_base.c:1374
 dos reproduced fixed untriaged — —
DF-0506 Low 1.9 ng_fec_ether_cmdmulti iterates if_multiaddrs lockless + leaks membership on partial kmalloc failure
sys/netgraph7/ng_fec.c:542
 panic reproduced fixed untriaged — —
DF-1055 Low 1.9 sgwrite truncates uio_resid to int and does not validate reply_len, enabling allocation-size confusion
sys/bus/cam/scsi/scsi_sg.c:648
 none reproduced fixed untriaged — —
DF-1195 Low 1.9 Missing goto out after ME/RLC firmware size checks allows malformed firmware use and kernel heap OOB read
sys/dev/drm/radeon/r600.c:2559
 panic reproduced fixed untriaged — —
DF-1201 Low 1.9 VT_PROCESS scp->proc stored without refcount; signal_vt_rel/acq PHOLD can hit freed/reused proc struct (UAF / pid-recycling)
sys/dev/misc/syscons/syscons.c:1251
 panic reproduced fixed untriaged — —
DF-1266 Low 1.9 Missing bounds validation on drm_fbdev_overalloc enables u32 overflow in framebuffer height
sys/dev/drm/drm_fb_helper.c:2014
 none reproduced fixed untriaged — —
DF-1826 Low 1.9 intel_guc: intel_guc_fini leaves shared_data_vaddr dangling after freeing mapping -> UAF
sys/dev/drm/i915/intel_guc.c:187
 none reproduced not_testable untriaged — —
DF-1877 Low 1.9 dp_work and audio_work not flushed in radeon_irq_kms_fini: UAF after device teardown
sys/dev/drm/radeon/radeon_irq_kms.c:313
 panic reproduced fixed untriaged — —
DF-2073 Low 1.9 ResetKeyCacheEntry MIC-clear path lacks runtime bounds check on entry+64 (HALASSERT inert in release)
sys/dev/netif/ath/ath_hal/ar5212/ar5212_keycache.c:86
 panic reproduced not_testable untriaged — —
DF-2220 Low 1.9 kobject_release leaks kobj->name string allocated by kobject_init_and_add
sys/dev/drm/linux_kobject.c:39
 — — — untriaged — —
DF-2235 Low 1.9 Read-before-bounds-check: 1-byte OOB read of source buffer in UCS-2/UTF-16 input parsing
sys/libiconv/iconv_ucs.c:247
 — — — untriaged — —
DF-2430 Low 1.9 Off-by-one NUL write past bt->model[5] in Inquire-Model parsing
sys/dev/disk/buslogic/bt.c:420
 — — — untriaged — —
DF-2444 Low 1.9 dm_dev_create assigns freed dmv to *dmvp on insert-failure path
sys/dev/disk/dm/dm_dev.c:264
 — — — untriaged — —
DF-2456 Low 1.9 FD_FORM formats with unbounded attacker nsecs over-reading fd_formb heap buffer via DMA/PIO
sys/dev/disk/fd/fd.c:2311
 — — — untriaged — —
DF-0160 Info 1.9 xio_init_kbuf silently truncates when kbytes exceeds XIO_INTERNAL_SIZE
sys/kern/kern_xio.c:113
 none reproduced not_testable untriaged — —
DF-0251 Info 1.9 PC_TO_INDEX u_quad_t overflow on 64-bit (correctness only, bounds check prevents OOB)
sys/kern/subr_prof.c:86
 none reproduced not_testable untriaged — —
DF-0377 Info 1.9 config_red error path kfrees struct that may be embedded member of dn_pipe: latent UAF/invalid-free
sys/net/dummynet/ip_dummynet.c:1359
 none reproduced not_testable untriaged — —
DF-0440 Info 1.9 red_pkttime computed as int64 then stored into int: truncation/overflow for jumbo MTU or low m2
sys/net/altq/altq_hfsc.c:451
 none reproduced not_testable untriaged — —
DF-0608 Info 1.9 sizeof(ips) pointer-vs-struct typo in NGM_CISCO_GET_IPADDR response sizing
sys/netgraph7/iface/ng_iface.c:724
 none reproduced fixed untriaged — —
DF-0939 Info 1.9 Unbounded bcopy of sv_name into 256-byte stack buffer in procfs_dotype (latent; no in-tree sv_name >= 256B)
sys/vfs/procfs/procfs_type.c:54
 none reproduced not_testable untriaged — —
DF-0980 Info 1.9 pmap_remove_pages skips cross-CPU TLB invalidation (cpu_invltlb only, no smp_invltlb)
sys/platform/pc64/x86_64/pmap.c:5727
 none reproduced not_testable untriaged — —
DF-1119 Info 1.9 Firmware header fields used as array indices without bounds checks (heap OOB read/write via corrupted ucode)
sys/dev/drm/radeon/cik.c:1873
 none reproduced not_testable untriaged — —
DF-1941 Info 1.9 Detach does not drain AcpiOsExecute callbacks: stale softc use-after-free (latent, AcpiOsWaitEventsComplete is no-op stub)
sys/dev/acpica/acpi_cmbat.c:154
 none reproduced not_testable untriaged — —
DF-1999 Info 1.9 amdgpu_gfx_compute_mqd_sw_fini kfrees mqd_backup without NULLing the slot (double-free landmine)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:366
 panic reproduced fixed untriaged — —
DF-1621 Low 1.1 Unbounded bcopy of user-controlled csio->cdb_len into 32-byte CDB32 frame (DF-1356/1547 class)
sys/dev/raid/mrsas/mrsas_cam.c:489
 panic reproduced fixed untriaged — —
DF-2068 Low 1.1 Unchecked capacity*struct_size multiplication can overflow in construct/presized/reserve (latent heap OOB)
sys/dev/drm/amd/display/dc/basics/vector.c:43
 none reproduced fixed untriaged — —
DF-0082 Info 1.1 Latent heap overflow in sbuf_extend via int truncation of caller length (zero callers, unreachable today)
sys/kern/subr_sbuf.c:150
 none reproduced fixed untriaged — —
DF-0215 Info 1.1 Wait-counter inc/dec can overflow into control bits (theoretical)
sys/kern/lwkt_serialize.c:271
 none reproduced not_testable untriaged — —
DF-0230 Info 1.1 table_blocks computed before entries/entsz validation (fragile ordering)
sys/kern/subr_diskgpt.c:131
 none reproduced not_testable untriaged — —
DF-1208 Info 1.1 intel_runtime_pm_get_if_in_use() returns true without taking wakeref on DragonFly, causing unbalanced put() underflow
sys/dev/drm/i915/intel_runtime_pm.c:4039
 none reproduced not_testable untriaged — —
DF-1263 Info 1.1 dsp_oss_syncgroup frees inserted smrd without removing from sg->members on unreachable M_WAITOK error branch
sys/dev/sound/pcm/dsp.c:2913
 none reproduced not_testable untriaged — —
DF-1930 Info 1.1 chn_removefeeder leaves stale parent pointer on new chain head (latent UAF)
sys/dev/sound/pcm/feeder.c:253
 none reproduced not_testable untriaged — —
DF-0908 Low 0.8 size_t underflow in trailing-slash strip causes OOB access on empty mount path
sys/vfs/dirfs/dirfs_vfsops.c:137
 none reproduced not_testable untriaged — —
DF-0094 Info 0.8 shmrealloc initializes OLD shmsegs[] instead of newsegs[] - heap OOB write + uninit new array (dead code)
sys/kern/sysv_shm.c:683
 none reproduced fixed untriaged — —
DF-0721 Info 0.8 Build break: IFP2SP and SP2IFP macros referenced 12 times but never defined anywhere in sys/
sys/netgraph7/ng_sppp.c:254
 none reproduced not_testable untriaged — —
DF-1379 Info 0.8 btexecuteccb SG-list copy has no nseg<=BT_NSEG bound (latent heap overflow)
sys/dev/disk/buslogic/bt.c:836
 none reproduced not_testable untriaged — —
DF-1824 Info 0.8 aac_cam: unbounded CDB bcopy overflows struct aac_srb.cdb[16] into sg_map
sys/dev/raid/aac/aac_cam.c:443
 panic reproduced fixed untriaged — —
DF-1896 Info 0.8 intel_csr_ucode_fini kfree dmc_payload without NULLing pointer: dangling pointer (latent UAF)
sys/dev/drm/i915/intel_csr.c:557
 none reproduced not_testable untriaged — —
DF-2144 Info 0.8 decoders counter never increments except at DELTA-aligned boundaries (registration array logic bug)
sys/dev/video/fb/splash.c:124
 corruption reproduced fixed untriaged — —
DF-2371 Low 0.5 twofish_set_key performs no key-length validation enabling stack/struct OOB writes and mk_tab corruption on out-of-range key_len_bits
sys/crypto/twofish/twofish.c:425
 — — — untriaged — —
DF-0087 Info 0.5 Signed integer overflow (C UB) in new_unrhdr last computation when high=INT_MAX
sys/kern/subr_unit.c:257
 none reproduced fixed untriaged — —
DF-0153 Info 0.5 EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit; no bounds guard
sys/kern/kern_spinlock.c:206
 none reproduced not_testable untriaged — —
DF-0550 Info 0.5 Ring-size computation uses 32-bit multiply without overflow check: latent heap overflow
sys/net/netmap/netmap_mem2.c:927
 none reproduced not_testable untriaged — —
DF-0579 Info 0.5 Unbounded mbuf-to-stack copy in slstart BPF path: latent stack overflow
sys/net/sl/if_sl.c:536
 none reproduced not_testable untriaged — —
DF-0614 Info 0.5 NGM_CISCO_GET_IPADDR response sized with sizeof(ips) (pointer) instead of sizeof(*ips) (struct)
sys/netgraph/iface/ng_iface.c:697
 none reproduced fixed untriaged — —
DF-0964 Info 0.5 Missing bounds check on ivlen in cryptoapi_cipher_encrypt/decrypt (latent stack buffer overflow)
sys/crypto/cryptoapi/cryptoapi.c:1118
 none reproduced fixed untriaged — —
DF-1117 Info 0.5 re_rar_set reads 2 bytes past 6-byte MAC buffer via u_int32_t cast (benign OOB stack read)
sys/dev/netif/re/re.c:3903
 none reproduced not_testable untriaged — —
DF-1850 Info 0.5 ksprintf overflows 9-byte msp/dpl version string buffers by up to 2 bytes (lands in struct padding, no impact today)
sys/dev/video/bktr/bktr_audio.c:442
 none reproduced fixed untriaged — —
DF-2013 Info 0.5 sili_pci_detach leaves sc_pregs dangling (typo nulls sc_regs twice)
sys/dev/disk/sili/sili_attach.c:375
 panic reproduced fixed untriaged — —
DF-2179 Info 0.5 Signed-integer overflow UB in SM() shift of EEPROM antdiv_ctl1
sys/dev/netif/ath/ath_hal/ar9002/ar9285_diversity.c:98
 none reproduced fixed untriaged — —
DF-2388 Info 0.5 Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:210
 — — — untriaged — —
DF-2440 Info 0.5 _table() passes DM_MAX_PARAMS_SIZE instead of remaining buffer space to ksnprintf (latent OOB-write enabler)
sys/dev/disk/dm/delay/dm_target_delay.c:183
 — — — untriaged — —
DF-2162 Info 0.3 parent_dmat DMA tag leaked on bt_pci_attach error paths
sys/dev/disk/buslogic/bt_pci.c:142
 none reproduced fixed untriaged — —
DF-1461 High — Premature kfree of persistent per-slot swdesc in txp_rxbuf_reclaim error path causes UAF and double-free
sys/dev/netif/txp/if_txp.c:793
 panic reproduced not_testable untriaged — —
DF-1977 High — destroy_workqueue is #if 0 no-op; drain_workqueue does not wait for in-flight works; driver teardown UAF + permanent memory/thread leak
sys/dev/drm/linux_workqueue.c:243
 none inconclusive — untriaged — —
DF-1687 Low — agp: agp_close frees all GART state and clears as_isopen on EVERY close, not on last close
sys/dev/agp/agp.c:789
 dos reproduced fixed untriaged — —

Privilege escalation (general use) 148

Missing/wrong privilege checks, credential handling bugs, and anything already driven to uid=0 — general-use-case paths.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2929 High 8.8 systimer_init_oneshot() bzero of a queued timer silently corrupts gd_systimerq; reached via DRM hrtimer_start re-arm on every i915 auto-forcewake register access
sys/kern/kern_systimer.c:360 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2738 Medium 8.1 CTLFLAG_PRISON never enforced: jailed uid-0 can write host-global sysctls (kern.maxfiles, kern.securelevel, debug.*, net.*, vm.*)
sys/kern/kern_sysctl.c:1438 · pass 2 · new
 dos reproduced inconclusive untriaged — —
DF-2950 Medium 7.9 Jailed uid-0 passes the sysctl write gate and can write every host-global RW MIB defined here — kern.securelevel raised irreversibly from inside a jail (host root gets EPERM lowering it), plus kern.hostid/domainname/bootfile/maxprocperuid/maxposixlocksperuid/tls_extra corruption; CTLFLAG_PRISON is dead
sys/kern/kern_mib.c:142 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2815 Medium 7.8 Unserialized global dumper: set_dumper() EBUSY-check TOCTOU / torn struct copy, and clear-or-swap landing during an active dumpsys() → NULL di->priv dereferenced by dev_ddump() (kernel page fault while dumping) and torn-geometry dump misdirection to the wrong device
sys/kern/kern_shutdown.c:948 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2900 Low 7.8 procfs_rwmem ignores kmem_alloc_pageable failure — kva=0 reaches pmap_kenter_quick(0,pa), overwriting pml4[0] of the current user pmap (page-table pivot) plus uiomove on VA 0
sys/vfs/procfs/procfs_mem.c:101 · pass 2 · new
 — — — untriaged — —
DF-3009 High 7.5 Zero-length SunRPC record mark from an NFS/TCP server returns a NULL reply mbuf — nfs_reply() dereferences mtod(NULL), deterministic client kernel panic
sys/vfs/nfs/nfs_socket.c:648 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2716 High 7.1 nlookup() misclassifies a leaf component followed by a trailing slash as an intermediate directory, dropping NLC_STICKY/NLC_APPENDONLY feedback — sticky-bit and append-only-directory deletion/rename restriction bypass
sys/kern/vfs_nlookup.c:653 · pass 2 · new
 authz_bypass (sticky-bit / append-only-dir deletion+rename restriction bypass; not uid0/panic/leak class) reproduced fixed untriaged — —
DF-2769 High 7.0 Stale unix98 pty master re-open admitted by ptcopen (ptcclose disarms all gates): cross-user session takeover with root command injection when /dev/ptm is exposed by devfs rules
sys/kern/tty_pty.c:585 · pass 2 · new
 uid0 → root reproduced fixed untriaged — —
DF-2800 Medium 6.7 prison_priv_check allows SYSCAP_NOSETTIME in jails — jailed uid-0 sets the HOST system clock (settimeofday/clock_settime/adjtime/ntp_adjtime)
sys/kern/kern_jail.c:858 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2898 Medium 6.5 sysent[0]/sysent[198] indirect-syscall gateway dispatches itself: unprivileged one-line syscall(SYS_syscall,0) deterministically panics the kernel (double fault on the kernel-stack guard)
sys/kern/init_sysent.c:17 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2963 Medium 6.5 GPT entry #127 maps to slice index 128, which dkmakeminor() silently truncates to 7 bits: duplicate major:minor cdevs and s127<->s0 cross-slice data aliasing (reads AND writes)
sys/kern/subr_diskgpt.c:175 · pass 2 · new
 data_integrity_aliasing reproduced fixed untriaged — —
DF-2799 Medium 5.6 AB-BA kernel deadlock: jail_lock vs per-CPU gd_sysctllock — unprivileged `sysctl jail.list` readers vs root jail(2) permanently wedge the kernel
sys/kern/kern_jail.c:275 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2667 Medium 5.5 Unprivileged kernel NULL-pointer panic via mountctl(2) MOUNTCTL_MOUNTFLAGS with buflen=0: vfs_flagstostr() strlens a NULL buffer before its degenerate-length guard
sys/kern/vfs_syscalls.c:1281 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2759 Medium 5.5 Unprivileged kernel-log/kernel-pointer disclosure channel: default-config UCONSOLE lets any user's pty become constty and subr_prf.c streams all kernel messages to it, bypassing security.unprivileged_read_msgbuf and nullifying ptr_restrict against the %p leak population
sys/kern/subr_prf.c:396 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2834 Medium 5.5 Unbounded vmspace allocation in sys_vmspace_create: no per-process cap, each create pins a wired PML4 page + 8KB KVA + vmspace struct → unprivileged kernel-memory exhaustion DoS (requires vm.vkernel_enable=1)
sys/vm/vm_vmspace.c:146 · pass 2 · new
 — — — untriaged — —
DF-2979 Medium 5.3 physio consumes stale/uninitialized b_resid from the shared pbuf_mem pool and copyouts stale bounce-buffer contents before the B_ERROR check — failed raw reads disclose other contexts' kernel-resident I/O data
sys/kern/kern_physio.c:98 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2795 Medium 4.7 msgsnd missing sequence-number revalidation after tsleep: stale sleeper injects into an IPC_RMID'd-and-reallocated queue (cross-user message injection)
sys/kern/sysv_msg.c:605 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2697 Medium 4.4 vaccess() grants group file-access permissions from the SAVED gid (cr_svgid): kernel-enforced group privileges survive setegid()/setgid() drops (POSIX mqueue access control fail-open)
sys/kern/vfs_subr.c:1752 · pass 2 · new
 access_bypass reproduced fixed untriaged — —
DF-2915 Medium 4.4 sleepq_lock() trusts uninitialized objcache memory: first use of the API on any chain panics (INVARIANTS) or corrupts the chain with a garbage wchan entry and live-locks the allocator loop (production)
sys/kern/subr_sleepqueue.c:145 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3001 Low 4.3 hammer_vop_setattr applies va_atime/va_mtime with no ownership/privilege check (VFS-contract divergence vs UFS): NFS SETATTR can forge timestamps on any file in an exported HAMMER1 filesystem
sys/vfs/hammer/hammer_vnops.c:2345 · pass 2 · new
 — — — untriaged — —
DF-2791 Low 4.1 sys_rtprio() NULL lwp dereference on processes in the fork (SIDL) window — unprivileged EFAULT read of &((struct lwp*)0)->lwp_rtprio; privileged raw kernel write to 0x198 panics the kernel
sys/kern/kern_resource.c:704 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2874 Info 3.4 DIOCRECLUSTER has no privilege check and the kernel services dmsg peers with root credentials (raw RW with proc0.p_ucred, no open/keyid validation on I/O) — gated today only by diskopen's SYSCAP_RESTRICTEDROOT
sys/kern/subr_diskiocom.c:108 · pass 2 · new
 none not_reproduced fixed untriaged — —
DF-2867 Medium 3.3 ktrsyscall copies the unfetched argument tail of sysmsg.extargs into the trace file: unprivileged self-tracing leaks stale kernel-stack words (groom-echo + kernel-canonical pointers) from failed stack-argument fetches
sys/kern/kern_ktrace.c:111 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2706 Low 3.3 kern.proc.pid.<pid> sysctl bypasses security.ps_showallprocs — unprivileged full kinfo_proc disclosure of any process (incl. root, plus kernel-heap pointers)
sys/kern/kern_proc.c:1686 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2927 Low 3.3 debug.dump_modinfo sysctl is world-readable and discloses kernel pointers (kernel base, module load addresses, SSYM/ESYM, _DYNAMIC, ENVP, KERNEND)
sys/kern/subr_module.c:373 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2932 Low 3.3 Kernel v1 UUIDs disclose the host's real NIC MAC and exact wall-clock generation time to any unprivileged user (RFC 4122 sec 6 privacy exposure)
sys/kern/kern_uuid.c:86 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2955 Low 3.3 fattime2timespec: 32-bit unsigned DAY*day multiply wraps — every valid FAT date 2106-02-08..2107-12-31 decodes ~55.7 years in the past (2107-12-31 → 1971-11-23)
sys/kern/subr_fattime.c:233 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3024 Low 3.3 tmpfs_chtimes applies va_atime/va_mtime with no ownership/VA_UTIMES_NULL check — non-owner timestamp forgery (DF-3001 contract analog, locally reachable)
sys/vfs/tmpfs/tmpfs_vnops.c:486 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-3080 Info 3.3 /proc/0 makes kernel-internal proc0 (swapper) addressable and readable by unprivileged users (atopid("0") slips past the NO_PID guard into pfs_pfind(0)→&proc0)
sys/vfs/procfs/procfs_vnops.c:798 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2966 Low 2.5 net_add_domain publishes a domain into the global domains list before net_init_domain stubs its NULL pru_* entries — a socket created in the kldload window dispatches a NULL function pointer in the netisr protocol thread (guaranteed panic)
sys/kern/uipc_domain.c:137 · pass 2 · new
 — — — untriaged — —
DF-2935 Info 2.5 Kernel-internal VOP_ACCESS(3-arg) callers silently get access(2)-style REAL-ID authorization semantics from vop_helper_access
sys/kern/vfs_helper.c:88 · pass 2 · new
 — — — untriaged — —
DF-2794 Info 1.9 sys_lwp_rtprio() with tid == -1 ignores the target pid and always operates on the caller's own lwp
sys/kern/kern_resource.c:588 · pass 2 · new
 — — — untriaged — —
DF-2852 Info 1.1 dev_dmmap/dev_dpsize don't preset a_result; dead dev_dclone never initializes a_name/a_namelen/a_cred/a_mode — uninitialized kernel stack passed to drivers by the dispatch shim
sys/kern/kern_device.c:261 · pass 2 · new
 — — — untriaged — —
DF-2743 Info 0.8 DIOCGKERNELDUMP handled with no privilege check or FWRITE gate (diskioctl → disk_dumpconf → set_dumper)
sys/kern/subr_disk.c:1186 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-0165 High 8.4 caps_priv_check corrupts cap argument before prison_priv_check: bypasses per-cap jail policy (raw sockets + mounts in jail)
sys/kern/kern_caps.c:333
 jail-policy bypass reproduced fixed untriaged — —
DF-2511 High 8.4 Unvalidated controller-supplied subq_id and cmd_id in nvme_poll_completions enable kernel memory corruption
sys/dev/disk/nvme/nvme.c:713
 none not_reproduced not_testable untriaged — —
DF-1010 Low 7.8 fwohci_ioctl performs privileged OHCI register/PHY/DMA operations without priv_check_cred
sys/bus/firewire/fwohci.c:333
 none reproduced fixed untriaged — —
DF-0768 Medium 7.4 nfs_readdirplusrpc_uio signed-overflow in nfsm_rndup(i) corrupts RPC reply cursor — kernel memory info leak via getdents or panic
sys/vfs/nfs/nfs_vnops.c:2924
 panic reproduced fixed untriaged — —
DF-2418 Medium 7.4 Missing bounds check on device-controlled NCQ error tag causes OOB heap read/write in ahci_port_read_ncq_error
sys/dev/disk/ahci/ahci.c:3488
 none not_reproduced not_testable untriaged — —
DF-0141 High 7.3 Missing privilege check in sys_vquotactl: any user can set/read all quotas
sys/kern/vfs_quota.c:328
 dos reproduced fixed untriaged — —
DF-2300 Medium 7.3 Missing privilege check in FWOHCI_WRREG/RDREG ioctl allows operator-group users to write arbitrary OHCI hardware registers
sys/bus/firewire/fwohci.c:354
 — — — untriaged — —
DF-0769 High 7.1 hammer_vop_readdir OOB kernel-heap read / info leak via forged direntry data_len underflow
sys/vfs/hammer/hammer_vnops.c:1728
 panic (GENERIC/INVARIANTS ON); ~49160-byte kernel-heap info leak (production/INVARIANTS OFF) reproduced fixed untriaged — —
DF-2221 High 7.1 ar5312EepromRead unbounded OOB read of radio-config buffer reachable from unprivileged SIOCGATHDIAG/HAL_DIAG_EEREAD
sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:37
 none not_reproduced not_testable untriaged — —
DF-0931 Medium 7.1 setuid/setgid bit bypass in ffs_write via int truncation of size_t uio_resid
sys/vfs/ufs/ufs_readwrite.c:220
 uid0 → root reproduced fixed untriaged — —
DF-2236 Medium 7.1 iconv_xlat16_open trusts attacker-controlled cp_data size causing OOB heap read and NULL-deref panic
sys/libiconv/iconv_xlat16.c:68
 panic reproduced fixed untriaged — —
DF-1645 Medium 6.7 Unchecked / signedness-buggy msg->index allows OOB read+write of vinum SD/DRIVE/PLEX/VOL arrays via VINUM_SETSTATE(_FORCE)
sys/dev/raid/vinum/vinumstate.c:848
 panic reproduced fixed untriaged — —
DF-2278 Low 6.7 CAM_DATA_PHYS / CAM_SG_LIST_PHYS accepted by pass allowing user-supplied raw physical DMA addresses to reach the SIM
sys/bus/cam/scsi/scsi_pass.c:565
 — — — untriaged — —
DF-2350 Medium 6.2 Heap OOB read in VS frame descriptor interval parsing leaks kernel memory to userspace
sys/bus/u4b/uvc/uvc_drv.c:1900
 none not_reproduced not_testable untriaged — —
DF-0536 Medium 6.1 Unprivileged kernel heap over-read via non-NUL-terminated sg_data in ng_connect_data
sys/netgraph7/socket/ng_socket.c:752
 leak reproduced fixed untriaged — —
DF-0778 Medium 6.1 ufs_readlink OOB read / panic via i_size truncation to int — crafted FFS image heap info leak or DoS
sys/vfs/ufs/ufs_vnops.c:1740
 panic reproduced fixed untriaged — —
DF-2200 Medium 6.1 Missing runtime bounds check on gpio in 4/5 entry points (sibling of DF-2199)
sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c:42
 dos reproduced fixed untriaged — —
DF-0588 Medium 6.0 tunwrite leaks mbuf chain on unsupported address family (m_freem(m) vs m_freem(top))
sys/net/tun/if_tun.c:875
 dos reproduced fixed untriaged — —
DF-2246 Medium 6.0 Destructive DDB sysctls (debug.panic/panic2/enter_debugger) have no jail confinement: jailed root can crash or freeze entire host
sys/ddb/db_sysctl.c:56
 dos reproduced fixed untriaged — —
DF-1643 Low 5.8 Missing caps_priv_check on destructive ATA ioctls (IOCATADETACH/ATTACH/REINIT/REQUEST)
sys/dev/disk/nata/ata-all.c:369
 none reproduced fixed untriaged — —
DF-0272 High 5.5 Missing ifnet_unlock on error paths in SIOCAIFGROUP/SIOCDIFGROUP/SIOCGIFGROUP/SIOCSIFDESCR: permanent ifnet_mtx deadlock
sys/net/if.c:2389
 dos reproduced fixed untriaged — —
DF-0680 Medium 5.5 NULL-pointer dereference / local kernel panic via getsockopt on RFCOMM socket with unknown option (rfcomm_socket.c:121-126)
sys/netbt/rfcomm_upper.c:562
 panic reproduced fixed untriaged — —
DF-0682 Medium 5.5 NULL-deref panic in l2cap_ctloutput getsockopt path (l2cap_socket.c:126-131) — same defect class as DF-0680
sys/netbt/l2cap_upper.c:521
 panic reproduced fixed untriaged — —
DF-0829 Medium 5.5 HPFS EA ioctls walk past fn_int using unvalidated on-disk fn_ealen — kernel heap info leak via copyout
sys/vfs/hpfs/hpfs_vnops.c:144
 leak:65540 reproduced fixed untriaged — —
DF-0921 Medium 5.5 Missing privilege check in /proc/<pid>/map exposes VM layout and mapped file paths of any process
sys/vfs/procfs/procfs_map.c:56
 leak reproduced fixed untriaged — —
DF-1116 Medium 5.5 Integer divide-by-zero panic in fwdma_malloc_multiseg via esize==0 (FW_SSTBUF psize=0)
sys/bus/firewire/fwdma.c:153
 panic reproduced not_testable untriaged — —
DF-1434 Medium 5.5 CDRIOCSETBLOCKSIZE with arg=0 causes kernel divide-by-zero panic via rounddown()
sys/dev/disk/nata/atapi-cd.c:723
 none inconclusive — untriaged — —
DF-1520 Medium 5.5 Heap OOB read in ath_hal_getregdump via HAL_DIAG_REGS — loop bound on output space, not on input array size
sys/dev/netif/ath/ath_hal/ah.c:848
 none inconclusive — untriaged — —
DF-1521 Medium 5.5 NULL-deref kernel panic via HAL_DIAG_REGS / HAL_DIAG_EEREAD when caller passes result=NULL or args=NULL
sys/dev/netif/ath/ath_hal/ah.c:880
 none inconclusive — untriaged — —
DF-2052 Medium 5.5 DFS_SET_THRESH dereferences indata without verifying ATH_DIAG_IN was set (NULL-pointer-deref panic)
sys/dev/netif/ath/ath_dfs/null/dfs_null.c:260
 panic reproduced fixed untriaged — —
DF-0361 Low 5.5 Default netmap ioctl passthrough fabricates zeroed stack struct socket passed to ifioctl
sys/net/netmap/netmap.c:1488
 none reproduced fixed untriaged — —
DF-1819 Low 5.5 ar5210_misc: NULL pointer write in HAL_DIAG_EEREAD via ar5210GetDiagState (unprivileged local DoS)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c:624
 none reproduced not_testable untriaged — —
DF-0522 Medium 5.3 thread0 root-credential fallback for socket operations (DF-0510 v1 twin)
sys/netgraph/ksocket/ng_ksocket.c:559
 none not_reproduced not_testable untriaged — —
DF-2135 Low 5.3 Missing smc_idx_lock around SMC indirect SRAM register access in radeon kv_smc.c (radeon twin of DF-2130)
sys/dev/drm/radeon/kv_smc.c:75
 none reproduced fixed untriaged — —
DF-1217 Medium 5.2 Unprivileged users get raw I2C-bus, EEPROM-write, and GPIO control over the capture card
sys/dev/video/bktr/bktr_core.c:2058
 none inconclusive not_testable untriaged — —
DF-2219 Medium 5.2 Unbounded array index in encode_pcie_lane_width() allows OOB .rodata read via crafted GPU VBIOS
sys/dev/drm/amd/powerplay/hwmgr/pppcielanes.c:56
 none not_reproduced not_testable untriaged — —
DF-2122 Medium 5.1 vinum_rqinfo: signed negative index yields out-of-bounds kernel-memory read past rqinfo[]
sys/dev/raid/vinum/vinummemory.c:219
 panic reproduced fixed untriaged — —
DF-2130 Medium 4.7 Missing smc_idx_lock spinlock on all SMC SRAM register access -- race condition corrupts GPU power-management state
sys/dev/drm/amd/amdgpu/kv_smc.c:78
 none reproduced fixed untriaged — —
DF-2140 Medium 4.7 NULL pointer dereference in construct() under memory pressure -> kernel panic
sys/dev/drm/amd/display/dc/core/dc_surface.c:42
 panic reproduced fixed untriaged — —
DF-2586 Medium 4.7 sysctl_kern_msgbuf OOB kernel-memory read via unsigned underflow in linear-section length
sys/kern/subr_prf.c:1177
 panic reproduced fixed untriaged — —
DF-2053 Low 4.7 Error-cleanup NULL-deref + refcount leak in amdgpu_bo_list_create iterates wrong indices (dormant: userptr disabled on DFBSD)
sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:142
 panic reproduced fixed untriaged — —
DF-2108 Low 4.7 Unchecked JOY_SOFTC() return dereferences NULL across all four dev entry points (local DoS / panic)
sys/dev/misc/joy/joy.c:157
 panic reproduced fixed untriaged — —
DF-2118 Low 4.7 NULL-deref panic in amdgpu_dig_monitor_is_duallink when encoder has no linked connector
sys/dev/drm/amd/amdgpu/amdgpu_encoders.c:196
 panic reproduced fixed untriaged — —
DF-2225 Low 4.7 _PROP_ONCE_RUN sets completion flag before calling init racing concurrent first-user into NULL-deref on uninitialized rb_tree
sys/libprop/prop_dictionary.c:288
 — — — untriaged — —
DF-0621 Medium 4.6 Privilege bypass: rip6_output uses cr_uid==0 instead of caps_priv_check for per-packet IPv6 options
sys/netinet6/raw_ip6.c:297
 none not_reproduced not_testable untriaged — —
DF-0510 Medium 4.5 Credential bypass via thread0 fallback in socket operations: root creds for all ksocket ops
sys/netgraph7/ksocket/ng_ksocket.c:546
 none not_reproduced not_testable untriaged — —
DF-0436 Medium 4.4 Heap OOB read + security-filter bypass via OGF=0/event=0: negative bitstr index into ng_btsocket_hci_raw_sec_filter
sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:669
 none not_reproduced not_testable untriaged — —
DF-0761 Medium 4.4 ipfw3 sockopt path bypasses securelevel>=3 firewall-mutability gate — missing check present in all sibling glue layers
sys/net/ipfw3/ip_fw3_glue.c:50
 policy-bypass reproduced fixed untriaged — —
DF-1633 Medium 4.4 drm_gem_mmap_single skips per-file access control, allowing any local DRM client to mmap arbitrary GEM objects via brute-forceable offset
sys/dev/drm/drm_gem.c:1082
 panic reproduced fixed untriaged — —
DF-2343 Medium 4.4 Divide-by-zero and OOB read in umcs7840_calc_baudrate when rate==0
sys/bus/u4b/serial/umcs.c:1066
 — — — untriaged — —
DF-0005 Low 4.4 TIOCSTI unrestricted terminal input injection with no killswitch
sys/kern/tty.c:1158
 none reproduced fixed untriaged — —
DF-1721 Low 4.4 amdgpu_gem: GEM_CREATE GDS-domain ALIGN(size,4) wrap to zero produces zero-size GEM object
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:248
 none reproduced fixed untriaged — —
DF-1722 Low 4.4 amdgpu_gem: GEM_VA ioctl VA-reserved-area bypass via HOLE_END then GMC_HOLE_MASK
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:566
 none reproduced fixed untriaged — —
DF-1975 Low 4.4 Unconditional kprintf debug spam in i915_gem_evict_something leaks GTT layout and enables local log/console DoS
sys/dev/drm/i915/i915_gem_evict.c:156
 none reproduced not_testable untriaged — —
DF-2004 Low 4.4 Missing zero-check on writable machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic
sys/dev/acpica/acpi_timer.c:310
 none reproduced not_testable untriaged — —
DF-2046 Low 4.4 dma_fence_default_wait returns negative value on clean timeout (unsigned wrap) misreported as error to unprivileged render clients
sys/dev/drm/linux_fence.c:124
 none reproduced fixed untriaged — —
DF-2201 Low 4.4 GPIO index unvalidated in 4/5 exported ar5212 HAL GPIO functions (HALASSERT compiled out; SetIntr has no check) -> UB shifts -> local DoS
sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:41
 dos reproduced fixed untriaged — —
DF-2241 Low 4.4 Signed divide/modulo by -1 on LONG_MIN triggers #DE trap leaking db_active wedging system after DDB exit
sys/ddb/db_expr.c:147
 — — — untriaged — —
DF-2264 Low 4.4 Control-device ioctl path leaks cam_periph_lock (SIM-wide deadlock)
sys/bus/cam/scsi/scsi_sa.c:849
 — — — untriaged — —
DF-2487 Low 4.4 Modifying ioctls (MPTIO_WRITE_CFG_PAGE MPTIO_RAID_ACTION) allowed via read-only file descriptor
sys/dev/disk/mpt/mpt_user.c:116
 — — — untriaged — —
DF-0409 Info 4.4 Unprivileged users can install IP source-route options (LSRR/SSRR) without privilege check
sys/netinet/ip_output.c:1097
 none reproduced not_testable untriaged — —
DF-0707 Low 4.1 Missing return after NG_FREE_ITEM in ng_etf_rcvdata — same pattern as DF-0696 (reduced impact in ng7)
sys/netgraph7/etf/ng_etf.c:377
 panic reproduced fixed untriaged — —
DF-1105 Low 4.1 NULL-pointer dereference panic via uhci_reset() in uhci_pci_attach error paths
sys/bus/u4b/controller/uhci_pci.c:286
 panic reproduced fixed untriaged — —
DF-0388 Medium 4.0 Kernel heap info leak via uninitialized rt_msghdr.rtm_inits in NET_RT_DUMP sysctl: no M_ZERO on buffer
sys/net/rtsock.c:1676
 leak:130bytes reproduced fixed untriaged — —
DF-0025 Low 4.0 Missing privilege check on sys_kldstat()/sys_kldsym() leaks kernel symbol and module addresses
sys/kern/kern_linker.c:940
 leak reproduced fixed untriaged — —
DF-2194 Low 3.6 Undefined-behavior mask in AcpiOsReadPciConfiguration zeroes all 32-bit PCI config reads
sys/dev/acpica/Osd/OsdHardware.c:96
 none reproduced fixed untriaged — —
DF-0188 Info 3.6 No defense-in-depth privilege check; acl_cnt not bounds-validated pre-VOP
sys/kern/kern_acl.c:74
 none reproduced not_testable untriaged — —
DF-2029 Info 3.6 iir_ioctl performs no privilege check on RAID management commands
sys/dev/raid/iir/iir_ctrl.c:221
 none reproduced fixed untriaged — —
DF-2199 Low 3.4 Missing/ineffective bounds checks on gpio pin in 4 of 5 entry points (UB in shift macros, register field corruption)
sys/dev/netif/ath/ath_hal/ar5312/ar5312_gpio.c:42
 dos reproduced fixed untriaged — —
DF-2379 Medium 3.3 Integer underflow in P-state sysctl readers leaks uninitialized kernel stack
sys/dev/acpica/acpi_cpu_pstate.c:1258
 none not_reproduced not_testable untriaged — —
DF-2557 Medium 3.3 Kernel stack info leak via SO_PASSCRED auto-created SCM_CREDS on AF_UNIX SOCK_DGRAM
sys/kern/uipc_usrreq.c:683
 leak:62 reproduced fixed untriaged — —
DF-0015 Low 3.3 Missing visibility/privilege check in kern.proc.pathname -> exe-path disclosure of arbitrary processes
sys/kern/kern_proc.c:2080
 leak reproduced fixed untriaged — —
DF-0120 Low 3.3 Unprivileged read of all kernel env variables (boot/loader secrets)
sys/kern/kern_environment.c:135
 leak:N reproduced fixed untriaged — —
DF-0135 Low 3.3 Integer overflow in l64_setdisklabel partition bounds check: p_boffset+p_bsize wraparound bypasses ENOSPC
sys/kern/subr_disklabel64.c:304
 none reproduced fixed untriaged — —
DF-0292 Low 3.3 Missing privilege check on SIOCG80211 (get path): unpriv info disclosure
sys/netproto/802_11/wlan/ieee80211_ioctl.c:3467
 leak reproduced fixed untriaged — —
DF-0499 Low 3.3 Unprivileged info disclosure: read-only L2CAP node ioctls (GET_CON_LIST, GET_CHAN_LIST) lack privilege check
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:850
 none reproduced fixed untriaged — —
DF-0814 Low 3.3 tmpfs_chmod swallows vop_helper_chmod error and always returns success — POSIX contract violation
sys/vfs/tmpfs/tmpfs_subr.c:1174
 none reproduced not_testable untriaged — —
DF-1218 Low 3.3 drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails
sys/dev/drm/drm_atomic_helper.c:2938
 none reproduced fixed untriaged — —
DF-1524 Low 3.3 Kernel pointer disclosure via unprivileged SIOCGATHNODERATESTATS rate-stats ioctl
sys/dev/netif/ath/ath_rate/sample/sample.c:1181
 leak:16 reproduced fixed untriaged — —
DF-1657 Low 3.3 radeon_uvd: destroy message missing filp ownership check -> cross-process UVD session teardown
sys/dev/drm/radeon/radeon_uvd.c:505
 none reproduced fixed untriaged — —
DF-1892 Low 3.3 Hardware-control sysctls exposed writable to unprivileged users (CTLFLAG_ANYBODY): local DoS via cpu_speed/backlight/fan
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:250
 none reproduced fixed untriaged — —
DF-2020 Low 3.3 DRM magic auth tokens leaked to unprivileged users via sysctl hw.dri.N.clients (cross-file drm_sysctl.c)
sys/dev/drm/drm_auth.c:58
 none reproduced not_testable untriaged — —
DF-2148 Low 3.3 Missing privilege check on PPS_IOC_KCBIND allows unprivileged kernel clock-discipline binding
sys/dev/misc/pps/pps.c:183
 none reproduced fixed untriaged — —
DF-2154 Low 3.3 Uninitialized kernel stack memory leaked to userspace via sysctl read of failing Sony ACPI node
sys/dev/acpica/acpi_sony/acpi_sony.c:183
 leak reproduced fixed untriaged — —
DF-2217 Low 3.3 Missing privilege check on NVMEIOCGETLOG allows unprivileged NVMe admin command execution
sys/dev/disk/nvme/nvme_ioctl.c:37
 none not_reproduced not_testable untriaged — —
DF-2391 Low 3.3 Uninitialized kernel stack leaked to unprivileged users via sysctl when ACPI get-method fails
sys/dev/acpica/acpi_sony/acpi_sony.c:183
 — — — untriaged — —
DF-0037 Info 3.3 sys_getpgid / sys_getsid lack cross-session visibility checks (unprivileged pgid/sid enumeration)
sys/kern/kern_prot.c:106
 leak:64bytes reproduced fixed untriaged — —
DF-1077 Info 3.3 Panic backtrace writes raw kernel addresses to world-readable msgbuf
sys/platform/pc64/x86_64/db_trace.c:211
 none reproduced not_testable untriaged — —
DF-2226 Info 3.3 Internalizer accepts empty <key></key> violating keysym non-empty invariant guarded by _PROP_ASSERT
sys/libprop/prop_dictionary.c:1334
 — — — untriaged — —
DF-1380 Low 3.0 Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel heap
sys/dev/drm/amd/amdgpu/atombios_encoders.c:2156
 none reproduced not_testable untriaged — —
DF-2213 Low 3.0 OOB read on piotiming[] via raw mode&ATA_MODE_MASK index writes garbage PIO timing to disk controller
sys/dev/disk/nata/chipsets/ata-cyrix.c:67
 — — — untriaged — —
DF-2372 Low 3.0 Undefined-behavior bit shift zeroes all 32-bit PCI config reads via ACPI
sys/dev/acpica/Osd/OsdHardware.c:96
 — — — untriaged — —
DF-0245 Medium 2.5 Per-cpu iowbytes counter underflow via thread migration accounting break
sys/kern/kern_iosched.c:79
 dos not_reproduced not_testable untriaged — —
DF-0022 Low 2.5 PPS_IOC_KCBIND missing privilege check allows unprivileged kernel-PLL binding (NTP confusion)
sys/kern/kern_clock.c:1680
 none reproduced fixed untriaged — —
DF-0190 Low 2.5 logopen performs no jail check beyond devfs file mode
sys/kern/subr_log.c:92
 none reproduced fixed untriaged — —
DF-0870 Low 2.5 Unprivileged kernel heap info leak via volume_list when device_name not NUL-terminated
sys/vfs/hammer/hammer_volume.c:107
 leak:device_path_string reproduced fixed untriaged — —
DF-1074 Low 2.5 nexus_deactivate_resource truncates MMIO size to 32 bits, leaving stale PTEs and orphaning KVA for >4 GiB BARs
sys/platform/pc64/x86_64/nexus.c:462
 none reproduced fixed untriaged — —
DF-1808 Low 2.5 ar5211_misc: HAL_DIAG_RFGAIN ioctl leaks kernel rodata pointer via embedded currStep pointer in GAIN_VALUES
sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680
 none reproduced not_testable untriaged — —
DF-2054 Low 2.5 Memory leak of userspace entry array on idr_alloc failure in BO_LIST_OP_CREATE
sys/dev/drm/amd/amdgpu/amdgpu_bo_list.c:285
 leak reproduced fixed untriaged — —
DF-0126 Info 2.5 TIOCCONS privilege check skipped when a_cred is NULL
sys/kern/tty_cons.c:486
 none reproduced not_testable untriaged — —
DF-0314 Info 2.5 Inconsistent privilege enforcement: RFC3542 GET path lacks priv check present in RFC2292 path
sys/netinet6/ip6_output.c:1942
 none reproduced not_testable untriaged — —
DF-0959 Info 2.5 KASSERT in old_dev_pager_fault checks paddr instead of dev_dmmap return value, never fires
sys/vm/device_pager.c:360
 none reproduced not_testable untriaged — —
DF-0080 Low 2.3 MEMRANGE_SET ioctl bypasses securelevel (mem_ioctl never checks FWRITE flag)
sys/kern/kern_memio.c:521
 none reproduced fixed untriaged — —
DF-0592 Low 2.3 Uninitialized kernel stack leaked to userspace via fairq_getqstats copyout of struct fairq_classstats
sys/net/altq/altq_fairq.c:282
 leak:176 reproduced fixed untriaged — —
DF-1631 Low 1.9 evdev_open leaks allocated client on every error path (memory-exhaustion DoS)
sys/dev/misc/evdev/evdev.c:118
 leak reproduced fixed untriaged — —
DF-1680 Low 1.9 lpt: backoff-clamp typo makes callout spin at 1-tick interval instead of backing off
sys/dev/misc/lpt/lpt.c:418
 dos reproduced fixed untriaged — —
DF-1993 Low 1.9 ath_btcoex_ioctl copies uninitialized kernel heap to userspace (latent; function currently has no caller)
sys/dev/netif/ath/ath/if_ath_btcoex.c:397
 none reproduced not_testable untriaged — —
DF-2031 Low 1.9 Resource leak in mfi_pci_attach when IRQ allocation fails (return bypasses cleanup)
sys/dev/raid/mfi/mfi_pci.c:288
 none reproduced not_testable untriaged — —
DF-1025 Info 1.9 Kernel pointer/function pointer leak via bcopy of full union ccb in CAMGETPASSTHRU
sys/bus/cam/cam_periph.c:888
 none reproduced not_testable untriaged — —
DF-1897 Info 1.9 mmhub_v1_0_get_clockgating missing return on SR-IOV VF path reads host-managed registers
sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548
 none reproduced not_testable untriaged — —
DF-2139 Info 1.9 Raw RDRAND entropy bytes logged to world-readable kernel message buffer
sys/dev/crypto/rdrand/rdrand.c:175
 leak reproduced fixed untriaged — —
DF-2185 Info 1.9 backlight_lock is never lockinit()d — lockuninit() called instead during SYSINIT
sys/dev/misc/backlight/backlight.c:45
 panic reproduced fixed untriaged — —
DF-0427 Info 0.8 ip6_mrouter_set performs no explicit capability check: relies entirely on raw-socket attach privilege
sys/netinet6/ip6_mroute.c:265
 none reproduced not_testable untriaged — —
DF-1047 Info 0.5 Wrong loop bound (USB_DEV_QUIRKS_MAX vs USB_QUIRK_MAX) in USB_DEV_QUIRK_ADD/REMOVE quirk-name lookup
sys/bus/u4b/quirk/usb_quirk.c:883
 none reproduced fixed untriaged — —

Kernel memory leaks / uninitialized disclosure 657

Uninitialized or OOB-read disclosure of kernel memory, pointer leaks, missing zeroization.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2910 Medium 8.2 disklabel64 read-path trust: crafted-media partition fields yield OOB absolute-media-offset I/O — cross-slice access, mod-2^64 wraparound slice escape, and ds_reserved EROFS label-area write bypass (concrete impact upgrade of DF-0134)
sys/kern/subr_disklabel64.c:183 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3027 High 7.9 fuse_vop_getattr returns success without initializing *a_vap (dead mount / ENOSYS-latched GETATTR) — unprivileged kernel-stack info leak incl. kernel pointers via stat()/fstat()
sys/vfs/fuse/fuse_vnops.c:312 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3048 High 6.1 s_inodes_count never validated against gcount*ipg — dirent inode numbers beyond the group-descriptor table OOB-read fs->e2fs_gd in ext2_vget
sys/vfs/ext2fs/ext2_vfsops.c:606 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2876 Medium 5.7 BLK_READ replies disclose stale shared pbuf-mem contents on EOF/error/short reads (cross-process, cross-device kernel-mediated info leak)
sys/kern/subr_diskiocom.c:594 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2698 Medium 5.5 hammer(1) MOUNTCTL_MOUNTFLAGS result-length double-count: unprivileged copyout reads up to ~U bytes past a kmalloc'd M_TEMP buffer (kernel heap pointer disclosure)
sys/vfs/hammer/hammer_vnops.c:2577 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2702 Medium 5.5 AF_UNIX SCM_RIGHTS raw kernel file-pointer leak via recvmsg(MSG_PEEK) — soreceive skips unp_externalize on the peek path
sys/kern/uipc_usrreq.c:1543 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2713 Medium 5.5 recvmsg(2) copies out uninitialized CMSG_SPACE tail padding of every kernel-built control message — unprivileged, groomable kernel heap disclosure
sys/kern/uipc_syscalls.c:1175 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2718 Medium 5.5 PT_INTERP interpreter string never NUL-terminated: kernel heap OOB read disclosed to unprivileged users via uprintf("ELF interpreter %s not found")
sys/kern/imgact_elf.c:668 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2952 Medium 5.5 Resident-exec stack remap silently fails (vm_map_stack KERN_NO_SPACE swallowed at imgact_resident.c:185): every exec of a registered binary runs on the registration snapshot's COW stack, disclosing the registering root process's stack contents to unprivileged exec'ers
sys/kern/imgact_resident.c:185 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2882 Medium 5.3 kvsscanf %*Nc suppress short-input branch leaves inr stale → conversions read past the input string's NUL (cross-object kernel heap disclosure into caller buffers)
sys/kern/subr_scanf.c:292 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2609 Low 5.3 Default-enabled ICMPv6 Node Information responder discloses hostname and full IPv6 address inventory to unauthenticated remote peers
sys/netinet6/icmp6.c:628 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3012 Medium 4.7 hammer(1) in-memory record permanently leaked when hammer_blockmap_reserve() fails in hammer_ip_add_bulk() (and on the namekey-exhaustion ENOSPC path of hammer_ip_add_direntry)
sys/vfs/hammer/hammer_object.c:711 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3065 Low 4.7 ext2_reallocblks feeds unclamped attacker-controlled pref (crafted i_db[]/indirect values via ext2_blkpref) into dtog() as the cg index — OOB heap reads of e2fs_gd[]/e2fs_maxcluster[]/e2fs_clustersum[] and wild device I/O (root-sysctl-gated)
sys/vfs/ext2fs/ext2_alloc.c:302 · pass 2 · new
 — — — untriaged — —
DF-2859 Low 4.5 sglist_split() trims `count` entries instead of the surviving remainder — stale/duplicated DMA segments and heap OOB read past the segs array (dead code; identical latent bug in FreeBSD HEAD)
sys/kern/subr_sglist.c:571 · pass 2 · new
 none reproduced fixed untriaged — —
DF-3040 Medium 4.4 Unbounded HAMMER_UNDO_INDEX indexes vol0_undo_array[128] out of bounds — attacker-aimed kernel heap OOB read (up to ~4GB reach) and deterministic panic at mount of a crafted HAMMER1 image
sys/vfs/hammer/hammer_ondisk.c:688 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2809 Low 4.4 "Unreadable program headers" check is warning-only: e_phoff/e_phnum bounds and the bytes-actually-read (nbytes) bound are never enforced → unbounded wild kernel read from firstpage+e_phoff and parsing of uninitialized heap for short files
sys/kern/link_elf.c:489 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2708 Medium 4.3 DMSG wire msgid discloses the kernel heap address of every kernel-initiated transaction state to the cluster peer (msgid = (uint64_t)(uintptr_t)state)
sys/kern/kern_dmsg.c:1804 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2847 Low 4.0 get_next_valid_apicid() -1 sentinel propagated unvalidated into get_cpuid_from_apicid(-1): OOB read of apic_id_to_cpu_id[-1] whose value is used, plus duplicate leaf member masks on exhaustion
sys/kern/subr_cpu_topology.c:100 · pass 2 · new
 — — — untriaged — —
DF-2793 Low 3.8 rtprio()/lwp_rtprio() omit PRISON_CHECK — jailed root can read any host process's realtime scheduling class and priority (cross-jail info leak)
sys/kern/kern_resource.c:582 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3057 Medium 3.6 dirfs_write clobbers the bread() error and ignores bwrite(): a failed block read is still modified and the whole 16KB block persisted — stale/foreign buffer data written into the target file (readable back) and failures reported as success
sys/vfs/dirfs/dirfs_vnops.c:740 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-3066 Low 3.6 ext2_nodealloccg honors unvalidated inode-bitmap content: reserved inode numbers (below first_ino) and tail bits (>= ipg) are allocatable — silent fs aliasing / OOB e2fs_gd[] reads via ino_to_cg
sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2684 Medium 3.3 World-readable sysctl kern.file exports raw kernel heap pointers (kinfo_file.f_file/f_data) and cross-user fd state (types/flags/offsets) to unprivileged users
sys/kern/kern_descrip.c:3464 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2695 Medium 3.3 sys_sendfile() copies out 8 bytes of uninitialized kernel stack (off_t sbytes) on every failing sendfile(2) — unprivileged kernel-pointer leak
sys/kern/uipc_syscalls.c:1594 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2854 Medium 3.3 sysctl_rman (hw.bus.rman) leaks uninitialized kernel stack beyond DF-0092's padding: r_devname/rm_descr bytes after the NUL (up to 31/entry, incl. live kernel pointers) exported to unprivileged readers
sys/kern/subr_rman.c:653 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2972 Medium 3.3 exec_shell_imgact() double-scan TOCTOU on the live first page: kernel reserves one interpreter line and copies another; stale recycled exec-args objcache bytes can be delivered to the interpreter as argv (kernel-heap info leak)
sys/kern/imgact_shell.c:75 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2783 Low 3.3 IPC_STAT (and dead SEM_STAT) copy out live kernel heap pointer sem_base to unprivileged users
sys/kern/sysv_sem.c:431 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2796 Low 3.3 World-readable sysctl kern.ipc.msqids dumps raw kernel msqid_ds array: live kernel heap pointers and other users' queue metadata without any permission check
sys/kern/sysv_msg.c:1072 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2838 Low 3.3 sotoxsocket()/ssbtoxsockbuf() never initialize structure padding — net.inet.tcp.pcblist leaks 8 uninitialized kernel-stack bytes per record to unprivileged users (incl. kernel-pointer halves)
sys/kern/uipc_socket2.c:188 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3081 Low 3.3 Ungated /proc/<pid>/file and /exe readlink discloses every process's full executable path (root daemons included) to unprivileged users
sys/vfs/procfs/procfs_vnops.c:147 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2689 Info 3.3 Leftover DEBUG kprintf in vm_pageout_scan_hold leaks kernel pointer and spams the console on the normal race-recovery path
sys/vm/vm_pageout.c:1932 · pass 2 · new
 none untested not_testable untriaged — —
DF-3036 Info 3.3 ffs_reallocblks reads start_ap[-1] (stack OOB) when a cluster spans direct→indirect blocks — DIAGNOSTIC-only
sys/vfs/ufs/ffs_alloc.c:430 · pass 2 · new
 — — — untriaged — —
DF-2611 Low 3.1 icmp6_redirect_output leaves target-link-layer-address option padding uninitialized (second leak site beyond DF-0329)
sys/netinet6/icmp6.c:2496 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2856 Info 3.0 Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors
sys/kern/subr_rman.c:257 · pass 2 · new
 — — — untriaged — —
DF-3049 Medium 2.5 s_desc_size unvalidated without the 64BIT feature — ext2_gd_csum() over-reads the group-descriptor heap allocation; console-printed crc is a kernel-heap disclosure oracle
sys/vfs/ext2fs/ext2_vfsops.c:549 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2886 Low 2.5 uiomovez() copyouts unbounded cnt from PAGE_SIZE-sized ZeroPage — OOB kernel heap read into userspace (latent: sole in-tree caller passes UIO_SYSSPACE)
sys/kern/kern_subr.c:241 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2890 Low 2.5 vm_contig_pg_alloc verify/alloc loops lack the vm_page_count bound — oversized size with permissive high reads one element past the end of vm_page_array
sys/vm/vm_contig.c:331 · pass 2 · new
 — — — untriaged — —
DF-2671 Info 2.5 extattr syscalls copyin() the 255-byte attribute name without a NUL-termination guarantee (latent stack OOB read)
sys/kern/vfs_syscalls.c:5224 · pass 2 · new
 none untested not_testable untriaged — —
DF-2734 Info 2.5 mapped_ioctl: heap/stack buffer passed to fo_ioctl uninitialized for IOC_NONE-direction ioctls (kmalloc without M_ZERO, no bzero)
sys/kern/sys_generic.c:674 · pass 2 · new
 — — — untriaged — —
DF-3033 Low 2.3 Kernel panic via unvalidated on-disk leaf->data_len used as getblk() size in hammer_io_direct_uncache_callback
sys/vfs/hammer/hammer_io.c:1948 · pass 2 · new
 — — — untriaged — —
DF-2862 Low 2.1 Heap OOB read in vfs_mountroot_try: strncpy(mf, cp, 96) leaves the parse buffer unterminated; ksscanf's strlen() and %80s copy adjacent heap bytes into devname, which kgetdiskbyname() prints to the console
sys/kern/vfs_conf.c:421 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2722 Low 1.9 kstrndup() reads one byte past the maxlen-bounded source when no NUL is present
sys/kern/kern_slaballoc.c:1324 · pass 2 · new
 — — — untriaged — —
DF-3052 Low 1.9 nfsm_request_bio early-abort path leaks the kmalloc'd struct nfsm_info and never runs the done() callback
sys/vfs/nfs/nfsm_subs.c:825 · pass 2 · new
 — — — untriaged — —
DF-2715 Info 1.9 Kernel-internal MSG_FNONBLOCKING/MSG_FBLOCKING state leaks into user-visible msg_flags on every recvmsg(2) from a non-blocking socket
sys/kern/uipc_syscalls.c:996 · pass 2 · new
 — — — untriaged — —
DF-3046 Info 1.7 TAG_OVERLOAD consumed without length validation — zero-length overload option at the end of an options region reads one byte past the region and adopts an arbitrary overload value
sys/vfs/nfs/bootp_subr.c:1283 · pass 2 · new
 — — — untriaged — —
DF-2613 Info 0.5 Off-by-one bounds checks in SES config-page walkers allow a 1-byte heap over-read past the 8192-byte sdata allocation
sys/bus/cam/scsi/scsi_ses.c:1311 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2822 Info 0.5 Latent boot-window OOB: csprng_pcpu aliases the single-element csprng_boot while APs are up, and read_random/add_buffer_randomness_src index it with unclamped gd_cpuid
sys/kern/kern_nrandom.c:495 · pass 2 · new
 — — — untriaged — —
DF-2887 Info 0.5 uiomove/uiomovez/uiomove_fromphys/ureadc walk the iovec array with no uio_iovcnt guard — OOB iov walk on any inconsistent uio
sys/kern/kern_subr.c:120 · pass 2 · new
 — — — untriaged — —
DF-1125 High 9.3 Unvalidated FCP response/sense lengths cause OOB read from kernel stack (24XX FC)
sys/dev/disk/isp/isp.c:5225
 leak inconclusive not_testable untriaged — —
DF-0570 High 8.2 Remote OOB read: inbound port/icmp_id indexed into alias arrays without bounds check
sys/net/ipfw3_nat/ip_fw3_nat.c:204
 leak reproduced fixed untriaged — —
DF-0775 High 8.2 RPC reply verifier-length integer overflow corrupts XDR cursor — wild pointer deref client kernel panic or OOB read
sys/vfs/nfs/nfs_socket.c:1498
 none not_reproduced not_testable untriaged — —
DF-0414 High 8.1 Unchecked ph->length in PPPoE discovery packets: remote heap OOB read via get_tag/scan_tags walk bound
sys/netgraph7/pppoe/ng_pppoe.c:1314
 panic reproduced fixed untriaged — —
DF-0457 High 8.1 Unchecked ph->length in PPPoE discovery: heap OOB read via tag-walk + heap info leak via echoed Relay-Session-Id (v1 twin of DF-0414)
sys/netgraph/pppoe/ng_pppoe.c:925
 leak:65535 reproduced not_testable untriaged — —
DF-1123 High 8.1 iwn_rx_done: missing upper bound on firmware-reported frame length allows OOB read of RX mbuf / kernel heap
sys/dev/netif/iwn/if_iwn.c:3069
 none not_reproduced not_testable untriaged — —
DF-1131 High 8.1 Heap OOB read in bwn_dma_rxeof via dr_rx_bufsize / descriptor bytecnt mismatch
sys/dev/netif/bwn/bwn/if_bwn.c:5486
 leak inconclusive not_testable untriaged — —
DF-1849 Medium 8.1 Missing upper-bound on attacker-controlled stream.len in fwe_as_input causes kernel heap over-read
sys/dev/netif/fwe/if_fwe.c:560
 none inconclusive — untriaged — —
DF-1857 High 7.9 BMP pixel/RLE decoders read data with no bounds check against file size: kernel-memory info leak + DoS
sys/dev/video/fb/bmp/splash_bmp.c:80
 leak:4096 reproduced fixed untriaged — —
DF-0912 High 7.8 fuse_audit_length validates daemon-claimed ohd->len (with integer underflow) instead of actual buffer size, unconditionally passes 3 opcodes
sys/vfs/fuse/fuse_util.c:87
 leak:80 reproduced fixed untriaged — —
DF-1468 High 7.8 VBIOS-supplied indices into clock-info arrays OOB read in processpptables.c
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1101
 panic reproduced fixed untriaged — —
DF-1469 High 7.8 VBIOS-supplied entry count trusted without validation against firmware image bounds
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:383
 panic reproduced fixed untriaged — —
DF-1634 High 7.8 Use of uninitialized heap memory in dm_target_crypt_destroy after failed init
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 panic reproduced fixed untriaged — —
DF-1088 Medium 7.8 No validation/stripping of dangerous user CCB flags allows privileged DMA to arbitrary physical memory and OOB reads
sys/bus/cam/scsi/scsi_pass.c:546
 none reproduced fixed untriaged — —
DF-0349 Medium 7.6 Heap OOB read in PREQ processing when target count is 0: (ndest-1) wraps to SIZE_MAX
sys/netproto/802_11/wlan/ieee80211_hwmp.c:311
 none inconclusive not_testable untriaged — —
DF-1292 Medium 7.4 Multi-segment RX reads overwritten descriptor length inflating m_len past cluster for heap OOB read
sys/dev/netif/age/if_age.c:2025
 none not_reproduced not_testable untriaged — —
DF-1211 High 7.3 OOB read+write in NCQ error recovery: device-controlled log-page tag indexes ap_ccbs without bounds check
sys/dev/disk/ahci/ahci.c:3488
 none not_reproduced not_testable untriaged — —
DF-0812 High 7.1 Unvalidated redo_data_bytes in HAMMER REDO recovery leaks kernel memory / panics on mount of crafted image
sys/vfs/hammer/hammer_recover.c:1296
 panic reproduced fixed untriaged — —
DF-0857 High 7.1 Missing ab_busycnt validation in hpfs_hpbmap allows OOB heap read via crafted fnode/alsec
sys/vfs/hpfs/hpfs_alsubr.c:74
 panic reproduced fixed untriaged — —
DF-0878 High 7.1 Missing SUSP entry-length bounds check in cd9660_rrip_loop enables OOB heap read and kernel memory info leak
sys/vfs/isofs/cd9660/cd9660_rrip.c:509
 leak:250 reproduced fixed untriaged — —
DF-0914 High 7.1 ufs_bmaparray OOB read of indirect block buffer via unvalidated fs_nindir
sys/vfs/ufs/ufs_bmap.c:221
 panic reproduced fixed untriaged — —
DF-0927 High 7.1 hpfs_genlookupbyname walks attacker dirent chain with no buffer bound, no reclen validation, and no DE_DOWN cycle guard
sys/vfs/hpfs/hpfs_lookup.c:73
 panic reproduced fixed untriaged — —
DF-1257 High 7.1 Integer overflow in offset+size bounds check in amdgpu_vm_bo_map enables OOB read in amdgpu_vm_bo_split_mapping
sys/dev/drm/amd/amdgpu/amdgpu_vm.c:2509
 none not_reproduced not_testable untriaged — —
DF-1286 High 7.1 SPROM rev4/5/8 TXPID parser reads kernel heap at negative array indices (unported offset constants)
sys/dev/netif/bwn/siba/siba_core.c:1591
 leak:32 reproduced not_testable untriaged — —
DF-1333 High 7.1 OOB kernel-heap read in rv7xx_parse_power_table via unchecked VBIOS offsets and indices
sys/dev/drm/radeon/rv770_dpm.c:2284
 none inconclusive not_testable untriaged — —
DF-1401 High 7.1 Missing bounds check on nonClockInfoIndex causes OOB read past NonClockInfoArray
sys/dev/drm/radeon/trinity_dpm.c:1774
 dos reproduced not_testable untriaged — —
DF-1402 High 7.1 Missing bounds check on vce_states[].clk_idx causes OOB read past ClockInfoArray
sys/dev/drm/radeon/trinity_dpm.c:1809
 dos reproduced not_testable untriaged — —
DF-1510 High 7.1 Unbounded autosense bcopy leaks kernel heap and corrupts the CCB
sys/dev/disk/advansys/adwcam.c:383
 leak:heap reproduced not_testable untriaged — —
1084 Medium 7.1 crom_init_context() trusts attacker-controlled info_len, allowing root-directory pointer to land past the csrrom buffer
sys/bus/firewire/fwcrom.c:67
 leak:1024bytes reproduced fixed untriaged — —
DF-0286 Medium 7.1 Missing length validation in mesh action frame handler: OOB read of stale data
sys/netproto/802_11/wlan/ieee80211_mesh.c:2548
 none inconclusive not_testable untriaged — —
DF-0458 Medium 7.1 Heap over-read / info-leak / panic in L2CA_Ping: missing echo-data length validation
sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c:1306
 leak:65531bytes reproduced not_testable untriaged — —
DF-0554 Medium 7.1 Missing min frame-length check + unsigned STEPBY underflow: kernel heap OOB read in LMI parser
sys/netgraph/lmi/ng_lmi.c:552
 leak:3 reproduced fixed untriaged — —
DF-1181 Medium 7.1 Heap OOB read via unbounded vddInd/vddciInd/mvddInd into 4-8 entry voltage lookup tables
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:635
 none not_reproduced not_testable untriaged — —
DF-1607 Medium 7.1 Off-by-one out-of-bounds read in CMI enum-value loop
sys/dev/acpica/acpi_hp/acpi_hp.c:931
 panic reproduced fixed untriaged — —
DF-0327 Low 7.1 ieee80211_ies_expand walks IE blob with no length validation: OOB read
sys/netproto/802_11/wlan/ieee80211_node.c:982
 none reproduced fixed untriaged — —
DF-0249 Low 7.0 Driver b_resid>b_bcount underflows iolen to huge size_t: oversized copyout leaks kernel heap
sys/kern/kern_physio.c:112
 leak reproduced fixed untriaged — —
DF-1157 High 6.8 wpi_rx_done reads tail and sets m_len from unbounded firmware head->len (OOB read / heap info-leak)
sys/dev/netif/wpi/if_wpi.c:1959
 none not_reproduced not_testable untriaged — —
DF-1124 Medium 6.8 iwn5000_rx_calib_results: signed integer underflow on firmware length and unbounded heap copy from RX buffer
sys/dev/netif/iwn/if_iwn.c:3353
 leak:12288 reproduced not_testable untriaged — —
DF-1369 Medium 6.8 Unvalidated SMID in reply descriptors allows NULL-deref panic and heap OOB write
sys/dev/raid/mps/mps.c:1515
 none inconclusive — untriaged — —
DF-1439 Medium 6.8 Wild OOB read in sumo_get_valid_engine_clock when num_max_dpm_entries==0
sys/dev/drm/radeon/sumo_dpm.c:1037
 none inconclusive — untriaged — —
DF-1478 Medium 6.8 my_rxeof trusts 12-bit NIC-reported FLNG as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/my/if_my.c:1105
 none inconclusive — untriaged — —
DF-1490 Medium 6.8 epic_rx_done trusts 16-bit NIC-reported rxlength as m_len with no MCLBYTES bound: large OOB heap read past RX mbuf cluster (16-bit field)
sys/dev/netif/tx/if_tx.c:557
 none inconclusive — untriaged — —
DF-1517 Medium 6.8 Missing MCLBYTES upper-bound check on rs->rs_datalen allows kernel heap OOB read via crafted wifi frames
sys/dev/netif/ath/ath/if_ath_rx.c:730
 none inconclusive — untriaged — —
DF-1519 Medium 6.8 lge_rxeof trusts 16-bit NIC-reported LGE_RXBYTES as m_len / m_devget copy length without jumbo-buffer bound: up to 56519-byte OOB heap read
sys/dev/netif/lge/if_lge.c:870
 none inconclusive — untriaged — —
DF-1554 Medium 6.8 Malformed _CST leaving cst_cx_count==0 causes heap OOB read in set_lowest_oncpu and NULL-deref panic in idle
sys/dev/acpica/acpi_cpu_cstate.c:530
 none inconclusive — untriaged — —
DF-1562 Medium 6.8 pcn_rxeof trusts 16-bit NIC-reported pcn_rxlen as m_len without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/pcn/if_pcn.c:798
 none inconclusive — untriaged — —
DF-1566 Medium 6.8 VBIOS-controlled VCE/UVD clock-info index and table entry counts are not bounds-checked against the BIOS allocation
sys/dev/drm/radeon/r600_dpm.c:1104
 none inconclusive — untriaged — —
DF-2005 Medium 6.8 Missing VBIOS PowerPlay table size validation allows heap out-of-bounds read
sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c:64
 none inconclusive fixed untriaged — —
DF-1528 Medium 6.6 Missing bounds validation of firmware-provided RAID map fields enables out-of-bounds kernel reads on every IO
sys/dev/raid/mrsas/mrsas_fp.c:1428
 none inconclusive — untriaged — —
DF-2055 Medium 6.6 Integer underflow in drm_gem_fb_create_with_funcs accepts undersized GEM buffers (size check bypass via (height-1) wraparound)
sys/dev/drm/drm_gem_framebuffer_helper.c:161
 panic reproduced fixed untriaged — —
DF-0494 High 6.5 Remote unauthenticated kernel heap+stack memory disclosure via ARP reply using attacker-controlled ar_hln/ar_pln
sys/netinet/if_ether.c:1182
 leak:190bytes reproduced fixed untriaged — —
DF-0542 High 6.5 inquiry_result: unbounded variable-length loop reads past mbuf end -> remote kernel panic
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:380
 none not_reproduced not_testable untriaged — —
DF-0207 Medium 6.5 Memory leak in clist_alloc_cblocks: old c_data never freed on resize
sys/kern/tty_subr.c:61
 leak reproduced fixed untriaged — —
DF-0560 Medium 6.5 hci_event_command_compl: reads status byte beyond asserted length -> short-event remote kernel panic
sys/netbt/hci_event.c:299
 panic not_reproduced not_testable untriaged — —
DF-0562 Medium 6.5 STEPBY unsigned underflow via missing minimum length check (LMI_MIN_LENGTH defined never used) — ng7 twin of DF-0554
sys/netgraph7/lmi/ng_lmi.c:88
 leak:3 not_reproduced not_testable untriaged — —
DF-0611 Medium 6.5 Missing IP-length / ip_hl validation in ng_nat_rcvdata allows OOB access of mbuf trailing area
sys/netgraph7/ng_nat.c:690
 none not_reproduced not_testable untriaged — —
DF-0625 Medium 6.5 Missing arglen check in L2CA_Ping path causes kernel heap OOB read leaked to remote Bluetooth peer
sys/netgraph7/bluetooth/l2cap/ng_l2cap_main.c:438
 none not_reproduced not_testable untriaged — —
DF-2538 Medium 6.5 Unbounded loop in inquiry_result causes kernel panic from malformed HCI Inquiry Result event
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:387
 none not_reproduced not_testable untriaged — —
DF-2539 Medium 6.5 Unbounded loop in num_compl_pkts causes kernel panic from malformed Number Of Completed Packets event
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:891
 — — — untriaged — —
DF-2577 Low 6.5 ICMP PULLUP_TO(hlen+4) reads icmp_id at hlen+4..hlen+5: 2-byte mbuf backing-store over-read on crafted short ICMP packets
sys/net/ipfw3/ip_fw3.c:400
 — — — untriaged — —
DF-1071 Medium 6.4 pnp_create_devices mis-tracks scanning, causing heap OOB reads (and possible bogus device creation) from crafted PnP resource data
sys/bus/isa/pnp.c:378
 none not_reproduced not_testable untriaged — —
DF-1228 Medium 6.4 Untrusted SMID used directly as sc->commands[] index in mpr_intr_locked (OOB array access)
sys/dev/raid/mpr/mpr.c:2336
 none not_reproduced not_testable untriaged — —
DF-2323 Medium 6.4 VPD error-cleanup loops use NULL sentinel without guaranteed terminator after krealloc shrink - OOB read and kfree of garbage pointers
sys/bus/pci/pci.c:1225
 — — — untriaged — —
DF-2413 Low 6.4 Unbounded ccb_index from firmware LRAM into ccb_infos[] heap OOB read + attacker-influenced pointer deref
sys/dev/disk/advansys/advansys.c:1106
 — — — untriaged — —
DF-0546 High 6.3 OOB read of lut[] in netmap_mem_ofstophys: page-padding offset maps garbage physical page into userspace
sys/net/netmap/netmap_mem2.c:165
 none not_reproduced not_testable untriaged — —
DF-0799 Medium 6.3 VREG read np->n_size TOCTOU race — concurrent stat syncs n_size down causing uint64 underflow + OOB heap leak via uiomovebp
sys/vfs/nfs/nfs_bio.c:224
 leak:24576 reproduced fixed untriaged — —
DF-1138 Medium 6.3 OOB read in si_parse_power_table VCE state fill-in: clk_idx never bounds-checked against ucNumEntries
sys/dev/drm/radeon/si_dpm.c:6882
 leak:1008 reproduced fixed untriaged — —
DF-1287 Medium 6.3 siba_pci_sprom dispatches rev-4/5/8 parsers without validating buffer size -> heap OOB read past 64-word buffer
sys/dev/netif/bwn/siba/siba_core.c:1398
 none inconclusive not_testable untriaged — —
DF-1362 Medium 6.3 Integer overflow in mps_diag_read_buffer bounds check enables OOB read of fw_diag_buffer
sys/dev/raid/mps/mps_user.c:1583
 none inconclusive — untriaged — —
DF-1418 Medium 6.3 OOB read of vddc_dependency_on_sclk via clock_info_index clamped to wrong bound
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1350
 none inconclusive — untriaged — —
DF-0880 High 6.1 Heap over-read in udf_vget via unbounded file-entry l_ea/l_ad
sys/vfs/udf/udf_vfsops.c:514
 panic reproduced fixed untriaged — —
DF-1210 High 6.1 OOB read in DHRS error path: device-controlled CCS slot index dereferenced before bounds check
sys/dev/disk/ahci/ahci.c:2843
 none not_reproduced not_testable untriaged — —
DF-1725 High 6.1 radeon_cs: heap OOB read in radeon_cs_packet_next_reloc via non-4-aligned relocs length_dw
sys/dev/drm/radeon/radeon_cs.c:89
 leak reproduced fixed untriaged — —
DF-2083 High 6.1 Heap OOB read in amdgpu_dm_set_degamma_lut via unvalidated blob size before __is_lut_linear
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:259
 none not_reproduced not_testable untriaged — —
DF-0744 Medium 6.1 udp6_output corrupts sticky socket options and leaks per-call options memory when ip6_setpktoptions fails
sys/netinet6/udp6_output.c:134
 leak:20bytes/iter+silent-sticky-state-corruption reproduced fixed untriaged — —
DF-0830 Medium 6.1 hpfs_readdir dep-walk unbounded against 2KB bread buffer — panic/heap-leak/infinite-loop via crafted dirblk
sys/vfs/hpfs/hpfs_vnops.c:825
 panic reproduced fixed untriaged — —
DF-0863 Medium 6.1 hpfs_cpload OOB read of cpdsec via unchecked d_cpcnt past fixed d_cpdblk[3] array
sys/vfs/hpfs/hpfs_subr.c:228
 panic reproduced fixed untriaged — —
DF-0864 Medium 6.1 hpfs_toupper indexes hpm_cpdblk[cp] with unchecked on-disk de_cpid OOB read on every name lookup
sys/vfs/hpfs/hpfs_subr.c:55
 leak:34813 reproduced fixed untriaged — —
DF-0865 Medium 6.1 hpfs_validateparent walks directory entries by attacker-controlled de_reclen with no buffer-bound check OOB read
sys/vfs/hpfs/hpfs_subr.c:567
 panic reproduced fixed untriaged — —
DF-0881 Medium 6.1 Heap OOB read in sparing-table scan rt_l unbounded by st_size
sys/vfs/udf/udf_vfsops.c:662
 panic reproduced fixed untriaged — —
DF-0997 Medium 6.1 RX mbuf m_len set from device-controlled RX descriptor flags with no bound -> heap OOB read
sys/bus/u4b/wlan/if_rum.c:1146
 none not_reproduced not_testable untriaged — —
DF-1182 Medium 6.1 Heap OOB read via unbounded state-record clock indices into VBIOS dep tables
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:2970
 none not_reproduced not_testable untriaged — —
DF-1200 Medium 6.1 Unvalidated BIOS-supplied array indices in power table parsing cause OOB heap reads
sys/dev/drm/radeon/radeon_atombios.c:606
 none not_reproduced not_testable untriaged — —
DF-1253 Medium 6.1 uint32 underflow in vega20_apply_clocks_adjust_rules: count-1 wraps to UINT32_MAX causing ~4B-iteration heap OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:3035
 none inconclusive not_testable untriaged — —
DF-1330 Medium 6.1 mixer_setrecsrc uses bitmask as array index causing OOB kernel read into envy24ht_mixmap[25]
sys/dev/sound/pci/envy24ht.c:1953
 leak reproduced fixed untriaged — —
DF-1347 Medium 6.1 amd_Reselect indexes target arrays with -1 via ffs(0)-1 on malicious reselect ID
sys/dev/disk/amd/amd.c:1829
 panic reproduced fixed untriaged — —
DF-1388 Medium 6.1 Integer overflow in find_section block-size check lets crafted MIPI block bypass bounds for OOB read
sys/dev/drm/i915/intel_bios.c:96
 none inconclusive — untriaged — —
DF-1389 Medium 6.1 get_lvds_dvo_timing uses unvalidated VBT offsets for pointer arithmetic -> OOB read of LVDS timing
sys/dev/drm/i915/intel_bios.c:169
 none inconclusive — untriaged — —
DF-1390 Medium 6.1 parse_mipi_config indexes config[6]/pps[6] with panel_type 0-15 -> OOB read
sys/dev/drm/i915/intel_bios.c:808
 none inconclusive — untriaged — —
DF-1576 Medium 6.1 Unbounded VBIOS USHORT offsets and VCE state indices cause OOB reads from BIOS image
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:283
 none inconclusive — untriaged — —
DF-1810 Medium 6.1 cardbus_cis: unbounded CIS tuple-chain offset allows OOB read past BAR mapping (panic / MAC info leak)
sys/dev/pccard/cardbus/cardbus_cis.c:451
 none inconclusive — untriaged — —
DF-2061 Medium 6.1 Unprivileged heap OOB read / wild MMIO read via HAL_DIAG_REGS: ath_hal_getregdump indexes input without consulting its length
sys/dev/netif/ath/ath/if_ath_ioctl.c:189
 panic reproduced not_testable untriaged — —
DF-2497 Medium 6.1 Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang
sys/dev/disk/nata/ata-raid.c:348
 — — — untriaged — —
DF-2498 Medium 6.1 Intel MatrixRAID heap OOB read via untrusted disk_idx and unvalidated map pointer
sys/dev/disk/nata/ata-raid.c:2132
 — — — untriaged — —
DF-1135 Low 6.1 Heap OOB read in hdaa_eld_dump: computed length never bounds field/SAD access
sys/dev/sound/pci/hda/hdaa.c:644
 panic reproduced fixed untriaged — —
DF-1168 Low 6.1 Heap OOB read: unvalidated VBIOS clock indices into SCLK/MCLK dependency tables
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3179
 panic reproduced fixed untriaged — —
DF-1250 High 6.0 Hardcoded EDID parser over-reads rdev->bios by up to 32KB, disclosing kernel heap via EDID ioctl
sys/dev/drm/radeon/radeon_combios.c:373
 none not_reproduced not_testable untriaged — —
DF-0739 Medium 6.0 Heap over-read / kernel memory disclosure in ip_fw3_ctl_set_get — bcopy sopt_valsize bytes from 4-byte ctx->sets
sys/net/ipfw3/ip_fw3_set.c:213
 leak reproduced fixed untriaged — —
DF-1164 Medium 6.0 CP/MEC/RLC firmware loaders OOB read via untrusted ucode_size_bytes
sys/dev/drm/amd/amdgpu/gfx_v7_0.c:2447
 leak:unbounded reproduced not_testable untriaged — —
DF-1408 Medium 6.0 Integer underflow / unbounded num_indices in multiple ATOM table parsers yields OOB read
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:106
 none inconclusive — untriaged — —
DF-1895 Medium 6.0 parse_csr_fw never validates fw->datasize before indexing fw->data: multiple OOB-read paths
sys/dev/drm/i915/intel_csr.c:297
 none inconclusive — untriaged — —
DF-0742 Medium 5.9 gre_input2 and gre_mobile_input dereference header fields at offset 20+ without m_pullup — OOB read on chained mbufs
sys/netinet/ip_gre.c:133
 panic reproduced fixed untriaged — —
DF-0825 Medium 5.9 nfs_getnickauth post-increment bug: auth_str points 4 bytes into 8-byte kmalloc — OOB heap read into RPC request + kfree of non-base pointer
sys/vfs/nfs/nfs_syscalls.c:1115
 leak:4bytes+panic reproduced fixed untriaged — —
DF-1336 Low 5.9 Multi-fragment RX frame truncation when total_len is exact multiple of MCLBYTES
sys/dev/netif/re/if_re.c:1209
 none reproduced fixed untriaged — —
DF-2537 Low 5.9 ABTS RX_ID bound check uses IOC mpt_max_tgtcmds instead of actual tgt_cmd_ptrs array size (OOB read in FC target mode)
sys/dev/disk/mpt/mpt_cam.c:3004
 — — — untriaged — —
DF-2436 High 5.8 Use of uninitialized heap memory in dm_target_crypt_destroy on partial init failure
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 panic reproduced fixed untriaged — —
DF-0328 Low 5.8 node_getmimoinfo loops on untrusted ni_mimo_chains without clamping to array size
sys/netproto/802_11/wlan/ieee80211_node.c:1164
 none reproduced fixed untriaged — —
DF-0986 Low 5.8 mt7601_set_chan unbounded linear search over mt7601_rf_chan[14] reads OOB for chan outside 1..14
sys/bus/u4b/wlan/if_mtw.c:3693
 none reproduced fixed untriaged — —
DF-0035 Medium 5.7 Integer underflow in sysctl_kern_msgbuf causes kernel heap OOB read via copyout
sys/kern/subr_prf.c:1177
 panic reproduced fixed untriaged — —
DF-0989 Medium 5.7 cdreaddvdstructure integer underflow in length math leaks kernel heap to userspace
sys/bus/cam/scsi/scsi_cd.c:4288
 none not_reproduced not_testable untriaged — —
DF-1214 Medium 5.7 Unchecked rxcd->len vs cluster size yields mbuf OOB read (guest kernel heap info leak) on RX
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2216
 none inconclusive not_testable untriaged — —
DF-1396 Medium 5.7 Firmware-controlled desc_count/desc_len in oce_get_profile_config/oce_get_func_config walks OOB past DMA buffer
sys/dev/netif/oce/oce_mbox.c:2013
 none inconclusive — untriaged — —
DF-1784 Medium 5.7 radeon_bios: OOB read in radeon_get_bios - attacker-controlled BIOS offsets index into potentially tiny BIOS buffer
sys/dev/drm/radeon/radeon_bios.c:752
 none inconclusive — untriaged — —
DF-0404 Low 5.7 Potential OOB ring access in netmap_bwrap_register for NICs with asymmetric TX/RX ring counts
sys/net/netmap/netmap_vale.c:1699
 dos reproduced fixed untriaged — —
DF-1248 Low 5.7 SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths
sys/dev/netif/dc/if_dc.c:1744
 none reproduced not_testable untriaged — —
DF-2485 Low 5.7 Unbounded NumPhysDisks/NumActiveVolumes loop counts read past IOC config-page trailing arrays
sys/dev/disk/mpt/mpt_raid.c:1149
 — — — untriaged — —
DF-0534 Medium 5.6 Heap OOB read in ngc_send: ng_mesg buffer under-allocated, header fields read out of bounds
sys/netgraph7/socket/ng_socket.c:254
 leak reproduced fixed untriaged — —
DF-0844 Medium 5.6 Heap OOB read when parsing crafted directory entries near buffer tail — missing d_reclen >= DIRSIZ validation
sys/vfs/ufs/ufs_dirhash.c:200
 leak:255 reproduced fixed untriaged — —
DF-1399 Medium 5.6 vol->plex[] set to -1 by kw_prefer logic bug causing PLEX[-1] OOB read
sys/dev/raid/vinum/vinumconfig.c:1537
 none inconclusive — untriaged — —
DF-2172 Medium 5.6 radeon_ucode_validate performs no minimum-size, NULL, or sub-field validation -- OOB reads and NULL deref in validator and all print functions
sys/dev/drm/radeon/radeon_ucode.c:156
 panic reproduced fixed untriaged — —
DF-0261 Low 5.6 act_ofs copied from user input without validation against cmd_len -> heap OOB read
sys/net/ipfw/ip_fw2.c:4515
 none reproduced fixed untriaged — —
DF-0876 High 5.5 ext2_gd_csum OOB heap read via unvalidated on-disk group descriptor size
sys/vfs/ext2fs/ext2_csum.c:684
 leak reproduced fixed untriaged — —
DF-0877 High 5.5 ext2_dx_csum OOB heap read via unvalidated htree entry count
sys/vfs/ext2fs/ext2_csum.c:253
 leak reproduced fixed untriaged — —
DF-1199 High 5.5 Integer underflow in radeon_atombios_get_asic_ss_info causes 1.4-billion-iteration OOB heap read
sys/dev/drm/radeon/radeon_atombios.c:1555
 panic reproduced not_testable untriaged — —
DF-1327 High 5.5 Kernel heap info leak in mpr_user_pass_thru: copyout uses user-controlled ReplySize with no upper bound
sys/dev/raid/mpr/mpr_user.c:857
 none inconclusive not_testable untriaged — —
DF-1328 High 5.5 Kernel heap info leak in mpr_user_event_report: copyout of user-supplied Size from fixed-size recorded_events[40000]
sys/dev/raid/mpr/mpr_user.c:2069
 none inconclusive not_testable untriaged — —
DF-1360 High 5.5 Kernel heap memory disclosure via mps_user_event_report copyout with attacker-controlled length
sys/dev/raid/mps/mps_user.c:1856
 none inconclusive not_testable untriaged — —
DF-1661 High 5.5 ipmi: size_t underflow in IPMICTL_RECEIVE_MSG_TRUNC copies unbounded kernel heap to user
sys/dev/misc/ipmi/ipmi.c:448
 leak reproduced not_testable untriaged — —
DF-1727 High 5.5 ttm_bo_vm: uninitialized kernel pages returned to userspace via TTM BO mmap fault
sys/dev/drm/ttm/ttm_bo_vm.c:690
 leak reproduced fixed untriaged — —
DF-0075 Medium 5.5 DIOCGSLICEINFO leaks kernel pointers (KASLR bypass) via raw struct diskslices copyout
sys/kern/subr_diskslice.c:556
 leak:24bytes reproduced fixed untriaged — —
DF-0107 Medium 5.5 dkcksum32 OOB read via DIOCSDINFO ioctl with crafted d_npartitions
sys/kern/subr_disklabel32.c:264
 panic reproduced fixed untriaged — —
DF-0585 Medium 5.5 TAPSIFINFO leaks the ifnet serializer on type mismatch (local DoS / kernel wedge)
sys/net/tap/if_tap.c:738
 dos reproduced fixed untriaged — —
DF-0748 Medium 5.5 Unchecked uint16_t index into 10-element log_if_table — OOB read + kernel panic on matching packet
sys/net/ipfw3_basic/ip_fw3_log.c:114
 panic reproduced fixed untriaged — —
DF-0810 Medium 5.5 nfs_getcookie() OOB array index via int truncation of 64-bit directory offset — local panic
sys/vfs/nfs/nfs_subs.c:1341
 panic reproduced fixed untriaged — —
DF-0850 Medium 5.5 Missing interior-node limit validation in ext2_htree_find_leaf — OOB heap read/panic from crafted ext2 htree image
sys/vfs/ext2fs/ext2_htree.c:308
 panic reproduced fixed untriaged — —
DF-0929 Medium 5.5 Unvalidated data_len in hammer_ioc_dedup causes kernel OOB read via crafted image
sys/vfs/hammer/hammer_dedup.c:92
 panic reproduced fixed untriaged — —
DF-1028 Medium 5.5 OOB heap read in READ ELEMENT STATUS response parsing (device-controlled desclen/avail/flags)
sys/bus/cam/scsi/scsi_ch.c:1118
 none not_reproduced not_testable untriaged — —
DF-1029 Medium 5.5 OOB heap read via unchecked blk_desc_len in MODE SENSE parsing (chdone/chgetparams)
sys/bus/cam/scsi/scsi_ch.c:494
 none not_reproduced not_testable untriaged — —
DF-1048 Medium 5.5 Kernel panic / divide-by-zero in umcs7840_calc_baudrate when c_ospeed == 0 (B0) via tcsetattr
sys/bus/u4b/serial/umcs.c:1056
 panic reproduced fixed untriaged — —
DF-1167 Medium 5.5 NULL deref / heap OOB read: cac_leakage_table indexed by unrelated SCLK count without bounds
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:673
 panic reproduced not_testable untriaged — —
DF-1175 Medium 5.5 Intel and nVidia parsers: unbounded config_size in checksum loop causes kernel OOB read / panic
sys/dev/disk/nata/ata-raid.c:2151
 leak:64000+3584 reproduced not_testable untriaged — —
DF-1183 Medium 5.5 Heap OOB read in vega10_get_soc_index_for_max_uclk: hardcoded entries[3] without count check
sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:3444
 none not_reproduced not_testable untriaged — —
DF-1332 Medium 5.5 amdgpu_fill_buffer uint32_t truncation skips VRAM clear for nodes>=4GiB (cross-user VRAM info leak)
sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2183
 leak reproduced fixed untriaged — —
DF-1361 Medium 5.5 OOB kernel read via unbounded ReplySize in mps_user_pass_thru copyout
sys/dev/raid/mps/mps_user.c:858
 leak reproduced fixed untriaged — —
DF-1403 Medium 5.5 Unprivileged OOB read / kernel memory leak in cik_get_register_value via attacker-controlled SE/SH index
sys/dev/drm/amd/amdgpu/cik.c:1026
 none inconclusive — untriaged — —
DF-1467 Medium 5.5 vi_get_register_value OOB read of gfx.config.rb_config[se][sh] via AMDGPU_INFO_READ_MMR_REG (DF-1403 twin)
sys/dev/drm/amd/amdgpu/vi.c:550
 none inconclusive — untriaged — —
DF-1494 Medium 5.5 midistat_read OOB kernel heap read via unchecked negative uio_offset
sys/dev/sound/midi/midi.c:1038
 none inconclusive — untriaged — —
DF-1774 Medium 5.5 mpt_user: uninitialized kernel-heap memory leak via MPTIO_READ_CFG_PAGE / READ_EXT_CFG_PAGE
sys/dev/disk/mpt/mpt_user.c:186
 none inconclusive — untriaged — —
DF-1789 Medium 5.5 ar2316: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> kernel OOB read (mirrors DF-1766)
sys/dev/netif/ath/ath_hal/ar5212/ar2316.c:384
 none inconclusive — untriaged — —
DF-1951 Medium 5.5 Kernel heap info leak: uninitialized BIOS buffer exposed to unprivileged userspace via AMDGPU_INFO_VBIOS_IMAGE ioctl on ATRM path
sys/dev/drm/amd/amdgpu/amdgpu_bios.c:338
 none inconclusive — untriaged — —
DF-1954 Medium 5.5 OOB kernel heap info leak in sndstat_read via signed/unsigned truncation in min() length math
sys/dev/sound/pcm/sndstat.c:206
 none inconclusive — untriaged — —
DF-2075 Medium 5.5 drm_vm_info leaks struct_mutex permanently on SYSCTL_OUT failure (local DoS)
sys/dev/drm/drm_sysctl.c:175
 dos reproduced fixed untriaged — —
DF-2177 Medium 5.5 acpi_PkgStr NULL-pointer dereference via firmware-supplied zero-length String/Buffer (kernel DoS)
sys/dev/acpica/acpi_package.c:76
 panic reproduced fixed untriaged — —
DF-2472 Medium 5.5 ISP_FC_GETDINFO ioctl missing channel bounds check -> kernel heap OOB read / info leak
sys/dev/disk/isp/isp_freebsd.c:471
 none not_reproduced not_testable untriaged — —
DF-2486 Medium 5.5 Kernel heap info leak via uninitialized DMA buffer in MPTIO_READ_CFG_PAGE / MPTIO_READ_EXT_CFG_PAGE
sys/dev/disk/mpt/mpt_user.c:203
 none not_reproduced not_testable untriaged — —
DF-2503 Medium 5.5 TOCTOU info leak in CDIOCREADSUBCHANNEL via double-fetch of args->data_len
sys/dev/disk/nata/atapi-cd.c:502
 none not_reproduced not_testable untriaged — —
DF-2505 Medium 5.5 Drive-controlled / TOCTOU OOB kernel heap read in DVD_STRUCT_BCA and DVD_STRUCT_MANUFACT
sys/dev/disk/nata/atapi-cd.c:1537
 — — — untriaged — —
DF-2535 Medium 5.5 OOB read / deterministic panic in mpt_disable_lun via wildcard LUN (loop indexes trt[lun] not trt[i])
sys/dev/disk/mpt/mpt_cam.c:4334
 none not_reproduced not_testable untriaged — —
DF-0644 Low 5.5 check_from_lookup / check_to_lookup OOB read via unvalidated table index cmd->arg1
sys/net/ipfw3_basic/ip_fw3_basic.c:311
 panic reproduced fixed untriaged — —
DF-1584 Low 5.5 mfi_build_and_issue_cmd leaks Thunderbolt command slot on mfi_tbolt_build_io failure
sys/dev/raid/mfi/mfi_tbolt.c:1097
 leak reproduced fixed untriaged — —
1086 Medium 5.4 crom_parse_text() CROM_END check treats crc_len as bytes instead of quadlets, allowing OOB read past csrrom
sys/bus/firewire/fwcrom.c:207
 leak:60bytes reproduced fixed untriaged — —
DF-0526 Medium 5.4 ng_fec_choose_port dereferences ether/IP headers without mbuf length validation: OOB read
sys/netgraph/fec/ng_fec.c:897
 none not_reproduced not_testable untriaged — —
DF-1239 Medium 5.4 iwi_frame_intr frame->len bound too loose: up to 28-byte OOB read past mbuf cluster
sys/dev/netif/iwi/if_iwi.c:1248
 none not_reproduced not_testable untriaged — —
DF-0288 Low 5.4 OOB read in mesh peering action: peer_linkid/peer_rcode decoded before length check
sys/netproto/802_11/wlan/ieee80211_mesh.c:2174
 none reproduced fixed untriaged — —
DF-0363 Low 5.4 ieee80211_dump_pkt reads WEP/QoS/4-addr fields without bounds-checking against frame length: OOB read when debug enabled
sys/netproto/802_11/wlan/ieee80211_proto.c:591
 none reproduced fixed untriaged — —
DF-0583 Low 5.4 ieee80211_parse_ath heap over-read via short Atheros vendor IE
sys/netproto/802_11/wlan/ieee80211_superg.c:198
 leak reproduced fixed untriaged — —
DF-1145 High 5.3 Unbounded firmware-supplied MPDU length in RX paths causes kernel heap OOB read
sys/dev/netif/iwm/if_iwm.c:3221
 none inconclusive not_testable untriaged — —
DF-1254 Medium 5.3 OD8 capability/settings arrays indexed by constants but allocated to VBIOS-supplied length -> heap OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:894
 none inconclusive not_testable untriaged — —
DF-1299 Medium 5.3 OOB kernel-heap reads from VBIOS-controlled flex-array counts across table walks
sys/dev/drm/amd/display/dc/bios/bios_parser.c:175
 leak reproduced fixed untriaged — —
DF-1306 Medium 5.3 Unbounded nonClockInfoIndex causes heap OOB read in kv_parse_power_table
sys/dev/drm/radeon/kv_dpm.c:2668
 leak reproduced fixed untriaged — —
DF-1307 Medium 5.3 Unbounded VCE clk_idx causes heap OOB read in kv_parse_power_table
sys/dev/drm/radeon/kv_dpm.c:2703
 leak reproduced fixed untriaged — —
DF-1484 Medium 5.3 Missing size validation for AMDGPU_CHUNK_ID_IB allows OOB read of drm_amdgpu_cs_chunk_ib fields
sys/dev/drm/amd/amdgpu/amdgpu_cs.c:166
 none inconclusive — untriaged — —
DF-1672 Medium 5.3 cik_sdma: integer overflow in cik_copy_dma size computation -> silent data corruption on >=4GB moves
sys/dev/drm/radeon/cik_sdma.c:586
 panic reproduced fixed untriaged — —
DF-1693 Medium 5.3 amdgpu_debugfs: PCIE/DIDT/SMC register handlers perform no upper-bound validation on user-supplied register offset
sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:229
 panic reproduced fixed untriaged — —
DF-1953 Medium 5.3 Unmasked ioread32(vaddr+head+4) reads 4 bytes past ring-buffer mapping in semaphore_waits_for
sys/dev/drm/i915/intel_hangcheck.c:103
 none inconclusive — untriaged — —
DF-2091 Medium 5.3 Integer overflow in si_copy_dma size computation truncates DMA copy for BOs >= 4GB
sys/dev/drm/radeon/si_dma.c:240
 dos reproduced fixed untriaged — —
DF-2196 Medium 5.3 task_struct allocated in kthread_run() is never freed and td_linux_task is never cleared, leaking memory and leaving dangling back-pointer in struct thread
sys/dev/drm/linux_kthread.c:54
 none reproduced fixed untriaged — —
DF-2271 Medium 5.3 Device-controlled avail in chgetelemstatus walks desc past data buffer -> kernel heap info leak via copyout
sys/bus/cam/scsi/scsi_ch.c:1159
 none not_reproduced not_testable untriaged — —
DF-2589 Medium 5.3 Unchecked AcpiEvaluateObject return in acpi_panasonic_sinf causes NULL-deref panic and heap OOB read
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:277
 none not_reproduced not_testable untriaged — —
DF-0469 Low 5.3 ip6_get_prevhdr dereferences ip6e without validating len against m_len: fragile implicit contract
sys/netinet6/ip6_input.c:1418
 none reproduced fixed untriaged — —
DF-0520 Low 5.3 icmp_reflect reflects source-route/RR/TS IP options into echo reply: info leak + source-route revival
sys/netinet/ip_icmp.c:1025
 leak reproduced fixed untriaged — —
DF-0747 Low 5.3 check_established reads TCP th_flags from non-first IP fragments without pullup — OOB read + firewall misclassification
sys/net/ipfw3_layer4/ip_fw3_layer4.c:173
 leak:0 reproduced fixed untriaged — —
DF-0750 Low 5.3 strncpy on binary MAC bytes silently truncates at 0x00 byte — radix key collision rule bypass
sys/net/ipfw3_layer2/ip_fw3_layer2.c:127
 none reproduced not_testable untriaged — —
DF-1140 Low 5.3 OOB read in si_parse_power_table: nonClockInfoIndex taken from VBIOS without bounds check
sys/dev/drm/radeon/si_dpm.c:6848
 panic reproduced fixed untriaged — —
DF-1144 Low 5.3 Unbounded VBIOS-supplied indices into nonClockInfo[]/clockInfo[] arrays in ci_parse_power_table
sys/dev/drm/amd/amdgpu/ci_dpm.c:5688
 panic reproduced fixed untriaged — —
DF-1196 Low 5.3 Unchecked power_state index increment in DYNPM downclock path causes kernel OOB read
sys/dev/drm/radeon/r600.c:360
 panic reproduced fixed untriaged — —
DF-1608 Low 5.3 Unchecked ACPI buffer length when reading WMI command result
sys/dev/acpica/acpi_hp/acpi_hp.c:847
 panic reproduced fixed untriaged — —
DF-1665 Low 5.3 twa: OOB read of tw_cli_severity_string_table[severity] via firmware-controlled severity bits
sys/dev/raid/twa/tw_cl_misc.c:55
 leak:0 reproduced fixed untriaged — —
DF-2016 Low 5.3 Unguarded data_ptr dereference in INQUIRY rewrite path of mfip_done (local DoS / 1-byte heap OOB)
sys/dev/raid/mfi/mfi_cam.c:339
 none reproduced not_testable untriaged — —
DF-2301 Low 5.3 Off-by-one OOB read in print_db iterates one past the DMA descriptor array
sys/bus/firewire/fwohci.c:2347
 — — — untriaged — —
DF-2384 Low 5.3 Missing Buffer.Length check in acpi_hp_exec_wmi_command (heap OOB read of result[1]/result[2])
sys/dev/acpica/acpi_hp/acpi_hp.c:838
 — — — untriaged — —
DF-0920 Info 5.3 Kernel heap pointer leaked to msgbuf via unconditional kprintf on NFS reply re-queue
sys/vfs/nfs/nfs_iod.c:134
 leak:0bytes reproduced fixed untriaged — —
DF-1165 Medium 5.2 Heap OOB read in drm_parse_tiled_block via undersized DisplayID tiled block
sys/dev/drm/drm_edid.c:5103
 leak:16 reproduced not_testable untriaged — —
DF-1415 Medium 5.2 Unchecked gpio pin count from u16 structuresize indexes fixed gpio_pin[8] array
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:353
 none inconclusive — untriaged — —
DF-1498 Medium 5.2 Unvalidated VBIOS USHORT offsets and UCHAR counts in atomctrl_get_leakage_vddc_base_on_leakage allow OOB read of BIOS image
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1498
 none inconclusive — untriaged — —
DF-2320 Medium 5.2 Unbounded tuple.ptr from attacker-controlled longlink/MFC addresses drives bus_space_read out of the mapped CIS window
sys/bus/pccard/pccard_cis.c:212
 — — — untriaged — —
DF-0138 Low 5.2 Cross-jail USER varsym namespace sharing (per-UID not per-jail)
sys/kern/kern_varsym.c:259
 none reproduced fixed untriaged — —
DF-1370 Low 5.2 Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame
sys/dev/raid/mps/mps.c:1269
 none reproduced fixed untriaged — —
DF-1591 Low 5.2 Firmware-controlled AEN severity indexes tws_sev_str[5] out of bounds via strcpy
sys/dev/raid/tws/tws_cam.c:52
 panic reproduced fixed untriaged — —
DF-1862 Low 5.2 ixgbe_dcb_config_pfc_82599 uses unbounded u8 map[] to size PFC loop: OOB read + OOB MMIO write (latent)
sys/dev/netif/ix/ixgbe_dcb_82599.c:321
 panic reproduced fixed untriaged — —
DF-2096 Low 5.2 amdgpu_ci_load_smc_ucode trusts unvalidated firmware header fields (dead limit, no blob/header bounds) -> OOB read of firmware buffer and unbounded SMC SRAM write
sys/dev/drm/amd/amdgpu/ci_smc.c:208
 dos reproduced fixed untriaged — —
DF-2328 Low 5.2 Missing NUL-termination of PnP string enables OOB stack read in search_token()
sys/bus/ppbus/ppbconf.c:219
 — — — untriaged — —
DF-0070 Medium 5.1 Heap OOB read in elf_getnote: untrusted n_namesz advances offset past note buffer with no bounds check
sys/kern/kern_checkpoint.c:313
 panic reproduced fixed untriaged — —
DF-0619 Medium 5.1 Heap OOB read in rip6_send via unvalidated sockaddr length
sys/netinet6/raw_ip6.c:743
 leak:26 reproduced fixed untriaged — —
DF-0634 Medium 5.1 Heap out-of-bounds read in ng_tag_rcvdata() mbuf-tag matching
sys/netgraph7/ng_tag.c:525
 leak:65535 reproduced not_testable untriaged — —
DF-1127 Medium 5.1 Missing bounds checks on BIOS-supplied array indices in si_parse_power_table (nonClockInfoIndex and VCE clk_idx)
sys/dev/drm/amd/amdgpu/si_dpm.c:7253
 leak reproduced not_testable untriaged — —
DF-1130 Medium 5.1 Firmware header OOB heap read in si_mc/si_cp/si_rlc microcode loaders via unchecked offset/size fields
sys/dev/drm/radeon/si.c:1574
 panic reproduced fixed untriaged — —
DF-1252 Medium 5.1 Unvalidated 16-bit BIOS offsets dereferenced in LVDS mode-table and GPIO voltage-table parsing (OOB read up to 64KB)
sys/dev/drm/radeon/radeon_combios.c:1246
 none inconclusive not_testable untriaged — —
DF-1530 Medium 5.1 hpt_get_channel_info uses caller-controlled bus with no bounds check (OOB read + kernel pointer leak / panic)
sys/dev/raid/hptmv/gui_lib.c:446
 none inconclusive — untriaged — —
DF-2027 Medium 5.1 All VBIOS table parsers dereference attacker-controlled offsets without bounds validation -- OOB heap read
sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:42
 none inconclusive not_testable untriaged — —
DF-2316 Medium 5.1 pnp_parse_desc reads fixed descriptor offsets without validating declared length causing heap OOB reads up to 17 bytes
sys/bus/isa/pnpparse.c:95
 — — — untriaged — —
DF-0040 Low 5.1 Section-header index not bounds-checked against e_shnum in link_elf_obj_load_file (heap OOB read)
sys/kern/link_elf_obj.c:551
 none reproduced fixed untriaged — —
DF-0041 Low 5.1 Unbounded st_name / sh_name offsets into symbol/section string tables (heap OOB read via strcmp)
sys/kern/link_elf_obj.c:304
 none reproduced fixed untriaged — —
DF-0057 Low 5.1 Missing e_shentsize validation causes heap OOB read on shdr[] array
sys/kern/link_elf.c:590
 none reproduced fixed untriaged — —
DF-0058 Low 5.1 Unbounded sh_link to symstrindex causes heap OOB read (DF-0040 analogue, worse: no check at all)
sys/kern/link_elf.c:601
 none reproduced fixed untriaged — —
DF-0060 Low 5.1 DT_HASH d_ptr dereferenced without bounds validation - wild kernel read in parse_dynamic
sys/kern/link_elf.c:240
 none reproduced fixed untriaged — —
DF-0062 Low 5.1 Unbounded st_name offsets into strtab (DF-0041 analogue, heap OOB read via strcmp)
sys/kern/link_elf.c:698
 none reproduced fixed untriaged — —
DF-0532 Low 5.1 bt3c_download_firmware: unvalidated block_size causes heap OOB read of msg->data
sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:1121
 panic reproduced fixed untriaged — —
DF-0610 Low 5.1 Heap OOB read in NGM_NAT_PROXY_RULE via non-NUL-terminated user string
sys/netgraph7/ng_nat.c:643
 none not_reproduced not_testable untriaged — —
DF-0899 Low 5.1 Cross-object heap over-read in devfs_rule_clear via non-NUL-terminated mntpoint
sys/vfs/devfs/devfs_rules.c:194
 panic reproduced not_testable untriaged — —
DF-1740 Low 5.1 vinumioctl: VINUM_GETFREELIST signed fe allows negative free-list index -> 16-byte OOB heap read
sys/dev/raid/vinum/vinumioctl.c:76
 panic reproduced fixed untriaged — —
DF-2247 Low 5.1 Translation table size never validated: heap OOB read and NULL-deref panic via undersized/NULL d_table
sys/libiconv/iconv_xlat.c:61
 — — — untriaged — —
DF-2260 Low 5.1 XPT_DEV_MATCH reads num_patterns without bounding by pattern_buf_len: kernel heap OOB read
sys/bus/cam/cam_xpt.c:3291
 — — — untriaged — —
DF-1931 Low 5.0 Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE
sys/dev/netif/ath/ath_rate/amrr/amrr.c:246
 panic reproduced fixed untriaged — —
DF-1948 Low 5.0 Missing bounds check on rt->info[] indexing in ath_rate_update allows OOB read past HAL_RATE_TABLE (sibling of DF-1931)
sys/dev/netif/ath/ath_rate/onoe/onoe.c:220
 panic reproduced fixed untriaged — —
DF-0260 Low 4.8 tcpopts_match/ipopts_match read options beyond m_pullup-guaranteed contiguous region
sys/net/ipfw/ip_fw2.c:1296
 none reproduced fixed untriaged — —
DF-0651 Low 4.8 IP_MINTTL (GTSM) bypassed for all raw sockets except the last in rip_input delivery list
sys/netinet/raw_ip.c:164
 leak reproduced fixed untriaged — —
DF-0408 Info 4.8 ip_optcopy validates IP-option lengths only with KASSERT (no-op on production): latent OOB read
sys/netinet/ip_output.c:1018
 none reproduced not_testable untriaged — —
DF-0784 High 4.7 ext2_readlink truncates i_size (uint64) to signed int — unbounded kernel heap disclosure via uiomove (ext2 analog of DF-0778)
sys/vfs/ext2fs/ext2_vnops.c:1345
 leak:4078 reproduced fixed untriaged — —
DF-1139 Medium 4.7 OOB read / kernel panic in si_get_std_voltage_value when cac_leakage_table.count==0
sys/dev/drm/radeon/si_dpm.c:4158
 panic reproduced fixed untriaged — —
DF-1391 Medium 4.7 VBIOS power-table parsing dereferences attacker-controlled offsets with no bounds checks
sys/dev/drm/radeon/rv6xx_dpm.c:1889
 none inconclusive — untriaged — —
DF-1424 Medium 4.7 TOCTOU race: interrupt completion re-reads unchecked user buffer sizes from ioctl ucmd
sys/dev/raid/iir/iir.c:1600
 none inconclusive — untriaged — —
DF-1581 Medium 4.7 Off-by-one SMID bounds check in mfi_tbolt_complete_cmd allows OOB read of mfi_cmd_pool_tbolt[]
sys/dev/raid/mfi/mfi_tbolt.c:666
 none inconclusive — untriaged — —
DF-1796 Medium 4.7 ar2413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> deterministic kernel OOB read panic (mirrors DF-1766/DF-1789)
sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:353
 none inconclusive — untriaged — —
DF-1806 Medium 4.7 ar2317: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796)
sys/dev/netif/ath/ath_hal/ar5212/ar2317.c:363
 none inconclusive — untriaged — —
DF-1815 Medium 4.7 ppatomfwctrl: voltage-object VBIOS walk uses attacker-controlled structuresize/object_size -> OOB read + infinite-loop DoS
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:33
 none inconclusive — untriaged — —
DF-2025 Medium 4.7 Missing upper-bound on BMC-supplied response byte count causes kernel stack OOB read into userspace reply
sys/dev/misc/ipmi/ipmi_ssif.c:183
 none inconclusive not_testable untriaged — —
DF-2198 Medium 4.7 Divide-by-zero in ar5416IQCalibration when IQ cal measurements are small-but-nonzero
sys/dev/netif/ath/ath_hal/ar5416/ar5416_cal_iq.c:95
 panic reproduced fixed untriaged — —
DF-2269 Medium 4.7 Kernel heap OOB read in cdreaddvdstructure() default case via short-transfer underflow
sys/bus/cam/scsi/scsi_cd.c:4288
 — — — untriaged — —
DF-1316 Low 4.7 Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads
sys/dev/drm/radeon/ni.c:769
 none reproduced fixed untriaged — —
DF-1420 Low 4.7 OOB read of vddc_dependency_on_sclk in smu8_read_sensor GFX_SCLK (index vs table->count)
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1688
 none reproduced fixed untriaged — —
DF-1430 Low 4.7 OOB array read in twe_format_aen: TWE_AEN_UNIT(aen) up to 255 indexes twe_drive[16]
sys/dev/raid/twe/twe.c:1808
 none reproduced fixed untriaged — —
DF-1451 Low 4.7 SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read
sys/dev/drm/amd/amdgpu/sdma_v4_0.c:918
 none reproduced fixed untriaged — —
DF-1569 Low 4.7 Hauppauge EEPROM block-parse reads block_2/block_3 via attacker-influenced offsets without bounds checks (kernel stack OOB read / panic on probe)
sys/dev/video/bktr/bktr_card.c:1001
 panic reproduced fixed untriaged — —
DF-1573 Low 4.7 Firmware upgrade path reads out of bounds on attacker-shaped firmware image
sys/dev/netif/oce/oce_sysctl.c:257
 panic reproduced fixed untriaged — —
DF-1839 Low 4.7 Unsigned underflow in psp_v3_1_compare_sram_data ucode_size loop: OOB read and MMIO storm (latent - caller inside #if 0)
sys/dev/drm/amd/amdgpu/psp_v3_1.c:553
 panic reproduced fixed untriaged — —
DF-1876 Low 4.7 Integer underflow in psp_v11_0_compare_sram_data loop causes OOB read of ucode buffer — variant of DF-1839
sys/dev/drm/amd/amdgpu/psp_v11_0.c:498
 panic reproduced fixed untriaged — —
DF-2006 Low 4.7 Heap OOB read in aibs_attach_sif when ACPI ?SIF returns a zero-element package
sys/dev/acpica/aibs/atk0110.c:169
 none reproduced not_testable untriaged — —
DF-2155 Low 4.7 Unguarded division by zero panics the kernel in bw_frc_to_fixed / bw_floor2 / bw_ceil2
sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:69
 panic reproduced fixed untriaged — —
DF-2385 Low 4.7 Package helpers index Elements[idx] with no bounds check; the apparent NULL guard is dead code (heap OOB read / info leak)
sys/dev/acpica/acpi_package.c:48
 — — — untriaged — —
DF-2412 Low 4.7 Unbounded queue-number index into sense_buffers[] heap OOB read / kernel heap info leak
sys/dev/disk/advansys/advansys.c:1185
 — — — untriaged — —
DF-1106 Medium 4.6 Unbounded XHCI extended-capability pointer walk allows OOB MMIO read/write and kernel DoS from malicious PCI controller
sys/bus/u4b/controller/xhci_pci.c:398
 none not_reproduced not_testable untriaged — —
DF-1240 Medium 4.6 iwi_checkforqos unbounded notif->len allows up to 292-byte OOB read past RX mbuf on crafted ASSOC RESP
sys/dev/netif/iwi/if_iwi.c:1368
 none not_reproduced not_testable untriaged — —
DF-1269 Medium 4.6 Missing bounds checks on VBIOS-supplied indices in kv_parse_power_table (OOB reads)
sys/dev/drm/amd/amdgpu/kv_dpm.c:2745
 none inconclusive not_testable untriaged — —
DF-1414 Medium 4.6 Unchecked VBIOS number_of_path (u8) indexes fixed display_path[8] at 6 call sites
sys/dev/drm/amd/display/dc/bios/bios_parser2.c:162
 none inconclusive — untriaged — —
DF-1452 Medium 4.6 ae_rxeof lacks upper-bound check on NIC-controlled rxd->len allowing OOB heap read via m_devget
sys/dev/netif/ae/if_ae.c:609
 none inconclusive — untriaged — —
DF-1809 Medium 4.6 ar2425: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers -> OOB read panic (mirrors DF-1766/1789/1796/1806)
sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:264
 none inconclusive — untriaged — —
DF-2290 Medium 4.6 Unchecked info_len in crom_init_context enables OOB heap reads up to ~1000 bytes past csrrom[] buffer
sys/bus/firewire/fwcrom.c:59
 — — — untriaged — —
DF-1041 Low 4.6 Unbounded out-of-bounds read loops in CISTPL_CFTABLE_ENTRY power and misc-extension parsing
sys/bus/pccard/pccard_cis.c:984
 panic reproduced fixed untriaged — —
DF-1205 Low 4.6 Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach
sys/dev/netif/de/if_de.c:2072
 none reproduced not_testable untriaged — —
DF-1308 Low 4.6 OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2108
 none reproduced not_testable untriaged — —
DF-1883 Low 4.6 Divide-by-zero in ad_attach/ad_describe via crafted IDENTIFY geometry (heads=0 or sectors=0)
sys/dev/disk/nata/ata-disk.c:147
 panic reproduced fixed untriaged — —
DF-2093 Low 4.6 NULL pointer dereference in PLX attach path when local I/O resource allocation fails
sys/dev/netif/wi/if_wi_pci.c:177
 dos reproduced fixed untriaged — —
DF-2321 Low 4.6 Unbounded idx extension loops in CISTPL_CFTABLE_ENTRY read past the declared tuple body
sys/bus/pccard/pccard_cis.c:995
 — — — untriaged — —
DF-2202 Medium 4.5 Unvalidated 4-bit register field indexes 9-element lookup table (OOB read)
sys/dev/drm/amd/amdgpu/df_v1_7.c:50
 panic reproduced fixed untriaged — —
DF-1339 Low 4.5 Unvalidated NCQ error tag allows OOB read on ap_ccbs via malicious device log page
sys/dev/disk/sili/sili.c:2138
 none reproduced fixed untriaged — —
DF-0354 Medium 4.4 nd6_sysctl_prlist stack buffer over-read leaks kernel memory when router count exceeds buffer capacity
sys/netinet6/nd6.c:2238
 leak:728bytes reproduced fixed untriaged — —
DF-0495 Medium 4.4 rn_delete integer underflow: klen-head_off wraps to huge size_t when key sa_len < tree offset -> kernel panic
sys/net/radix.c:884
 none not_reproduced not_testable untriaged — —
DF-0749 Medium 4.4 Unbounded table-id index in MAC-table lookup matchers — heap OOB read before eh-NULL gate (same DF-0668 pattern)
sys/net/ipfw3_layer2/ip_fw3_layer2.c:118
 panic reproduced fixed untriaged — —
DF-0832 Medium 4.4 Off-by-one OOB read in udf_bmap_internal ICB iteration — ad_offset > l_ad should be + sizeof(ad)
sys/vfs/udf/udf_vnops.c:1104
 leak:8 reproduced fixed untriaged — —
DF-1234 Medium 4.4 Kernel heap info leak via u_int16_t truncation in ASR_fillMessage on user-controlled reply size
sys/dev/raid/asr/asr.c:486
 none not_reproduced not_testable untriaged — —
DF-1364 Medium 4.4 Unchecked fd_formb_nsecs in FD_FORMAT causes OOB heap read via DMA/bcopy
sys/dev/disk/fd/fd.c:2272
 none inconclusive — untriaged — —
DF-1474 Medium 4.4 Topology/IR-config/PCIe-config change list loops trust firmware NumEntries/NumElements without bounding to allocation (heap OOB read)
sys/dev/raid/mpr/mpr_sas_lsi.c:216
 none inconclusive — untriaged — —
DF-1480 Medium 4.4 Signed integer underflow in P-state sysctl readers leaks kernel stack to unprivileged users
sys/dev/acpica/acpi_cpu_pstate.c:1255
 none inconclusive — untriaged — —
DF-1614 Medium 4.4 sln_rx mishandles RX ring wraparound: dead-code bounds check + missing modulo cause OOB reads (info leak / DoS)
sys/dev/netif/sln/if_sln.c:850
 panic reproduced fixed untriaged — —
DF-1697 Medium 4.4 mps_sas_lsi: SAS topology and IR config change loops trust firmware NumEntries/NumElements without bounding to allocation size (heap OOB read)
sys/dev/raid/mps/mps_sas_lsi.c:208
 panic reproduced fixed untriaged — —
DF-1798 Medium 4.4 smu_helper: heap OOB read in phm_get_sclk_for_voltage_evv via unvalidated vddInd from VBIOS
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:468
 none inconclusive — untriaged — —
DF-2056 Medium 4.4 iwm_fill_paging_mem copies paging sections with no length/NULL validation -> kernel OOB read or NULL-deref panic from malformed firmware
sys/dev/netif/iwm/if_iwm_fw.c:170
 panic reproduced fixed untriaged — —
DF-2107 Medium 4.4 Unbounded, unchecked SMBIOS structure-table walk causes OOB read and kernel panic
sys/dev/misc/ipmi/ipmi_smbios.c:147
 panic reproduced fixed untriaged — —
DF-2308 Medium 4.4 I2CREAD ioctl leaks uninitialized kernel heap memory to userspace
sys/bus/iicbus/iic.c:343
 — — — untriaged — —
DF-2333 Medium 4.4 UAC2.0 Feature Unit descriptor accepted too short causing OOB read of bmaControls[0]
sys/bus/u4b/audio/uaudio.c:4000
 none not_reproduced not_testable untriaged — —
DF-0020 Low 4.4 ELF ABI-note descriptor read out of bounds (note_overflow ignores n_descsz)
sys/kern/imgact_elf.c:1700
 panic reproduced fixed untriaged — —
DF-0157 Low 4.4 xio_uio_copy missing upper-bound check; KKASSERT(bytes>=0) is tautology on unsigned size_t
sys/kern/kern_xio.c:196
 none reproduced fixed untriaged — —
DF-0424 Low 4.4 Unvalidated mf6cc_parent stored in MFC: OOB read in ip6_mdq debug path when parent >= MAXMIFS(64)
sys/netinet6/ip6_mroute.c:751
 none reproduced fixed untriaged — —
DF-0607 Low 4.4 BPF write to ng_iface reads uninitialized sa_data, can KASSERT-panic the kernel
sys/netgraph7/iface/ng_iface.c:428
 none not_reproduced not_testable untriaged — —
DF-1006 Low 4.4 print_db reads DMA descriptor array OOB (off-by-one loop bound <= max plus db[i+1])
sys/bus/firewire/fwohci.c:2347
 none reproduced fixed untriaged — —
DF-1669 Low 4.4 if_vke: uninitialized struct tapinfo stack read leaks via ifconfig ifp->if_mtu/if_baudrate
sys/dev/virtual/vkernel/net/if_vke.c:771
 leak:0 reproduced fixed untriaged — —
DF-1852 Low 4.4 Unchecked copyin return + no M_ZERO in hptmv ioctl lets stale kernel heap leak via copyout
sys/dev/raid/hptmv/hptproc.c:297
 panic reproduced fixed untriaged — —
DF-1872 Low 4.4 Divide-by-zero panic via sysctl kern.dcons.poll_hz=0
sys/dev/misc/dcons/dcons_os.c:353
 panic reproduced fixed untriaged — —
DF-1885 Low 4.4 initsd computes size=0 for init_blocksize in [1,511]: OOB read / NULL-deref panic via bcmp
sys/dev/raid/vinum/vinumrevive.c:511
 panic reproduced fixed untriaged — —
DF-1898 Low 4.4 Firmware-controlled lengths in iwm_phy_db_set_section never validated against RX packet size: heap OOB read / kernel panic
sys/dev/netif/iwm/if_iwm_phy_db.c:268
 panic reproduced fixed untriaged — —
DF-2368 Low 4.4 Key-size validation is no-op KASSERT invalid keyBits silently yields Nr=0 and runaway loop / OOB read
sys/crypto/rijndael/rijndael-alg-fst.c:734
 — — — untriaged — —
DF-2502 Low 4.4 Signed int len assigned from u_int32_t dxfer_len signedness overflow in INQUIRY bzero and odd-length kmalloc/bcopy
sys/dev/disk/nata/atapi-cam.c:353
 — — — untriaged — —
DF-0454 Medium 4.3 Uninitialized kernel stack info leak in RPN response: param_mask never initialized for 1-byte RPN command
sys/netbt/rfcomm_session.c:1227
 leak:2bytes reproduced not_testable untriaged — —
DF-0540 Medium 4.3 Uninitialized cmd.ident sent in Command Reject: remote 1-byte kernel stack info leak
sys/netbt/l2cap_signal.c:70
 none not_reproduced not_testable untriaged — —
DF-0270 Low 4.3 OOB read in PAP ACK/NAK debug: wrong bound len+4 should be len-4
sys/net/sppp/if_spppsubr.c:4390
 none reproduced fixed untriaged — —
DF-0284 Low 4.3 Missing per-command payload bounds checks in MCC handlers (OOB read)
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521
 none reproduced fixed untriaged — —
DF-0346 Low 4.3 Uninitialized stack read of rsnparms on WPS/TSN assoc path bypasses HT-cipher downgrade protection
sys/netproto/802_11/wlan/ieee80211_hostap.c:1934
 none reproduced fixed untriaged — —
DF-2152 Low 4.3 ath_led_event indexes sc_hwmap[32] with unchecked rate index from received frame (OOB read)
sys/dev/netif/ath/ath/if_ath_led.c:189
 corruption reproduced fixed untriaged — —
DF-1481 Medium 4.2 vr_rxeof trusts 11-bit NIC-reported RX length as m_devget copy size without MCLBYTES bound: OOB heap read past RX mbuf cluster
sys/dev/netif/vr/if_vr.c:1005
 none inconclusive — untriaged — —
DF-1514 Medium 4.2 ste_rxeof trusts 13-bit NIC-reported FRAMELEN as m_len without MCLBYTES bound: large OOB heap read past RX mbuf cluster
sys/dev/netif/ste/if_ste.c:678
 none inconclusive — untriaged — —
DF-0582 Low 4.2 ieee80211_parse_beacon FHPARMS/DSPARMS field reads exceed declared IE length: OOB read
sys/netproto/802_11/wlan/ieee80211_input.c:571
 panic reproduced fixed untriaged — —
DF-1598 Low 4.2 Firmware header fields read without size check after amdgpu_ucode_validate
sys/dev/drm/amd/amdgpu/sdma_v2_4.c:154
 panic reproduced fixed untriaged — —
DF-2095 Low 4.2 u8 loop-variable underflow + signed shift UB in intel_dp_aux_set_pwm_freq (DoS via malicious eDP panel)
sys/dev/drm/i915/intel_dp_aux_backlight.c:114
 dos reproduced fixed untriaged — —
DF-2369 Low 4.2 Multi-block CFB1 never advances input/outBuffer leaking plaintext and stale output as ciphertext for blocks > 1
sys/crypto/rijndael/rijndael-api-fst.c:153
 — — — untriaged — —
DF-0595 Info 4.2 Michael MIC verification uses non-constant-time memcmp (defense-in-depth)
sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c:359
 leak:timing reproduced fixed untriaged — —
DF-0304 Low 4.1 CARP shared secret key material not zeroed before kfree
sys/netinet/ip_carp.c:307
 leak reproduced fixed untriaged — —
DF-0496 Low 4.1 rn_walktree_from dereferences caller-supplied mask without NULL check
sys/net/radix.c:1098
 leak reproduced fixed untriaged — —
DF-1050 Low 4.1 NULL-deref kernel panic in usb_detach when usb_proc_create failed during usb_attach_sub
sys/bus/u4b/controller/usb_controller.c:180
 none reproduced fixed untriaged — —
DF-1207 Low 4.1 alc_rxeof indexes alc_rxdesc[256] with hardware-controlled rx_cons (12-bit) and nsegs (4-bit) without bounds validation
sys/dev/netif/alc/if_alc.c:3304
 none reproduced fixed untriaged — —
DF-1457 Low 4.1 MC firmware header fields trusted without bounds validation causing heap OOB read
sys/dev/drm/amd/amdgpu/gmc_v8_0.c:314
 none reproduced fixed untriaged — —
DF-1538 Low 4.1 gmc_v7_0_mc_load_microcode trusts MC firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457 v7 twin)
sys/dev/drm/amd/amdgpu/gmc_v7_0.c:189
 panic reproduced fixed untriaged — —
DF-1553 Low 4.1 cik_sdma_load_microcode trusts SDMA firmware header offset/size fields without bounds-checking against fw->datasize (DF-1457/DF-1538 SDMA twin)
sys/dev/drm/amd/amdgpu/cik_sdma.c:539
 panic reproduced fixed untriaged — —
DF-1766 Low 4.1 ar5413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers causes OOB read and index wrap
sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:302
 panic reproduced fixed untriaged — —
DF-1845 Low 4.1 gpio_unregister calls devfs_clone_bitmap_get instead of _put, panicking kernel after repeated attach/detach
sys/dev/misc/gpio/gpio.c:596
 leak reproduced fixed untriaged — —
DF-2151 Low 4.1 Kernel panic on device attach error path: bus_release_resource uses wrong rid for io resource
sys/dev/raid/dpt/dpt_pci.c:174
 none reproduced fixed untriaged — —
DF-0065 Info 4.1 OOB read of thread struct before panic in lwkt_reltoken assertion path (console-only, no userspace leak)
sys/kern/lwkt_token.c:841
 none reproduced not_testable untriaged — —
DF-0333 Low 4.0 Kernel pointer leak to unprivileged users via in_pcblist_range xinpcb dump
sys/netinet/in_pcb.c:2409
 leak reproduced fixed untriaged — —
DF-0389 Low 4.0 Sockaddr padding not zeroed in rt_msg_buffer/rt_msg_mbuf: 1-7 bytes kernel memory leak per sockaddr
sys/net/rtsock.c:1140
 leak reproduced fixed untriaged — —
DF-1000 Low 4.0 Unbounded linear scan in rum_set_chan over rfprog channel table (defense-in-depth)
sys/bus/u4b/wlan/if_rum.c:2083
 none reproduced fixed untriaged — —
DF-1632 Info 4.0 Boot-time kernel pointer leak via dev_info %p of fence cpu_addr
sys/dev/drm/radeon/radeon_fence.c:861
 none reproduced not_testable untriaged — —
DF-1689 Medium 3.9 vega20_processpptables: VBIOS powerplay table size not validated against structure footprint -> OOB read
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:636
 panic reproduced fixed untriaged — —
DF-1690 Medium 3.9 vega20_processpptables: append_vbios_pptable dereferences smc_dpm_info VBIOS table without validating its size
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:714
 panic reproduced fixed untriaged — —
DF-0096 Low 3.9 sglist_join has reversed bcopy arguments - joins produce stale/garbage segments (dead code, identical to upstream FreeBSD)
sys/kern/subr_sglist.c:583
 none reproduced fixed untriaged — —
DF-0321 Low 3.9 Uninitialized stack read of maxunequalmcs when HTC_TXUNEQUAL set but ic_txstream<2
sys/netproto/802_11/wlan/ieee80211_ht.c:1643
 none reproduced fixed untriaged — —
DF-0798 Low 3.9 Missing bounds check on B-Tree node in-buffer offset — OOB heap read during CRC validation
sys/vfs/hammer/hammer_ondisk.c:1306
 panic reproduced fixed untriaged — —
DF-0827 Low 3.9 FAT12 1-byte OOB read in pcbmap via crafted cluster chain on small-FAT images
sys/vfs/msdosfs/msdosfs_fat.c:187
 leak:1 reproduced fixed untriaged — —
DF-1888 Low 3.9 Buffer over-read + u16 length underflow in e1000_mng_host_if_write_generic on misaligned offset with short length
sys/dev/netif/ig_hal/e1000_manage.c:237
 panic reproduced fixed untriaged — —
DF-1926 Low 3.9 tws_init_connect leaks sole internal-request slot on poll failure permanently disabling controller init/reset
sys/dev/raid/tws/tws_hdm.c:188
 leak reproduced fixed untriaged — —
DF-1958 Low 3.9 Unclamped csio->cdb_len and csio->sense_len allow OOB read of cdb_bytes and OOB write of sense_data in vpo_intr
sys/dev/disk/vpo/vpo.c:220
 panic reproduced fixed untriaged — —
DF-0036 Info 3.9 %n format specifier enabled in kernel printf engine with zero in-tree consumers
sys/kern/subr_prf.c:688
 none reproduced fixed untriaged — —
DF-0357 Info 3.9 nd6_cache_lladdr ignores lladdrlen parameter, uses ifp->if_addrlen for bcopy
sys/netinet6/nd6.c:1768
 none reproduced fixed untriaged — —
DF-0136 Medium 3.8 Jail isolation breach: varsym_list(VARSYM_SYS) leaks host varsyms to jailed processes
sys/kern/kern_varsym.c:263
 leak reproduced fixed untriaged — —
DF-0344 Low 3.7 No re-validation of m_len>=hlen after pfil hook rewrite/dummynet re-entry
sys/netinet/ip_input.c:631
 dos reproduced fixed untriaged — —
DF-0514 Low 3.7 REJECT_RST copies full 20-byte tcphdr after PULLUP_TO guaranteed only 14: stale mbuf buffer leak in RST
sys/net/ip6fw/ip6_fw.c:629
 none not_reproduced — untriaged — —
DF-0693 Low 3.7 ICV verification reads past mbuf data when ICV straddles mbuf boundary
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:477
 leak reproduced fixed untriaged — —
DF-0714 Low 3.7 One-byte OOB read in TCP option parser correct_mss when olen==1 after consuming NOPs
sys/netgraph7/tcpmss/ng_tcpmss.c:426
 none reproduced fixed untriaged — —
DF-1188 Low 3.7 OOB read in em_rxeof when NIC reports desc_len=0 on error descriptor
sys/dev/netif/em/if_em.c:3692
 panic reproduced fixed untriaged — —
DF-1960 Medium 3.6 Uninitialized heap memory leaked to any local user via sysctl when BIOS PSB has no matching PST
sys/dev/powermng/powernow/powernow.c:366
 none inconclusive — untriaged — —
DF-0151 Low 3.6 Fixed-size reads in preload_modinfo_value ignore field length
sys/kern/subr_module.c:374
 none reproduced fixed untriaged — —
DF-0152 Low 3.6 preload_dump_internal termination check weaker than other walkers; huge len advances pointer
sys/kern/subr_module.c:410
 none reproduced fixed untriaged — —
DF-0312 Low 3.6 Unchecked ifindex2ifnet[] indexing from embedded address scope-id on loopback output
sys/netinet6/ip6_output.c:577
 none reproduced fixed untriaged — —
DF-0407 Low 3.6 setsockopt(IP_OPTIONS) overwrites copyin error: parses stale mbuf data as IP options on copyin failure
sys/netinet/ip_output.c:1097
 none reproduced fixed untriaged — —
DF-0504 Low 3.6 ng_fec_choose_port dereferences ether/ip/ip6 headers with no mbuf length validation
sys/netgraph7/ng_fec.c:1018
 panic reproduced fixed untriaged — —
DF-1351 Low 3.6 nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1
sys/dev/netif/nfe/if_nfe.c:1072
 none reproduced not_testable untriaged — —
DF-1373 Low 3.6 oce_check_ipv6_ext_hdr parses IPv6 ext header without m_pullup (OOB read on short TX mbuf)
sys/dev/netif/oce/oce_if.c:2167
 none reproduced not_testable untriaged — —
DF-1458 Low 3.6 OOB stack read in cyapa_raw_input via unbounded device-reported finger count
sys/dev/smbus/cyapa/cyapa.c:1262
 none reproduced fixed untriaged — —
DF-1589 Low 3.6 Unbounded ucNumEntries-1 read in init_over_drive_limits reads patom_record_v2[-1] when ucNumEntries==0
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:269
 panic reproduced fixed untriaged — —
DF-1638 Low 3.6 u_int16_t truncation of buffer size in ess_dmasetup/ess_dmapos causes busy-loop stall and kernel heap info leak when buffersize=65536
sys/dev/sound/pci/solo.c:769
 dos reproduced fixed untriaged — —
DF-1765 Low 3.6 amdgpu_dm_debugfs: uninitialized stack read of param[] in dp_link_settings_write / dp_phy_settings_write
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:155
 none inconclusive — untriaged — —
DF-1782 Low 3.6 ata-siliconimage: OOB read in ata_sii_setmode PIO timing lookup (piotimings[mode&0x0f] on 5-element array with index 8..12)
sys/dev/disk/nata/chipsets/ata-siliconimage.c:366
 none reproduced fixed untriaged — —
DF-2223 Low 3.6 pcie_capability_read_dword leaves *dst uninitialized on register-not-implemented path diverging from LinuxKPI contract
sys/dev/drm/linux_pci.c:35
 — — — untriaged — —
DF-2387 Low 3.6 Unchecked SINF package index yields heap out-of-bounds read for short/malformed firmware packages
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:280
 — — — untriaged — —
DF-1523 Info 3.6 ar5212GetNfAdjust sentinel-terminator bug: OOB read when channel == 0
sys/dev/netif/ath/ath_hal/ar5212/ar5212_misc.c:769
 none reproduced not_testable untriaged — —
DF-0266 Medium 3.5 Uninitialized inflate window: kernel heap info leak via stale window data
sys/net/zlib.c:3706
 leak not_reproduced not_testable untriaged — —
DF-0973 Low 3.5 PROBE_MODE_SENSE OOB read via device-controlled blk_desc_len in mode header
sys/bus/cam/cam_xpt.c:6234
 none reproduced fixed untriaged — —
DF-1730 Low 3.5 atombios_dp: unvalidated DP lane count from malicious sink causes OOB stack reads during link training
sys/dev/drm/radeon/atombios_dp.c:312
 panic reproduced fixed untriaged — —
DF-0860 Medium 3.4 ngc_send does not validate ng_mesg length or arglen causing heap OOB read (FreeBSD CVE-2008-5736 never ported)
sys/netgraph/socket/ng_socket.c:248
 leak:128 reproduced fixed untriaged — —
DF-1091 Medium 3.4 Slave-controlled block-read count drives OOB MMIO reads and inflates returned byte count (amdsmb_bread)
sys/bus/smbus/amdsmb/amdsmb.c:517
 none not_reproduced fixed untriaged — —
DF-1222 Low 3.4 RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow)
sys/dev/virtual/amazon/ena/ena.c:1457
 none reproduced fixed untriaged — —
DF-1409 Low 3.4 OOB read of fixed-size ucMuxState[2] via BIOS-controlled enum_id in router-record parsing
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:431
 none reproduced fixed untriaged — —
DF-1597 Low 3.4 Signed/unsigned confusion in tpm_tis12_write causes stack buffer over-read on zero-length write
sys/dev/crypto/tpm/tpm.c:821
 panic reproduced fixed untriaged — —
DF-2239 Low 3.4 Before-buffer OOB read and conditional OOB write on CTRL(n) down-arrow at end of history
sys/ddb/db_input.c:236
 — — — untriaged — —
DF-0185 Medium 3.3 Uninitialized kernel stack memory leaked via acl_get_file/acl_get_fd
sys/kern/kern_acl.c:92
 none not_reproduced fixed untriaged — —
DF-0337 Medium 3.3 tcp_pcblist sysctl raw-copies entire inpcb and tcpcb with kernel pointers to unprivileged users
sys/netinet/tcp_subr.c:1284
 leak:113ptrs reproduced fixed untriaged — —
DF-0650 Medium 3.3 Heap OOB read in rip_send via unvalidated sockaddr length (IPv4 twin of DF-0619)
sys/netinet/raw_ip.c:632
 leak:4 reproduced fixed untriaged — —
DF-0922 Medium 3.3 Kernel heap pointer leaked to userspace via %p of vm_object in /proc/<pid>/map
sys/vfs/procfs/procfs_map.c:208
 leak reproduced fixed untriaged — —
DF-0938 Medium 3.3 Uninitialized kernel stack leaked via /proc/<pid>/fpregs read
sys/vfs/procfs/procfs_fpregs.c:54
 leak:~300 reproduced fixed untriaged — —
DF-0993 Medium 3.3 fill_dbregs leaves dr[8]-dr[15] uninitialized - 64-byte kernel stack leak via /proc/<pid>/dbregs and PT_GETDBREGS
sys/platform/pc64/x86_64/machdep.c:3104
 leak:64 reproduced fixed untriaged — —
DF-1056 Medium 3.3 fill_fpregs leaks ~404 bytes of uninitialized kernel stack via PT_GETFPREGS / /proc/pid/fpregs
sys/platform/vkernel64/x86_64/cpu_regs.c:711
 leak:404 reproduced fixed untriaged — —
DF-1353 Medium 3.3 vega12_force_clock_level OOB read of dpm_levels[16] via user-controlled mask
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1798
 leak reproduced fixed untriaged — —
DF-1641 Medium 3.3 Kernel pointer leak via non-NUL-terminated dm_dev UUID returned through info/deps ioctls
sys/dev/disk/dm/dm_ioctl.c:409
 panic reproduced fixed untriaged — —
DF-1712 Medium 3.3 intel_fbdev: stolen-memory framebuffer exposed unzeroed on DragonFly (info leak)
sys/dev/drm/i915/intel_fbdev.c:276
 none inconclusive — untriaged — —
DF-2449 Medium 3.3 dm_table_load_ioctl: uninitialized heap start/length in dm_table_entry_t leak to userspace via status ioctl
sys/dev/disk/dm/dm_ioctl.c:743
 leak:16 reproduced fixed untriaged — —
DF-2558 Medium 3.3 Kernel stack info leak via unp_pcblist sysctl (net.local.{dgram stream seqpacket}.pcblist)
sys/kern/uipc_usrreq.c:1465
 leak:~510 reproduced fixed untriaged — —
DF-0006 Low 3.3 kern.ttys sysctl leaks kernel function/heap pointers to unprivileged users
sys/kern/tty.c:2891
 leak:102ptrs reproduced fixed untriaged — —
DF-0009 Low 3.3 VFS_CONF (vfs.generic) sysctl leaks kernel pointers (vfc_vfsops, vfc_next) to unprivileged users
sys/kern/vfs_subr.c:1839
 leak:21bytes(11 vfc_vfsops + 10 vfc_next kernel pointers/run; KASLR-defeat) reproduced fixed untriaged — —
DF-0010 Low 3.3 Uninitialized struct cmsgcred leaks kernel stack via synthesized SCM_CREDS (SO_PASSCRED)
sys/kern/uipc_usrreq.c:683
 leak:62 reproduced fixed untriaged — —
DF-0016 Low 3.3 kinfo_proc (kern.proc.*) exports unredacted kernel pointers (KASLR defeat)
sys/kern/kern_proc.c:1603
 leak:69 reproduced fixed untriaged — —
DF-0027 Low 3.3 wait4/wait6 leak uninitialized kernel stack via status, rusage/wrusage and siginfo on WNOHANG/WCONTINUED return paths
sys/kern/kern_exit.c:913
 leak:148 reproduced fixed untriaged — —
DF-0034 Low 3.3 Uninitialized st_padding1 leaked to userspace via every stat syscall
sys/kern/vfs_vnops.c:852
 leak:2bytes reproduced fixed untriaged — —
DF-0050 Low 3.3 msgctl(IPC_STAT) leaks kernel heap pointers (msg_first/msg_last) and uninitialized padding to any local user
sys/kern/sysv_msg.c:324
 leak:8 reproduced fixed untriaged — —
DF-0077 Low 3.3 Uninitialized kernel stack bytes leaked via kern.ntp_pll.gettime sysctl (struct ntptimeval trailing padding)
sys/kern/kern_ntptime.c:205
 leak:4 reproduced fixed untriaged — —
DF-0093 Low 3.3 Kernel heap pointer leaked to userspace via shmctl(IPC_STAT) shm_internal field + struct padding
sys/kern/sysv_shm.c:420
 leak:8 reproduced fixed untriaged — —
DF-0101 Low 3.3 struct ktr_header written to trace file leaks kernel pointer (ktr_buf) and uninitialized padding
sys/kern/kern_ktrace.c:611
 leak:8 reproduced fixed untriaged — —
DF-0102 Low 3.3 Uninitialized payload fields (ktr_sysret.ktr_eosys, ktr_syscall padding) written to trace file
sys/kern/kern_ktrace.c:139
 leak:2 reproduced fixed untriaged — —
DF-0179 Low 3.3 Unconditional kernel address leak via kern.proc sysctl (KASLR bypass)
sys/kern/kern_kinfo.c:128
 none reproduced fixed untriaged — —
DF-0224 Low 3.3 ksched_getparam leaves sched_priority uninitialized for non-RT procs -> kernel stack info leak
sys/kern/kern_sched.c:142
 none reproduced fixed untriaged — —
DF-0256 Low 3.3 Kernel pointer info leak via kern.file sysctl (f_file, f_data) to unprivileged users
sys/kern/subr_kcore.c:67 · 📝
 leak reproduced fixed disputed — —
DF-0307 Low 3.3 Kernel heap/code pointer leak via SYSCTL_OPAQUE of mfctable and viftable to unprivileged users
sys/net/ip_mroute/ip_mroute.c:90
 leak reproduced fixed untriaged — —
DF-0435 Low 3.3 bpf_movein IEEE80211_RADIO path: ibp_len from user packet drives link-header copy without proper mbuf bounds check
sys/net/bpf.c:264
 none reproduced fixed untriaged — —
DF-0840 Low 3.3 hammer_ioc_get_data uses signed comparison on user-supplied size — negative size yields SIZE_MAX copyout (EFAULT on x86-64)
sys/vfs/hammer/hammer_ioctl.c:1080
 leak reproduced not_testable untriaged — —
DF-0866 Low 3.3 cd9660_readdir leaks kernel heap bytes via uninitialized struct dirent padding (d_unused1/d_unused2/d_name pad)
sys/vfs/isofs/cd9660/cd9660_vnops.c:447
 leak:7bytes reproduced fixed untriaged — —
DF-0882 Low 3.3 OOB read in partition-map walk n_pm unbounded by descriptor size
sys/vfs/udf/udf_vfsops.c:635
 none reproduced not_testable untriaged — —
DF-0954 Low 3.3 do_vmmeter_pcpu leaks kernel pointer v_lock_addr and token identifier to unprivileged users via vm.cpuN.vmmeter
sys/vm/vm_meter.c:428
 leak reproduced not_testable untriaged — —
DF-1032 Low 3.3 db_Grp7_11 OOB read when disassembling swapgs/rdtscp (6-entry array indexed by f_reg returning 7)
sys/cpu/x86_64/misc/db_disasm.c:204
 none reproduced fixed untriaged — —
DF-1062 Low 3.3 Uninitialized kernel stack leaks to userspace via short vendor control-IN responses from malicious CH341 device
sys/bus/u4b/serial/uchcom.c:417
 none reproduced fixed untriaged — —
DF-1087 Low 3.3 Kernel heap pointers leaked to userspace via full-CCB copyout in CAMIOCOMMAND/CAMGETPASSTHRU
sys/bus/cam/scsi/scsi_pass.c:546
 leak reproduced fixed untriaged — —
DF-1265 Low 3.3 Sideband reply parsers memcpy attacker-controlled num_bytes without bounds check (OOB read past msg_rx)
sys/dev/drm/drm_dp_mst_topology.c:441
 none reproduced fixed untriaged — —
DF-1522 Low 3.3 Off-by-one OOB read in ath_hal_EepromDataRead (off == ATH_DATA_EEPROM_SIZE allowed)
sys/dev/netif/ath/ath_hal/ah.c:1402
 leak:2 reproduced fixed untriaged — —
DF-1577 Low 3.3 Off-by-one in get_powerplay_table_entry_v1_0 allows OOB read of one state entry
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310
 panic reproduced fixed untriaged — —
DF-1594 Low 3.3 Uninitialized rv515_watermark.sclk read writes garbage to display priority MMIO
sys/dev/drm/radeon/rv515.c:946
 panic reproduced fixed untriaged — —
DF-1636 Low 3.3 Memory leak of priv struct on early error paths before dm_table_init_target
sys/dev/disk/dm/crypt/dm_target_crypt.c:489
 leak reproduced fixed untriaged — —
DF-1656 Low 3.3 radeon_uvd: missing radeon_bo_kunmap in error paths leaks kernel BO mapping
sys/dev/drm/radeon/radeon_uvd.c:489
 none reproduced fixed untriaged — —
DF-1762 Low 3.3 immio: off-by-one OOB heap read in OUTSTR path for odd blen
sys/dev/disk/vpo/immio.c:739
 leak:1 reproduced fixed untriaged — —
DF-1764 Low 3.3 amdgpu_dm_debugfs: memory leak on put_user failure in dp_link_settings_read / dp_phy_settings_read
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:89
 none inconclusive — untriaged — —
DF-1860 Low 3.3 apple_smc_mb_sysctl_fanid leaks kernel stack via unbounded strlen in sysctl_handle_string
sys/dev/apple/smc/smc_sysctl.c:51
 leak reproduced fixed untriaged — —
DF-1910 Low 3.3 i2s_pdata never freed: per-attach memory leak in all error paths of acp_hw_init
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:242
 leak reproduced fixed untriaged — —
DF-1936 Low 3.3 Unconditional kprintf on every VM retry fault: local kernel-log DoS
sys/dev/drm/amd/amdgpu/vega10_ih.c:288
 dos reproduced fixed untriaged — —
DF-2042 Low 3.3 Broken error path in i915_gem_prime_import leaks dma_buf_attachment
sys/dev/drm/i915/i915_gem_dmabuf.c:305
 leak reproduced fixed untriaged — —
DF-2080 Low 3.3 Uninitialized kernel heap memory disclosure via ATH_DIAG_DYN on non-output spectral control commands
sys/dev/netif/ath/ath/if_ath_spectral.c:218
 leak reproduced fixed untriaged — —
DF-2131 Low 3.3 Off-by-one OOB read of timings[] in ata_ite_8213_setmode at UDMA6
sys/dev/disk/nata/chipsets/ata-ite.c:158
 panic reproduced fixed untriaged — —
DF-2286 Low 3.3 Kernel pointer leak via targreturnccb copyout of ccb_hdr.cbfcnp and ccb_hdr.path
sys/bus/cam/scsi/scsi_target.c:967
 — — — untriaged — —
DF-2334 Low 3.3 UAC2.0 Mixer Unit verifier reads d1->bNrChannels one byte past the validated length
sys/bus/u4b/audio/uaudio.c:3976
 — — — untriaged — —
DF-2543 Low 3.3 Unprivileged kernel-pointer leak via hw.bus.devices sysctl (dv_handle/dv_parent)
sys/kern/subr_bus.c:3890
 leak:219 reproduced fixed untriaged — —
DF-2598 Low 3.3 NGM_SOURCE_GET_COUNTER reads msg->data without arglen validation heap OOB read
sys/netgraph7/ng_source.c:479
 — — — untriaged — —
DF-2600 Low 3.3 SETIFACE passes non-NUL-terminated msg->data to ifunit bounded heap OOB read
sys/netgraph7/ng_source.c:407
 — — — untriaged — —
DF-2608 Low 3.3 Uninitialized kernel stack memory leaked to userspace via USB FIFO in packet reassembly
sys/bus/u4b/input/uep.c:200
 none not_reproduced not_testable untriaged — —
DF-0092 Info 3.3 sysctl_rman leaks 4 bytes uninitialized kernel stack via struct u_resource trailing padding
sys/kern/subr_rman.c:700
 none reproduced fixed untriaged — —
DF-1841 Info 3.3 Sense-data over-copy in amr_cam_complete leaks stale cross-command SCSI sense bytes
sys/dev/raid/amr/amr_cam.c:451
 none reproduced not_testable untriaged — —
DF-2008 Info 3.3 Debugfs amdgpu_sa_info leaks kernel GPU virtual address and fence metadata to unprivileged users
sys/dev/drm/amd/amdgpu/amdgpu_sa.c:380
 leak reproduced fixed untriaged — —
DF-2306 Info 3.3 Unconditional PCI vendor/device ID disclosure to console in probe routine
sys/bus/firewire/fwohci_pci.c:190
 — — — untriaged — —
DF-0329 Low 3.1 icmp6_redirect_output leaks uninitialized mbuf heap bytes in padded redirected-header option
sys/netinet6/icmp6.c:2560
 leak reproduced fixed untriaged — —
DF-0544 Low 3.1 hardware_error and data_buffer_overflow: missing NG_HCI_M_PULLUP + length check on 1-byte body
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:826
 panic reproduced fixed untriaged — —
DF-2516 Low 3.1 Missing payload length validation in sbp_recv1 allows stale/uninitialized heap data to drive control flow and leak to userspace
sys/dev/disk/sbp/sbp.c:1572
 — — — untriaged — —
DF-0902 Info 3.1 setfs() leaves path buffer non-null-terminated after strncpy (latent OOB-read in strlen)
sys/vfs/nfs/nfs_mountrpc.c:347
 none reproduced fixed untriaged — —
DF-1873 Info 3.1 dcons DMA buffer allocated without M_ZERO: stale kernel memory leaked to FireWire peer
sys/dev/misc/dcons/dcons_os.c:462
 none reproduced fixed untriaged — —
DF-1994 Info 3.1 Missing payload-length validation in iwm_rx_time_event_notif firmware notification handler
sys/dev/netif/iwm/if_iwm_time_event.c:207
 panic reproduced fixed untriaged — —
DF-0274 Low 3.0 SIOCADDMULTI trusts user sa_len for heap alloc and bcopy without bounds check
sys/net/if.c:2327
 leak reproduced fixed untriaged — —
DF-0316 Low 3.0 OOB read: wg_output dereferences 4 bytes from mbuf without length check in BPF AF_UNSPEC path
sys/net/wg/if_wg.c:2289
 none reproduced fixed untriaged — —
DF-0971 Low 3.0 rc4_init reads key[0] before bounds check when keylen==0 (OOB read / NULL deref)
sys/crypto/rc4/rc4.c:72
 leak reproduced not_testable untriaged — —
DF-1027 Low 3.0 inittodr reads daysinmonth[12] OOB via unvalidated RTC month -> system clock corruption
sys/platform/pc64/isa/clock.c:1112
 none reproduced fixed untriaged — —
DF-1230 Low 3.0 mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128
sys/dev/raid/mpr/mpr.c:2458
 none reproduced fixed untriaged — —
DF-1256 Low 3.0 Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with missing release_firmware
sys/dev/drm/amd/amdgpu/amdgpu_device.c:757
 none reproduced fixed untriaged — —
DF-1432 Low 3.0 Heap OOB read in radeon_print_display_setup via BIOS-controlled encoder_id indexing encoder_names[38]
sys/dev/drm/radeon/radeon_display.c:714
 none reproduced fixed untriaged — —
DF-1922 Low 3.0 aac_print_fib iterates controller-supplied SgCount without bounding against FIB data size (debug-only)
sys/dev/raid/aac/aac_debug.c:240
 panic reproduced fixed untriaged — —
DF-2330 Low 3.0 amdsmb_bread uses unbounded hardware byte-count for register indexing and out-param
sys/bus/smbus/amdsmb/amdsmb.c:533
 — — — untriaged — —
DF-2542 Low 3.0 mfc entries kmalloc without M_ZERO only [0 numvifs) of mfc_ttls/mfc_flags initialized later add_vif exposes uninitialized heap bytes via forwarding decisions
sys/net/ip_mroute/ip_mroute.c:1055
 — — — untriaged — —
DF-0123 Info 3.0 kernenv_next unbounded walk of bootloader static env
sys/kern/kern_environment.c:510
 none reproduced not_testable untriaged — —
DF-1952 Info 3.0 Unbounded loop over displays[] in phm_store_dal_configuration_data (latent OOB read)
sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:294
 none reproduced not_testable untriaged — —
DF-0084 Low 2.9 Off-by-one OOB read in get_next_valid_apicid: array indexed before bound check in while condition
sys/kern/subr_cpu_topology.c:91
 none reproduced fixed untriaged — —
DF-0541 Low 2.9 Uninitialized cp.data[0] in Command Reject MTU_EXCEEDED sets link MTU to stack garbage
sys/netbt/l2cap_signal.c:91
 leak reproduced fixed untriaged — —
DF-1406 Low 2.9 OOB read of sdtr_period_tbl[8] on non-Ultra controllers when sync_data upper nibble>=8
sys/dev/disk/advansys/advlib.c:1073
 none reproduced fixed untriaged — —
DF-1552 Low 2.9 chip_ids[15] indexed by (rev>>4)&0xF is a 1-element OOB read at probe/attach when chip reports rev with high nibble 0xF
sys/dev/netif/sn/if_sn.c:140
 panic reproduced fixed untriaged — —
DF-0197 Info 2.9 sysctl_devstat copies full struct devstat including unset fields and padding
sys/kern/subr_devstat.c:289
 none reproduced not_testable untriaged — —
DF-0643 Low 2.7 check_forward heap OOB read via unvalidated cmd->arg3 destination count
sys/net/ipfw3_basic/ip_fw3_basic.c:213
 panic reproduced fixed untriaged — —
DF-0771 Medium 2.5 Missing data_len validation on inode load — crafted image heap OOB read via struct copy past buffer end
sys/vfs/hammer/hammer_inode.c:524
 leak:128 reproduced fixed untriaged — —
DF-0031 Low 2.5 pipe->open_count underflow on pipe_create partial failure leaks kernel KVA and pipe struct
sys/kern/sys_pipe.c:433
 none not_reproduced not_testable untriaged — —
DF-0111 Low 2.5 CT_CHAR (%c) non-suppress bcopy reads width bytes without checking inr -> OOB read
sys/kern/subr_scanf.c:307
 none reproduced fixed untriaged — —
DF-0167 Low 2.5 syscap_get INPARENT: no same-uid/same-prison authorization: info leak of capability config
sys/kern/kern_caps.c:95
 none reproduced fixed untriaged — —
DF-0433 Low 2.5 bpf_mtap_hdr submits partially-initialized stack mbuf: bpf_mtap reads uninitialized m_pkthdr.rcvif
sys/net/bpf.c:1347
 dos reproduced fixed untriaged — —
DF-0437 Low 2.5 Receive-path filter dereferences mbuf data without m_pullup: OOB read within mbuf cluster on short first mbuf
sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:474
 none reproduced fixed untriaged — —
DF-0967 Low 2.5 AES raw key material left unzeroized on kernel stack in rijndael_makeKey
sys/crypto/rijndael/rijndael-api-fst.c:36
 leak reproduced not_testable untriaged — —
DF-0995 Low 2.5 sardpos leaks uninitialized kernel stack via MTIOCRDSPOS/MTIOCRDHPOS when device returns short READ POSITION data
sys/bus/cam/scsi/scsi_sa.c:3247
 none reproduced fixed untriaged — —
DF-1160 Low 2.5 OOB read in HDMI IRQ handler: afmt_status indexed before bounds check
sys/dev/drm/radeon/evergreen.c:4803
 panic reproduced fixed untriaged — —
DF-1224 Low 2.5 Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header
sys/dev/raid/mpr/mpr_sas.c:2766
 none reproduced fixed untriaged — —
DF-1335 Low 2.5 Off-by-one OOB read of vddc_table[MAX_NO_VREG_STEPS=32] in rv770_populate_smc_vddc_table
sys/dev/drm/radeon/rv770_dpm.c:1124
 none reproduced fixed untriaged — —
DF-1436 Low 2.5 Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger
sys/dev/disk/sdhci/sdhci.c:1735
 none reproduced fixed untriaged — —
DF-1486 Low 2.5 Out-of-bounds stack read of fclks.data[-1] when SMU reports a single FCLK level
sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1368
 leak:8 reproduced fixed untriaged — —
DF-1518 Low 2.5 ar5416ChainTxDesc indexes ah_keytype[] unconditionally, causing OOB read when keyIx == HAL_TXKEYIX_INVALID
sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c:583
 panic reproduced fixed untriaged — —
DF-1588 Low 2.5 Off-by-one out-of-bounds read in vega10_get_powerplay_table_entry state-array index check
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1308
 panic reproduced fixed untriaged — —
DF-1620 Low 2.5 mrsas_startio leaks allocated mrsas_mpt_cmd on every build-failure path
sys/dev/raid/mrsas/mrsas_cam.c:481
 leak reproduced fixed untriaged — —
DF-1660 Low 2.5 ar5212_ani: HAL_DIAG_ANI_PARAMS allows setting maxLevel > array dim -> wild OOB read in ar5212AniControl
sys/dev/netif/ath/ath_hal/ar5212/ar5212_ani.c:181
 panic reproduced fixed untriaged — —
DF-1718 Low 2.5 ar5112: ar5112GetChannelMaxMinPower returns AH_TRUE on no-match without initializing *minPow -> stale stack leak via 802.11h PowerCapability
sys/dev/netif/ath/ath_hal/ar5212/ar5112.c:765
 leak:7 reproduced fixed untriaged — —
DF-1763 Low 2.5 immio: missing clen bound allows OOB read of csio struct in CDB-send loop
sys/dev/disk/vpo/immio.c:702
 leak:240 reproduced fixed untriaged — —
DF-1861 Low 2.5 dma_fence reference leak in amdgpu_pasid_free_delayed when fence-array allocation fails
sys/dev/drm/amd/amdgpu/amdgpu_ids.c:135
 leak reproduced fixed untriaged — —
DF-1914 Low 2.5 drm_agp_info_ioctl copies uninitialized trailing struct padding back to userspace
sys/dev/drm/drm_agpsupport.c:62
 leak reproduced fixed untriaged — —
DF-1984 Low 2.5 Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer (amdgpu)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:213
 none reproduced not_testable untriaged — —
DF-2021 Low 2.5 Signed table_id bounds check allows negative-index OOB on smu_tables.entry[]
sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c:41
 none reproduced not_testable untriaged — —
DF-2045 Low 2.5 extra_history_size pool leaks on failed history realloc; function falsely returns success
sys/dev/misc/syscons/schistory.c:122
 leak reproduced fixed untriaged — —
DF-2071 Low 2.5 kbdsw dispatch functions dereference kbdsw[kb_index] without bounds/NULL checks unlike kbd_intr
sys/dev/misc/kbd/kbdsw.c:80
 none reproduced fixed untriaged — —
DF-2295 Low 2.5 fw_read copies iso stream packet by attacker-controlled stream.len without bounding to psize (DMA buffer over-read)
sys/bus/firewire/fwdev.c:321
 — — — untriaged — —
DF-2296 Low 2.5 FW_ASYREQ send-path bcopy over-reads ioctl heap buffer when req.len exceeds data[] capacity
sys/bus/firewire/fwdev.c:529
 — — — untriaged — —
DF-2363 Low 2.5 Sensitive key material left on kernel stack across multiple paths
sys/crypto/chachapoly.c:52
 — — — untriaged — —
DF-2394 Low 2.5 Ignored acpi_PkgInt32 return values leak uninitialized kernel stack via sysctl read
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:442
 — — — untriaged — —
DF-2403 Low 2.5 Uninitialized kernel-stack info leak via fanid sysctl on MMIO/T2 backend
sys/dev/apple/smc/smc_sysctl.c:51
 — — — untriaged — —
DF-2422 Low 2.5 Missing cdb_len validation in DISK I/O path allows OOB read on short CDB pointer
sys/dev/disk/ahci/ahci_cam.c:1089
 — — — untriaged — —
DF-2549 Low 2.5 ttyinfo prints uninitialized stack rusage when the foreground LWP has no thread
sys/kern/tty.c:2505
 — — — untriaged — —
DF-0007 Info 2.5 Uninitialized struct sigaction trailing padding leaked to userspace via oact copyout
sys/kern/kern_sig.c:260
 leak:4bytes reproduced fixed untriaged — —
DF-0963 Info 2.5 Unvalidated keyBits/Nr in production kernels causes infinite loop walking rk off the end of the key schedule (latent)
sys/crypto/rijndael/rijndael-alg-fst.c:734
 none reproduced fixed untriaged — —
DF-1148 Info 2.5 RX return-ring buffer index validated only by KKASSERT (compiled out without INVARIANTS)
sys/dev/netif/bnx/if_bnx.c:2812
 none reproduced not_testable untriaged — —
DF-1901 Info 2.5 Stubbed get_local_mem_info returns uninitialized output structure: latent info-leak if KFD wired up (CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354
 none reproduced not_testable untriaged — —
DF-1971 Info 2.5 Uninitialized mode_cmd stack fields propagated into long-lived drm_framebuffer
sys/dev/drm/radeon/radeon_fb.c:224
 leak reproduced fixed untriaged — —
DF-2011 Info 2.5 hdspe_intr leaks sc->lock (lockmgr LK_EXCLUSIVE) on device_get_children error path
sys/dev/sound/pci/hdspe.c:96
 leak reproduced fixed untriaged — —
DF-2211 Info 2.5 Uninitialized res.clock field returned by value from amdgpu_afmt_acr()
sys/dev/drm/amd/amdgpu/amdgpu_afmt.c:90
 — — — untriaged — —
DF-2402 Info 2.5 Partial MMIO key read returns success without zeroing unfilled buffer tail enabling uninitialized-stack leak through sysctl
sys/dev/apple/smc/smc_mmio.c:75
 — — — untriaged — —
DF-2291 Medium 2.4 crom_parse_text bounds check missing sizeof(u_int32_t) multiplier allows OOB heap read past ROM buffer
sys/bus/firewire/fwcrom.c:207
 — — — untriaged — —
DF-0972 Low 2.4 PROBE_SERIAL_NUM_1 heap OOB read via device-controlled length in VPD unit serial number response
sys/bus/cam/cam_xpt.c:6309
 leak reproduced not_testable untriaged — —
DF-0984 Low 2.4 OOB read of ridx2rate[] in urtwn_rx_frame for legacy rates >= 12
sys/bus/u4b/wlan/if_urtwn.c:1069
 none reproduced fixed untriaged — —
DF-1099 Low 2.4 Parent DMA tag sc->fc.dmat never destroyed in detach
sys/bus/firewire/fwohci_pci.c:300
 leak reproduced fixed untriaged — —
DF-1103 Low 2.4 Uninitialized kernel stack bytes leaked to userspace via short USB interrupt transfers in packet reassembly
sys/bus/u4b/input/uep.c:225
 leak reproduced fixed untriaged — —
DF-1281 Low 2.4 Unbounded EventDataLength loop in mpt_core_event reads past reply frame leaking kernel memory to console
sys/dev/disk/mpt/mpt.c:559
 none reproduced fixed untriaged — —
DF-1447 Low 2.4 OOB read of static wordsForPdgains[] when EEPROM xpd_mask has no set bits (numPdGains=0)
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:763
 none reproduced fixed untriaged — —
DF-1715 Low 2.4 adwlib: adw_find_period reads one element past adw_syncrates[] on unrecognized mc_sdtr, leaking 1 byte of adjacent rodata
sys/dev/disk/advansys/adwlib.c:825
 leak:4 reproduced fixed untriaged — —
DF-1776 Low 2.4 radeon_dp_mst: uninitialized kernel stack byte read in radeon_dp_mst_probe when AUX transfer fails
sys/dev/drm/radeon/radeon_dp_mst.c:676
 leak:1 reproduced fixed untriaged — —
DF-2092 Low 2.4 OOB stack read in Hauppauge EEPROM parser leaks kernel stack bytes to dmesg
sys/dev/video/cxm/cxm_eeprom.c:145
 leak reproduced fixed untriaged — —
DF-2337 Low 2.4 Uninitialized kernel-stack bytes leaked to userspace via uep FIFO during short-transfer packet reassembly
sys/bus/u4b/input/uep.c:225
 — — — untriaged — —
DF-2529 Low 2.4 1-byte heap OOB read in OUT-data transfer path of imm_do_scsi
sys/dev/disk/vpo/immio.c:739
 — — — untriaged — —
DF-2588 Low 2.4 Signed/unsigned comparison in RX aggregation loop permits heap OOB read of RX descriptor
sys/bus/u4b/wlan/if_urtwn.c:984
 none not_reproduced not_testable untriaged — —
DF-1063 Info 2.4 USB_GET_GPIO returns 1 byte of uninitialized kernel stack on a short control-IN response
sys/bus/u4b/serial/uslcom.c:622
 none reproduced fixed untriaged — —
DF-1104 Info 2.4 One-byte out-of-bounds stack read in get_pkt_len when parsing DIAG header at end of buffer
sys/bus/u4b/input/uep.c:127
 none reproduced not_testable untriaged — —
DF-0451 Medium 2.3 OOB read in ng_fixedstring_unparse: known bufSize ignored, delegates to unbounded strlen
sys/netgraph/netgraph/ng_parse.c:785
 leak:7 reproduced fixed untriaged — —
DF-0670 Medium 2.3 Missing sopt_valsize validation -> heap OOB read of ioc_table fields, info leak via table LIST
sys/net/ipfw3_basic/ip_fw3_table.c:92
 none reproduced fixed untriaged — —
DF-1357 Medium 2.3 Kernel heap info leak via unchecked request-sense length in Linux-compat ioctl
sys/dev/raid/amr/amr.c:583
 leak:223 reproduced fixed untriaged — —
DF-0293 Low 2.3 OOB heap read in setwparsnie during WPA/RSN app-IE split
sys/netproto/802_11/wlan/ieee80211_ioctl.c:2319
 none reproduced fixed untriaged — —
DF-0297 Low 2.3 1-byte heap OOB read in ng_name_node name-length validation
sys/netgraph7/netgraph/ng_base.c:817
 none reproduced fixed untriaged — —
DF-0379 Low 2.3 NGM_BINARY2ASCII heap OOB read via ng_unparse: arglen not validated against mesgType/respType struct size
sys/netgraph/netgraph/ng_base.c:1505
 leak reproduced fixed untriaged — —
DF-0412 Low 2.3 Kernel heap OOB read in ng_string_unparse via unbounded strlen on binary data without NUL terminator
sys/netgraph7/netgraph/ng_parse.c:747
 leak reproduced fixed untriaged — —
DF-0438 Low 2.3 Kernel stack info-leak via uninitialized redstats[3] array in hfsc_getqstats copyout
sys/net/altq/altq_hfsc.c:293
 leak reproduced fixed untriaged — —
DF-0603 Low 2.3 Kernel pointer leak via DIOCIGETIFACES wholesale copyout of struct pfi_kif
sys/net/pf/pf_if.c:763
 leak:224bytes reproduced fixed untriaged — —
DF-0652 Low 2.3 cbq_getqstats leaks uninitialized kernel stack to userspace via class_stats_t
sys/net/altq/altq_cbq.c:473
 leak reproduced fixed untriaged — —
DF-0658 Low 2.3 Uninitialized kernel stack leaked via priq_getqstats copyout of struct priq_classstats
sys/net/altq/altq_priq.c:221
 leak reproduced fixed untriaged — —
DF-0665 Low 2.3 Kernel address disclosed to netgraph peer via ngdioctl datap->p = addr
sys/netgraph/ng_device.c:476
 leak reproduced fixed untriaged — —
DF-0756 Low 2.3 Missing m_len bound check in discoutput AF_UNSPEC (BPF write) path corrupts obytes counter
sys/net/disc/if_disc.c:117
 none reproduced not_testable untriaged — —
DF-1013 Low 2.3 SESIOC_GETOBJMAP leaks 2 bytes uninitialized kernel stack per object (struct padding)
sys/bus/cam/scsi/scsi_ses.c:503
 none reproduced fixed untriaged — —
DF-1030 Low 2.3 Unbounded strlen on possibly non-NUL-terminated user cv_volid in chsetvoltag
sys/bus/cam/scsi/scsi_ch.c:1300
 none reproduced fixed untriaged — —
DF-1067 Low 2.3 PCIOCGETCONF_OLD leaks uninitialized kernel stack padding to userspace
sys/bus/pci/pci_user.c:316
 none reproduced fixed untriaged — —
DF-1110 Low 2.3 Memory leak of usrbufs array on I2CRDWR copyin-failure path
sys/bus/iicbus/iic.c:352
 leak reproduced fixed untriaged — —
DF-1111 Low 2.3 Ignored copyin/copyout return values in I2CRDWR leak uninitialized kernel heap to I2C bus
sys/bus/iicbus/iic.c:360
 leak reproduced fixed untriaged — —
DF-1156 Low 2.3 ISP_FC_GETDINFO ioctl missing bounds check on ifc->chan -> OOB fcparam read
sys/dev/disk/isp/isp_freebsd.c:479
 panic reproduced fixed untriaged — —
DF-1504 Low 2.3 genkbd_get_fkeystr off-by-one bound (> instead of >=) permits one-element OOB read
sys/dev/misc/kbd/kbd.c:1119
 none reproduced fixed untriaged — —
DF-1532 Low 2.3 Kernel stack info leak via TW_CL_IOCTL_GET_COMPATIBILITY_INFO
sys/dev/raid/twa/tw_cl_io.c:656
 leak:0 reproduced fixed untriaged — —
DF-1541 Low 2.3 Out-of-bounds read in NGM_TEXT_CONFIG via strcmp/kprintf on non-NUL-terminated user string
sys/dev/netif/mn/if_mn.c:360
 leak:0 reproduced fixed untriaged — —
DF-1691 Low 2.3 viapm: viasmb_bread reports untrusted hardware length as bytes-written, leaking kernel stack
sys/dev/powermng/viapm/viapm.c:852
 leak:0 reproduced fixed untriaged — —
DF-1711 Low 2.3 intpm: intsmb_bread discards SMBus block-read bytes; leaks uninitialized kernel stack via /dev/smb* SMB_BREAD
sys/dev/powermng/intpm/intpm.c:836
 leak:32 reproduced fixed untriaged — —
DF-1844 Low 2.3 GPIOINFO ioctl leaks kernel cdev pointer to userspace (KASLR bypass for root)
sys/dev/misc/gpio/gpio.c:466
 leak reproduced fixed untriaged — —
DF-2032 Low 2.3 Kernel stack info leak via TWS_IOCTL_GET_COMPATIBILITY_INFO (uninitialized driver_version tail)
sys/dev/raid/tws/tws_user.c:267
 leak:19 reproduced not_testable untriaged — —
DF-2266 Low 2.3 CAMGETPASSTHRU leaks stale kernel pointers and prior I/O data via whole-CCB bcopy
sys/bus/cam/cam_periph.c:888
 — — — untriaged — —
DF-2277 Low 2.3 Kernel pointer leak to userspace via unconditional bcopy of full union ccb on CAMIOCOMMAND completion
sys/bus/cam/scsi/scsi_pass.c:610
 — — — untriaged — —
DF-2280 Low 2.3 SESIOC_GETOBJMAP leaks 2 bytes of uninitialized kernel stack per object via ses_object struct padding
sys/bus/cam/scsi/scsi_ses.c:559
 — — — untriaged — —
DF-2546 Low 2.3 Missing arglen validation in NGM_SOURCE_GET_COUNTER allows uninitialized heap read
sys/netgraph7/ng_source.c:481
 — — — untriaged — —
DF-0447 Info 2.3 AF_ARP output case is dead code carrying latent uninitialized-read/OOB-read: mtod returns ether_header not arphdr after M_PREPEND
sys/net/if_ethersubr.c:237
 none reproduced not_testable untriaged — —
DF-1219 Info 2.3 ACPIIO_DO_MCALL leaks kernel heap pointers via PACKAGE results (incomplete pointer fixup)
sys/dev/acpica/acpi.c:3364
 none reproduced not_testable untriaged — —
DF-1742 Info 2.3 vinumioctl: VINUM_*CONFIG bcopy entire struct including kernel pointers vp/dev to userland
sys/dev/raid/vinum/vinumioctl.c:127
 leak reproduced fixed untriaged — —
DF-1786 Info 2.3 fb: FBIO_ADPINFO leaks kernel framebuffer addresses to userspace
sys/dev/video/fb/fb.c:682
 leak reproduced fixed untriaged — —
DF-2123 Info 2.3 vinum_meminfo discloses the kernel address of the malloced[] debug table to userspace
sys/dev/raid/vinum/vinummemory.c:184
 leak reproduced fixed untriaged — —
DF-1567 Low 2.1 Unvalidated lane_count causes OOB read of link_status[] in DP link-training helpers
sys/dev/drm/drm_dp_helper.c:46
 panic reproduced fixed untriaged — —
DF-2342 Low 2.1 Uninitialized kernel stack read via short/malformed CH341 control responses
sys/bus/u4b/serial/uchcom.c:417
 — — — untriaged — —
DF-1098 Low 2.0 Missing resource cleanup when bus_dma_tag_create fails in fwohci_pci_attach
sys/bus/firewire/fwohci_pci.c:320
 leak reproduced fixed untriaged — —
DF-0150 Low 1.9 Unbounded strlen/strcmp on TLV string fields ignores declared length
sys/kern/subr_module.c:69
 none reproduced fixed untriaged — —
DF-0182 Low 1.9 Uninitialized kernel stack memory disclosed via vm.resident sysctl
sys/kern/imgact_resident.c:82
 none reproduced fixed untriaged — —
DF-0277 Low 1.9 Kernel pointer leak via DIOCGETRULE: bcopy of pf_rule exposes kif/anchor/rpool.cur/skip[].ptr
sys/net/pf/pf_ioctl.c:1336
 leak reproduced fixed untriaged — —
DF-0278 Low 1.9 Kernel pointer leak via DIOCGETADDR: bcopy of pf_pooladdr exposes pfi_kif*
sys/net/pf/pf_ioctl.c:2220
 leak reproduced fixed untriaged — —
DF-0279 Low 1.9 Kernel pointer leak via DIOCGETALTQ: bcopy of pf_altq exposes altq_disc
sys/net/pf/pf_ioctl.c:2088
 leak reproduced fixed untriaged — —
DF-0400 Low 1.9 rt_fixchange indexes mask bytes by key length without verifying mask size: latent OOB read
sys/net/route.c:1130
 none reproduced fixed untriaged — —
DF-0425 Low 1.9 MRT6 setsockopt handlers cast mtod() without verifying m_len against struct size: reads uninitialized mbuf data
sys/netinet6/ip6_mroute.c:277
 leak reproduced fixed untriaged — —
DF-0515 Low 1.9 add_entry6 null-terminates fw_in_if.name but not fw_out_if.name: kfnmatch bounded over-read
sys/net/ip6fw/ip6_fw.c:851
 leak reproduced fixed untriaged — —
DF-0574 Low 1.9 Uninitialized kernel stack read as alias IPs via count mismatch in copyin
sys/net/ipfw3_nat/ip_fw3_nat.c:756
 panic reproduced fixed untriaged — —
DF-0655 Low 1.9 Expanded AES key schedule (containing raw 128-bit key) not zeroed before ccmp_ctx freed
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:119
 leak reproduced fixed untriaged — —
DF-0966 Low 1.9 Raw key words me_key[4]/mo_key[4] left unzeroed on kernel stack after twofish_set_key returns
sys/crypto/twofish/twofish.c:427
 leak reproduced not_testable untriaged — —
DF-1052 Low 1.9 SG_IO sense-data copyout reads past csio->sense_data when sense_resid exceeds mx_sb_len
sys/bus/cam/scsi/scsi_sg.c:570
 none reproduced fixed untriaged — —
DF-1247 Low 1.9 Out-of-bounds read in bwn_phy_g_dc_lookup_init via hardcoded loop bound (64 vs 63 valid pairs)
sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:2599
 none reproduced fixed untriaged — —
DF-1291 Low 1.9 Sense copyout over-reads 64-byte command packet in mly_user_command
sys/dev/raid/mly/mly.c:2922
 none reproduced fixed untriaged — —
DF-1349 Low 1.9 EE_SPEED EEPROM byte used unbounded as index into eeprom_period[8]
sys/dev/disk/amd/amd.c:2342
 none reproduced not_testable untriaged — —
DF-1512 Low 1.9 vga_switcheroo_lock_ddc leaks mux_hw_lk on the no-handler / no-switch_ddc error path
sys/dev/video/vga/vga_switcheroo.c:557
 leak reproduced fixed untriaged — —
DF-1564 Low 1.9 Kernel stack info leak via uninitialized bytesReturned copyout
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1260
 leak reproduced fixed untriaged — —
DF-1565 Low 1.9 Kernel heap info leak via unbounded copyout of oversized outbuffer
sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c:1289
 leak reproduced fixed untriaged — —
DF-1579 Low 1.9 Kernel stack info leak via uninitialized bytesReturned copyout
sys/dev/raid/hptrr/hptrr_osm_bsd.c:1236
 leak reproduced fixed untriaged — —
DF-1580 Low 1.9 Kernel heap info leak via oversized copyout of unzeroed outbuffer
sys/dev/raid/hptrr/hptrr_osm_bsd.c:1266
 leak reproduced fixed untriaged — —
DF-1629 Low 1.9 OpRegion KVA mappings leak on every suspend/resume: pmap_mapbios mappings invisible to DRM iounmap()
sys/dev/drm/i915/intel_opregion.c:987
 leak reproduced fixed untriaged — —
DF-1673 Low 1.9 cik_sdma: firmware header offset/size fields not bounds-checked in cik_sdma_load_microcode
sys/dev/drm/radeon/cik_sdma.c:471
 panic reproduced fixed untriaged — —
DF-1674 Low 1.9 amdgpu_dpm: VBIOS power-table parsing reads heap OOB via unchecked offsets and indices
sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:282
 panic reproduced fixed untriaged — —
DF-1817 Low 1.9 ppatomfwctrl: voltage LUT iteration bounds destination not source -> OOB read of VBIOS heap when gpio_entry_num exceeds actual LUT extent
sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:110
 none reproduced not_testable untriaged — —
DF-1835 Low 1.9 alpm_bread leaks uninitialized kernel stack via unchecked SMBus block-read length (variant of DF-1833)
sys/dev/powermng/alpm/alpm.c:606
 none reproduced not_testable untriaged — —
DF-1887 Low 1.9 revive_block leaks rangelock when read returns B_ERROR: permanent I/O hang on affected stripe
sys/dev/raid/vinum/vinumrevive.c:137
 leak reproduced fixed untriaged — —
DF-2106 Low 1.9 Unbounded sg_count drives OOB read in mfi_print_sgl / mfi_validate_sg debug helpers (MFI_DEBUG builds only)
sys/dev/raid/mfi/mfi_debug.c:66
 none reproduced fixed untriaged — —
DF-2111 Low 1.9 Uninitialized kernel-stack bytes leaked to the console splash screen when bpsl < width (or compressed stream is short)
sys/dev/video/fb/pcx/splash_pcx.c:176
 none reproduced fixed untriaged — —
DF-2310 Low 1.9 I2CRDWR: unchecked copyin return value sends uninitialized kernel heap to I2C device
sys/bus/iicbus/iic.c:360
 — — — untriaged — —
DF-2373 Low 1.9 Kernel heap address leak via incomplete pointer fix-up in ACPIIO_DO_MCALL Package results
sys/dev/acpica/acpi.c:3380
 — — — untriaged — —
DF-2395 Low 1.9 Heap OOB read via zero-element ACPI SIF package - no count check before o[0]
sys/dev/acpica/aibs/atk0110.c:169
 — — — untriaged — —
DF-2531 Low 1.9 Unclamped cdb_len over-reads 16-byte inline cdb_bytes and leaks kernel memory out parallel port
sys/dev/disk/vpo/vpo.c:220
 — — — untriaged — —
DF-2593 Low 1.9 Missing sopt_valsize validation causes OOB heap read in every set-mutation handler
sys/net/ipfw3/ip_fw3_set.c:105
 — — — untriaged — —
DF-2603 Low 1.9 Missing minimum-length check + u_short packetlen underflow in LMI packet parser kernel heap OOB read
sys/netgraph7/lmi/ng_lmi.c:88
 — — — untriaged — —
DF-0066 Info 1.9 Undefined behavior: shift by sysctl-controlled token_window_shift in backoff spin
sys/kern/lwkt_token.c:398
 none reproduced fixed untriaged — —
DF-0164 Info 1.9 sys_modstat copyout non-NUL-terminated module name when name>=MAXMODNAME
sys/kern/kern_module.c:348
 none reproduced fixed untriaged — —
DF-0180 Info 1.9 Fragile zeroing contract for fill_kinfo_lwp aggregation (+=)
sys/kern/kern_kinfo.c:219
 none reproduced fixed untriaged — —
DF-0405 Info 1.9 Missing null-termination of bdg_basename when namelen==IFNAMSIZ: OOB read in debug format strings
sys/net/netmap/netmap_vale.c:331
 none reproduced fixed untriaged — —
DF-0500 Info 1.9 Response handlers trust count/size fields without checking pcb->msg arglen: defense-in-depth gap
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:917
 none reproduced not_testable untriaged — —
DF-0854 Info 1.9 User-controlled iconv charset names copied without null-termination — bounded kernel-stack OOB read via kprintf/strcasecmp
sys/vfs/msdosfs/msdosfs_vfsops.c:116
 none reproduced fixed untriaged — —
DF-1033 Info 1.9 REX.R prefix causes OOB read across all Group/FPU escape tables (f_reg returns 8..15 into 8-entry arrays)
sys/cpu/x86_64/misc/db_disasm.c:908
 none reproduced not_testable untriaged — —
DF-1037 Info 1.9 Negative hw.ioapic.msi_start loader tunable causes OOB array index in MSI allocation
sys/platform/pc64/apic/ioapic_abi.c:753
 none reproduced not_testable untriaged — —
DF-1460 Info 1.9 init_device discards product-ID mismatch error and reads uninitialized cap on smbus failure
sys/dev/smbus/cyapa/cyapa.c:360
 none reproduced not_testable untriaged — —
DF-2094 Info 1.9 Resource leak in ata_ali_sata_allocate error path: io released with wrong device and rid
sys/dev/disk/nata/chipsets/ata-acerlabs.c:152
 none reproduced fixed untriaged — —
DF-2193 Info 1.9 Off-by-one OOB read in fire fade loop at bottom-right corner (buf[64320])
sys/dev/misc/syscons/fire/fire_saver.c:56
 panic reproduced fixed untriaged — —
DF-2370 Info 1.9 Raw AES key left unzeroed on kernel stack in rijndael_makeKey
sys/crypto/rijndael/rijndael-api-fst.c:36
 — — — untriaged — —
DF-2405 Info 1.9 Harvested RDRAND output left unzeroed on the kernel stack
sys/dev/crypto/rdrand/rdrand.c:163
 — — — untriaged — —
DF-2445 Info 1.9 strncpy of uuid without guaranteed NUL termination
sys/dev/disk/dm/dm_dev.c:365
 — — — untriaged — —
DF-0324 Info 1.7 HT cap/info IE parsers perform no own length validation (caller-trust fragile)
sys/netproto/802_11/wlan/ieee80211_ht.c:1418
 none reproduced not_testable untriaged — —
DF-1793 Info 1.6 puc: IRQ resource leak when BUS_SETUP_INTR fails during attach
sys/dev/misc/puc/puc.c:229
 leak reproduced fixed untriaged — —
DF-1600 Low 1.1 Out-of-bounds read on carrier_detect_main[max1] when no positive carrier detected (max1 stays -1)
sys/dev/video/bktr/msp34xx.c:744
 panic reproduced fixed untriaged — —
DF-0602 Info 1.1 NGM_SOURCE_GET_COUNTER dereferences msg->data without arglen check (latent: file is orphaned and non-compiling)
sys/netgraph7/ng_source.c:479
 none not_reproduced not_testable untriaged — —
DF-2023 Info 1.1 evdev_hid2key indexes static scancode table with unbounded signed int no bounds check
sys/dev/misc/evdev/evdev_utils.c:217
 panic reproduced fixed untriaged — —
DF-2178 Info 1.1 Dead obj==NULL checks give false impression of bounds safety across all package helpers
sys/dev/acpica/acpi_package.c:48
 none reproduced fixed untriaged — —
DF-0073 Info 0.8 Pointless cfi++ causes 1-element OOB read in DEBUG builds (elf_getfiles)
sys/kern/kern_checkpoint.c:667
 none reproduced not_testable untriaged — —
DF-0444 Info 0.8 rmc_newclass does not reject negative priority: only checks upper bound, latent negative array index
sys/net/altq/altq_rmclass.c:201
 none reproduced fixed untriaged — —
DF-1683 Info 0.8 hptmv: default ioctl dispatch reads struct fields from lpInBuffer before validating nInBufferSize (heap OOB read)
sys/dev/raid/hptmv/ioctl.c:337
 panic reproduced fixed untriaged — —
DF-2273 Info 0.8 Unbounded strlen() on user-supplied cv_volid in chsetvoltag can read past the 33-byte field
sys/bus/cam/scsi/scsi_ch.c:1300
 — — — untriaged — —
DF-0982 Info 0.6 uaudio20_mixer_verify_desc FEATURE case under-validates bLength, allowing 1-3 byte OOB read in uaudio20_mixer_add_feature (defense-in-depth)
sys/bus/u4b/audio/uaudio.c:4000
 none reproduced not_testable untriaged — —
DF-0098 Info 0.5 sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defense-in-depth, dead code)
sys/kern/subr_sglist.c:402
 none reproduced fixed untriaged — —
DF-0667 Info 0.5 ieee80211_compute_duration reads rt->info[rix] without bounding rix against IEEE80211_RATE_TABLE_SIZE (latent OOB read)
sys/netproto/802_11/wlan/ieee80211_phy.c:506
 none reproduced not_testable untriaged — —
DF-1102 Info 0.5 msi_setup/msi_map perform no bounds validation on intr/cpuid before indexing fixed-size arrays and programming the IDT
sys/platform/pc64/x86_64/msi.c:430
 none reproduced not_testable untriaged — —
DF-1107 Info 0.5 Incomplete index validation in camq_remove; none in camq_change_priority
sys/bus/cam/cam_queue.c:174
 none reproduced fixed untriaged — —
DF-1445 Info 0.5 ttm_mem_type_from_place omits upper-bound check vs TTM_NUM_MEM_TYPES before indexing bdev->man[8]
sys/dev/drm/ttm/ttm_bo.c:62
 none reproduced not_testable untriaged — —
DF-1622 Info 0.5 Unbounded loop in cxm_saa7115_configure reads past saa7115_scalings[]/saa7115_audio_clock[] (missing i< before NUM_ELEMENTS)
sys/dev/video/cxm/cxm_saa7115.c:825
 none reproduced fixed untriaged — —
DF-2033 Info 0.5 Wrong sizeof in smb_attach bzero() zeroes only first pointer-sized bytes of softc
sys/dev/smbus/smb/smb.c:129
 leak reproduced fixed untriaged — —
DF-2089 Info 0.5 Missing lower-bound check on signed gpio_ddc_line index in acquire_i2c_hw_engine allows negative-index array read
sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c:122
 dos reproduced fixed untriaged — —
DF-2102 Info 0.5 Resource leak in wbsio_attach on child-add / set-resource / probe-and-attach failure paths
sys/dev/powermng/wbsio/wbsio.c:256
 none reproduced fixed untriaged — —
DF-2604 Info 0.5 Dead empty-body bounds check on DLCI in nglmi_rcvdata case 6 protected only by nglmi_checkdata
sys/netgraph7/lmi/ng_lmi.c:689
 — — — untriaged — —
DF-0265 High — Missing distance bounds validation in inflate: heap OOB read when windowBits<15
sys/net/zlib.c:4824
 heap OOB read (info-leak/panic); LATENT in-kernel (netgraph7_deflate not in X86_64_GENERIC); demonstrated deterministically via userspace harness linking the verbatim audited sys/net/zlib.c reproduced fixed untriaged — —
DF-2548 Medium — sysctl kern.ttys leaks raw kernel pointers (function + heap) to unprivileged users
sys/kern/tty.c:2911
 leak:102ptrs reproduced fixed untriaged — —

Base system — kernel core (kern) 275

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2878 Low 7.9 l32_setdisklabel installs partition tables with no slice-bounds validation — DIOCSDINFO32/DIOCWDINFO32 partition devices read/write OUTSIDE the slice (label64 twin validates the same fields)
sys/kern/subr_disklabel32.c:306 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2747 High 7.8 Journal memfifo reservation protocol is not MP-safe: concurrent VOPs on a journaled mount overlap reservations and corrupt the raw record chain (unprivileged reproducible panic; release-kernel OOB-read/livelock)
sys/kern/vfs_journal.c:527 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2851 High 7.8 netmsg_so_notify abort path derives lock, list and reply identity from nm_so, which soaccept_predicate mutates mid-flight on a foreign CPU: unserialized abort → wrong-list TAILQ_REMOVE, illegal pool-token release, double reply
sys/kern/uipc_msg.c:744 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2779 High 7.0 mq_send1 re-reads mq_sig_notify.sigev_signo after releasing mq_mtx: concurrent mq_notify re-registration (SIGEV_NONE bypasses signo validation) smuggles an attacker-chosen int into ksignal — panic on INVARIANTS, OOB atomic sigset write on production kernels
sys/kern/sys_mqueue.c:877 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2710 Medium 6.5 Peer-freezable iocom reader: writer parked in fp_write with KDMSG_STATE_INTERLOCK set turns the 'dmrace' 1s-sleep loop into an indefinite cluster-link stall
sys/kern/kern_dmsg.c:1636 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2789 Low 6.3 Dead terminator guard in blst_meta_free/blst_meta_fill checks parent's bm_bighint instead of child's scan[i] — out-of-range free/fill walks uninitialized terminator slots and can index past bl_rootblks
sys/kern/subr_blist.c:660 · pass 2 · new
 — — — untriaged — —
DF-2798 Low 6.3 Out-of-domain free discipline: production kernels silently accept a full-child free beyond bl_blocks (unbounded full-cover branch) and poison parent meta bits to ALL-FREE; the likewise-unbounded direct-allocation path then returns block numbers >= bl_blocks (wild PHYS_TO_VM_PAGE precursor); bl_root allocated without M_ZERO
sys/kern/subr_alist.c:286 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2709 Low 5.7 hammer2_volconf_update() uses iocom->conn_state unlocked across a peer-driven drop (TOCTOU): kdmsg_lnk_conn_reply mutates conn_state without msglk
sys/kern/kern_dmsg.c:231 · pass 2 · new
 — — — untriaged — —
DF-2714 Medium 5.5 sendfile(2) marshals hdtr headers into an unbounded M_WAITOK mbuf chain before any socket validation — attacker-chosen kernel memory exhaustion and uninterruptible full mbuf-pool wedge (unkillable, reboot required)
sys/kern/uipc_syscalls.c:1617 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2753 Medium 5.5 fork1() publishes the embryonic SIDL child to the pid hash/allproc list before p_pgrp/p_ucred initialization; pfind()/allproc_scan() don't filter SIDL — unprivileged NULL-pointer-deref kernel panic via kill(-1), sched_*(pid), getsid(pid), ptrace/sysctl
sys/kern/kern_fork.c:491 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2781 Medium 5.5 No system-wide or per-user POSIX mqueue accounting: queues and their queued messages persist after the last close with no enumeration — unprivileged, unbounded, permanent-until-reboot kernel heap exhaustion
sys/kern/sys_mqueue.c:391 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2785 Medium 5.5 Reachable panic("semop - can't undo undos") in sys_semop SEM_UNDO rollback via same-process thread race — unprivileged local kernel DoS
sys/kern/sysv_sem.c:998 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2813 Medium 5.5 objcache_get() M_WAITOK lost wakeup: objects stranded in remote CPUs' partially-filled magazines cause a permanent, unkillable sleep
sys/kern/kern_objcache.c:547 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2839 Medium 5.5 /dev/lpmap fault races lwp teardown: orphaned lpmap allocation leaks 4KB M_UPMAP kernel heap per hit (unprivileged kmem exhaustion)
sys/kern/kern_memio.c:801 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2870 Medium 5.5 taskqueue_free() terminate lost-wakeup: worker parks without re-checking TQ_FLAGS_ACTIVE → permanent deadlock with in-flight task
sys/kern/subr_taskqueue.c:141 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2926 Medium 5.5 Unbounded user plist × unconditional per-call leak in sys_vquotactl → kmalloc-type-limit panic: guaranteed unprivileged kernel panic (DF-0146 escalation)
sys/kern/vfs_quota.c:345 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2827 Low 5.5 ckpt_thaw_proc(): e_phnum == 0 makes kmalloc(0) return ZERO_LENGTH_PTR; phdr->p_filesz reads kernel VA 0x18 (unconditional fatal kernel page fault)
sys/kern/kern_checkpoint.c:232 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2677 Medium 5.3 SysV shmat() vs IPC_RMID TOCTOU: attach counted after blocking ops, RMID terminates a still-referenced VM object (vm_object_terminate2 panic)
sys/kern/sysv_shm.c:1025 · pass 2 · new
 panic reproduced fix_failed untriaged — —
DF-2903 Medium 5.3 Ontrack (DOSPTYP_ONTRACK 0x54) re-read path releases a getpbuf_mem() pbuf via brelse() — guaranteed kernel panic from one crafted MBR sector (INVARIANTS) / cross-subsystem pbuf corruption + leak and latent infinite re-read wedge holding ds_token (production)
sys/kern/subr_diskmbr.c:174 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2924 Medium 5.3 cmd_get_usage_all walks accounting RB trees without ac_spin → RB_NEXT traversal cycle (unkillable kernel spin) and torn 64-bit reads
sys/kern/vfs_quota.c:183 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2906 Low 5.3 Unchecked mbuf allocations in mb_init/mb_reserve/mb_put_mem/md_init — NULL-pointer kernel panic under allocation failure
sys/kern/libmchain/subr_mchain.c:75 · pass 2 · new
 — — — untriaged — —
DF-2917 Medium 5.1 sleepq_wait/sleepq_wait_sig/sleepq_timedwait/sleepq_timedwait_sig NEVER sleep: _sleepq_wait_begin() drops the PDOMAIN_FBSD domain from the tsleep() flags, so tsleep's interlock validation always mismatches and returns immediately
sys/kern/subr_sleepqueue.c:275 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2776 Low 5.1 unregister_int dereferences the caller-supplied (possibly stale/freed) cookie before and after validation → freed-heap read and arbitrary-pointer %s print
sys/kern/kern_intr.c:425 · pass 2 · new
 — — — untriaged — —
DF-2975 Low 5.1 Accept-filter registry has no refcount: kldunload under unloadable=1 deregisters a filter still attached to live listeners — next connection dispatches a NULL (or freed-module-text) accf_callback, guaranteed fatal trap; reload also strands stale accf_create/accf_destroy
sys/kern/uipc_accf.c:59 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2683 Medium 4.7 fsetown() publishes an uninitialized sigio into the owner list — exit1()/pgdelete() teardown consumes the half-born entry: NULL-page fault or wrong-list SLIST_REMOVE walk-off (plus funsetownlst livelock variant)
sys/kern/kern_descrip.c:1351 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2712 Medium 4.7 bsd4_kick_helper issues IPIs/wakeups while holding the global bsd4_spin: FIFO-full liveloop enables same-cpu schedclock recursion into the spinlock (whole-system wedge), unprivileged-triggerable when usched_bsd4 is active
sys/kern/usched_bsd4.c:1590 · pass 2 · new
 — — — untriaged — —
DF-2721 Medium 4.7 Lost-wakeup race in slab remote-free z_RSignal interlock permanently strands whole zones — unbounded kernel KVA + wired-page leak (local DoS)
sys/kern/kern_slaballoc.c:1508 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2782 Medium 4.7 sys_mq_open race-gated NULL-pointer lockmgr panic: the under-lock EMFILE branch jumps to the shared exit label while mq is still NULL, releasing a lock on a NULL-derived address
sys/kern/sys_mqueue.c:577 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2873 Medium 4.7 taskqueue_run() wakeup(task) outside TQ_LOCK vs drain's check-then-ssleep: lost wakeup parks taskqueue_drain forever
sys/kern/subr_taskqueue.c:411 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2693 Low 4.7 postsig() KASSERT panic: unlocked ps_sigact[] read races concurrent sigaction(SIG_IGN) from another LWP
sys/kern/kern_sig.c:2281 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2797 Low 4.7 alist API performs no release-kernel domain validation: alist_alloc(count==0) silently wipes whole 32-block leaves or spins forever with the caller's lock held; alist_create/init with blocks>2^29 radix-wraps into an infinite loop; count==bl_radix full-capacity allocation off-by-one on leaf-root alists
sys/kern/subr_alist.c:250 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2849 Low 4.7 taskqgroup_detach() unsynchronized lifecycle tail: gt_taskqueue=NULL window panics racing enqueuers; unlocked TASK_NOENQUEUE clear can lose the TASK_ENQUEUED bit and corrupt the queue list
sys/kern/subr_gtaskqueue.c:746 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2980 Medium 4.5 addupc_task() calls stopprofclock() without p->p_token: non-atomic p->p_flags RMW race annihilating concurrent token-held flag updates (P_TRACED/P_SUGID security gates)
sys/kern/subr_prof.c:145 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2803 Medium 4.4 Unbounded udev event queue growth behind a slow/stalled initiated reader (no udev_evqlen cap, no backpressure)
sys/kern/kern_udev.c:515 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2681 Low 4.4 bus_generic_delete_resource() dispatches BUS_DELETE_RESOURCE on itself instead of dev->parent: unbounded kernel recursion/livelock for any driver using the shipped generic default
sys/kern/subr_bus.c:3145 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2772 Low 4.4 REL/RELA sh_info accepted unvalidated → findbase()==0 → panic("lost base for reltab/relatab") on crafted module (also via the boot preload path)
sys/kern/link_elf_obj.c:775 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2773 Low 4.4 link_elf_obj_unload_file NULL-derefs reltab/relatab when load aborts between the scan and the table allocation (e.g. 'file has no contents')
sys/kern/link_elf_obj.c:887 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2805 Low 4.4 UDEVWAIT ioctl dereferences the userspace pointer directly (missing copyin/copyout) — kernel panic on any unmapped a_data
sys/kern/kern_udev.c:925 · pass 2 · new
 — — — untriaged — —
DF-2810 Low 4.4 parse_dynamic accepts DT_REL/DT_RELA/DT_JMPREL/DT_HASH without DT_SYMTAB/DT_STRTAB → NULL-base wild reads in symbol_name()/elf_lookup()/link_elf_lookup_symbol()
sys/kern/link_elf.c:232 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2816 Low 4.4 boot()/shutdown_cleanup_proc() tears down the live reboot(2)-calling process (all fds closed, fd_ncdir/fd_nrdir/fd_njdir nchandles NULLed, entire user vmspace removed) while its sibling threads still run on other CPUs → sibling path lookups dereference NULL ncp in naccess() → kernel panic and hard machine wedge
sys/kern/kern_shutdown.c:291 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2833 Low 4.4 kern.syncdelay=SYNCER_MAXDELAY (32) accepted by sysctl → same-slot requeue livelock/deadlock of the syncer under sc_token (also kern.retrydelay<=0)
sys/kern/vfs_sync.c:133 · pass 2 · new
 — — — untriaged — —
DF-2877 Low 4.4 kdmsg_iocom_reconnect() kill-wait deadlocks the DIOCRECLUSTER caller unkillably when the old peer socket is idle-but-open (no fp_shutdown escape, unlike iocom_uninit)
sys/kern/subr_diskiocom.c:141 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2928 Low 4.4 Dead spin_lock_test_mode: debug.spin_lock_test=1 wedges a CPU in a critical section for 60s then panics INVARIANTS kernels (test-mode escape never fires)
sys/kern/kern_spinlock.c:88 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2754 Info 4.4 sysctl kern.stackgap_random accepts unbounded negative values: ALIGN(-gap) up to 2GB silently places every exec's stack contents outside the stack mapping — system-wide exec SIGSEGV from a single root sysctl (validation gap)
sys/kern/kern_exec.c:159 · pass 2 · new
 — — — untriaged — —
DF-2711 Low 4.3 Unbounded peer-driven kdmsg_state allocation: no quota on transactions a peer may open (kernel memory exhaustion)
sys/kern/kern_dmsg.c:898 · pass 2 · new
 — — — untriaged — —
DF-2728 Low 4.1 lwkt_preempt() KKASSERT(gd->gd_processing_ipiq == 0) contradicts the designed preemption-from-framed-IPI path of lwkt_schedule_remote() — INVARIANTS kernels panic
sys/kern/lwkt_thread.c:1026 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2729 Low 4.1 _lwkt_schedule() KKASSERT(TDF_MIGRATING == 0) contradicts _lwkt_enqueue()'s by-design TDF_MIGRATING swallow during push/pull migration windows — INVARIANTS kernels panic
sys/kern/lwkt_thread.c:1293 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-2752 Low 4.1 pipe_size sysctl lacks power-of-two validation: non-pow2 buffer size silently aliases FIFO slots (in-bounds cross-process data corruption) on misconfigured systems
sys/kern/sys_pipe.c:125 · pass 2 · new
 — — — untriaged — —
DF-2777 Low 4.1 register_int check-then-create windows span blocking allocations: NULL info->i_thread dereference and re-arm of an already-armed emergency systimer under concurrent registration
sys/kern/kern_intr.c:308 · pass 2 · new
 — — — untriaged — —
DF-2871 Low 4.1 taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c)
sys/kern/subr_taskqueue.c:594 · pass 2 · new
 — — — untriaged — —
DF-2899 Low 4.1 fp_mmap maps VCHR vnodes without the revoked-device (v_rdev == NULL) guard its sibling kern_mmap has: NULL-deref panic in vm_mmap
sys/kern/kern_fp.c:473 · pass 2 · new
 — — — untriaged — —
DF-2967 Low 4.1 wdog_disable() self-deadlocks/livelocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC)
sys/kern/kern_wdog.c:96 · pass 2 · new
 — — — untriaged — —
DF-2727 Info 4.1 cluster_callback() panics on residual/short cluster I/O instead of propagating an error to components
sys/kern/vfs_cluster.c:1127 · pass 2 · new
 — — — untriaged — —
DF-2780 Medium 3.3 p_mqueue_cnt accounting broken across fork(): decrement runs in the last-reference closer (not the opener) while fork zeroes the child's counter — u_int underflow defeats the '== mq_open_max' check, and the open-existing path has no check at all
sys/kern/sys_mqueue.c:384 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2925 Medium 3.3 Uninitialized kernel stack stored into accounting state and disclosed via "get usage all" (ac_limit/ac_bytes/space)
sys/kern/vfs_quota.c:249 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2669 Low 3.3 kern_truncate()/kern_ftruncate() execute VFS_ACCOUNT() even when VOP_SETATTR failed — quota accounting corruption on failed truncates
sys/kern/vfs_syscalls.c:4044 · pass 2 · new
 none untested not_testable untriaged — —
DF-2670 Low 3.3 sys_fchown() performs VFS_ACCOUNT() ownership-transfer accounting against the cwd's mount instead of the chowned file's mount
sys/kern/vfs_syscalls.c:3637 · pass 2 · new
 none untested not_testable untriaged — —
DF-2705 Low 3.3 vop_write quota accounting skips unlinked-open files (va_nlink==0) → complete quota enforcement bypass when vfs.quota_enabled=1; concurrent-writer delta TOCTOU
sys/kern/vfs_vopops.c:476 · pass 2 · new
 none untested not_testable untriaged — —
DF-2733 Low 3.3 poll() silently truncates nfds to kern.maxfilesperproc*2 — ready descriptors beyond the clamp are dropped without error
sys/kern/sys_generic.c:1639 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2756 Low 3.3 vn_read has no VDIR gate: read() on a directory fd is dispatched to VOP_READ, and ffs_read explicitly accepts VDIR, exposing raw directory blocks (deleted-entry residue) instead of returning EISDIR
sys/kern/vfs_vnops.c:749 · pass 2 · new
 — — — untriaged — —
DF-2764 Low 3.3 journal_setextattr journals the post-VOP, fully consumed uio: the extended-attribute VALUE is never recorded in the REDO stream
sys/kern/vfs_jops.c:1027 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2765 Low 3.3 journal_nrename records both path leaves after cache_rename mutated the namecache: PATH1==PATH2==target and the source path is never journaled
sys/kern/vfs_jops.c:1318 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2784 Low 3.3 Missing SEMAEM enforcement: un_adjval (short) signed overflow in semundo_adjust flips semexit's clamp branch — deterministic wrong undo application
sys/kern/sysv_sem.c:244 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2823 Low 3.3 F_UNLCK of caller's own locks fails with ENOLCK when the uid POSIX-lock limit is reached (POSIX violation, lock-shedding wedge)
sys/kern/kern_lockf.c:510 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2836 Low 3.3 sonewconn_faddr() inherits the listener's entire so_state — accepted connections born half-shut (SS_CANTSENDMORE/SS_CANTRCVMORE/SS_ASYNC) after listener shutdown
sys/kern/uipc_socket2.c:383 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2846 Low 3.3 CPU topology sysctl strings rendered while ncpus==1: hw.cpu_topology.members and per-cpu physical/core siblings are wrong on every SMP system; fix_amd_topology cpusync reaches only the BSP
sys/kern/subr_cpu_topology.c:563 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2883 Low 3.3 kvsscanf 'x'-pushback under-advance at exact end-of-input: stale byte re-consumed (parse divergence from userland scanf, double-counted nread)
sys/kern/subr_scanf.c:487 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2825 Info 3.3 Negative l_len rejected with EINVAL instead of the POSIX [l_start+l_len, l_start-1] semantics
sys/kern/kern_lockf.c:230 · pass 2 · new
 — — — untriaged — —
DF-2895 Info 3.3 sys_kenv KENV_SET ignores ksetenv() failure — variables rejected at limit boundaries (name/value of exactly KENV_M*LEN, full table) silently appear 'set'
sys/kern/kern_environment.c:164 · pass 2 · new
 — — — untriaged — —
DF-2957 Info 3.3 fattime2timespec accepts out-of-range month (0, 13-15) and hour>23/minute>59 fields from crafted FAT images — no bounds validation (garbage dates, index safely masked)
sys/kern/subr_fattime.c:226 · pass 2 · new
 — — — untriaged — —
DF-2863 Low 3.2 vfs_mountroot_try ignores the ';' candidate bound when copying into mf: every root-mount candidate except the last gets a device name contaminated with the ';<tail>' of later candidates — fallback lists silently degenerate (valid candidates skipped; boot panic or wrong-device-as-root)
sys/kern/vfs_conf.c:423 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2911 Low 3.0 l64_setdisklabel accepts internally inconsistent label geometry: d_pbase/d_pstop/d_bbase unvalidated, partitions may overlap the label+boot area, and d_bbase directly becomes ds_reserved (0 disables the label-area EROFS guard)
sys/kern/subr_disklabel64.c:278 · pass 2 · new
 — — — untriaged — —
DF-2736 Low 2.5 vop_compat_* '[diagnostic] EAGAIN on ncp %p %s' prints leak kernel namecache heap pointer and full pathname into the world-readable msgbuf
sys/kern/vfs_default.c:200 · pass 2 · new
 — — — untriaged — —
DF-2750 Low 2.5 lockmgr_release() multi-count blind decrement loses the grant/wakeup transition under concurrent LK_KERNTHREAD release (lost wakeup: waiter sleeps on a free lock)
sys/kern/kern_lock.c:874 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2758 Low 2.5 FOFFSETLOCK acquisition sleeps uninterruptibly ('fpoff', no PCATCH): a thread wedged forever inside VOP_READ while holding the offset lock makes every other thread sharing the file descriptor permanently unkillable
sys/kern/vfs_vnops.c:569 · pass 2 · new
 — — — untriaged — —
DF-2821 Low 2.5 rand_thread_loop feeds generator output back into the entropy pools, so the MIN_POOL_SIZE reseed gate can be satisfied with zero external entropy
sys/kern/kern_nrandom.c:886 · pass 2 · new
 — — — untriaged — —
DF-2858 Low 2.5 shmfork() bcopy's transient shmmap_s reservation state: fork landing in shmat's blocked window permanently burns a SHMSEG slot in the child (and gives it an un-accounted, un-shmdt-able mapping)
sys/kern/sysv_shm.c:646 · pass 2 · new
 — — — untriaged — —
DF-2868 Low 2.5 ktrcanset dereferences targetp->p_ucred with no token and no crhold — freed-cred read / stale-cred TOCTOU racing cratom_proc (distinct from DF-0103's p_tracenode scope)
sys/kern/kern_ktrace.c:668 · pass 2 · new
 — — — untriaged — —
DF-2909 Low 2.5 sys_varsym_set replace is a non-atomic remove-then-insert: concurrent same-name sets create duplicate shadowed varsym entries; invalid level values silently return success
sys/kern/kern_varsym.c:152 · pass 2 · new
 — — — untriaged — —
DF-2944 Low 2.5 acct_process() leaks 9 bytes of uninitialized kernel stack into every accounting record (struct acct alignment padding)
sys/kern/kern_acct.c:198 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2958 Low 2.5 vkernel64: sys_umtx_sleep() calls blocking uservtophys() inside a critical section — LWKT lock-protocol violation
sys/kern/kern_umtx.c:199 · pass 2 · new
 — — — untriaged — —
DF-2976 Low 2.5 Unprivileged SO_ACCEPTFILTER duplicate-attach race: two M_WAITOK allocations inside the check-then-store window of do_setopt_accept_filter() let concurrent setsockopt on a shared listener orphan struct so_accf chunks permanently — unbounded kernel heap exhaustion
sys/kern/uipc_socket.c:1999 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2730 Info 2.5 lwkt_acquire() spins forever on a wedged owner cpu with no watchdog recovery (wedge-family hardening)
sys/kern/lwkt_thread.c:1394 · pass 2 · new
 — — — untriaged — —
DF-2762 Info 2.5 sys_setgroups publishes the COW credential before mutating it: mid-copyin window exposes mixed old/new group sets to other threads, and a failing copyin leaves the credential partially mutated despite the error return
sys/kern/kern_prot.c:682 · pass 2 · new
 — — — untriaged — —
DF-2824 Info 2.5 POSIX EDEADLK not detected for F_SETLKW deadlock cycles spanning two (or more) files
sys/kern/kern_lockf.c:406 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-2884 Info 2.5 kvsscanf silently accepts unknown conversion specifiers, desynchronizing the varargument list
sys/kern/subr_scanf.c:148 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2804 Medium 2.3 Permanent kernel memory leak of undelivered udev event dictionaries on last-reader close (reap/abandon without prop_object_release)
sys/kern/kern_udev.c:534 · pass 2 · new
 leak reproduced not_testable untriaged — —
DF-2699 Low 2.3 vfs_setpublicfs() leaks nfs_pub.np_index when MNT_EXPUBLIC is re-exported on the same mount without MNT_DELEXPORT
sys/kern/vfs_subr.c:2246 · pass 2 · new
 — — — untriaged — —
DF-2766 Low 2.3 journal_remove_all_journals never detaches: mnt_jbitmap (1024 bytes, M_JOURNAL) leaks on every journaled unmount
sys/kern/vfs_jops.c:423 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2788 Low 2.3 callout_stop/stop_async/cancel/drain return 0 after dequeuing a pending callout: sync fast path never reads CALLOUT_PREVENTED it just caused to be set
sys/kern/kern_timeout.c:888 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2801 Low 2.3 Namecache-reference leak on failed jail(2): pr_root handle never dropped on kern_jail error paths (deterministic via jail path = regular file)
sys/kern/kern_jail.c:206 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2812 Low 2.3 elf_lookup() STB_LOCAL branch returns the resolved address as the int error code and never writes *result → relocations against defined local symbols always fail (or write an uninitialized stack value)
sys/kern/link_elf.c:1003 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2897 Low 2.3 Mute-interaction bookkeeping leak: cnclose()'s muted early-return never clears cn_is_open/cn_phys_is_open, so un-muting re-opens the physical console device with a stale flags snapshot for a /dev/console that is no longer open
sys/kern/tty_cons.c:403 · pass 2 · new
 none untested not_testable untriaged — —
DF-2916 Low 2.3 sleepq timeout API is broken: documented sleepq_set_timeout() macro cannot compile (undefined tick_sbt/C_HARDCLOCK), sbt-vs-ticks unit confusion, and int64->int truncation into tsleep()
sys/kern/subr_sleepqueue.c:300 · pass 2 · new
 — — — untriaged — —
DF-2615 Info 2.3 kdmsg_iocom_uninit leaks the queued LNK_PING when iocom threads are gone (one kdmsg_msg per hammer2 unmount)
sys/kern/kern_dmsg.c:264 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2749 Info 2.3 journal_wthread pad-skip accounting bug: total_acked += bytes counts all pending bytes instead of the pad size, inflating bytessent (MOUNTCTL_STATUS)
sys/kern/vfs_journal.c:220 · pass 2 · new
 — — — untriaged — —
DF-2912 Info 2.3 l64_makevirginlabel unsigned underflow on tiny slices: d_abase = d_total_size - ressize (and derived d_pstop) wrap to ~2^64 when the slice is smaller than the reserved area
sys/kern/subr_disklabel64.c:465 · pass 2 · new
 — — — untriaged — —
DF-2696 Low 1.9 sorecvtcp(): MSG_OOB + sio path is missing 'm = m_free(m)' — repeated sbappend of the same mbuf corrupts the caller's sockbuf (latent, currently unreachable)
sys/kern/uipc_socket.c:1648 · pass 2 · new
 — — — untriaged — —
DF-2703 Low 1.9 vop_mountctl/vop_markatime/vop_allocate dispatch with partially-uninitialized stack argument structs (a_vp pointer never set)
sys/kern/vfs_vopops.c:1300 · pass 2 · new
 none untested not_testable untriaged — —
DF-2720 Low 1.9 load_section truncated-file check bypassed by 64-bit wrap of (off_t)filsz + offset
sys/kern/imgact_elf.c:274 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2732 Low 1.9 readv/writev/extpreadv/extpwritev accept iovcnt==0 — POSIX EINVAL missing; uninitialized stack iovec pointer plumbed into fo_read/fo_write
sys/kern/sys_generic.c:195 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2792 Low 1.9 sys_ioprio_get(PRIO_PGRP) compares p_nice but assigns p_ionice — wrong (order-dependent) result and possible spurious ESRCH
sys/kern/kern_resource.c:366 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2850 Low 1.9 _gtaskqueue_start_threads() reports total thread-creation failure as success; queue teardown lifecycle is stubbed, so a half-born queue silently hangs all future drainers
sys/kern/subr_gtaskqueue.c:455 · pass 2 · new
 — — — untriaged — —
DF-2945 Low 1.9 acctwatch() ignores VFS_STATFS failure (decides suspend/resume on uninitialized stack statfs) and races vgone(): NULL v_mount dereference panic
sys/kern/kern_acct.c:332 · pass 2 · new
 — — — untriaged — —
DF-2971 Low 1.9 No common lock between linesw[] mutation and dispatch — register/deregister swap entries under tty_token while TIOCSETD (t_token+p_token) and driver read/write/ioctl paths read the table under unrelated locks, permitting torn multi-pointer swaps
sys/kern/tty_conf.c:97 · pass 2 · new
 — — — untriaged — —
DF-2724 Info 1.9 NTP PLL discipline state is mutated by hardclock/pps interrupt paths with no lock excluded from sys_ntp_adjtime's ntp_lock — interleaved PLL transitions
sys/kern/kern_clock.c:749 · pass 2 · new
 — — — untriaged — —
DF-2757 Info 1.9 vn_stat's MNT_NOSYMFOLLOW symlink-mode adjustment is dead code and reads sb->st_mode before it is ever initialized
sys/kern/vfs_vnops.c:882 · pass 2 · new
 — — — untriaged — —
DF-2770 Info 1.9 ptcread TIOCPKT_IOCTL path ignores uiomove error: EFAULT swallowed, read() returns 0 (EOF-like) with control byte consumed
sys/kern/tty_pty.c:718 · pass 2 · new
 — — — untriaged — —
DF-2787 Info 1.9 mtx_notlocked_ex() returns the exact opposite of its documented contract (inverted exclusive-lock test in shipped header)
sys/kern/kern_mutex.c:436 · pass 2 · new
 — — — untriaged — —
DF-2933 Info 1.9 xio_init_kbuf: size_t→int truncation of kbytes at kern_xio.c:121 corrupts xio_bytes negative while returning success
sys/kern/kern_xio.c:119 · pass 2 · new
 — — — untriaged — —
DF-2962 Info 1.9 kobj API robustness gaps: double kobj_init() silently leaks a permanent class reference (pins KLD class+ops forever), kobj_delete() on an uninitialized/deleted object NULL-derefs obj->ops->cls, and cyclic baseclass graphs recurse without bound
sys/kern/subr_kobj.c:137 · pass 2 · new
 — — — untriaged — —
DF-2978 Info 1.9 do_setopt_accept_filter() saves the filter NAME as so_accept_filter_str instead of the user's af_arg — getsockopt(SO_ACCEPTFILTER) returns the name as the argument; latent divergence from FreeBSD (functional, dead in-tree)
sys/kern/uipc_socket.c:2043 · pass 2 · new
 — — — untriaged — —
DF-2986 Info 1.9 cv_destroy performs no waiters/queued-state validation — destroy-with-waiter goes undiagnosed, leaving a stale wchan in td_wchan (divergence from FreeBSD INVARIANTS probe)
sys/kern/kern_condvar.c:14 · pass 2 · new
 — — — untriaged — —
DF-2989 Info 1.9 RB tree engine has zero INVARIANTS-mode structural validation, and scan_info_done walks the inprog list without a termination guard
sys/kern/subr_rbtree.c:460 · pass 2 · new
 — — — untriaged — —
DF-2723 Info 1.1 pps_fetch_timeout() feeds user-supplied unnormalized tv_nsec into tstohz_low(), whose int truncation yields an attacker-chosen (possibly negative) sleep tick count
sys/kern/kern_clock.c:1609 · pass 2 · new
 — — — untriaged — —
DF-2700 Info 0.8 vfs_hang_addrlist() returns through 'out' while still holding NE_LOCK(nep) on the rn_inithead-failure and unsupported-sa_family paths
sys/kern/vfs_subr.c:2085 · pass 2 · new
 — — — untriaged — —
DF-2767 Info 0.8 journal_status_vfs_journal index filter over-returns: requesting status for index k returns journals 0..k instead of only k
sys/kern/vfs_jops.c:476 · pass 2 · new
 — — — untriaged — —
DF-2806 Info 0.8 udev_event_attach returns stale ENOMEM on the success path when the device dict already exists
sys/kern/kern_udev.c:589 · pass 2 · new
 — — — untriaged — —
DF-2807 Info 0.8 Short-buffer read() on /dev/udev silently drops the event and reports ENOMEM
sys/kern/kern_udev.c:846 · pass 2 · new
 — — — untriaged — —
DF-2837 Info 0.8 sysctl_handle_sb_max() maintains u_long sb_max through sizeof(int) transfers — 8-byte writes silently truncated by 4 GiB, sb_max can never represent its declared type
sys/kern/uipc_socket2.c:686 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2930 Info 0.8 _systimer_init_periodic(): SYSTF_100KHZSYNC phase-sync branch is dead code (missing else-if)
sys/kern/kern_systimer.c:268 · pass 2 · new
 — — — untriaged — —
DF-2937 Info 0.8 sched_setscheduler returns success (0) for invalid policies — POSIX-required EINVAL missing; silent no-op leaves processes at real-time priority
sys/kern/kern_p1003_1b.c:265 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2974 Info 0.8 EVENTHANDLER_FAST_DEREGISTER macro is syntactically broken (missing underscore in list symbol) and the entire FAST handler API is dead code
sys/kern/subr_eventhandler.c:95 · pass 2 · new
 — — — untriaged — —
DF-2761 Info 0.5 sys_setlogin mutates s_login while holding p_token SHARED — data race with concurrent setlogin/getlogin produces torn login names
sys/kern/kern_prot.c:1290 · pass 2 · new
 — — — untriaged — —
DF-2818 Info 0.5 lwkt_token_init() on a live token silently drops a held exclusive; lwkt_token_uninit() performs no quiescence check
sys/kern/lwkt_token.c:914 · pass 2 · new
 — — — untriaged — —
DF-2860 Info 0.5 sglist_consume_uio() swallows all errors and unconditionally returns 0 — EFBIG/EFAULT indistinguishable from full success (dead code; upstream parity)
sys/kern/subr_sglist.c:417 · pass 2 · new
 — — — untriaged — —
DF-2861 Info 0.5 _sglist_append_buf() ignores pmap_extract() failure — unmapped user addresses become physical-page-0 DMA segments instead of EFAULT (dead paths; upstream parity)
sys/kern/subr_sglist.c:125 · pass 2 · new
 — — — untriaged — —
DF-2914 Info 0.5 dev_is_good() tests a sentinel that is never installed: dead_dev_ops is assigned to no cdev, making every dead-device fence in the kernel dead code
sys/kern/kern_conf.c:127 · pass 2 · new
 — — — untriaged — —
DF-2934 Info 0.5 m_tag_alloc silently truncates int len/type into uint16_t m_tag_len/m_tag_id (allocation sized from untruncated len)
sys/kern/uipc_mbuf2.c:260 · pass 2 · new
 none untested — untriaged — —
DF-2941 Info 0.5 _sysref_put accepts count==0 double-releases with no put-side floor guard; the only barrier is the debug-only KKASSERT whose flags read races the final-release sequence
sys/kern/kern_sysref.c:303 · pass 2 · new
 none reproduced not_testable untriaged — —
DF-2943 Info 0.5 Dead sysref machinery retained and exported: sysref_init (no callers) can produce objects whose final put objcache_puts non-objcache memory on production builds; allocsysid, SRC_MANAGEDINIT and SRF_SYSIDUSED are entirely unused
sys/kern/kern_sysref.c:105 · pass 2 · new
 — — — untriaged — —
DF-2964 Info 0.5 gptinit() accepts any CRC-self-consistent LBA1 block as a GPT header: hdr_sig ("EFI PART"), hdr_revision, and the partition-array CRC (hdr_crc_table) are never validated
sys/kern/subr_diskgpt.c:108 · pass 2 · new
 — — — untriaged — —
DF-2968 Info 0.5 Kernel threads leak one td_ucred reference per exit: crhold at creation is never crfreed on the LWKT teardown path
sys/kern/kern_kthread.c:62 · pass 2 · new
 — — — untriaged — —
DF-2981 Info 0.5 bus_dmamem_coherent reports success when the underlying bus_dmamap_load fails (error swallowed in callback), yielding dmem_busaddr==0
sys/kern/subr_busdma.c:46 · pass 2 · new
 — — — untriaged — —
DF-2731 Medium — sys_extpread/sys_extpwrite/sys_extpreadv/sys_extpwritev accept negative offsets — unprivileged kernel panic on ext2 (INVARIANTS), POSIX EINVAL missing
sys/kern/sys_generic.c:153 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-0139 Medium 7.8 SLEEPQ_HASH misplaced mask causes massive OOB index into sleepq_chains array
sys/kern/subr_sleepqueue.c:82
 none reproduced not_testable untriaged — —
DF-0220 High 7.5 Predictable RNG: /dev/urandom+getrandom+kern.random return deterministic ChaCha20 keystream (zero key) before first reseed
sys/kern/subr_csprng.c:84
 none not_reproduced — untriaged — —
DF-0243 High 7.1 size_t underflow in exec_shell_imgact when argv[0] longer than interpreter+fname -> kernel panic
sys/kern/imgact_shell.c:117
 none not_reproduced — untriaged — —
DF-0198 Low 6.7 tag_types[tag_type] indexed without bounds check
sys/kern/subr_devstat.c:211
 none reproduced fixed untriaged — —
DF-0032 Medium 6.5 fdcopy() failure in fork1() permanently leaks the child proc, nprocs, and the per-uid proc-count (system-wide fork DoS)
sys/kern/kern_fork.c:491
 dos reproduced fixed untriaged — —
DF-0149 Medium 6.0 Signed-integer truncation in TLV walk size math allows backward/OOB pointer movement
sys/kern/subr_module.c:79
 none reproduced not_testable untriaged — —
DF-0181 Medium 6.0 sysctl_hostname leaks XLOCK on EPERM: jailed root deadlocks host sysctl subsystem
sys/kern/kern_mib.c:217
 dos reproduced fixed untriaged — —
DF-0134 Medium 5.9 Missing structural validation in l64_readdisklabel: crafted partition fields accepted without bounds checks
sys/kern/subr_disklabel64.c:176
 none reproduced fixed untriaged — —
DF-0018 Low 5.9 Duplicate DELETE for same DMSG msgid triggers KKASSERT panic (DoS)
sys/kern/kern_dmsg.c:1076
 panic reproduced fixed untriaged — —
DF-0142 High 5.5 Sleeping allocation (M_WAITOK kmalloc) while holding ac_spin -> panic/deadlock
sys/kern/vfs_quota.c:158
 panic reproduced fixed untriaged — —
DF-0079 Medium 5.5 Unprivileged local DoS via u_int truncation of iov_len in /dev/null and /dev/zero write (infinite kernel loop)
sys/kern/kern_memio.c:292
 dos reproduced fixed untriaged — —
DF-2550 Medium 5.5 setfown() leaks vnode exclusive lock and reference on VOP_GETATTR failure causing permanent file DoS
sys/kern/vfs_syscalls.c:3541
 panic reproduced fixed untriaged — —
DF-2556 Medium 5.5 clist_alloc_cblocks leaks previous c_data buffer on every reallocation
sys/kern/tty_subr.c:48
 dos reproduced fixed untriaged — —
DF-0038 Low 5.5 journal_putpages UNDO records btoc(a_count) pages instead of a_count bytes (silent rollback corruption)
sys/kern/vfs_jops.c:955
 none reproduced fixed untriaged — —
DF-0144 Medium 5.3 copyin return value silently discarded before prop_dictionary_copyin
sys/kern/vfs_quota.c:345
 panic reproduced fixed untriaged — —
DF-0233 Low 5.3 Lockless SLIST traversal of domains list races with crit_enter-only writer
sys/kern/uipc_domain.c:137
 none reproduced not_testable untriaged — —
DF-0004 Info 5.3 devaddq error path leaks data buffer due to wrong variable checked (loc instead of data)
sys/kern/subr_bus.c:615
 none reproduced fixed untriaged — —
DF-0196 Low 5.1 STAILQ_REMOVE in devstat_remove_entry derefs NULL if node already absent
sys/kern/subr_devstat.c:139
 none reproduced fixed untriaged — —
DF-0014 Medium 4.7 enterpgrp() lwkt_reltoken on an un-acquired token -> race-triggered kernel panic
sys/kern/kern_proc.c:763
 none not_reproduced — untriaged — —
DF-0039 Medium 4.7 ptsopen check-then-use TOCTOU on dev->si_drv1 -> NULL-deref kernel panic (local DoS)
sys/kern/tty_pty.c:313
 none not_reproduced — untriaged — —
DF-0047 Medium 4.7 mtx_wait_link lock-leak race: chain can grant lock during mtx_delete_link window, caller returns error despite holding the lock (permanent deadlock)
sys/kern/kern_mutex.c:1002
 none not_reproduced not_testable untriaged — —
DF-0001 Low 4.7 Reachable KASSERT panic in kern_truncate()/kern_ftruncate() when VOP_GETATTR fails under quotas
sys/kern/vfs_syscalls.c:4036
 panic reproduced fixed untriaged — —
DF-0011 Low 4.7 Missing NULL check on sbcreatecontrol() in SO_PASSCRED path -> kernel NULL-deref panic
sys/kern/uipc_usrreq.c:694
 panic reproduced fixed untriaged — —
DF-2559 Low 4.7 Local NULL-deref panic when sbcreatecontrol fails in SO_PASSCRED path
sys/kern/uipc_usrreq.c:694
 — — — untriaged — —
DF-0187 Low 4.5 vacl_get_acl/aclcheck call VOPs without vnode lock, inconsistent with set/delete
sys/kern/kern_acl.c:88
 none reproduced fixed untriaged — —
DF-0234 Medium 4.4 Signed-integer overflow in callout timer calc (min_period*hz/2) -> self-perpetuating CPU-burn or watchdog defeat
sys/kern/kern_wdog.c:94
 dos not_reproduced not_testable untriaged — —
DF-0236 Medium 4.4 Driver callbacks (wdog_fn) invoked under global spinlock with interrupts disabled
sys/kern/kern_wdog.c:84
 dos not_reproduced not_testable untriaged — —
DF-0239 Medium 4.4 Missing resume_kproc implementation: suspend permanently freezes kernel daemons
sys/kern/kern_kthread.c:216
 dos reproduced fixed untriaged — —
DF-0019 Low 4.4 usched_bsd4.queue_checks accepts <=0 causing NULL-deref/panic in cache-coherent chooseproc
sys/kern/usched_bsd4.c:1483
 panic reproduced fixed untriaged — —
DF-0026 Low 4.4 Root-writable bioq_reorder_minor_interval used as modulus divisor without validation -> divide-by-zero panic
sys/kern/subr_disk.c:1325
 panic reproduced fixed untriaged — —
DF-0029 Low 4.4 Unchecked copyin() in jrecord_data leaves stale kernel data in the journal stream
sys/kern/vfs_journal.c:1093
 none reproduced fixed untriaged — —
DF-0046 Low 4.4 Missing SEMVMX upper-bound in semop/semexit allows semval overflow, wrap, spurious wakeups, and rollback corruption
sys/kern/sysv_sem.c:848
 dos reproduced fixed untriaged — —
DF-0063 Low 4.4 Hash-chain cycle in link_elf_lookup_symbol causes kernel infinite-loop DoS
sys/kern/link_elf.c:812
 none reproduced fixed untriaged — —
DF-0071 Low 4.4 Missing sign/upper-bound validation on vpcount before heap alloc + file read (negative->huge kmalloc M_WAITOK DoS)
sys/kern/kern_checkpoint.c:561
 none reproduced fixed untriaged — —
DF-0158 Low 4.4 Signed uoffset/bytes in copy routines let negative values bypass EFAULT guard
sys/kern/kern_xio.c:235
 none reproduced fixed untriaged — —
DF-0173 Low 4.4 Divide-by-zero panic via kern.hz=0 loader tunable
sys/kern/subr_param.c:200
 none reproduced fixed untriaged — —
DF-0191 Low 4.4 Divide-by-zero panic via log_wakeups_per_second=0 sysctl
sys/kern/subr_log.c:87
 none reproduced fixed untriaged — —
DF-0228 Low 4.4 hdr_lba_table (uint64) read via le32toh() -> silent 64-to-32 truncation
sys/kern/subr_diskgpt.c:133
 none reproduced fixed untriaged — —
DF-0089 Low 4.2 Resource merge in release path ignores address contiguity - creates false spans across unmanaged gaps
sys/kern/subr_rman.c:560
 none reproduced fixed untriaged — —
DF-0241 Low 4.1 kproc_start dereferences thread pointer before checking kthread_create error
sys/kern/kern_kthread.c:176
 none reproduced fixed untriaged — —
DF-0247 Info 4.1 cpuid bounds check is KASSERT-only — compiled out in production kernels
sys/kern/subr_cpuhelper.c:45
 none reproduced not_testable untriaged — —
DF-0090 Low 4.0 rman_reserve_resource has no count==0 guard - unsigned underflow in range math corrupts resource list
sys/kern/subr_rman.c:205
 none reproduced fixed untriaged — —
DF-2545 Info 4.0 devaddq() error path frees wrong variable leaking 1024 bytes of M_BUS on allocation pressure
sys/kern/subr_bus.c:585
 — — — untriaged — —
DF-0250 Info 3.9 Dead page-alignment computation: iolen computed but never applied
sys/kern/kern_physio.c:88
 none reproduced not_testable untriaged — —
DF-0113 Low 3.6 PT_DETACH reparents tracee to recycled p_oppid PID
sys/kern/sys_process.c:350
 none reproduced fixed untriaged — —
DF-0156 Low 3.6 be_uuid_dec decodes time_mid with wrong byte order (le16dec instead of be16dec)
sys/kern/kern_uuid.c:361
 none reproduced fixed untriaged — —
DF-0166 Low 3.6 syscap_set INPARENT: uid/prison checked without p_token before capability mutation
sys/kern/kern_caps.c:164
 none reproduced fixed untriaged — —
DF-0203 Low 3.6 Sentinel -1 collision: fuwordadd32 fault indistinguishable from mutex value -1
sys/kern/kern_umtx.c:146
 none reproduced fixed untriaged — —
DF-0212 Low 3.6 lwkt_serialize_handler_try omits post-acquire re-check of handler-enabled bit
sys/kern/lwkt_serialize.c:189
 none reproduced fixed untriaged — —
DF-0210 Info 3.6 clist_catq infinite loop on aliasing (cls==cld)
sys/kern/tty_subr.c:294
 none reproduced fixed untriaged — —
DF-0118 Low 3.5 Memory leak of dios_io/dios_open on kdmsg state teardown (no destructor for state->any.any)
sys/kern/subr_diskiocom.c:637
 none reproduced fixed untriaged — —
DF-0174 Low 3.4 Integer overflow in ncallout via unbounded kern.maxfiles
sys/kern/subr_param.c:282
 none reproduced fixed untriaged — —
DF-0235 Low 3.4 No bounds validation on watchdog period (negative/>period_max accepted)
sys/kern/kern_wdog.c:114
 none reproduced fixed untriaged — —
DF-0143 Medium 3.3 nlookupdata leaked on nlookup failure (missing nlookup_done)
sys/kern/vfs_quota.c:354
 dos reproduced fixed untriaged — —
DF-0145 Medium 3.3 vq_done stub leaks all quota RB-trees on unmount
sys/kern/vfs_quota.c:142
 dos reproduced fixed untriaged — —
DF-0202 Medium 3.3 Unthrottled kprintf log-flood DoS via umtx_sleep/wakeup on unmapped address
sys/kern/kern_umtx.c:150
 dos reproduced fixed untriaged — —
DF-0054 Low 3.3 Truncated prison-id sysctl node name in prison_sysctl_create (off-by-one in ksnprintf size)
sys/kern/kern_jail.c:993
 none reproduced fixed untriaged — —
DF-0133 Low 3.3 Algorithmic-complexity DoS in EBR recursion (tetranacci explosion)
sys/kern/subr_diskmbr.c:427
 none reproduced fixed untriaged — —
DF-0146 Low 3.3 prop_dictionary/prop_array leaks on several sys_vquotactl paths
sys/kern/vfs_quota.c:374
 none reproduced fixed untriaged — —
DF-0186 Low 3.3 vacl_delete silently ignores user-supplied ACL type, always deletes ACL_TYPE_DEFAULT
sys/kern/kern_acl.c:107
 none reproduced fixed untriaged — —
DF-0199 Low 3.3 Day-of-month 0 causes unsigned underflow in fattime2timespec (crafted FAT image)
sys/kern/subr_fattime.c:233
 none reproduced fixed untriaged — —
DF-0204 Low 3.3 umtx_wakeup ignores count argument: over-wakeup / cross-process thundering herd
sys/kern/kern_umtx.c:297
 none reproduced fixed untriaged — —
DF-0229 Low 3.3 uint32 wraparound in table_lba+table_blocks location bounds-check
sys/kern/subr_diskgpt.c:139
 none reproduced fixed untriaged — —
DF-2560 Low 3.3 File refcount / unp_rights leak when ssb_appendcontrol fails on SOCK_STREAM SCM_RIGHTS
sys/kern/uipc_usrreq.c:766
 — — — untriaged — —
DF-0132 Low 3.0 Unvalidated sensor type as array index: OOB write in sensor_attach/detach
sys/kern/kern_sensors.c:143
 none reproduced fixed untriaged — —
DF-0189 Low 3.0 TOCTOU race in /dev/klog single-open enforcement
sys/kern/subr_log.c:98
 none reproduced fixed untriaged — —
DF-0193 Low 3.0 vfs_vptofh reads vp->v_mount twice without snapshot/NULL-check
sys/kern/vfs_vfsops.c:266
 none reproduced fixed untriaged — —
DF-0049 Info 3.0 IPI ring/serial indices are signed int, incremented without wraparound handling (overflow after ~2^31 messages)
sys/kern/lwkt_ipiq.c:218
 none reproduced not_testable untriaged — —
DF-0244 Info 3.0 ldisc_deregister missing lower-bound check: negative index OOB write into linesw[]
sys/kern/tty_conf.c:122
 none reproduced fixed untriaged — —
DF-0030 Low 2.5 jrecord_write_path goto again can spin indefinitely under concurrent rename (local DoS)
sys/kern/vfs_journal.c:1251
 none reproduced fixed untriaged — —
DF-0052 Low 2.5 alst_leaf_alloc corrupts bm_bighint hint by mutating start before the bighint-decision comparison
sys/kern/subr_alist.c:443
 none reproduced fixed untriaged — —
DF-0067 Low 2.5 add_buffer_randomness_src passes full remaining length (bytes) instead of chunk size (n), defeating cross-CPU entropy splitting
sys/kern/kern_nrandom.c:650
 none reproduced fixed untriaged — —
DF-0097 Low 2.5 sglist_consume_uio truncates iov_len (size_t) to int - signedness confusion / data drop (dead code)
sys/kern/subr_sglist.c:383
 none reproduced fixed untriaged — —
DF-0128 Low 2.5 fp_vpopen NULL deref on td->td_proc when called from pure thread context
sys/kern/kern_fp.c:165
 none reproduced fixed untriaged — —
DF-0129 Low 2.5 fp_mmap dereferences fp->f_data without NULL check after f_type check
sys/kern/kern_fp.c:472
 none reproduced fixed untriaged — —
DF-0130 Low 2.5 fp_read all=1 mode can spin indefinitely on persistent EINTR/ERESTART
sys/kern/kern_fp.c:271
 none reproduced fixed untriaged — —
DF-0148 Low 2.5 TOCTOU: vq_write_ok check and vfs_stdaccount commit are separate critical sections
sys/kern/vfs_quota.c:443
 none reproduced fixed untriaged — —
DF-0161 Low 2.5 m_tag_copy_chain reverses tag order: tprev=t misplaced inside else branch
sys/kern/uipc_mbuf2.c:376
 none reproduced fixed untriaged — —
DF-0178 Low 2.5 cttyvp() snapshot read of s_ttyvp unsynchronized vs proc_token-held writers
sys/kern/tty_tty.c:74
 none reproduced fixed untriaged — —
DF-0200 Low 2.5 Negative tv_sec bypasses 1980-truncate guard in timespec2fattime
sys/kern/subr_fattime.c:150
 none reproduced fixed untriaged — —
DF-0208 Low 2.5 No validation of negative length in clist_qtob/btoq/ndflush
sys/kern/tty_subr.c:127
 none reproduced fixed untriaged — —
DF-0217 Low 2.5 sysctl reads kcollect_ary outside lock racing collection thread
sys/kern/kern_collect.c:233
 none reproduced fixed untriaged — —
DF-0223 Low 2.5 Missing sched_priority bounds check in SCHED_OTHER + signed-overflow UB in p4prio_to_rtpprio
sys/kern/kern_sched.c:181
 none reproduced fixed untriaged — —
DF-0232 Low 2.5 SIOCSPGRP invokes fsetown(-INT_MIN) -> signed-overflow UB on attacker-controlled value
sys/kern/sys_socket.c:164
 none reproduced fixed untriaged — —
DF-0012 Info 2.5 vop_nremove quota-accounting glue: latent NULL-deref on nc_vp, nlink TOCTOU, wrong mount for PFS overlays
sys/kern/vfs_vopops.c:1660
 none reproduced fixed untriaged — —
DF-0048 Info 2.5 CALLOUT_PREVENTED set on wrong structure (verifier/cc) vs read from backend _callout -> wrong callout_stop/cancel/drain return
sys/kern/kern_timeout.c:600
 none reproduced fixed untriaged — —
DF-0051 Info 2.5 msgsnd lacks explicit MSGMAX upper-bound check; msg_ts (u_short) silently truncates when MSGMNB compiled > 65535 (latent panic)
sys/kern/sysv_msg.c:50
 none reproduced not_testable untriaged — —
DF-0086 Info 2.5 dev_dopen dereferences inner *a_fpp without NULL check (latent panic, no current trigger)
sys/kern/kern_device.c:151
 none reproduced fixed untriaged — —
DF-0091 Info 2.5 Lock-order inversion between sysctl_rman and rman_fini creates ABBA deadlock potential (rman_fini dead code)
sys/kern/subr_rman.c:155
 none reproduced not_testable untriaged — —
DF-0116 Info 2.5 copyin/copyout/uiomove_nofault clear TDF_NOFAULT unconditionally instead of save/restore
sys/kern/kern_subr.c:60
 none reproduced not_testable untriaged — —
DF-0121 Info 2.5 Signed/unsigned confusion defeats length clamp in KENV_GET
sys/kern/kern_environment.c:141
 none reproduced fixed untriaged — —
DF-0122 Info 2.5 kgetenv_quad signed-shift overflow on magnitude-suffixed values
sys/kern/kern_environment.c:436
 none reproduced not_testable untriaged — —
DF-0168 Info 2.5 Lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
sys/kern/kern_sysref.c:142
 none reproduced not_testable untriaged — —
DF-0238 Low 2.3 Callout overwrites sysctl-visible wdog_auto_period with driver-reported min
sys/kern/kern_wdog.c:108
 none reproduced fixed untriaged — —
DF-0240 Low 2.3 suspend_kproc swallows timeout: always returns 0 even when daemon did not stop
sys/kern/kern_kthread.c:195
 none reproduced fixed untriaged — —
DF-0255 Info 2.3 Non-atomic RMW on global synth_synced counter (race)
sys/kern/vfs_synth.c:49
 none reproduced not_testable untriaged — —
DF-0124 Low 1.9 Unsynchronized open-mode bookkeeping in cnopen/cnclose (D_MPSAFE)
sys/kern/tty_cons.c:368
 none reproduced fixed untriaged — —
DF-0125 Low 1.9 sysctl_kern_consmute races cnread/cnwrite/cnioctl forwarding (no lock)
sys/kern/tty_cons.c:257
 none reproduced fixed untriaged — —
DF-0163 Low 1.9 module_register_init runs lookup/register/MOD_EVENT without mod_token
sys/kern/kern_module.c:89
 none reproduced fixed untriaged — —
DF-0170 Low 1.9 Ignored copyin return feeds uninitialized stack sched_param into ksched
sys/kern/kern_p1003_1b.c:202
 none reproduced fixed untriaged — —
DF-0237 Low 1.9 TOCTOU on wdog_auto_enable in wdog_ioctl
sys/kern/kern_wdog.c:191
 none reproduced fixed untriaged — —
DF-0253 Low 1.9 Namecache lock+ref leaked on nc_vp==NULL error path (missing nlookup_done)
sys/kern/vfs_synth.c:82
 none reproduced fixed untriaged — —
DF-0254 Low 1.9 Namecache reference leaked on every successful call (cache_drop never called)
sys/kern/vfs_synth.c:86
 none reproduced fixed untriaged — —
DF-2551 Low 1.9 sys_fhopen() returns success (error=0) without valid file descriptor when regular file vnode lacks VM object
sys/kern/vfs_syscalls.c:4933
 — — — untriaged — —
DF-0023 Info 1.9 Missing return after EINVAL in sys_read/sys_write/sys_extpwrite bypasses nbyte>SSIZE_MAX guard
sys/kern/sys_generic.c:130
 dos reproduced fixed untriaged — —
DF-0068 Info 1.9 IBAA-only RNG mode (rand_mode==1) has no seeding-readiness gate before first output
sys/kern/kern_nrandom.c:700
 none reproduced not_testable untriaged — —
DF-0078 Info 1.9 pps_shift/pps_shiftmax sysctl lack range validation allowing UB shift counts in hardpps (root self-DoS)
sys/kern/kern_ntptime.c:265
 none reproduced fixed untriaged — —
DF-0109 Info 1.9 l32_fixlabel partition loop lacks internal d_npartitions cap
sys/kern/subr_disklabel32.c:592
 none reproduced not_testable untriaged — —
DF-0114 Info 1.9 PT_IO trusts user piod_len without bounds check; narrows size_t into ssize_t uio_resid
sys/kern/sys_process.c:429
 none reproduced fixed untriaged — —
DF-0115 Info 1.9 sys_ptrace discards copyout error returning PT_IO descriptor
sys/kern/sys_process.c:112
 none reproduced fixed untriaged — —
DF-0155 Info 1.9 Division by unvalidated freq<=0 -> kernel divide-by-zero panic
sys/kern/kern_systimer.c:269
 none reproduced fixed untriaged — —
DF-0159 Info 1.9 xio_init_pages accepts negative npages; only upper bound asserted
sys/kern/kern_xio.c:142
 none reproduced fixed untriaged — —
DF-0172 Info 1.9 mpipe_free reads/writes mpipe->pending outside the lwkt_token
sys/kern/kern_mpipe.c:344
 none reproduced not_testable untriaged — —
DF-0175 Info 1.9 Integer overflow in NPROC macro via unbounded kern.maxusers
sys/kern/subr_param.c:56
 none reproduced not_testable untriaged — —
DF-0201 Info 1.9 dhp computed from raw tv_sec instead of UTC-adjusted t1
sys/kern/subr_fattime.c:150
 none reproduced fixed untriaged — —
DF-0205 Info 1.9 Timeout conversion uses 32-bit int arithmetic that can overflow
sys/kern/kern_umtx.c:188
 none reproduced not_testable untriaged — —
DF-0206 Info 1.9 Dead code: offset computed and never used in both syscalls
sys/kern/kern_umtx.c:114
 none reproduced not_testable untriaged — —
DF-0211 Info 1.9 No negative-size guard on ccmax in clist_alloc_cblocks
sys/kern/tty_subr.c:61
 none reproduced fixed untriaged — —
DF-0213 Info 1.9 last_td tracking field uses non-atomic plain load/store racy on SMP
sys/kern/lwkt_serialize.c:112
 none reproduced not_testable untriaged — —
DF-0214 Info 1.9 handler_disable discards in-flight indicator from atomic_intr_handler_disable
sys/kern/lwkt_serialize.c:149
 none reproduced not_testable untriaged — —
DF-0218 Info 1.9 kcollect_setvalue divides by kcollect_samples without guard
sys/kern/kern_collect.c:128
 none reproduced not_testable untriaged — —
DF-0219 Info 1.9 kcollect_setscale/setvalue mutate shared state without kcollect_lock
sys/kern/kern_collect.c:124
 none reproduced not_testable untriaged — —
DF-0222 Info 1.9 csprng_get_random byte count signed int: huge u_int requests silently truncate to 0
sys/kern/subr_csprng.c:127
 none reproduced fixed untriaged — —
DF-0242 Info 1.9 TOCTOU: td_proc NULL check without holding kpsus_token
sys/kern/kern_kthread.c:190
 none reproduced not_testable untriaged — —
DF-0064 Info 1.1 Unsynchronized data race on desc->total_objects (statistics-only, no security impact)
sys/kern/kern_objcache.c:357
 none reproduced fixed untriaged — —
DF-0069 Info 1.1 Signed integer overflow (C UB) in lock range end calculation (caught by guard, no corruption reachable)
sys/kern/kern_lockf.c:227
 none reproduced fixed untriaged — —
DF-0231 Info 1.1 Buffer-size safety depends solely on KKASSERT debug assertions
sys/kern/subr_diskgpt.c:93
 none reproduced not_testable untriaged — —
DF-0252 Info 1.1 Theoretical cross-field torn-read between sys_profil multi-field update and addupc
sys/kern/subr_prof.c:68
 none reproduced not_testable untriaged — —
DF-0221 Low 0.5 Signed 1<<31 overflow disables Fortuna pool 31 from reseed schedule
sys/kern/subr_csprng.c:203
 none reproduced fixed untriaged — —
DF-0002 Info 0.5 sys_fhopen returns spurious success (fd 0) on VREG-without-VM-object invariant violation
sys/kern/vfs_syscalls.c:4933
 none reproduced fixed untriaged — —
DF-0043 Info 0.5 SYSCTL_INT declared for long counters (auxrecovervnodes1/2) - type/size mismatch
sys/kern/vfs_lock.c:109
 none reproduced fixed untriaged — —
DF-0100 Info 0.5 Missing NULL check on vfsconf_find_by_name("devfs") before dereference in vfs_mountroot_devfs
sys/kern/vfs_conf.c:300
 none reproduced fixed untriaged — —
DF-0104 Info 0.5 Boot-time ktr_buf/ktr_entries_mask publication relies on TSO (no explicit read-side barrier, x86-only safe)
sys/kern/kern_ktr.c:231
 none reproduced not_testable untriaged — —
DF-0127 Info 0.5 cndbctl uses unlocked static refcount
sys/kern/tty_cons.c:570
 none reproduced not_testable untriaged — —
DF-0131 Info 0.5 fp_mmap size arithmetic can wrap past SSIZE_MAX after signedness check
sys/kern/kern_fp.c:409
 none reproduced not_testable untriaged — —
DF-0171 Info 0.5 Ignored copyout return in sys_sched_getparam
sys/kern/kern_p1003_1b.c:245
 none reproduced fixed untriaged — —
DF-0184 Info 0.5 Lockless read of exec_res_id counter mutated under list lock
sys/kern/imgact_resident.c:138
 none reproduced not_testable untriaged — —
DF-0192 Info 0.5 Concurrent writer/reader cursor updates on msg_bufl unsynchronized
sys/kern/subr_log.c:153
 none reproduced not_testable untriaged — —
DF-0194 Info 0.5 vfs_mount caches mnt_cred with unlocked check-then-set
sys/kern/vfs_vfsops.c:89
 none reproduced not_testable untriaged — —
DF-0225 Info 0.5 Implicit undocumented locking contract on lwp_rtprio writes
sys/kern/kern_sched.c:175
 none reproduced not_testable untriaged — —

Base system — virtual memory 42

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2685 High 7.1 mlock()/mlockall()/wiring faults zero-fill non-resident (swapped-out) pages instead of paging them in — silent memory destruction in privileged processes
sys/vm/vm_fault.c:383 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2672 Medium 6.5 vm_object reference leak on fork() of wired (mlock'd) map entries — permanent swap/kernel-memory exhaustion by unprivileged users
sys/vm/vm_map.c:3627 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2843 Low 5.5 vnode_pager_generic_putpages() undirties pages on short writes — silent stale-data substitution (write-side DF-2663 family)
sys/vm/vnode_pager.c:771 · pass 2 · new
 none untested not_testable untriaged — —
DF-2686 Medium 4.7 vm_fault_object() pager-error tail wakes the wrong object's PIP: double-decrement on the terminal object (u_int wrap) and permanent +1 leak on fs->first_ba->object — unkillable D-state hang in vm_object_terminate
sys/vm/vm_fault.c:2241 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2866 Low 4.7 pagertab[] has 7 slots but enum obj_type has 8 values — an OBJT_MARKER (7) object dispatched to any pager op indexes one struct pagerops* past the array (latent uncontrolled indirect call; DF-0944 family)
sys/vm/vm_pager.c:152 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2939 Low 4.7 dev_pager_dealloc runs cdev_pg_dtor before unlinking the object from dev_pager_object_list (and outside dev_pager_mtx): racing cdev_pager_allocate for the same handle clobbers the fresh object's si_object, making the later old_dev_pager_dtor KKASSERT(dev->si_object) a reachable panic
sys/vm/device_pager.c:211 · pass 2 · new
 — — — untriaged — —
DF-2844 Info 4.7 vnode_pager_haspage() divides by mnt_stat.f_iosize without a zero guard (autofs leaves f_iosize=0)
sys/vm/vnode_pager.c:259 · pass 2 · new
 none untested not_testable untriaged — —
DF-2879 Medium 4.4 swaponvp() stripe round-up registers up to 63 phantom swap pages per device beyond the real device end, wedging the pageout daemon in an unbounded EINVAL retry loop
sys/vm/vm_swap.c:365 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2673 Low 4.4 Recursive vm_map_lock in vm_map_growstack() MAP_WIREFUTURE path — deterministic kernel panic (mlockall(MCL_FUTURE) + stack growth)
sys/vm/vm_map.c:4274 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2983 Low 4.4 phys_pager_putpages() panics: vm_fault wiring path creates queue-managed pages in OBJT_PHYS objects (SysV shm + mlock + memory pressure → kernel panic)
sys/vm/phys_pager.c:99 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2676 Low 4.1 vm_page_grab() NULL-pointer dereference when the page exists but is busy and VM_ALLOC_RETRY is not set
sys/vm/vm_page.c:3841 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2880 Low 4.1 sp->sw_nblks is a 32-bit int but swaponvp() stores a 64-bit block count — swap devices >= 2^31 pages (8 TiB) truncate to negative/garbage bounds while vm_swap_size still counts the full size
sys/vm/vm_swap.c:344 · pass 2 · new
 — — — untriaged — —
DF-2829 Medium 4.0 Uninitialized vm_zone->znalloc discloses stale kernel heap memory to unprivileged users via sysctl vm.zone (REQUESTS column)
sys/vm/vm_zone.c:453 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-2674 Low 3.6 vm_map_growstack() maps grown stack pages VM_PROT_ALL (RWX), silently making the grown stack executable (W^X bypass)
sys/vm/vm_map.c:4246 · pass 2 · new
 none reproduced fixed untriaged — —
DF-2889 Low 3.3 vm_contig_pg_clean color-queue validation is provably wrong: reclaims only color-0 pages, skipping 1023/1024 page queues — contigmalloc reclaim flush is ~99.9% ineffective
sys/vm/vm_contig.c:194 · pass 2 · new
 — — — untriaged — —
DF-2881 Low 3.0 Duplicate-swap-device check compares vnodes, not devices — the same cdev swapped on twice via distinct devfs alias vnodes interleaves two swap stripes over the same physical blocks
sys/vm/vm_swap.c:281 · pass 2 · new
 — — — untriaged — —
DF-2865 Low 2.5 pbuf reservation counters (pfreecnt): unsynchronized check-then-decrement in getpbuf*/trypbuf* drives counters negative and past their caps
sys/vm/vm_pager.c:418 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-2840 Low 2.3 vm.swapcache.* tunables accept unbounded/negative values, wedging the swapcache daemon state machine and burst accounting
sys/vm/vm_swapcache.c:120 · pass 2 · new
 — — — untriaged — —
DF-2678 Low 1.9 vm_page_free_contig() can leak PG_FICTITIOUS DMA-reserve pages when vm_low_phys_reserved has been lowered below the freed block
sys/vm/vm_page.c:2868 · pass 2 · new
 — — — untriaged — —
DF-2835 Info 1.1 sys_vmspace_create violates its own ABI contract: accepts id==NULL and silently ignores type/data instead of rejecting them
sys/vm/vm_vmspace.c:146 · pass 2 · new
 — — — untriaged — —
DF-2888 Info 1.1 vcnt()/vcnt_intr() accumulate u_int per-CPU counters into signed int, wrapping vm.stats.* exports negative after 2^31 aggregate events
sys/vm/vm_meter.c:245 · pass 2 · new
 — — — untriaged — —
DF-2965 Info 1.1 brk/sbrk mappings are created RWX (VM_PROT_ALL as both prot and max_protection) — executable heap defeats future W^X policy
sys/vm/vm_unix.c:137 · pass 2 · new
 — — — untriaged — —
DF-2892 Info 0.8 alignment==0 passes the power-of-two check but means 'physical address 0' — guaranteed allocation failure after three full page-queue flush passes; plus copy-paste panic string in contigfree
sys/vm/vm_contig.c:268 · pass 2 · new
 — — — untriaged — —
DF-2841 Info 0.5 vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors
sys/vm/vm_swapcache.c:608 · pass 2 · new
 — — — untriaged — —
DF-2891 Info 0.5 contigmalloc_map silently ignores its map argument — kmap always allocates from kernel_map; a caller freeing via its own map corrupts the wrong vm_map
sys/vm/vm_contig.c:527 · pass 2 · new
 — — — untriaged — —
DF-0946 Medium 6.5 swp_pager_meta_build while-loop can free a swap block assigned by a concurrent meta_build for the same pindex
sys/vm/swap_pager.c:2385
 none not_reproduced not_testable untriaged — —
DF-0940 Medium 5.5 Integer truncation in vm_map_growstack grow_amount enables unbounded kernel-memory-growth local DoS
sys/vm/vm_map.c:4110
 none not_reproduced not_testable untriaged — —
DF-0952 Medium 5.5 sys_vmspace_destroy leaks ve->refs on EBUSY, causing kernel panic in rb_vmspace_delete at proc exit
sys/vm/vm_vmspace.c:222
 none not_reproduced not_testable untriaged — —
DF-0955 Medium 4.7 Race-induced kernel panic in vm_contig_pg_alloc when first iteration of alloc loop fails (vm_contig_pg_free called with size=0)
sys/vm/vm_contig.c:398
 none not_reproduced not_testable untriaged — —
DF-0944 Low 4.7 NULL vm_page dereference when OBJT_MGTDEVICE pager returns VM_PAGER_FAIL (latent; no in-tree driver triggers it)
sys/vm/vm_fault.c:2033
 panic reproduced not_testable untriaged — —
DF-0941 Low 4.4 Kernel divide-by-zero panic in vm_get_pg_color via writable CPU topology sysctls (CTLFLAG_RW)
sys/vm/vm_page.c:1225
 panic reproduced fixed untriaged — —
DF-0958 Low 3.3 Double vm_object reference in cdev_pager_allocate leaks device pager objects forever
sys/vm/device_pager.c:131
 dos reproduced not_testable untriaged — —
DF-0961 Low 3.3 sys_sbrk does not enforce RLIMIT_VMEM (address-space limit), unlike sys_obreak
sys/vm/vm_unix.c:107
 none reproduced not_testable untriaged — —
DF-0943 Info 3.0 vm_page_alloc_contig silently ignores alignment, boundary, and low address constraints
sys/vm/vm_page.c:2764
 none reproduced not_testable untriaged — —
DF-0953 Low 2.5 Missed wakeup in relpbuf: pbuf pool sleepers not woken on first available buffer (I/O latency DoS)
sys/vm/vm_pager.c:645
 dos reproduced not_testable untriaged — —
DF-0960 Info 2.5 old_dev_pager_ctor truncates page count to unsigned int, skipping validation for huge sizes
sys/vm/device_pager.c:316
 none reproduced not_testable untriaged — —
DF-0947 Low 2.3 swap_pager_reserve leaks unused tail of last bulk allocation
sys/vm/swap_pager.c:764
 dos reproduced not_testable untriaged — —
DF-0950 Low 2.3 sys_mlockall done block unconditionally unwires, making MCL_CURRENT a silent no-op and undoing prior mlock() wiring
sys/vm/vm_mmap.c:1089
 dos reproduced not_testable untriaged — —
DF-0956 Low 2.3 kmem_alloc_attr leaks KVA, kernel_object ref, and wired pages on partial vm_page_alloc_contig failure
sys/vm/vm_kern.c:437
 dos reproduced not_testable untriaged — —
DF-0942 Info 1.9 vm_page_set_invalid dereferences m->object without NULL check (latent; no in-tree caller triggers it)
sys/vm/vm_page.c:4101
 none reproduced fixed untriaged — —
DF-0948 Info 1.9 swap_pager_putpages stripe-boundary trim is off-by-one, invoking freeswapspace with npages=0
sys/vm/swap_pager.c:1713
 none reproduced fixed untriaged — —
DF-0962 Info 1.1 Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-exploitable)
sys/vm/vm_unix.c:86
 none reproduced fixed untriaged — —

Base system — filesystems 96

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-3044 Medium 8.8 BOOTP/DHCP reply acceptance has zero origin validation and a fully deterministic transaction XID — spoofed reply gives same-L2 attacker total control of the diskless client (root/swap NFS server, hostname, default route)
sys/vfs/nfs/bootp_subr.c:595 · pass 2 · new
 — — — untriaged — —
DF-3062 High 8.4 ext2_nodealloccg INODE_UNINIT: memset(b_data, 0, ipg/8 - 1) underflows size_t for mount-legal ipg < 8 — unbounded kernel-heap memset on first create
sys/vfs/ext2fs/ext2_alloc.c:1319 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2993 High 7.5 NFS READDIR/READDIRPLUS with count=0 from the wire infinite-loops the nfsd kernel thread (remote DoS, host starvation)
sys/vfs/nfs/nfs_serv.c:2977 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3082 High 7.1 ext2 create in an htree-indexed directory truncates the directory mid-tree — mass silent data loss on valid Linux-created images, then kernel panic
sys/vfs/ext2fs/ext2_lookup.c:377 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3063 Medium 7.1 ext2_zero_inode_table computes all_blks from the RAW s_inode_size field — REV0 (which also bypasses the feature gate) zeroes up to ~512MB of device blocks past the inode table on first create
sys/vfs/ext2fs/ext2_alloc.c:1251 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3030 Medium 6.5 fuse_vop_nrename leaks a kmalloc'd M_TEMP buffer on every effective rename — unprivileged unbounded kernel heap exhaustion
sys/vfs/fuse/fuse_vnops.c:1219 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3000 Medium 6.3 hammer_vop_write UIO_NOCOPY (putpages/msync) path: bqrelse(bp) followed by bread(&bp) makes breadnx reuse the RELEASED buffer; write-out then runs on an unlocked free-queued buffer (guaranteed panic('buffer is not busy') + buffer-recycle race window); identical pattern in hammer2
sys/vfs/hammer/hammer_vnops.c:690 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-2994 Medium 5.9 WebNFS public-filehandle LOOKUP with configured-but-missing index file: vput() on an unlocked vnode → guaranteed kernel panic
sys/vfs/nfs/nfs_serv.c:565 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2995 Low 5.9 nfsrv_writegather leaks a reply mbuf chain per malformed-fh v3 WRITE when vfs.nfs.gatherdelay_v3 > 0 (remote mbuf exhaustion)
sys/vfs/nfs/nfs_serv.c:1263 · pass 2 · new
 leak reproduced fixed untriaged — —
DF-3022 Medium 5.6 devfs lock-order inversion: VOP_NRESOLVE holds ncp across devfs_lock while destroy path holds devfs_lock across cache_inval_vp/cache_zap of the same ncp → unprivileged whole-system deadlock
sys/vfs/devfs/devfs_vnops.c:474 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3029 Medium 5.6 fuse_io_thread lost-wakeup window (no tsleep interlock between empty-queue check and sleep) can strand a bio indefinitely
sys/vfs/fuse/fuse_vnops.c:1682 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3023 Medium 5.5 tmpfs_write accepts negative pwrite offsets: unsigned-wrap of the EFBIG/RLIMIT/growth checks drives tmpfs_reg_resize(negative) → unprivileged kernel panic
sys/vfs/tmpfs/tmpfs_vnops.c:691 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3050 Medium 5.5 s_blocks_count never checked against the device size — crafted superblock drives a ~256GB M_WAITOK kmalloc before any group-descriptor read, wedging the whole system
sys/vfs/ext2fs/ext2_vfsops.c:591 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3056 Medium 5.5 dirfs_nrename never updates dn_parent on cross-directory rename — every subsequent path-based operation acts on the WRONG host file while fd I/O keeps hitting the original inode
sys/vfs/dirfs/dirfs_vnops.c:907 · pass 2 · new
 integrity reproduced not_testable untriaged — —
DF-3064 Medium 5.5 ext2_valloc EEXIST path leaks the ext2_ihashget() vnode lock+vref — crafted bitmap makes the mount un-unmountable with uninterruptible D-state processes
sys/vfs/ext2fs/ext2_alloc.c:423 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3083 Medium 5.5 ext2_dirbad panic()s a writable-mounted ext2 on any mangled directory entry — one flipped byte = reboot-loopable local DoS
sys/vfs/ext2fs/ext2_lookup.c:701 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-2997 Medium 5.3 nfs_lookup/nfs_mkdir error paths vrele() vnodes that nfs_nget returned LK_EXCLUSIVE-locked — permanent vnode-lock leak, mount wedge / vnode exhaustion DoS from malformed server replies
sys/vfs/nfs/nfs_vnops.c:1270 · pass 2 · new
 — — — untriaged — —
DF-3013 Low 5.3 _hammer_ip_reseek() KKASSERTs on an EDEADLK-capable seek: INVARIANTS panic (or silent early iteration-EOF on release builds) when the btree re-seek deadlocks
sys/vfs/hammer/hammer_object.c:1443 · pass 2 · new
 — — — untriaged — —
DF-3014 Low 5.3 hammer_ip_sync_record_cursor() error path frees the bulk record's data reservation on retryable EDEADLK and ignores hammer_blockmap_finalize() failure — double-finalize / blockmap accounting corruption on the flush retry
sys/vfs/hammer/hammer_object.c:1256 · pass 2 · new
 — — — untriaged — —
DF-3004 Low 4.7 Unconditional nlinks decrement on unlink wraps a crafted nlinks=0 inode to UINT64_MAX — KKASSERT((int64_t)nlinks >= 0) panic in hammer_sync_inode (INVARIANTS) / poisoned link count persisted to media
sys/vfs/hammer/hammer_inode.c:2980 · pass 2 · new
 — — — untriaged — —
DF-3020 Low 4.7 devfs_allocv failure ignored: devfs_spec_open and devfs_vop_nlookupdotdot use the vp unconditionally → vn_unlock(NULL)/NULL-fp panic under vnode exhaustion
sys/vfs/devfs/devfs_vnops.c:535 · pass 2 · new
 — — — untriaged — —
DF-3021 Low 4.7 devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has → NULL-deref panic when the device node was torn down under an open fd
sys/vfs/devfs/devfs_vnops.c:1432 · pass 2 · new
 — — — untriaged — —
DF-3025 Low 4.7 tmpfs_nlink LINK_MAX check-then-increment race across different directories can push tn_links past LINK_MAX → KKASSERT panic (INVARIANTS) / nlink contract breach
sys/vfs/tmpfs/tmpfs_vnops.c:1209 · pass 2 · new
 — — — untriaged — —
DF-3068 Low 4.7 Undo-walk desync via tail_size/hdr_size inconsistency drives bytes negative — deterministic KKASSERT(error || bytes == 0) panic in hammer_recover_stage1 (INVARIANTS) / silent mis-recovery on production kernels
sys/vfs/hammer/hammer_recover.c:393 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3067 Medium 4.4 PAD-only undo FIFO makes hammer_recover_stage1's seqno backscan (and stage2's extended-range scan) unbounded — mount never terminates, unkillable CPU-burning kernel thread (livelock DoS)
sys/vfs/hammer/hammer_recover.c:257 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3002 Low 4.4 Forged btree leaf with data_offset==0: hammer_btree_extract returns cursor->data==NULL with error==0 (CRC skipped) → NULL-deref kernel panics in readdir/readlink/nresolve/dounlink/strategy_read sinks on crafted HAMMER images
sys/vfs/hammer/hammer_vnops.c:1254 · pass 2 · new
 — — — untriaged — —
DF-3087 Low 4.4 nfssvc(NFSSVC_AUTHIN) resume of an ENEEDAUTH'd nfsd re-enters the reply loop with nd == NULL — deterministic kernel NULL-deref panic (:671), plus nfsd_nd leak/dangle
sys/vfs/nfs/nfs_syscalls.c:448 · pass 2 · new
 panic reproduced fixed untriaged — —
DF-3069 Low 4.1 Unbounded rterm/rte allocation during stage2 extended-range TERM collection — attacker-controlled kernel-heap exhaustion at mount ('This must fit in memory!' is not enforced)
sys/vfs/hammer/hammer_recover.c:611 · pass 2 · new
 — — — untriaged — —
DF-3075 Info 3.9 nfs_statfs/nfs_statvfs apply server-claimed filesystem geometry unvalidated: v3 f_blocks/f_bfree/f_bavail cast (long)(u_quad/1024) can go negative, v2 f_bsize is an arbitrary server int, statvfs 64-bit fields unclamped
sys/vfs/nfs/nfs_vfsops.c:357 · pass 2 · new
 — — — untriaged — —
DF-3088 Low 3.7 nfssvc_nfsd() socket-zap race after the pipelined dorec leaks the request's mbuf chain and client address (:576-579 frees only the descriptor)
sys/vfs/nfs/nfs_syscalls.c:575 · pass 2 · new
 — — — untriaged — —
DF-3038 Low 3.6 Crafted FAT32 root-alias directory entry (startCluster == pm_rootdirblk): rmdir() frees the live mount's root-directory cluster chain; rename() clobbers root entry 1 and creates a namespace cycle
sys/vfs/msdosfs/msdosfs_vnops.c:1230 · pass 2 · new
 dos untested not_testable untriaged — —
DF-3076 Low 3.6 Unvalidated on-disk B-Tree leaf data_len consumed as `bytes` by hammer_blockmap_free/dedup/finalize with INVARIANTS-only bounds — deterministic panic from unprivileged unlink on crafted nohistory HAMMER; production: int32 layer2 bytes_free wrap and force-free of a still-referenced big-block
sys/vfs/hammer/hammer_blockmap.c:785 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3043 Low 3.5 nm_bioqlen async-bio accounting leaks on every nfs_startio early-exit and underflows on commit→write reissue — permanent mount-wide loss of NFS read-ahead from a malicious/oversized-server attribute claim (and loss of the async throttle)
sys/vfs/nfs/nfs_bio.c:922 · pass 2 · new
 — — — untriaged — —
DF-3026 Low 3.3 tmpfs_write never re-checks APPEND/IMMUTABLE per write — flags set after open are defeated by pre-existing writable fds (UFS enforces APPEND per-write)
sys/vfs/tmpfs/tmpfs_vnops.c:268 · pass 2 · new
 — — — untriaged — —
DF-3059 Low 3.3 dirfs_setattr chtimes ignores the requested va_atime/va_mtime entirely — lutimes(path, NULL) always stamps 'now' (utimensat/UTIME_OMIT semantics unimplemented)
sys/vfs/dirfs/dirfs_vnops.c:556 · pass 2 · new
 — — — untriaged — —
DF-3079 Low 3.3 procfs Pmem exclusive-open latch: plain write-open+close permanently denies O_EXCL opens of /proc/<pid>/mem (EBUSY until vnode reclaim)
sys/vfs/procfs/procfs_vnops.c:186 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-3085 Low 3.3 htree lookup misses existing entries whose hash sorts below the first dx entry (dx count/limit overlay used as an entry) — existing files unopenable/undeletable on valid indexed dirs
sys/vfs/ext2fs/ext2_lookup.c:380 · pass 2 · new
 — — — untriaged — —
DF-3031 Low 3.1 ext2_readdir never corrects the caller's cookie count — missing '*' deref leaves stale uninitialized kernel heap in the over-reported tail (VOP contract violation, latent NFS-facing heap disclosure)
sys/vfs/ext2fs/ext2_vnops.c:262 · pass 2 · new
 none untested not_testable untriaged — —
DF-2991 Low 2.5 handle_workitem_freeblocks: indir_trunc errors silently swallowed — '== 0' dead store makes allerror unreachable, I/O errors during indirect-block deallocation unreported
sys/vfs/ufs/ffs_softdep.c:2168 · pass 2 · new
 — — — untriaged — —
DF-3032 Low 2.5 ext2_rename strands IN_RENAME on the source directory inode when the step-3 relookup race resolves the from-name to a different inode — directory permanently unrenameable (EINVAL) until reclaim
sys/vfs/ext2fs/ext2_vnops.c:1025 · pass 2 · new
 none untested not_testable untriaged — —
DF-3053 Low 2.5 nfsm_mbuftouio ignores copyout() fault — NFS read() reports full success with stale destination bytes
sys/vfs/nfs/nfsm_subs.c:1071 · pass 2 · new
 — — — untriaged — —
DF-3058 Low 2.5 dirfs_fsync returns 0 unconditionally — host fsync() failures are swallowed (and the double-fsync retry stores -1, not errno)
sys/vfs/dirfs/dirfs_vnops.c:588 · pass 2 · new
 — — — untriaged — —
DF-3077 Low 2.5 Zone-end wrap check uses exact equality while unvalidated layer2->append_off / blockmap next_offset / hint can push next_offset past the zone boundary — allocations returned outside the requested zone on production kernels
sys/vfs/hammer/hammer_blockmap.c:137 · pass 2 · new
 — — — untriaged — —
DF-3006 Low 2.3 nlinks double-decrement on DEVFS_RULE_RESET of a rule-created link underflows size_t and permanently leaks the target devfs node (silent, leak_count-balanced)
sys/vfs/devfs/devfs_core.c:526 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3019 Low 1.9 devfs_spec_open clone path: EPERM/EBUSY early returns after securelevel/mounted-RW checks leak the cloned vp exclusively locked and referenced forever
sys/vfs/devfs/devfs_vnops.c:1006 · pass 2 · new
 — — — untriaged — —
DF-3070 Low 1.1 tmpfs_reg_resize shrink path: 'aobj->size = osize;' self-assignment dead store — swap-object size never reduced after truncate (intended aobj->size = nsize), live upstream
sys/vfs/tmpfs/tmpfs_subr.c:1055 · pass 2 · new
 — — — untriaged — —
DF-3007 Info 0.8 devfs_uninit passes NULL to devfs_msg_send — two stores through address 0 (latent; SYSUNINIT path dead on stock configs)
sys/vfs/devfs/devfs_core.c:1112 · pass 2 · new
 none not_reproduced not_testable untriaged — —
DF-3042 Info 0.8 Volume-header CRC (vol_crc) is never verified — hammer_crc_test_volume has zero callers; all mount-time header consumption is integrity-unchecked
sys/vfs/hammer/hammer_ondisk.c:180 · pass 2 · new
 — — — untriaged — —
DF-3034 Info 0.5 KKASSERT is the only bounds check before bcopy/hammer_datacrc in hammer_indirect_callback (defense-in-depth gap on non-INVARIANTS kernels)
sys/vfs/hammer/hammer_io.c:1658 · pass 2 · new
 — — — untriaged — —
DF-3039 Info 0.5 msdosfs_mkdir truncates cntobn() block number to int — new-directory metadata written at wrong device offset on FAT volumes >1 TiB
sys/vfs/msdosfs/msdosfs_vnops.c:1332 · pass 2 · new
 — — — untriaged — —
DF-3037 Medium — msdosfs doscheckpath() unbounded ".." ancestor walk — rename(2) kernel livelock wedging the whole system (crafted FAT ".." cycle)
sys/vfs/msdosfs/msdosfs_vnops.c:1045 · pass 2 · new
 dos reproduced fixed untriaged — —
DF-3054 Medium — dirfs_findfd() NULL return on over-length relative path is dereferenced by dirfs_getattr/dirfs_readlink/dirfs_alloc_file — vkernel panic from a deep path (unprivileged DoS)
sys/vfs/dirfs/dirfs_vnops.c:389 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-3055 Medium — dirfs_nsymlink/dirfs_nmkdir execute the success path when dirfs_alloc_file() fails: dirfs_knote(*vpp==NULL) SIGSEGV, negative-cache of an existing name, and the real error clobbered by stale errno
sys/vfs/dirfs/dirfs_vnops.c:1067 · pass 2 · new
 panic reproduced not_testable untriaged — —
DF-0779 Medium 6.5 tmpfs_readdir cookie generation panics on attacker-supplied bogus NFS cookie — KKASSERT/RB_NEXT(NULL)
sys/vfs/tmpfs/tmpfs_vnops.c:1697
 panic reproduced fixed untriaged — —
DF-0802 Medium 6.5 Panic on malformed BOOTP/DHCP options from unauthenticated network reply during diskless boot — pre-auth remote DoS
sys/vfs/nfs/bootp_subr.c:1390
 panic reproduced not_testable untriaged — —
DF-0893 High 6.3 hammer_enter_undo_history mutates RB tree/TAILQ without lock racing concurrent frontends
sys/vfs/hammer/hammer_undo.c:125
 panic reproduced fixed untriaged — —
DF-0886 Medium 6.1 autofs_node_vn loses a create race panicking kernel on concurrent first-lookup
sys/vfs/autofs/autofs_vnops.c:569
 panic reproduced fixed untriaged — —
DF-0841 Medium 5.9 NULL deref in ISDOTDOT lookup path — VTODE(*vpp) on unassigned *vpp=NUL via missing assignment
sys/vfs/msdosfs/msdosfs_lookup.c:557
 panic reproduced fixed untriaged — —
DF-0858 High 5.5 Unbounded dive depth in hpfs_hpbmap allows infinite kernel loop via cyclic alsec pointers
sys/vfs/hpfs/hpfs_alsubr.c:78
 dos reproduced fixed untriaged — —
DF-0770 Medium 5.5 Record sync error silently dropped in hammer_sync_inode — variable name typo tmp_error=-error should be -tmp_error
sys/vfs/hammer/hammer_inode.c:3066
 data-integrity (silent error-drop; not memory corruption) reproduced fixed untriaged — —
DF-0808 Medium 5.5 dirfs_nrename NULL deref panic on over-length or unlinked rename paths
sys/vfs/dirfs/dirfs_vnops.c:977
 none not_reproduced not_testable untriaged — —
DF-0834 Medium 5.5 ufs_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang (UFS analog of DF-0824)
sys/vfs/ufs/ufs_lookup.c:1130
 dos reproduced fixed untriaged — —
DF-0839 Medium 5.5 hammer_ioc_set_version leaks sync_lock and finalize_lock on undo-upgrade error — deadlocks or panics filesystem
sys/vfs/hammer/hammer_ioctl.c:638
 dos reproduced fixed untriaged — —
DF-0855 Medium 5.5 dirfs_findfd KKASSERT panic / NULL deref on unlinked dirfs nodes
sys/vfs/dirfs/dirfs_subr.c:479
 panic reproduced fixed untriaged — —
DF-0879 Medium 5.5 Unbounded CE continuation chain in cd9660_rrip_loop allows infinite kernel loop via crafted ISO
sys/vfs/isofs/cd9660/cd9660_rrip.c:503
 dos reproduced fixed untriaged — —
DF-0883 Medium 5.5 Unvalidated logical block size lb_size enables divide-by-zero and UB shifts
sys/vfs/udf/udf_vfsops.c:306
 panic reproduced fixed untriaged — —
DF-0910 Medium 5.5 Divide-by-zero kernel panic via HAMMER_IOC_PRUNE with mod_tid=0
sys/vfs/hammer/hammer_prune.c:305
 panic reproduced fixed untriaged — —
DF-0911 Medium 5.5 procfs ATTACH skips saving p_oppid for already-owned children; DETACH reparents victim to proc0 leaking permanent zombies
sys/vfs/procfs/procfs_ctl.c:153
 logic_orphan reproduced fixed untriaged — —
DF-0765 Low 5.5 Wrong semaphore released in newblk_lookup race-avoided path — pagedep_in_progress instead of newblk_in_progress
sys/vfs/ufs/ffs_softdep.c:1017
 none reproduced not_testable untriaged — —
DF-0794 Low 5.5 Divide-by-zero panic when fs_ncg==0 — unvalidated superblock geometry mounts successfully then traps on first allocation
sys/vfs/ufs/ffs_alloc.c:676
 panic reproduced fixed untriaged — —
DF-0928 Medium 5.3 UFS inode-hash has no lock; concurrent ffs_vget() inserts orphan an inode and panic on reclaim (dual-vnode on production)
sys/vfs/ufs/ufs_ihash.c:78
 none not_reproduced not_testable untriaged — —
DF-0900 Low 5.3 Signed integer overflow in RPC reply verifier length allows mbuf length corruption
sys/vfs/nfs/krpc_subr.c:425
 dos reproduced fixed untriaged — —
DF-0824 Medium 5.0 ext2_checkpath infinite loop on crafted cyclic .. directory entries — uninterruptible kernel hang
sys/vfs/ext2fs/ext2_lookup.c:1212
 dos reproduced fixed untriaged — —
DF-0819 Medium 4.7 blkmap_lock leaked on hammer_bnew error paths — goto failed jumps past hammer_unlock permanently deadlocking HAMMER filesystem
sys/vfs/hammer/hammer_blockmap.c:285
 dos reproduced fixed untriaged — —
DF-0847 Medium 4.7 Global dquot hash/free-list manipulated with no lock - concurrent ufs_dqget cache-miss corrupts lists and panics
sys/vfs/ufs/ufs_quota.c:769
 none not_reproduced not_testable untriaged — —
DF-0889 Medium 4.7 hpmp leaked in hpfs_mountfs failed-mount path (memory exhaustion DoS)
sys/vfs/hpfs/hpfs_vfsops.c:262
 dos reproduced fixed untriaged — —
DF-0918 Medium 4.7 NULL-deref panic via dead/replied race in fuse_ipc_wait early-return paths
sys/vfs/fuse/fuse_ipc.c:163
 panic reproduced fixed untriaged — —
DF-0892 Low 4.7 tmpfs_root dereferences *vpp without checking tmpfs_alloc_vp error
sys/vfs/tmpfs/tmpfs_vfsops.c:424
 panic reproduced not_testable untriaged — —
DF-0913 Info 4.7 fuse_audit_length / fuse_get_ops panic kernel on unknown opcode
sys/vfs/fuse/fuse_util.c:229
 none reproduced not_testable untriaged — —
DF-0773 Medium 4.4 NULL deref in devfs_inode_to_vnode — vn_lock called on NULL vp when inode not found
sys/vfs/devfs/devfs_core.c:959
 panic reproduced fixed untriaged — —
DF-0867 Medium 4.4 Kernel panic via unvalidated rec_type in mirror_write_rec path
sys/vfs/hammer/hammer_mirror.c:575
 dos reproduced fixed untriaged — —
DF-0898 Medium 4.4 NULL pointer deref when DEVFS_RULE_LINK is used without DEVFS_RULE_NAME
sys/vfs/devfs/devfs_rules.c:113
 panic reproduced fixed untriaged — —
DF-0838 Low 4.4 Crafted image triggers kernel panic via unimplemented directory hash algorithm (ALG2/ALG3)
sys/vfs/hammer/hammer_subs.c:953
 panic reproduced fixed untriaged — —
DF-0852 Low 4.4 Unvalidated user ssector causes signed-integer overflow in volume descriptor loop and volume_space_size
sys/vfs/isofs/cd9660/cd9660_vfsops.c:326
 dos reproduced fixed untriaged — —
DF-0868 Low 4.4 Missing error check on hammer_init_cursor in mirror_write allows use of invalid cursor
sys/vfs/hammer/hammer_mirror.c:362
 panic reproduced not_testable untriaged — —
DF-0792 Low 4.1 NULL deref in direct I/O paths when hammer_get_volume fails — hammer_rel_volume(NULL) unconditional
sys/vfs/hammer/hammer_io.c:1487
 panic reproduced fixed untriaged — —
DF-0845 Low 4.1 Integer overflow in nslots computation with very large directories and elevated dirhash_maxmem — infinite loop hang
sys/vfs/ufs/ufs_dirhash.c:132
 dos reproduced not_testable untriaged — —
DF-0890 Low 3.6 hpfsnode h_gid initialized from hpm_uid (copy/paste typo) wrong group on all files
sys/vfs/hpfs/hpfs_vfsops.c:510
 none reproduced not_testable untriaged — —
DF-0856 Low 3.3 dirfs_alloc_file openat error path leaks dirfs node and parent refcount
sys/vfs/dirfs/dirfs_subr.c:182
 none reproduced not_testable untriaged — —
DF-0924 Low 3.3 Attacker-controlled kernel heap allocation size via read() resid
sys/vfs/procfs/procfs_map.c:61
 dos reproduced fixed untriaged — —
DF-0809 Low 2.5 dirfs_getattr returns 0 unconditionally even when dirfs_node_stat fails — stale/uninitialized attributes
sys/vfs/dirfs/dirfs_vnops.c:368
 none reproduced not_testable untriaged — —
DF-0833 Low 2.5 Integer truncation of uint64_t inf_len to int in udf_read and udf_readdir — files >2GB truncated
sys/vfs/udf/udf_vnops.c:391
 dos reproduced not_testable untriaged — —
DF-0937 Info 2.5 Write-path SSTOP check diverges from LSSTOP check used by fpregs/dbregs siblings
sys/vfs/procfs/procfs_regs.c:68
 none reproduced not_testable untriaged — —
DF-0896 Low 2.3 Resource leak on mount error paths leaks credential fuse_node and refcount
sys/vfs/fuse/fuse_vfsops.c:185
 dos reproduced not_testable untriaged — —
DF-0909 Info 2.3 Memory leak of dirfs_mount structure on mount-time stat failure
sys/vfs/dirfs/dirfs_vfsops.c:148
 none reproduced fixed untriaged — —
DF-0828 Info 1.9 Buffer leak in markvoldirty_upgrade on bread error (dead code path)
sys/vfs/msdosfs/msdosfs_fat.c:1154
 none reproduced fixed untriaged — —

Base system — network stack 223

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2977 Low 5.3 accf_http soparsehttpvers() restarts its scan at ssb_mb on every data arrival with no retained parse state — O(n^2) per connection, all on the netisr protocol thread; unauthenticated remote CPU/netisr exhaustion for any httpready-configured listener
sys/net/accf_http/accf_http.c:237 · pass 2 · new
 dos reproduced not_testable untriaged — —
DF-0428 High 9.6 pfsync_input has no source/peer authentication: any on-link host can inject/modify/destroy pf state
sys/net/pf/if_pfsync.c:462
 none not_reproduced not_testable untriaged — —
DF-0430 High 9.3 Unauthenticated PFSYNC_ACT_CLR/DEL/DEL_C let attacker mass-destroy arbitrary pf state across all CPUs
sys/net/pf/if_pfsync.c:542
 none not_reproduced not_testable untriaged — —
DF-0704 Medium 9.1 No length validation on received sync datagram — type field and struct casts read without bounds check
sys/net/ipfw3_basic/ip_fw3_sync.c:208
 none not_reproduced not_testable untriaged — —
DF-0429 High 8.2 Unauthenticated PFSYNC_ACT_UREQ forces victim to multicast entire pf state table: info disclosure + amplification DoS
sys/net/pf/if_pfsync.c:900
 none not_reproduced not_testable untriaged — —
DF-0632 Medium 8.2 Per-CPU state counters never decremented: permanent state-table exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_state.c:317
 dos reproduced fixed untriaged — —
DF-0351 High 8.1 uint32 metric accumulation overflow enables route poisoning / route hijacking
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1089
 dos reproduced fixed untriaged — —
DF-0630 High 7.5 udp6_ctlinput returns without lwkt_replymsg, deadlocking the netisr on a single crafted ICMPv6 packet
sys/netinet6/udp6_usrreq.c:434
 dos reproduced fixed untriaged — —
DF-0703 High 7.5 Unauthenticated remote mbuf leak in edge socket handler — kernel memory exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_sync.c:203
 none not_reproduced not_testable untriaged — —
DF-0571 Medium 7.5 kernel panic on any non-TCP/UDP/ICMP packet hitting NAT rule
sys/net/ipfw3_nat/ip_fw3_nat.c:219
 panic reproduced fixed untriaged — —
DF-0710 Medium 7.5 sco_input uses while-loop (not if) for receive buffer check — oversized SCO packet hangs protocol thread in infinite loop
sys/netbt/sco_socket.c:221
 dos reproduced not_testable untriaged — —
DF-0743 Medium 7.5 struct greip/mobip_h overlay assumes ip_hl==5 — IP options make all GRE/mobile header reads use wrong offset compounds DF-0740
sys/netinet/ip_gre.c:133
 misparse/dos reproduced fixed untriaged — —
DF-0564 Low 7.4 DLCI array access lacks local bounds check — ng7 twin of DF-0556
sys/netgraph7/lmi/ng_lmi.c:690
 panic reproduced fixed untriaged — —
DF-0473 High 7.2 ip_fw3_chk: unbounded filter_funcs[module][opcode] indexing -> OOB function pointer call on remote traffic
sys/net/ipfw3/ip_fw3.c:506
 panic reproduced fixed untriaged — —
DF-0352 Medium 7.1 RANN frame overwrites shared global ieee80211_hwmp_rannint without lock: remote timer DoS
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1971
 none not_reproduced not_testable untriaged — —
DF-0556 Low 6.8 DLCI array index without local bounds check in nglmi_rcvdata: latent heap OOB write
sys/netgraph/lmi/ng_lmi.c:692
 panic reproduced fixed untriaged — —
DF-0281 High 6.5 Remote kernel panic: divide-by-zero via PN MCC command with mtu=0
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3019
 dos reproduced fixed untriaged — —
DF-0350 High 6.5 Unbounded mesh route-table growth + attacker-controlled lifetime: remote memory exhaustion DoS
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1057
 dos reproduced fixed untriaged — —
DF-0453 High 6.5 Wrong session variable in rfcomm_session_newconn: timeout armed on listener not new session — memory leak + listener corruption DoS
sys/netbt/rfcomm_session.c:423
 panic reproduced not_testable untriaged — —
DF-0543 High 6.5 num_compl_pkts: unbounded variable-length loop reads past mbuf end -> remote kernel panic
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:884
 none not_reproduced not_testable untriaged — —
DF-0558 High 6.5 hci_event_num_compl_pkts: unbounded variable-length loop NO per-iteration bounds check -> remote kernel panic
sys/netbt/hci_event.c:376
 panic inconclusive not_testable untriaged — —
DF-0559 High 6.5 hci_event_inquiry_result/rssi_result: unbounded loops guarded only by KKASSERT -> remote kernel panic on short data
sys/netbt/hci_event.c:447
 panic inconclusive not_testable untriaged — —
DF-0654 High 6.5 ccmp_setkey omits AES key load for software-decrypt-only keys, causing kernel panic on first received frame
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:140
 none inconclusive not_testable untriaged — —
DF-0751 High 6.5 Infinite loop for MPLS explicit-NULL label 0/2 with clear bottom-of-stack bit — single-packet remote hard hang
sys/netproto/mpls/mpls_input.c:101
 dos / hard-hang - single-packet remote kernel busy-loop (one CPU at 100% holding mplock, no panic, no dmesg, power-cycle required) reproduced fixed untriaged — —
DF-0287 Medium 6.5 Divide-by-zero kernel panic in mesh_airtime_calc via ni_txrate==0
sys/netproto/802_11/wlan/ieee80211_mesh.c:3366
 none inconclusive not_testable untriaged — —
DF-0301 Medium 6.5 Missing replay protection on CARP advertisements: L2-adjacent DoS of failover
sys/netinet/ip_carp.c:1137
 dos reproduced fixed untriaged — —
DF-0418 Medium 6.5 Unbounded default-router and prefix list growth from spoofed RAs: RA-flooding kernel memory exhaustion DoS
sys/netinet6/nd6_rtr.c:689
 dos reproduced fixed untriaged — —
DF-0445 Medium 6.5 altq_etherclassify NULL-pointer dereference: mbuf chain walk advances to m_next without NULL check
sys/net/if_ethersubr.c:927
 panic reproduced fixed untriaged — —
DF-0752 Medium 6.5 mbuf leak in mpls_forward on route-not-found — remote memory-exhaustion DoS
sys/netproto/mpls/mpls_input.c:199
 dos reproduced fixed untriaged — —
DF-0653 Low 6.5 Signed integer overflow in ieee80211_pwrsave frame-age computation yields KASSERT panic
sys/netproto/802_11/wlan/ieee80211_power.c:359
 dos reproduced fixed untriaged — —
DF-0322 Low 6.1 No validation of tid/baw before indexing ni_rx_ampdu[tid] and setting rxa_wnd
sys/netproto/802_11/wlan/ieee80211_ht.c:566
 none reproduced fixed untriaged — —
DF-0660 High 6.0 Heap memory corruption: kfree() on mbuf data pointer in ng_device_rcvdata
sys/netgraph/ng_device.c:363
 none not_reproduced not_testable untriaged — —
DF-2570 High 6.0 Heap corruption: kfree() of in-mbuf data pointer on every received packet in ng_device_rcvdata
sys/netgraph/ng_device.c:363
 none not_reproduced not_testable untriaged — —
DF-0276 Medium 6.0 Wrong-pointer kfree in DIOCADDADDR error path frees framework pointer instead of allocated pooladdr
sys/net/pf/pf_ioctl.c:2160
 none not_reproduced not_testable untriaged — —
DF-0302 Medium 5.9 Failover state machine in input path runs without synchronization: concurrent state corruption
sys/netinet/ip_carp.c:1108
 dos inconclusive not_testable untriaged — —
DF-0391 Medium 5.9 pf_fragcache: m_dup NULL dereferenced before NULL check in m_adj argument: remote DoS under memory pressure with fragcrop
sys/net/pf/pf_norm.c:661
 panic inconclusive not_testable untriaged — —
DF-0645 Medium 5.9 NULL pointer dereference in div_packet() on re-injected divert packets (rcvif==NULL)
sys/netinet/ip_divert.c:182
 panic reproduced not_testable untriaged — —
DF-0493 Low 5.9 KASSERT-only bounds check on nack before xwin[] indexing: no runtime protection in production kernels
sys/netgraph/l2tp/ng_l2tp.c:1141
 dos reproduced fixed untriaged — —
DF-0663 Medium 5.7 SLIST_REMOVE on never-inserted element in newhook error paths corrupts list head
sys/netgraph/ng_device.c:286
 panic reproduced not_testable untriaged — —
DF-0403 Low 5.7 Unvalidated dst_ring from custom lookup causes OOB index into dst_ents array
sys/net/netmap/netmap_vale.c:1162
 dos reproduced fixed untriaged — —
DF-0618 Low 5.7 Signed integer overflow in ieee80211_dwds_discover age calculation causes KASSERT panic
sys/netproto/802_11/wlan/ieee80211_wds.c:336
 dos reproduced fixed untriaged — —
DF-0308 Low 5.6 X_ipip_input reads viftable/last_encap_vif without mroute_token: race with vif teardown
sys/net/ip_mroute/ip_mroute.c:1709
 none reproduced fixed untriaged — —
DF-0475 Medium 5.5 act_ofs never validated: OOB pointer deref via ACTION_PTR during packet matching
sys/net/ipfw3/ip_fw3.c:520
 panic reproduced fixed untriaged — —
DF-0687 Medium 5.5 Missing break in sco_ctloutput PRCO_GETOPT causes NULL-deref panic via getsockopt (DF-0682 pattern)
sys/netbt/sco_socket.c:113
 panic reproduced fixed untriaged — —
DF-0688 Medium 5.5 sco_ctloutput PRCO_SETOPT unconditionally NULL-dereferences on every setsockopt
sys/netbt/sco_socket.c:123
 panic reproduced fixed untriaged — —
DF-0705 Medium 5.5 Local DoS / panic via out-of-order ioctls, kthread_create failure, and negative count in show_conf
sys/net/ipfw3_basic/ip_fw3_sync.c:239
 none not_reproduced not_testable untriaged — —
DF-0709 Medium 5.5 sco_ctloutput PRCO_GETOPT success path leaks one mbuf per getsockopt call — mbuf-exhaustion DoS
sys/netbt/sco_socket.c:111
 dos reproduced fixed untriaged — —
DF-0759 Low 5.5 Double NG_FREE_ITEM on out-hook data path panics INVARIANTS kernels
sys/netgraph7/ng_split.c:134
 panic reproduced fixed untriaged — —
DF-2601 Low 5.5 snd_queue enqueue ignores ifq_maxlen unbounded kernel memory exhaustion DoS
sys/netgraph7/ng_source.c:280
 — — — untriaged — —
DF-0282 Medium 5.4 Signed tx_cred overflow and OOB credit byte read in UIH reception
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2409
 none inconclusive not_testable untriaged — —
DF-0431 Medium 5.4 Dead expire-scaling code: imported state expiry is always raw attacker value, enabling infinite-lifetime states
sys/net/pf/if_pfsync.c:402
 none inconclusive not_testable untriaged — —
DF-0353 Low 5.4 hwmp_recv_perr switches on dest_flags instead of dest_rcode: PERR never actioned
sys/netproto/802_11/wlan/ieee80211_hwmp.c:1768
 none reproduced fixed untriaged — —
DF-0371 Low 5.4 Unlocked memcmp of lp_marker before LACP_LOCK: torn-read data race with lacp_xmit_marker
sys/net/lagg/ieee8023ad_lacp.c:1934
 none reproduced fixed untriaged — —
DF-0481 Low 5.4 Integer overflow in root path cost comparison allows topology manipulation via crafted BPDU
sys/net/bridge/bridgestp.c:513
 none reproduced fixed untriaged — —
DF-0555 Low 5.4 m_pullup is dead code: packetlen=m_len then m_len<packetlen always false, mbuf chains mis-parsed
sys/netgraph/lmi/ng_lmi.c:575
 none reproduced fixed untriaged — —
DF-0584 Info 5.4 ieee80211_ff_decap skips framelen validation: truncated frame delivery
sys/netproto/802_11/wlan/ieee80211_superg.c:309
 none reproduced not_testable untriaged — —
DF-0271 Medium 5.3 NULL deref in bridge_input: unchecked bridge_lookup_member_if result (race with member deletion)
sys/net/bridge/if_bridge.c:2738
 panic not_reproduced not_testable untriaged — —
DF-0406 Medium 5.3 in_delayed_cksum: unchecked m_pullup return leads to NULL pointer write panic
sys/netinet/ip_output.c:940
 panic inconclusive not_testable untriaged — —
DF-0518 Medium 5.3 ICMP error generation (icmp_error) not rate-limited: reflection/amplification DoS
sys/netinet/ip_icmp.c:144
 dos reproduced fixed untriaged — —
DF-0566 Medium 5.3 ACL reassembly want is uint16_t: overshoot wraps -> L2CAP RX stall + unbounded memory growth
sys/netbt/hci_link.c:421
 none not_reproduced not_testable untriaged — —
DF-0659 Medium 5.3 ng_l2cap_discon_untimeout leaves AUTO_DISCON_TIMO flag set on timer-already-fired path, causing kernel panic via con_ref/con_unref cycle
sys/netgraph7/bluetooth/l2cap/ng_l2cap_misc.c:223
 panic reproduced not_testable untriaged — —
DF-0729 Medium 5.3 NULL mbuf dereference in P2P routing-loop detector when m_copym(M_NOWAIT) fails — kernel panic under memory pressure
sys/netinet6/ip6_forward.c:138
 panic reproduced fixed untriaged — —
DF-0264 Low 5.3 Unsigned wraparound in p_len when TCP th_off exceeds actual header
sys/net/pf/pf.c:6623
 none reproduced fixed untriaged — —
DF-0283 Low 5.3 Unconditional kernel panic if mbuf chain ends with zero-length mbuf
sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:1956
 panic reproduced fixed untriaged — —
DF-0309 Low 5.3 Unbounded pending NOCACHE upcall entries: remote memory-exhaustion DoS when mrouter active
sys/net/ip_mroute/ip_mroute.c:1266
 dos reproduced not_testable untriaged — —
DF-0331 Low 5.3 Unbounded kprintf on fragment-queue exhaustion: remote log-flood DoS
sys/netgraph7/ppp/ng_ppp.c:1519
 dos reproduced fixed untriaged — —
DF-0392 Low 5.3 Fragment overlap trim uses non-8-aligned shifts for last-fragment overlaps: inconsistent reassembly metadata
sys/net/pf/pf_norm.c:412
 none reproduced fixed untriaged — —
DF-0456 Low 5.3 NULL deref in rfcomm_session_complete: credit NULL check under #ifdef DIAGNOSTIC only, no guard on production
sys/netbt/rfcomm_session.c:446
 dos reproduced fixed untriaged — —
DF-0485 Low 5.3 IPv6 syncache hash uses only 64/128 address bits with 32-bit secret: attacker-guaranteed bucket collisions
sys/netinet/tcp_syncache.c:157
 none reproduced fixed untriaged — —
DF-0487 Low 5.3 sc_flags assign instead of OR wipes SCF_HASH and negotiated-option flags on TF_NOOPT listener
sys/netinet/tcp_syncache.c:1102
 none reproduced fixed untriaged — —
DF-0519 Low 5.3 ICMP PMTUD accepts attacker-controlled nextmtu: PMTU poisoning via unauthenticated frag-needed
sys/netinet/ip_icmp.c:282
 dos reproduced fixed untriaged — —
DF-0563 Low 5.3 Dead m_pullup: packetlen=m_len makes check tautologically false — ng7 twin of DF-0555
sys/netgraph7/lmi/ng_lmi.c:569
 none reproduced fixed untriaged — —
DF-0626 Low 5.3 frag6_nfragpackets counter leak on queue allocation failure permanently reduces reassembly capacity
sys/netinet6/frag6.c:267
 dos reproduced fixed untriaged — —
DF-0646 Low 5.3 ip_len double-counted in ip_divert_in() after ip_reass() (corrupted packet metadata on fragmented divert)
sys/netinet/ip_divert.c:607
 dos reproduced fixed untriaged — —
DF-0470 Info 5.3 Disabling ip6_hdrnestlimit sysctl (=0) removes only ext-header depth bound: no hard floor
sys/netinet6/ip6_input.c:693
 none reproduced fixed untriaged — —
DF-0575 Info 5.3 Wrong timeout variable for inbound TCP/UDP state cleanup: 6x/3x premature expiry
sys/net/ipfw3_nat/ip_fw3_nat.c:971
 none reproduced fixed untriaged — —
DF-0606 Medium 5.1 _db_show_mesh invokes ieee80211_mesh_rt_update() from DDB: takes lockmgr lock and mutates mesh route state inside a read-only debugger pretty-printer
sys/netproto/802_11/wlan/ieee80211_ddb.c:897
 panic reproduced fixed untriaged — —
DF-0334 Low 5.1 Divide-by-zero panic in ephemeral port allocation on degenerate sysctl port range
sys/netinet/in_pcb.c:424
 panic reproduced fixed untriaged — —
DF-0442 Low 5.1 rmc_init stores user-driven maxqueued_ without validation: div-by-zero or heap OOB via fixed-size array modulus
sys/net/altq/altq_rmclass.c:680
 dos reproduced fixed untriaged — —
DF-0484 Medium 4.8 SYN-cookie crypto state global unsynchronized across netisr CPUs: racy MD5_CTX + tcp_secret[] defeats SYN-flood mitigation
sys/netinet/tcp_syncache.c:1351
 none not_reproduced not_testable untriaged — —
DF-0263 Low 4.8 ICMP-error NAT for other protocol corrupts inner source (copy-paste bug)
sys/net/pf/pf.c:5732
 none reproduced fixed untriaged — —
DF-0305 Low 4.8 HMAC comparison uses non-constant-time bcmp: timing side-channel
sys/netinet/ip_carp.c:581
 none reproduced fixed untriaged — —
DF-0310 Low 4.8 Non-atomic increment of global fragment ID (ip6_id): data race / predictable fragment IDs
sys/netinet6/ip6_output.c:753
 none reproduced fixed untriaged — —
DF-0317 Low 4.8 Unsynchronized global static shared across all WireGuard interfaces in wg_is_underload
sys/net/wg/if_wg.c:1577
 none reproduced not_testable untriaged — —
DF-0516 Low 4.8 ip6opts_match bails to opts_check on short first mbuf: IPv6 option matching silently skipped -> firewall bypass
sys/net/ip6fw/ip6_fw.c:256
 none reproduced fixed untriaged — —
DF-0325 Medium 4.7 Deadlock: callout_stop under pcb_lock while timeout callback requires pcb_lock
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2765
 none inconclusive not_testable untriaged — —
DF-0366 Medium 4.7 Lockless sc_count pre-check in lagg_start races with port destroy causing divide-by-zero panic
sys/net/lagg/if_lagg.c:1758
 none inconclusive not_testable untriaged — —
DF-0604 Medium 4.7 Cross-CPU race on global pfi_buffer corrupts pf dynamic-interface address tables (filtering bypass)
sys/net/pf/pf_if.c:74
 panic reproduced fixed untriaged — —
DF-0370 Low 4.7 Marker PDU reflection without rate-limiting or request-address validation: on-link amplification DoS
sys/net/lagg/ieee8023ad_lacp.c:1911
 none reproduced fixed untriaged — —
DF-2587 Low 4.7 NULL-dereference panic in ng_ether_input/input_orphan/output when IFP2NG(ifp) NULL
sys/netgraph/ether/ng_ether.c:206
 panic reproduced fixed untriaged — —
DF-0678 Info 4.7 Missing NULL-node guard in ng_gif_input/ng_gif_input_orphan (latent panic; unreachable while file is dead code)
sys/netgraph7/ng_gif.c:170
 none reproduced not_testable untriaged — —
DF-0267 Low 4.5 Race condition in fixed Huffman table initialization
sys/net/zlib.c:4496
 none reproduced not_testable untriaged — —
DF-0382 Medium 4.4 config_red divides by (max_th-min_th) and max_th without zero check: kernel panic — same bug class as dummynet v1 unfixed
sys/net/dummynet3/ip_dummynet3.c:1351
 panic reproduced fixed untriaged — —
DF-0411 Medium 4.4 Infinite loop in ng_parse_skip_value on unclosed quoted string inside brackets: kernel thread hang DoS
sys/netgraph7/netgraph/ng_parse.c:1651
 none not_reproduced not_testable untriaged — —
DF-0441 Medium 4.4 Divide-by-zero kernel panic when ns_per_byte==0: CBQ class add/modify unconditionally divides by user-supplied value
sys/net/altq/altq_rmclass.c:237
 panic reproduced fixed untriaged — —
DF-0474 Medium 4.4 Opcode iteration loop: F_LEN(cmd)==0 causes infinite loop hanging netisr thread
sys/net/ipfw3/ip_fw3.c:493
 dos reproduced fixed untriaged — —
DF-0527 Medium 4.4 ng_fec_choose_port NULL dereference when computed port index removed: reachable panic after port delete
sys/netgraph/fec/ng_fec.c:896
 none not_reproduced not_testable untriaged — —
DF-0535 Medium 4.4 Integer underflow in ngc_send path-length math: sg_len<2 -> bcopy with SIZE_MAX -> kernel heap smash
sys/netgraph7/socket/ng_socket.c:245
 none not_reproduced not_testable untriaged — —
DF-0622 Medium 4.4 NULL-pointer dereference panic: ng_car_disconnect does not cancel the pending SHAPE callout, ng_car_q_event dereferences purged queue
sys/netgraph7/ng_car.c:553
 none not_reproduced not_testable untriaged — —
DF-0666 Medium 4.4 NULL mbuf deref/panic on m_devget failure in ngdwrite
sys/netgraph/ng_device.c:589
 none not_reproduced not_testable untriaged — —
DF-0669 Medium 4.4 NULL-pointer dereference in rn_flush on never-created tables -> kernel panic via delete/flush ioctl and module unload
sys/net/ipfw3_basic/ip_fw3_table.c:130
 panic reproduced fixed untriaged — —
DF-0731 Medium 4.4 rssadapt_tx_complete unconditionally dereferences arg2(rssi) NULL — every in-tree driver passes NULL — instant panic
sys/netproto/802_11/wlan/ieee80211_rssadapt.c:327
 panic reproduced fixed untriaged — —
DF-2576 Medium 4.4 ip_fw3_ctl_zero_entry KKASSERT(zmsg.start_rule==NULL) fires deterministically on every zero/resetlog of a specific rule (root DoS panic on default INVARIANTS kernel)
sys/net/ipfw3/ip_fw3.c:932
 panic reproduced fixed untriaged — —
DF-0358 Low 4.4 Sign error in netmap_grab_packets: computes cur+reserved instead of cur-reserved, forwarding wrong slots to host stack
sys/net/netmap/netmap.c:736
 none reproduced fixed untriaged — —
DF-0374 Low 4.4 config_red divides by (max_th-min_th) and max_th without zero/negative check: kernel panic via setsockopt
sys/net/dummynet/ip_dummynet.c:1346
 dos reproduced fixed untriaged — —
DF-0375 Low 4.4 red_drops divides by fs->lookup_step taken verbatim from user config: panic when lookup_step==0
sys/net/dummynet/ip_dummynet.c:885
 dos reproduced fixed untriaged — —
DF-0421 Low 4.4 ng_ubt_rcvdata calls panic() on malformed HCI frames from netgraph hook: local DoS
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1755
 dos reproduced fixed untriaged — —
DF-0422 Low 4.4 Missing validation of queue length in NGM_UBT_NODE_SET_QLEN: negative qlen -> uint32 wrap to 0xFFFFFFFF unbounded queuing
sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1625
 dos reproduced fixed untriaged — —
DF-0439 Low 4.4 hfsc_dequeue panic() on NULL from hfsc_getq: kernel-panic DoS if backlogged class queue drains underneath scheduler
sys/net/altq/altq_hfsc.c:827
 dos reproduced fixed untriaged — —
DF-0623 Low 4.4 Divide-by-zero panic in ng_car_schedule: SET_CONF permits cir==0 in non-SHAPE modes
sys/netgraph7/ng_car.c:656
 dos reproduced fixed untriaged — —
DF-0648 Low 4.4 NULL-deref panic in NGM_NETFLOW_INFO and NGM_NETFLOW_IFINFO response allocation
sys/netgraph7/netflow/ng_netflow.c:305
 panic inconclusive — untriaged — —
DF-0649 Low 4.4 Per-node ~1.5 MB kernel-memory amplification via fixed NG_NETFLOW_MAXIFACES array
sys/netgraph7/netflow/ng_netflow.c:172
 dos inconclusive — untriaged — —
DF-0684 Low 4.4 hci_complete_sco enqueues to hci_scodone without bounds check (kernel memory exhaustion DoS)
sys/netbt/hci_unit.c:538
 dos reproduced fixed untriaged — —
DF-0727 Low 4.4 NULL-pointer dereference in NGM_FLOW_COOKIE handler when lasthook is NULL and left/right hook disconnected
sys/netgraph7/tee/ng_tee.c:263
 panic reproduced fixed untriaged — —
DF-0736 Low 4.4 Kernel panic via forged mbuf tag with invalid dir value — panic() on attacker-controllable data
sys/netgraph7/ng_ipfw.c:251
 panic reproduced fixed untriaged — —
DF-2547 Low 4.4 Unbounded input queue in ng_source_rcvdata allows system-wide mbuf exhaustion
sys/netgraph7/ng_source.c:564
 — — — untriaged — —
DF-0290 Low 4.3 GANN sequence comparison not wrap-safe (raw <= on uint32)
sys/netproto/802_11/wlan/ieee80211_mesh.c:2649
 none reproduced fixed untriaged — —
DF-0294 Low 4.3 KASSERT panic/uint16 truncation in get_scan_result from remote IE length
sys/netproto/802_11/wlan/ieee80211_ioctl.c:280
 panic reproduced fixed untriaged — —
DF-0386 Low 4.3 ng_ppp_frag_checkstale sequence tracking diverges after gaps: stale-packet delivery suppressed
sys/netgraph/ppp/ng_ppp.c:1384
 none reproduced fixed untriaged — —
DF-0387 Low 4.3 No MRRU enforcement on MP fragment reassembly: peer can assemble oversized PDUs beyond negotiated MRRU
sys/netgraph/ppp/ng_ppp.c:1203
 dos reproduced fixed untriaged — —
DF-0432 Low 4.3 Crafted PFSYNC_ACT_BUS endtime prematurely marks pfsync_sync_ok: HA-status spoofing
sys/net/pf/if_pfsync.c:950
 none reproduced fixed untriaged — —
DF-0455 Low 4.3 MCC multi-byte length decode reverses octet ordering: interoperability bug for MCC frames >= 128 bytes
sys/netbt/rfcomm_session.c:1027
 none reproduced fixed untriaged — —
DF-0468 Low 4.3 ip6_savecontrol ext-header walk has no nest limit (self-flagged by code comment)
sys/netinet6/ip6_input.c:1214
 dos reproduced fixed untriaged — —
DF-0482 Low 4.3 sc_topology_change_time never initialized: premature TC timer expiry defeats topology change notification
sys/net/bridge/bridgestp.c:1465
 none reproduced fixed untriaged — —
DF-2579 Low 4.3 Silent uint16_t truncation of iv_swbmiss_period can yield zero (callout flood DoS)
sys/netproto/802_11/wlan/ieee80211_tdma.c:284
 — — — untriaged — —
DF-0483 Info 4.3 No validation of attacker-supplied STP timer values from winning root bridge BPDU
sys/net/bridge/bridgestp.c:393
 none reproduced not_testable untriaged — —
DF-0273 Medium 4.2 Missing break between SIOCSIFDESCR and SIOCSIFFLAGS: fall-through reinterprets description length as interface flags
sys/net/if.c:2131
 dos reproduced fixed untriaged — —
DF-0323 Low 4.2 ampdu_dispatch re-enters ieee80211_input while iterating rxa_m[] (re-entrancy)
sys/netproto/802_11/wlan/ieee80211_ht.c:616
 none reproduced not_testable untriaged — —
DF-0338 Low 4.2 tcp_mtudisc accepts forged ICMP MTU small enough to drive t_maxseg negative
sys/netinet/tcp_subr.c:1783
 none reproduced fixed untriaged — —
DF-0399 Low 4.2 rtredirect_oncpu ignores rt_setgate return: routes redirect that failed or self-targets
sys/net/route.c:421
 none reproduced fixed untriaged — —
DF-2573 Medium 4.1 NULL deref / panic: SLIST_REMOVE on connection never inserted in error paths of ng_device_newhook
sys/netgraph/ng_device.c:290
 — — — untriaged — —
DF-0376 Low 4.1 Negative qsize bypasses queue-size limit via signed/unsigned comparison: unbounded mbuf accumulation / OOM
sys/net/dummynet/ip_dummynet.c:1437
 dos reproduced fixed untriaged — —
DF-0397 Low 4.1 rt_setshims: unchecked R_Malloc (M_NULLOK) leads to NULL-pointer-write panic via bcopy to NULL
sys/net/route.c:1374
 dos reproduced fixed untriaged — —
DF-0491 Low 4.1 NULL td dereference in SIOCSIFDSTADDR and default ioctl handlers despite documented td might be NULL contract
sys/netinet/in.c:606
 dos reproduced fixed untriaged — —
DF-0587 Low 4.1 NULL vap deref in scan_curchan_task: scan state not re-validated after dropping IEEE80211_LOCK across ic_set_channel
sys/netproto/802_11/wlan/ieee80211_scan_sw.c:741
 panic not_reproduced not_testable untriaged — —
DF-0713 Low 4.1 cac_timeout assigns dfs->newchan (may be NULL) to iv_des_chan — downstream hostap/adhoc/mesh dereference NULL via IEEE80211_IS_CHAN_RADAR
sys/netproto/802_11/wlan/ieee80211_dfs.c:154
 none inconclusive not_testable untriaged — —
DF-0345 Info 3.9 IP header checksum left stale after kernel records RR/TS options on locally-delivered packets
sys/netinet/ip_input.c:1702
 none reproduced not_testable untriaged — —
DF-0372 Info 3.9 Undefined behavior shift 1 << if_dunit for member NIC unit numbers >= 32
sys/net/lagg/ieee8023ad_lacp.c:310
 none reproduced fixed untriaged — —
DF-0467 Info 3.9 Dead code in ip6_savecontrol: RTHDRDSTOPTS walk result discarded, RFC3542 semantics not implemented
sys/netinet6/ip6_input.c:1173
 none reproduced not_testable untriaged — —
DF-0488 Info 3.9 Hash secret only 32-bit + sc_flags 8-bit near exhaustion: hardening gaps
sys/netinet/tcp_syncache.c:118
 none reproduced not_testable untriaged — —
DF-0465 Low 3.7 Handshake state irrevocably corrupted when noise_begin_session kmalloc(M_NOWAIT) fails
sys/net/wg/wg_noise.c:1188
 none reproduced fixed untriaged — —
DF-0319 Info 3.7 Lockless torn reads of multi-word struct wg_endpoint in fast paths
sys/net/wg/if_wg.c:746
 none reproduced not_testable untriaged — —
DF-0448 Info 3.7 Safety-critical checks rely on KASSERT/KKASSERT which are no-ops on production kernels without INVARIANTS
sys/net/if_ethersubr.c:993
 none reproduced not_testable untriaged — —
DF-0656 Info 3.7 CCMP MIC verified with non-constant-time memcmp
sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:642
 none reproduced not_testable untriaged — —
DF-0303 Medium 3.6 HMAC precomputed context torn-read race between config and input paths
sys/netinet/ip_carp.c:504
 dos inconclusive not_testable untriaged — —
DF-0311 Low 3.6 Multicast setsockopt discards copyin error: partially-initialized mbuf fed to ip6_setmoptions
sys/netinet6/ip6_output.c:1496
 none reproduced fixed untriaged — —
DF-0330 Low 3.6 Global mutable pointer used as qsort comparator state: latent cross-bundle race
sys/netgraph7/ppp/ng_ppp.c:471
 none reproduced not_testable untriaged — —
DF-0268 Low 3.5 No decompression bomb (zip bomb) protection
sys/net/zlib.c:3209
 dos reproduced not_testable untriaged — —
DF-2564 Low 3.5 Decompress path signed integer underflow from missing minimum packet size check
sys/netgraph7/ng_pred1.c:468
 — — — untriaged — —
DF-0373 Low 3.4 delete_pipe uses wrong constant DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 permanently undeletable
sys/net/dummynet/ip_dummynet.c:1654
 none reproduced fixed untriaged — —
DF-0551 Low 3.4 MTU unsigned underflow when parent MTU < EVL_ENCAPLEN(4)
sys/net/vlan/if_vlan.c:727
 panic reproduced fixed untriaged — —
DF-0343 Info 3.4 IPv6 address configured while interface is down bypasses Duplicate Address Detection entirely
sys/netinet6/in6.c:1070
 none reproduced not_testable untriaged — —
DF-0359 Low 3.3 Unguarded uint32 subtraction can underflow nr_hwavail causing self-inflicted ring-state corruption
sys/net/netmap/netmap.c:906
 dos reproduced fixed untriaged — —
DF-0498 Low 3.3 SIOC_L2CAP_L2CA_GET_INFO: unvalidated info_size causes oversized kmalloc + feature non-functional
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:1061
 dos reproduced fixed untriaged — —
DF-0591 Low 3.3 Legacy netgraph/ng_bridge leaks mbuf+meta when the bridge has exactly one link (numLinks==1 fan-out loop never runs)
sys/netgraph/bridge/ng_bridge.c:663
 dos reproduced fixed untriaged — —
DF-0686 Low 3.3 Duplicate m_copym in l2cap_ssend leaks an mbuf chain on every send()
sys/netbt/l2cap_socket.c:433
 dos reproduced fixed untriaged — —
DF-0690 Low 3.3 mbuf + item leak on debug-hook data path (unreachable free condition) in dormant template
sys/netgraph7/ng_sample.c:337
 none inconclusive — untriaged — —
DF-0698 Low 3.3 Filter entries leaked on hook disconnect (LIST_REMOVE without kfree) and node shutdown (no hashtable walk)
sys/netgraph/etf/ng_etf.c:473
 dos reproduced fixed untriaged — —
DF-0757 Low 3.3 Global ifnet_mtx held across user-controlled copyin/copyout in sysctl_ifdata - unprivileged local DoS
sys/net/if_mib.c:88
 dos reproduced not_testable untriaged — —
DF-2581 Low 3.3 radix_node_head leak on table_delete and on table re-create enables kernel memory exhaustion DoS
sys/net/ipfw3_basic/ip_fw3_table.c:100
 — — — untriaged — —
DF-0463 Info 3.3 Lockless write to seq->inproc in M_PREPEND failure path: data race
sys/netgraph7/l2tp/ng_l2tp.c:957
 none reproduced not_testable untriaged — —
DF-0419 Low 3.1 nd6_ra_input mutates per-interface ND timing state (reachable/retrans/chlim/linkmtu) without nd6_mtx: data race
sys/netinet6/nd6_rtr.c:272
 dos reproduced fixed untriaged — —
DF-0545 Low 3.1 Buffer accounting u_int16_t wrap in num_compl_pkts via attacker-controlled compl_pkt: throughput DoS
sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:905
 dos reproduced fixed untriaged — —
DF-0567 Low 3.1 Memory leak of in-progress reassembly mbuf when new ACL START arrives
sys/netbt/hci_link.c:471
 dos reproduced fixed untriaged — —
DF-0724 Low 3.1 Unsynchronized timer-vs-caller double-close race in rfcomm_dlc_close — no lock/atomic on CLOSED transition
sys/netbt/rfcomm_dlc.c:156
 none not_reproduced not_testable untriaged — —
DF-0348 Info 3.1 Missing m_pullup for management frames: no guarantee frame header contiguous
sys/netproto/802_11/wlan/ieee80211_hostap.c:594
 none reproduced not_testable untriaged — —
DF-0364 Info 3.1 ieee80211_fix_rate and findrix iterate rs_rates without validating rs_nrates <= IEEE80211_RATE_MAXSIZE: missing defense-in-depth
sys/netproto/802_11/wlan/ieee80211_proto.c:623
 none reproduced not_testable untriaged — —
DF-0383 Low 3.0 SET_TICKS computes len*8*dn_hz as signed int: overflow for jumbo at high dn_hz — same as dummynet v1 unfixed
sys/net/dummynet3/ip_dummynet3.c:450
 dos reproduced fixed untriaged — —
DF-0443 Low 3.0 Integer overflow in scaled scheduler parameter math: maxidle/offtime/pkttime products truncate to 32-bit int
sys/net/altq/altq_rmclass.c:248
 none reproduced fixed untriaged — —
DF-0446 Low 3.0 SIOCSIFMTU missing lower-bound validation: ifr_mtu=0 or negative accepted, corrupts downstream MSS/fragmentation math
sys/net/if_ethersubr.c:715
 none reproduced fixed untriaged — —
DF-0548 Low 3.0 bitmap[0]=~3 marks non-existent objects free when pool has <32 objects
sys/net/netmap/netmap_mem2.c:677
 dos reproduced fixed untriaged — —
DF-0299 Info 3.0 ng_bypass rewrites peer back-pointers without topology lock
sys/netgraph7/netgraph/ng_base.c:1207
 none reproduced not_testable untriaged — —
DF-0342 Info 3.0 in6_update_ifa inconsistent error handling on multicast group joins
sys/netinet6/in6.c:1144
 none reproduced not_testable untriaged — —
DF-0378 Info 3.0 SET_TICKS computes len*8*dn_hz in int: overflow for jumbo packets at high dn_hz -> shaper bypass
sys/net/dummynet/ip_dummynet.c:431
 none reproduced not_testable untriaged — —
DF-0347 Low 2.9 Undefined behavior: 1<<32 in WPA/RSN cipher selector parsing for unknown OUI
sys/netproto/802_11/wlan/ieee80211_hostap.c:1198
 none reproduced fixed untriaged — —
DF-0505 Low 2.9 ng_fec_input defined 2 params but assigned to 4-param if_input slot: calling-convention UB
sys/netgraph7/ng_fec.c:862
 none not_reproduced — untriaged — —
DF-0561 Info 2.9 hci_event ignores hci_event_hdr_t.length: per-spec bound for all variable-length events dropped (root cause)
sys/netbt/hci_event.c:163
 none reproduced not_testable untriaged — —
DF-0507 Info 2.6 IPv6 port-selection hash XORs destination with itself: always zero, no load balancing
sys/netgraph7/ng_fec.c:1056
 none reproduced fixed untriaged — —
DF-0538 Info 2.6 Type-confused stack buffer: char *addrbuf[NG_HOOKSIZ+4] is pointer array not byte array
sys/netgraph7/socket/ng_socket.c:981
 none reproduced not_testable untriaged — —
DF-0415 Low 2.5 Signed integer overflow in keepalive t_maxidle: t_keepintvl*t_keepcnt exceeds INT_MAX at high hz
sys/netinet/tcp_usrreq.c:1644
 dos reproduced fixed untriaged — —
DF-0501 Low 2.5 netgraph message leak on ioctl timeout-vs-response race
sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c:910
 dos reproduced fixed untriaged — —
DF-0685 Low 2.5 TOCTOU on hci_num_cmd_pkts in hci_send_cmd causes uint8_t underflow
sys/netbt/hci_unit.c:314
 panic reproduced fixed untriaged — —
DF-0697 Low 2.5 SET_FILTER ENOMEM path leaks the inbound ng_mesg (return bypasses epilogue)
sys/netgraph/etf/ng_etf.c:327
 dos reproduced fixed untriaged — —
DF-0760 Low 2.5 Unsynchronized per-CPU IP-ID swap lets duplicate IDs be emitted within 32768-call non-reuse window
sys/netinet/ip_id.c:110
 none reproduced not_testable untriaged — —
DF-0416 Info 2.5 TCP_MAXSEG minmss floor can raise t_maxseg above current negotiated value on small-MTU paths
sys/netinet/tcp_usrreq.c:1613
 none reproduced not_testable untriaged — —
DF-2582 Info 2.5 Unbounded shift and missing masklen=0 guard in table_append_dispatch yield wrong mask (logic bug UB)
sys/net/ipfw3_basic/ip_fw3_table.c:161
 — — — untriaged — —
DF-0340 Low 2.3 in6_ifremloop leaks rtentry refcount when matched route is not loopback host route
sys/netinet6/in6.c:318
 none reproduced fixed untriaged — —
DF-0341 Low 2.3 in6_lifaddr_ioctl SIOCDLIFADDR copies prefix mask into ifra_dstaddr instead of ifra_prefixmask
sys/netinet6/in6.c:1606
 none reproduced fixed untriaged — —
DF-0478 Low 2.3 Rule set field not validated: 1<<set with set>=32 is UB enabling rule-set bypass
sys/net/ipfw3/ip_fw3.c:487
 none reproduced fixed untriaged — —
DF-0577 Low 2.3 Integer overflow in SLIOCSKEEPAL/SLIOCSOUTFILL interval computation: tight callout loop DoS
sys/net/sl/if_sl.c:398
 dos reproduced fixed untriaged — —
DF-0613 Low 2.3 Control-message request msg leaked on EBUSY early return in POINT2POINT/BROADCAST handler
sys/netgraph/iface/ng_iface.c:660
 dos reproduced fixed untriaged — —
DF-0723 Low 2.3 Error-path kfree uses wrong malloc type M_NETGRAPH_SPPP for M_IFNET allocation and bypasses if_free (LATENT — file does not compile)
sys/netgraph7/ng_sppp.c:261
 dos inconclusive — untriaged — —
DF-2574 Low 2.3 Memory leak of struct ngd_connection in ng_device_disconnect (unbounded kernel heap exhaustion)
sys/netgraph/ng_device.c:411
 — — — untriaged — —
DF-0318 Info 2.3 Inconsistent atomic vs non-atomic access to wg_packet::p_state
sys/net/wg/if_wg.c:508
 none reproduced not_testable untriaged — —
DF-0369 Info 2.3 lagg_port_ioctl fallback forwards ioctl to driver but always returns EINVAL discarding result
sys/net/lagg/if_lagg.c:896
 none reproduced not_testable untriaged — —
DF-0384 Info 2.3 delete_pipe uses DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 undeletable — same as v1
sys/net/dummynet3/ip_dummynet3.c:1645
 none reproduced fixed untriaged — —
DF-0461 Info 2.3 Potential signed integer overflow in kern_load burst-adaptation math
sys/net/if_poll.c:1019
 none reproduced not_testable untriaged — —
DF-0531 Info 2.3 NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path: all packets silently dropped
sys/netgraph/fec/ng_fec.c:1180
 none reproduced not_testable untriaged — —
DF-0390 Low 1.9 rt_xaddrs accepts sockaddrs with sa_len below _SA_MINSIZE: inconsistent with RO_MISSFILTER validation
sys/net/rtsock.c:1010
 none reproduced fixed untriaged — —
DF-0479 Low 1.9 ip_fw3_ctl_delete_rule: unchecked direct pointer deref of sopt_val without size validation
sys/net/ipfw3/ip_fw3.c:850
 dos reproduced fixed untriaged — —
DF-0530 Low 1.9 ng_fec_free_unit increments usage counter instead of decrementing + global bitmap mutated without locks
sys/netgraph/fec/ng_fec.c:290
 none not_reproduced — untriaged — —
DF-0552 Low 1.9 VLAN tag match strips priority on input but stores full 16-bit tag: input/output asymmetry
sys/net/vlan/if_vlan.c:605
 none reproduced fixed untriaged — —
DF-0576 Low 1.9 Callout handlers dereference sc_ttyp before NULL check/token: callout-vs-close race panic
sys/net/sl/if_sl.c:1012
 panic reproduced fixed untriaged — —
DF-0452 Info 1.9 Octal/hex escape loops in ng_get_string_token: counter k never incremented, consumes all consecutive digits
sys/netgraph/netgraph/ng_parse.c:1599
 none reproduced fixed untriaged — —
DF-0459 Info 1.9 user_frac sysctl accepts any uint32 without range validation (documented 0-100)
sys/net/if_poll.c:1116
 none reproduced not_testable untriaged — —
DF-0460 Info 1.9 status_frac / tx_frac sysctls have no upper bound: signed int overflow in ifpoll_compat_setup
sys/net/if_poll.c:1497
 none reproduced not_testable untriaged — —
DF-0681 Info 1.9 Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports bogus flow-control credits
sys/netbt/rfcomm_upper.c:550
 none reproduced fixed untriaged — —
DF-0695 Info 1.9 RC4 key material and S-box left unzeroed on kernel stack after encrypt/decrypt
sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c:334
 none reproduced fixed untriaged — —
DF-2596 Info 1.9 Incorrect totlen update after packet truncation produces wrong xmitOctets statistics
sys/netgraph/bpf/ng_bpf.c:415
 — — — untriaged — —
DF-0568 Info 1.7 ACL/SCO packet type and length validation only compiled under #ifdef DIAGNOSTIC
sys/netbt/hci_link.c:431
 none reproduced not_testable untriaged — —
DF-0313 Info 1.3 Sticky Hop-by-Hop/Destination options un-settable: hardcoded priv=0 always returns EPERM for root
sys/netinet6/ip6_output.c:2019
 none reproduced not_testable untriaged — —
DF-0675 Info 1.1 BPF LSH/RSH shift amount unbounded: shift-by->=32 is undefined behavior
sys/net/bpf_filter.c:443
 none reproduced not_testable untriaged — —
DF-0699 Info 1.1 Wrong byte counter after BPF truncation: totlen -= len should be totlen = len
sys/netgraph/bpf/ng_bpf.c:414
 none reproduced fixed untriaged — —
DF-0300 Info 0.8 ng_decodeidname truncates u_long to ng_ID_t without range check
sys/netgraph7/netgraph/ng_base.c:919
 none reproduced fixed untriaged — —
DF-0332 Info 0.8 Statistics counters read without lock: torn 64-bit reads
sys/netgraph7/ppp/ng_ppp.c:647
 none reproduced not_testable untriaged — —
DF-0553 Info 0.8 SIOCSETVLAN accepts reserved VLAN IDs (0 and 0xFFF) without validation
sys/net/vlan/if_vlan.c:996
 none reproduced not_testable untriaged — —
DF-0708 Low 0.5 Filter entries leaked on shutdown — hashtable not purged before kfree(privdata)
sys/netgraph7/etf/ng_etf.c:437
 dos reproduced fixed untriaged — —
DF-0339 Info 0.5 tcp_new_isn last_offset signed int overflow-wrap on churn (UB / monotonicity erosion)
sys/netinet/tcp_subr.c:1670
 none reproduced not_testable untriaged — —
DF-0398 Info 0.5 rt_setshims leaks previously allocated shims on partial allocation failure
sys/net/route.c:1374
 none reproduced not_testable untriaged — —
DF-0464 Info 0.5 bzero (not explicit_bzero) used to clear sensitive key material in heap structs: DSE risk
sys/net/wg/wg_noise.c:411
 none reproduced fixed untriaged — —
DF-0466 Info 0.5 Potentially unaligned 64-bit write constructing transport AEAD nonce
sys/net/wg/wg_noise.c:996
 none reproduced not_testable untriaged — —
DF-0647 Info 0.5 Module is dead code: cannot link because all engine symbols are defined only in non-compilable netflow.c
sys/netgraph7/netflow/ng_netflow.c:188
 none reproduced not_testable untriaged — —
DF-0711 Info 0.5 Build break: ADD_FILTER references undefined EVL_VLID_MASK macro — dead code not in any build
sys/netgraph7/ng_vlan.c:218
 none reproduced not_testable untriaged — —

Base system — drivers 417

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-1173 High 7.8 Multiple metadata parsers: OOB write on ar_softc.disks[] via unvalidated disk_number
sys/dev/disk/nata/ata-raid.c:1806
 corruption reproduced not_testable untriaged — —
DF-1122 High 7.6 iwn_rx_compressed_ba: unbounded firmware-supplied qid indexes sc->txq[] and sc->qid2tap[] (OOB array access / NULL deref)
sys/dev/netif/iwn/if_iwn.c:3251
 none not_reproduced not_testable untriaged — —
DF-1161 Medium 7.5 Unbounded els_cmd_ptrs[] index from IOC-supplied TransactionContext in FC ELS reply handler
sys/dev/disk/mpt/mpt_cam.c:2951
 panic reproduced not_testable untriaged — —
DF-1162 Medium 7.5 tgt_cmd_ptrs[rx_id] bounds check uses wrong limit in FC ABTS path
sys/dev/disk/mpt/mpt_cam.c:3004
 panic reproduced not_testable untriaged — —
DF-2175 High 7.1 hrtimer_start_range_ns corrupts per-CPU systimer queue by calling systimer_init_oneshot without prior systimer_del on an armed timer
sys/dev/drm/linux_hrtimer.c:115
 none not_reproduced not_testable untriaged — —
DF-1545 Medium 7.1 amdgpu atom WS operand index unbounded + NULL deref when ws=0
sys/dev/drm/amd/amdgpu/atom.c:222
 none inconclusive — untriaged — —
DF-1755 Medium 7.1 radeon_vce: integer overflow in create-message size calculation bypasses reloc buffer checks
sys/dev/drm/radeon/radeon_vce.c:602
 none inconclusive — untriaged — —
DF-2062 High 7.0 dm_table_busy exports only SHARED lock primitive; dm_table_load_ioctl races on inactive TAILQ -> kernel list corruption / wild-pointer write
sys/dev/disk/dm/dm_table.c:38
 panic reproduced not_testable untriaged — —
DF-1546 Medium 7.0 Unclamped csio->sense_len handed to firmware allows DMA overflow of the per-queue sense slot
sys/dev/disk/advansys/advansys.c:559
 none inconclusive — untriaged — —
DF-1979 Medium 7.0 queue_work broken lock protocol on multi-CPU bound workqueues enables cross-CPU STAILQ corruption and arbitrary code execution
sys/dev/drm/linux_workqueue.c:119
 none inconclusive — untriaged — —
DF-2532 High 6.8 xa_start panics in xa_done KKASSERT when a B_FAILONDIS bio fails with no live span
sys/dev/disk/xdisk/xdisk.c:976
 panic reproduced fixed untriaged — —
DF-1590 Medium 6.8 Firmware-supplied req_id used as heap index without bounds check in tws_intr_resp and tws_err_complete
sys/dev/raid/tws/tws_cam.c:1163
 none inconclusive — untriaged — —
DF-2518 Medium 6.8 OOB array access in sili_port_read_ncq_error via unchecked device-supplied NCQ tag
sys/dev/disk/sili/sili.c:2138
 none not_reproduced not_testable untriaged — —
DF-1242 Medium 6.6 mrsas_complete_cmd uses firmware-controlled SMID to index mpt_cmd_list with no bounds check
sys/dev/raid/mrsas/mrsas.c:1269
 none not_reproduced not_testable untriaged — —
DF-1655 Medium 6.6 radeon_uvd: integer overflow in radeon_uvd_cs_msg_decode bypasses buffer-size validation
sys/dev/drm/radeon/radeon_uvd.c:367
 panic reproduced fixed untriaged — —
DF-1315 High 6.5 Guest debug registers (DR7/DR0-3) persist in host after #VMEXIT enabling host kernel panic via injected HW breakpoint
sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c:1492
 none inconclusive not_testable untriaged — —
DF-2475 High 6.5 Wrong bitmask includes task-attribute bits in IU length causing ATIO queue consumer to skip 128-960 entries on any non-SIMPLE FCP_CMND (remote DoS)
sys/dev/disk/isp/isp_target.c:174
 none not_reproduced not_testable untriaged — —
DF-1126 Medium 6.5 Infinite loop in response queue processing when target mode consumes multiple entries
sys/dev/disk/isp/isp.c:5112
 dos reproduced not_testable untriaged — —
DF-1515 Medium 6.5 Kernel divide-by-zero via zero dst_height/dst_width in overlay PUT_IMAGE ioctl
sys/dev/drm/i915/intel_overlay.c:916
 none inconclusive — untriaged — —
DF-1312 Low 6.4 Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks
sys/dev/raid/hptiop/hptiop.c:336
 none reproduced not_testable untriaged — —
DF-2421 Medium 6.3 INQUIRY/READ_CAPACITY/page_inquiry dereference user-controlled data_ptr without CAM_DIR validation
sys/dev/disk/ahci/ahci_cam.c:1083
 — — — untriaged — —
DF-2427 Medium 6.3 Out-of-bounds array access in amd_Reselect when reselecting-ID byte decodes to no valid target
sys/dev/disk/amd/amd.c:1829
 — — — untriaged — —
DF-1262 Info 6.3 dsp_mmap (legacy d_mmap) performs unbounded vtophys() on user offset (dead code, latent critical)
sys/dev/sound/pcm/dsp.c:2287
 none reproduced not_testable untriaged — —
DF-1238 Medium 6.2 trm_Reselect walks circular DCB ring with no termination -> infinite loop / hard system hang
sys/dev/disk/trm/trm.c:2426
 none not_reproduced not_testable untriaged — —
DF-1377 Medium 6.2 btccbptov() performs no bounds validation on HBA-supplied ccb_addr yielding OOB kernel read/write
sys/dev/disk/buslogic/bt.c:104
 none inconclusive — untriaged — —
DF-1438 Medium 6.2 Divide-by-zero in sumo_calculate_bsp via BIOS-controlled high_clk=0
sys/dev/drm/radeon/sumo_dpm.c:323
 none inconclusive — untriaged — —
DF-1624 Medium 6.2 MSI-X fallback path passes rid=0 to pci_release_msix_vector, causing guaranteed kernel panic
sys/dev/virtual/virtio/pci/virtio_pci.c:494
 panic reproduced fixed untriaged — —
DF-2411 Medium 6.2 Divide-by-zero DoS in XPT_CALC_GEOMETRY via target-controlled block_size
sys/dev/disk/advansys/advansys.c:441
 none not_reproduced not_testable untriaged — —
DF-1456 Medium 6.1 Signed integer overflow in drm_mode_set_crtcinfo via unchecked vscan on user-supplied modes
sys/dev/drm/drm_modes.c:1102
 none inconclusive — untriaged — —
DF-1920 Medium 6.1 Cleanup loop reads uninitialized stack arrays when copyin fails partway through SGL loop
sys/dev/raid/mrsas/mrsas_ioctl.c:153
 none inconclusive — untriaged — —
DF-2181 Medium 6.1 wait_on_bit_timeout() timeout is permanently expired: absolute ticks compared against a relative jiffies count
sys/dev/drm/linux_wait.c:108
 dos reproduced fixed untriaged — —
DF-2161 Low 6.1 enable_irq ignores bus_setup_intr return value; disable_irq does not invalidate cookiep, inviting stale-cookie double-teardown
sys/dev/drm/linux_irq.c:159
 dos reproduced fixed untriaged — —
DF-1251 High 6.0 Unbounded BIOS table-walking loops read past rdev->bios and drive WREG32 with OOB garbage
sys/dev/drm/radeon/radeon_combios.c:291
 none not_reproduced not_testable untriaged — —
DF-1603 High 6.0 Divide-by-zero panic via attacker-controlled blk_size=0 in virtio-blk config space
sys/dev/virtual/virtio/block/virtio_blk.c:703
 panic reproduced not_testable untriaged — —
DF-1604 Medium 6.0 Divide-by-zero panic via attacker-controlled geometry (heads=0 or sectors=0) when cylinders==16383
sys/dev/virtual/virtio/block/virtio_blk.c:711
 panic reproduced fixed untriaged — —
DF-1212 Medium 5.8 OOB array access in FBSS saved-commands reissue loop (hardcoded 32 vs sc_ncmds)
sys/dev/disk/ahci/ahci.c:3972
 none inconclusive not_testable untriaged — —
DF-1159 Low 5.8 Unvalidated NIC descriptor index in RX mismatch recovery causes OOB kernel heap access
sys/dev/netif/bge/if_bge.c:3061
 panic reproduced fixed untriaged — —
DF-1756 Low 5.7 radeon_vce: unsigned underflow in firmware header scan when datasize < strlen(prefix)+9
sys/dev/drm/radeon/radeon_vce.c:60
 panic reproduced fixed untriaged — —
DF-1734 Medium 5.6 vinumio: remove_drive indexes drive[] with no bounds check; caller off-by-one > instead of >=
sys/dev/raid/vinum/vinumio.c:237
 none inconclusive — untriaged — —
DF-1739 Medium 5.6 vinumioctl: validdrive/validsd/validplex/validvol/resetstats accept negative indices -> OOB heap read/write via DRIVE[idx]/SD[idx]/PLEX[idx]/VOL[idx]
sys/dev/raid/vinum/vinumioctl.c:381
 none inconclusive — untriaged — —
DF-1639 High 5.5 NULL-deref kernel panic in dm_table_load_ioctl via missing/non-array cmd_data
sys/dev/disk/dm/dm_ioctl.c:707
 panic reproduced fixed untriaged — —
DF-1976 High 5.5 flush_workqueue hangs forever in uninterruptible tsleep (permanent kernel thread DoS)
sys/dev/drm/linux_workqueue.c:309
 none inconclusive — untriaged — —
DF-2163 High 5.5 tsleep while holding queue_lock deadlocks interrupt handler permanently hanging IPS controller
sys/dev/raid/ips/ips_ioctl.c:125
 none not_reproduced not_testable untriaged — —
DF-2164 High 5.5 get_user_pages() KKASSERT inverts td_proc polarity, panicking on every user-context call
sys/dev/drm/linux_shmem.c:137
 none not_reproduced not_testable untriaged — —
DF-2187 High 5.5 vunmap() unconditional SLIST_REMOVE/kfree on addr-not-found dereferences NULL and panics
sys/dev/drm/linux_vmalloc.c:77
 panic reproduced fixed untriaged — —
DF-2222 High 5.5 wait_for_completion_interruptible spins forever on signal (no break on ERESTART/EINTR) unkillable CPU-bound local DoS
sys/dev/drm/linux_completion.c:38
 none not_reproduced not_testable untriaged — —
DF-1143 Medium 5.5 Divide-by-zero in ci_thermal_setup_fan_table from VBIOS-controlled fan temperature deltas
sys/dev/drm/amd/amdgpu/ci_dpm.c:1094
 none not_reproduced not_testable untriaged — —
DF-1152 Medium 5.5 BUG_ON kernel panic in atomic_check via MST connector without dc_sink
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:5290
 none not_reproduced not_testable untriaged — —
DF-1174 Medium 5.5 Systemic divide-by-zero via zero width or interleave from crafted metadata
sys/dev/disk/nata/ata-raid.c:157
 panic reproduced not_testable untriaged — —
DF-1193 Medium 5.5 CISS_BIG_MAP_BUS divide-by-zero: drives_per_scsi_bus==0 from controller ID_CTLR panics the kernel
sys/dev/raid/ciss/ciss.c:4026
 none not_reproduced not_testable untriaged — —
DF-1245 Medium 5.5 Divide-by-zero DoS in evergreen_cs_track_validate_cb via user-controlled CB_COLOR_PITCH
sys/dev/drm/radeon/evergreen_cs.c:1396
 none inconclusive not_testable untriaged — —
DF-1260 Medium 5.5 AIOGCAP ioctl dereferences d->mixer_dev without NULL check, causing kernel panic
sys/dev/sound/pcm/dsp.c:1285
 none inconclusive not_testable untriaged — —
DF-1274 Medium 5.5 Divide-by-zero in SCLK/MCLK spread-spectrum math from VBIOS-controlled zero rates
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:591
 none inconclusive not_testable untriaged — —
DF-1323 Medium 5.5 Divide-by-zero panic in iceland_thermal_setup_fan_table from unchecked VBIOS fan temperatures
sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2122
 dos reproduced fixed untriaged — —
DF-1325 Medium 5.5 Divide-by-zero in fiji_thermal_setup_fan_table from unvalidated VBIOS fan temperature deltas
sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:2171
 dos reproduced fixed untriaged — —
DF-1334 Medium 5.5 Kernel divide-by-zero panics from VBIOS-supplied zero clock/spread-spectrum/voltage divisors
sys/dev/drm/radeon/rv770_dpm.c:548
 dos reproduced fixed untriaged — —
DF-1341 Medium 5.5 Unsigned underflow of nlevels in r600_texture_size causes local DoS (multi-minute kernel spin)
sys/dev/drm/radeon/r600_cs.c:1418
 dos reproduced fixed untriaged — —
DF-1393 Medium 5.5 Off-by-one in seq_fetch_mid yields NULL kobj dereference (local kernel panic via 0666 device)
sys/dev/sound/midi/sequencer.c:724
 none inconclusive — untriaged — —
DF-1431 Medium 5.5 Divide-by-zero in radeon_compute_pll_avivo via sub-10 kHz mode clock
sys/dev/drm/radeon/radeon_display.c:959
 none inconclusive — untriaged — —
DF-1433 Medium 5.5 NULL pointer dereference in radeon_wb_init on GPU resume/reset (kernel panic)
sys/dev/drm/radeon/radeon_device.c:454
 none inconclusive — untriaged — —
DF-1453 Medium 5.5 NULL pointer dereference in radeon_legacy_tv_dac_mode_set via unguarded enc_priv
sys/dev/drm/radeon/radeon_legacy_encoders.c:1159
 none inconclusive — untriaged — —
DF-1471 Medium 5.5 NULL deref DoS in init_overdrive_limits and cac_dtp_table allocation path
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1062
 none inconclusive — untriaged — —
DF-1495 Medium 5.5 qlock leak in midi_read/midi_write/midisynth_writeraw blocks device permanently (local DoS)
sys/dev/sound/midi/midi.c:762
 none inconclusive — untriaged — —
DF-1509 Medium 5.5 Unbounded multicast CAM index in bfe_set_rx_mode enables local NIC hang DoS
sys/dev/netif/bfe/if_bfe.c:844
 none inconclusive — untriaged — —
DF-1555 Medium 5.5 Memory leak of drm_pending_vblank_event on out-fence error path in complete_signaling()
sys/dev/drm/drm_atomic_uapi.c:1083
 none inconclusive — untriaged — —
DF-1575 Medium 5.5 NULL pointer dereference in get_pcie_table/get_gpio_table when vdd_dep_on_sclk is NULL
sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:522
 none inconclusive — untriaged — —
DF-1587 Medium 5.5 NULL pointer dereference in get_pcie_table when usGfxclkDependencyTableOffset is zero
sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:765
 none inconclusive — untriaged — —
DF-1593 Medium 5.5 rv515_debugfs_ga_info issues destructive GPU reset on every read of world-readable debugfs file
sys/dev/drm/radeon/rv515.c:259
 none inconclusive — untriaged — —
DF-1595 Medium 5.5 Divide-by-zero in UVD decode message parser crashes the kernel
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524
 none inconclusive — untriaged — —
DF-1599 Medium 5.5 32-bit truncation of last_pfn bypasses VM offset bounds check and panics the kernel via BUG_ON
sys/dev/drm/radeon/radeon_vm.c:446
 panic reproduced fixed untriaged — —
DF-1611 Medium 5.5 Divide-by-zero in hubp1_cursor_set_position when pixel_clk_khz == 0
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:1117
 panic reproduced fixed untriaged — —
DF-1612 Medium 5.5 Divide-by-zero in hubp1_vready_workaround when pipe_dest->htotal == 0
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:123
 panic reproduced fixed untriaged — —
DF-1615 Medium 5.5 Unmatched crit_exit() in twe_suspend corrupts critical-section accounting and panics INVARIANTS kernels
sys/dev/raid/twe/twe_freebsd.c:494
 panic reproduced fixed untriaged — —
DF-1616 Medium 5.5 Divide-by-zero panic in ath_beacon_proc when ic->ic_lintval is 0
sys/dev/netif/ath/ath/if_ath_beacon.c:481
 panic reproduced fixed untriaged — —
DF-1635 Medium 5.5 NULL pointer dereference via strsep-parsed cipher spec components
sys/dev/disk/dm/crypt/dm_target_crypt.c:470
 panic reproduced fixed untriaged — —
DF-1648 Medium 5.5 Divide-by-zero panic from crafted EDID with min_vfreq == 0 in mod_freesync_build_vrr_params
sys/dev/drm/amd/display/modules/freesync/freesync.c:93
 panic reproduced fixed untriaged — —
DF-1658 Medium 5.5 nvmm: mach->commvmobj creation reference never dropped -> kernel memory leak / local DoS
sys/dev/virtual/nvmm/nvmm.c:197
 panic reproduced fixed untriaged — —
DF-1666 Medium 5.5 drm_syncobj: unprivileged fd+struct file leak via broken LinuxKPI fd shim -> system-wide ENFILE DoS
sys/dev/drm/drm_syncobj.c:407
 panic reproduced fixed untriaged — —
DF-1708 Medium 5.5 radeon_clocks: divide-by-zero in calc_eng_mem_clock via zeroed reference_freq from crafted VBIOS
sys/dev/drm/radeon/radeon_clocks.c:371
 none inconclusive — untriaged — —
DF-1717 Medium 5.5 amdgpu_display: GEM object reference leak on imported dma-buf framebuffer creation path (local memory-exhaustion DoS)
sys/dev/drm/amd/amdgpu/amdgpu_display.c:531
 none inconclusive — untriaged — —
DF-1724 Medium 5.5 radeon_cs: unchecked IB chunk length_dw in non-VM path triggers BUG_ON kernel panic
sys/dev/drm/radeon/radeon_cs.c:608
 none inconclusive — untriaged — —
DF-1726 Medium 5.5 radeon_cs: NULL parser->ib.fence dereference in radeon_cs_parser_fini when CS has relocs but no IB chunk
sys/dev/drm/radeon/radeon_cs.c:414
 none inconclusive — untriaged — —
DF-1775 Medium 5.5 mpt_user: kernel panic via len==0 kmalloc(0) returns ZERO_LENGTH_PTR -> page fault in copyin/hdr deref
sys/dev/disk/mpt/mpt_user.c:186
 none inconclusive — untriaged — —
DF-1855 Medium 5.5 Unbounded busy-wait in psp_cmd_submit_buf hangs kernel thread on PSP submission failure or non-response
sys/dev/drm/amd/amdgpu/amdgpu_psp.c:130
 none inconclusive — untriaged — —
DF-1907 Medium 5.5 acp_poweron dereferences powerplay.pp_funcs without NULL guard: kernel panic
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:145
 none inconclusive — untriaged — —
DF-1921 Medium 5.5 Early-return error paths leak mfi cmds and DMA resources: cmd-pool exhaustion DoS
sys/dev/raid/mrsas/mrsas_ioctl.c:193
 none inconclusive — untriaged — —
DF-1932 Medium 5.5 kfree(NULL) kernel panic on any PCI attach failure path
sys/dev/raid/aac/aac_pci.c:358
 none inconclusive — untriaged — —
DF-1957 Medium 5.5 Divide-by-zero in clip_scaled when destination rectangle has zero width or height
sys/dev/drm/drm_rect.c:53
 none inconclusive — untriaged — —
DF-1987 Medium 5.5 BUG_ON panic on oversize SA allocation request converts user-triggerable error into kernel panic (Local DoS)
sys/dev/drm/radeon/radeon_sa.c:321
 none inconclusive not_testable untriaged — —
DF-2003 Medium 5.5 Unbounded busy-wait polling in SMIC allows permanent kernel thread hang / CPU DoS
sys/dev/misc/ipmi/ipmi_smic.c:53
 none inconclusive not_testable untriaged — —
DF-2069 Medium 5.5 Divide-by-zero kernel panic via crafted IDENTIFY in CHS path of tf_write
sys/dev/disk/nata/chipsets/ata-serverworks.c:216
 panic reproduced fixed untriaged — —
DF-2124 Medium 5.5 Unconditional NULL-pointer dereference in drm_mmap d_mmap handler panics before the auth check
sys/dev/drm/drm_vm.c:47
 panic reproduced fixed untriaged — —
DF-2127 Medium 5.5 Inverted skip condition + dead curoff in sg_pcopy_from_buffer / sg_pcopy_to_buffer break data extraction (GuC firmware loading DoS)
sys/dev/drm/linux_scatterlist.c:167
 corruption reproduced fixed untriaged — —
DF-2186 Medium 5.5 sn_pccard_detach re-enters the ifnet serializer instead of exiting it -- guaranteed panic on every device detach
sys/dev/netif/sn/if_sn_pccard.c:115
 panic reproduced fixed untriaged — —
DF-2386 Medium 5.5 Unchecked AcpiEvaluateObject return causes NULL-pointer-dereference panic reachable from unprivileged user via CTLFLAG_ANYBODY sysctl
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:276
 — — — untriaged — —
DF-2420 Medium 5.5 NULL pointer dereference of xa when ahci_ata_get_xfer() returns NULL
sys/dev/disk/ahci/ahci_cam.c:1082
 — — — untriaged — —
DF-2426 Medium 5.5 Divide-by-zero panic via XPT_CALC_GEOMETRY with block_size == 0
sys/dev/disk/amd/amd.c:683
 — — — untriaged — —
DF-2429 Medium 5.5 Divide-by-zero in XPT_CALC_GEOMETRY from unvalidated block_size (local DoS / panic)
sys/dev/disk/buslogic/bt.c:1157
 — — — untriaged — —
DF-2432 Medium 5.5 Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0
sys/dev/disk/ccd/ccd.c:1319
 panic reproduced fixed untriaged — —
DF-2442 Medium 5.5 KKASSERT kernel panic in dm_dev_insert on concurrent dm_dev_create name collision
sys/dev/disk/dm/dm_dev.c:187
 panic reproduced fixed untriaged — —
DF-2448 Medium 5.5 dm_table_load_ioctl: NULL-pointer-dereference panic via missing cmd_data array
sys/dev/disk/dm/dm_ioctl.c:707
 panic reproduced fixed untriaged — —
DF-2450 Medium 5.5 NULL-deref kernel panic when dm backing path resolves to a non-device vnode
sys/dev/disk/dm/dm_pdev.c:69
 panic reproduced fixed untriaged — —
DF-2452 Medium 5.5 NULL-deref kernel panic via mismatched feature_count in _init_features
sys/dev/disk/dm/flakey/dm_target_flakey.c:131
 panic reproduced fixed untriaged — —
DF-2479 Medium 5.5 Divide-by-zero in mmcsd_delete via attacker-controlled CSD erase-sector size
sys/dev/disk/mmcsd/mmcsd.c:407
 none not_reproduced not_testable untriaged — —
DF-2489 Medium 5.5 Divide-by-zero kernel panic from zero geometry in ad_attach/ad_describe
sys/dev/disk/nata/ata-disk.c:147
 — — — untriaged — —
DF-2496 Medium 5.5 Kernel divide-by-zero panics from crafted RAID geometry (width/interleave/total_sectors == 0)
sys/dev/disk/nata/ata-raid.c:1028
 — — — untriaged — —
DF-2504 Medium 5.5 CDRIOCSETBLOCKSIZE accepts block_size=0 -> divide-by-zero kernel panic
sys/dev/disk/nata/atapi-cd.c:723
 — — — untriaged — —
DF-2512 Medium 5.5 Admin request leak on failed Identify NS exhausts pool and panics kernel
sys/dev/disk/nvme/nvme_admin.c:624
 none not_reproduced not_testable untriaged — —
DF-2514 Medium 5.5 Divide-by-zero kernel panic in XPT_CALC_GEOMETRY from block_size > 1MB
sys/dev/disk/sbp/sbp.c:2384
 none not_reproduced not_testable untriaged — —
DF-1170 Low 5.5 Divide-by-zero in smu7_get_profiling_clk when golden MCLK value is zero
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2737
 panic reproduced fixed untriaged — —
DF-1485 Low 5.5 NULL-pointer dereference when find_idle_secondary_pipe exhausts idle pipes
sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1151
 panic reproduced fixed untriaged — —
DF-1508 Low 5.5 kqfilter detach dereferences NULL dev->si_drv1 after close frees state
sys/dev/misc/vkbd/vkbd.c:311
 panic reproduced fixed untriaged — —
DF-1548 Low 5.5 Divide-by-zero panic in XPT_CALC_GEOMETRY when block_size > 1 MiB
sys/dev/disk/advansys/advansys.c:441
 panic reproduced fixed untriaged — —
DF-1582 Low 5.5 mfi_tbolt_get_cmd NULL-derefs when Thunderbolt command pool is empty
sys/dev/raid/mfi/mfi_tbolt.c:784
 panic reproduced fixed untriaged — —
DF-1840 Low 5.5 NULL-deref panic in amr_cam_complete when an INQUIRY CCB carries no data buffer
sys/dev/raid/amr/amr_cam.c:557
 none reproduced not_testable untriaged — —
DF-1973 Low 5.5 KKASSERT in mlphy_service panics INVARIANTS kernels on every autoneg tick
sys/dev/netif/mii_layer/mlphy.c:220
 none reproduced not_testable untriaged — —
DF-2067 Low 5.5 Unclamped si_iosize_max on syspd allows oversized bio to permanently stall controller
sys/dev/raid/mfi/mfi_syspd.c:135
 dos reproduced not_testable untriaged — —
DF-2160 Low 5.5 NULL-deref kernel panic in disable_irq/enable_irq when irq is not (or no longer) registered
sys/dev/drm/linux_irq.c:150
 panic reproduced fixed untriaged — —
DF-2390 Low 5.5 Boot-time kernel panic from inconsistent DPF handling between resource counter and link_add_crs
sys/dev/acpica/acpi_pci_link.c:180
 — — — untriaged — —
DF-2478 Low 5.5 Unbounded md device auto-creation on open allows kernel memory exhaustion (DoS) by operator-group users
sys/dev/disk/md/md.c:135
 — — — untriaged — —
DF-2501 Low 5.5 XPT_RESET_DEV dereferences softc->atadev[tid] with no NULL or bounds check
sys/dev/disk/nata/atapi-cam.c:428
 — — — untriaged — —
DF-1158 Medium 5.3 wpi_notif_intr RX index mask 0xfff wider than WPI_RX_RING_COUNT=64 can cause infinite softirq loop
sys/dev/netif/wpi/if_wpi.c:2208
 dos reproduced not_testable untriaged — —
DF-1371 Medium 5.3 oce_rx/oce_discard_rx_comp loop past empty RQ ring on firmware-misreported fragment count, NULL-deref panic
sys/dev/netif/oce/oce_if.c:1274
 none inconclusive — untriaged — —
DF-2533 Medium 5.3 xa_close leaks xdisk_lk and releases wrong lock on raced-destruction defensive paths
sys/dev/disk/xdisk/xdisk.c:767
 — — — untriaged — —
DF-1472 Low 5.3 get_clock_voltage_limit reads entries[0] without numEntries check; off-by-one in get_state_entry_v2
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:432
 none reproduced fixed untriaged — —
DF-1572 Low 5.3 DMSG_DBG_SHELL reply handler logs attacker-controlled string to console without rate limiting
sys/dev/disk/xdisk/xdisk.c:592
 dos reproduced fixed untriaged — —
DF-2471 Low 5.3 Missing channel bounds check on card-reported channel in SCSI async event handler
sys/dev/disk/isp/isp.c:5438
 — — — untriaged — —
DF-1617 Info 5.3 No local guard against intval==0 in ath_beacon_config STA timer math
sys/dev/netif/ath/ath/if_ath_beacon.c:988
 none reproduced not_testable untriaged — —
DF-1874 Medium 5.2 Signed int32 (daddr_t) overflow in block/offset math corrupts data.data pointer for >1 TiB SDXC cards
sys/dev/disk/mmcsd/mmcsd.c:338
 none inconclusive — untriaged — —
DF-1386 Medium 5.1 Divide-by-zero panic in cypress_calculate_burst_time when memory_clock<=1
sys/dev/drm/radeon/cypress_dpm.c:907
 none inconclusive — untriaged — —
DF-1802 Medium 5.1 snp: SNPSTTY with NOUDEV drops snp_token before snp_down/snp_detach -> ASSERT_LWKT_TOKEN_HELD panic or unlocked race
sys/dev/misc/snp/snp.c:540
 none inconclusive — untriaged — —
DF-1978 Medium 5.1 queue_delayed_work silently ignores caller workqueue always runs on system_wq breaking ordered/highpri semantics
sys/dev/drm/linux_workqueue.c:151
 none inconclusive — untriaged — —
DF-2523 Medium 5.1 trm_Reselect spins forever (no exit) if reselected target/LUN does not match any DCB - interrupt-context DoS
sys/dev/disk/trm/trm.c:2427
 — — — untriaged — —
DF-2524 Medium 5.1 trm_Disconnect dereferences pDCB->pActiveSRB without NULL check kernel panic on spurious disconnect (acknowledged in source)
sys/dev/disk/trm/trm.c:2354
 — — — untriaged — —
DF-1387 Low 5.1 Divide-by-zero in cypress_populate_mclk_value when VBIOS ss.rate==0
sys/dev/drm/radeon/cypress_dpm.c:553
 none reproduced fixed untriaged — —
DF-1488 Low 5.1 Uninitialized stack read of prefetchable[] in cbb_cardbus_auto_open programs bridge prefetch bits with stack garbage
sys/dev/pccard/pccbb/pccbb.c:1005
 none reproduced fixed untriaged — —
DF-1738 Low 5.1 ata-lowlevel: divide-by-zero panic in ata_tf_write CHS path from device-supplied zero geometry
sys/dev/disk/nata/ata-lowlevel.c:771
 panic reproduced fixed untriaged — —
DF-1455 Info 5.1 Unvalidated completion context and ring log2 sizes from hypervisor-controlled shared DMA memory
sys/dev/virtual/vmware/pvscsi/pvscsi.c:899
 none reproduced not_testable untriaged — —
DF-2165 High 4.7 shem_read_mapping_page() leaks VM_OBJECT_LOCK and hold_count on every error path
sys/dev/drm/linux_shmem.c:52
 none not_reproduced not_testable untriaged — —
DF-2166 High 4.7 pagecache_write_begin() stores shmem ERR_PTR in *pagep and returns success, causing kmap panic
sys/dev/drm/linux_shmem.c:102
 none not_reproduced not_testable untriaged — —
DF-1137 Medium 4.7 Kernel divide-by-zero in si_thermal_setup_fan_table from unvalidated VBIOS fan temp deltas
sys/dev/drm/radeon/si_dpm.c:6057
 dos reproduced fixed untriaged — —
DF-1151 Medium 4.7 Divide-by-zero DoS in ci_thermal_setup_fan_table from unvalidated VBIOS fan temperatures
sys/dev/drm/radeon/ci_dpm.c:1018
 none not_reproduced not_testable untriaged — —
DF-1297 Medium 4.7 Divide-by-zero in ci_thermal_setup_fan_table from unvalidated VBIOS temperature deltas
sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2159
 panic reproduced fixed untriaged — —
DF-1354 Medium 4.7 Integer underflow in mclk_latency loop in vega12_apply_clocks_adjust_rules (count-1 wraps when count==0)
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1973
 panic reproduced fixed untriaged — —
DF-1527 Medium 4.7 i915_request_skip reads uninitialized rq->postfix, causing ring-buffer memset with stale slab offset
sys/dev/drm/i915/i915_request.c:1019
 none inconclusive — untriaged — —
DF-1619 Medium 4.7 NULL-pointer dereference panic in mrsas_get_mpt_cmd when command pool is empty
sys/dev/raid/mrsas/mrsas_cam.c:580
 panic reproduced fixed untriaged — —
DF-1650 Medium 4.7 rs780_dpm: divide-by-zero in rs780_program_at via drm_mode_vrefresh()==0
sys/dev/drm/radeon/rs780_dpm.c:66
 panic reproduced fixed untriaged — —
DF-1695 Medium 4.7 atapi-cam: XPT_RESET_DEV dereferences atadev[tid] without NULL check or state_lock
sys/dev/disk/nata/atapi-cam.c:428
 panic reproduced fixed untriaged — —
DF-1834 Medium 4.7 NULL pointer deref in drm_sched_job_timedout first loop (missing parent check)
sys/dev/drm/scheduler/sched_main.c:259
 none inconclusive — untriaged — —
DF-1949 Medium 4.7 ASSERT-only divide-by-zero guard in fixed-point division panics kernel in production builds
sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43
 none inconclusive — untriaged — —
DF-1974 Medium 4.7 NULL pointer dereference in radeon_dig_monitor_is_duallink when encoder has no linked connector
sys/dev/drm/radeon/radeon_encoders.c:368
 none inconclusive — untriaged — —
DF-1985 Medium 4.7 u32 to uint16 truncation of pitch into fb_info.stride enables syscons mmap SIZE_MAX bound-check bypass (kernel memory read primitive)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:261
 none inconclusive — untriaged — —
DF-2037 Medium 4.7 Divide-by-zero kernel panic in amdgpu_pll_compute when target_clock or post_div is zero
sys/dev/drm/amd/amdgpu/amdgpu_pll.c:88
 panic reproduced fixed untriaged — —
DF-2038 Medium 4.7 dc_create_stream_for_sink: unchecked NULL from dc_create_transfer_func() dereferenced in construct() -> kernel panic
sys/dev/drm/amd/display/dc/core/dc_stream.c:58
 panic reproduced fixed untriaged — —
DF-2066 Medium 4.7 mfi_syspd_strategy leaks bio on controller fault/reset permanently wedging I/O
sys/dev/raid/mfi/mfi_syspd.c:249
 dos reproduced not_testable untriaged — —
DF-2076 Medium 4.7 drm_bufs_info NULL-pointer write when M_NULLOK kmalloc fails (local panic)
sys/dev/drm/drm_sysctl.c:226
 dos reproduced fixed untriaged — —
DF-2103 Medium 4.7 Daemon work queue (daemonq/dqend) and intqp pool guarded only by crit_enter/exit (per-CPU interrupt deferral not MP lock); cross-CPU races lose/leak requests and lose wakeups stalling daemon (local DoS)
sys/dev/raid/vinum/vinumdaemon.c:88
 corruption reproduced fixed untriaged — —
DF-2136 Medium 4.7 Reservation ww_mutex lock leak when reservation_object_reserve_shared fails in ttm_eu_reserve_buffers
sys/dev/drm/ttm/ttm_execbuf_util.c:131
 none reproduced fixed untriaged — —
DF-2182 Medium 4.7 wait_on_bit_timeout() lost-wakeup / indefinite hang: missing tsleep_interlock() before condition re-check
sys/dev/drm/linux_wait.c:111
 dos reproduced fixed untriaged — —
DF-2210 Medium 4.7 Unconditional NULL dereference of ch->dma in ata_national_setmode panics kernel when DMA unavailable
sys/dev/disk/nata/chipsets/ata-national.c:77
 — — — untriaged — —
DF-2423 Medium 4.7 NULL-pointer dereference in ahci_pm_read/ahci_pm_write when CCB pool is exhausted
sys/dev/disk/ahci/ahci_pm.c:976
 — — — untriaged — —
DF-2509 Medium 4.7 ast_reinit frees softc/NULLs ivars; ast_detach then NULL-derefs (same class as DF-2507 never fixed here)
sys/dev/disk/nata/atapi-tape.c:202
 none not_reproduced not_testable untriaged — —
DF-1206 Low 4.7 alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure
sys/dev/netif/alc/if_alc.c:1361
 none reproduced fixed untriaged — —
DF-1226 Low 4.7 Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_calc_wrpll_link)
sys/dev/drm/i915/intel_ddi.c:1298
 none reproduced fixed untriaged — —
DF-1267 Low 4.7 NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cmdline_mode fails under OOM
sys/dev/drm/drm_fb_helper.c:2176
 none reproduced fixed untriaged — —
DF-1301 Low 4.7 Display scaling math divides by stream/plane rect dimensions with no zero guard (kernel #DE panic)
sys/dev/drm/amd/display/dc/core/dc_resource.c:635
 none reproduced fixed untriaged — —
DF-1302 Low 4.7 Unguarded integer divides by timing fields in modeset commit path allow kernel panic
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:1621
 none reproduced fixed untriaged — —
DF-1318 Low 4.7 NULL cam_path dereference in sbp_target_reset iterating all LUNs
sys/dev/disk/sbp/sbp.c:2098
 none reproduced fixed untriaged — —
DF-1322 Low 4.7 NULL-pointer dereference at attach when Envy24 subsystem unknown and EEPROM absent
sys/dev/sound/pci/envy24.c:2409
 none reproduced fixed untriaged — —
DF-1343 Low 4.7 OOM in radeon_add_atom_connector turns into NULL-deref panic via drm_connector_cleanup on uninitialized connector
sys/dev/drm/radeon/radeon_connectors.c:2343
 none reproduced fixed untriaged — —
DF-1376 Low 4.7 Unguarded divide-by-zero in spread-spectrum step_size when pll reference clock is zero
sys/dev/drm/radeon/atombios_crtc.c:1129
 none reproduced fixed untriaged — —
DF-1419 Low 4.7 NULL deref in smu8_construct_max_power_limits_table when VBIOS omits SCLK dependency table
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:259
 none reproduced fixed untriaged — —
DF-1440 Low 4.7 NULL ddc_bus dereference in amdgpu_connector_get_edid for connectors with failed I2C bus init
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:296
 none reproduced fixed untriaged — —
DF-1441 Low 4.7 drm_connector_cleanup on never-initialized connector in amdgpu_connector_add error path
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1902
 none reproduced fixed untriaged — —
DF-1444 Low 4.7 Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth)
sys/dev/disk/ahci/ahci_cam.c:1082
 none reproduced fixed untriaged — —
DF-1465 Low 4.7 dpt_intr exits entire ISR on one bogus status packet (return should be continue)
sys/dev/raid/dpt/dpt_scsi.c:1518
 none reproduced fixed untriaged — —
DF-1479 Low 4.7 my_start ignores my_encap failure: leaks dequeued mbuf and NULL-derefs BPF_MTAP under memory pressure
sys/dev/netif/my/if_my.c:1290
 panic reproduced fixed untriaged — —
DF-1583 Low 4.7 mfi_tbolt_alloc_cmd leaks lock and NULL-derefs sc->mfi_cmd_pool_tbolt on kmalloc failure
sys/dev/raid/mfi/mfi_tbolt.c:455
 panic reproduced fixed untriaged — —
DF-1613 Low 4.7 Unbounded pitch underflow in hubp1_program_size can hang the GPU
sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:167
 dos reproduced fixed untriaged — —
DF-1623 Low 4.7 NULL-pointer dereference in atmel_reset_device when cmdprocobj (T6) object is absent
sys/dev/smbus/atmel_mxt/atmel_mxt.c:418
 panic reproduced fixed untriaged — —
DF-1628 Low 4.7 Missing error-handling goto after opps[j] NULL check leaves NULL OPP pointer in pool, enabling later NULL-deref DoS
sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1065
 panic reproduced fixed untriaged — —
DF-1644 Low 4.7 IOCATAREQUEST accepts count==0, passing ZERO_LENGTH_PTR as DMA target
sys/dev/disk/nata/ata-all.c:462
 panic reproduced fixed untriaged — —
DF-1647 Low 4.7 bre() plex_concat NULL dereference when plex has zero subdisks (local DoS panic)
sys/dev/raid/vinum/vinumrequest.c:491
 panic reproduced fixed untriaged — —
DF-1659 Low 4.7 ahci_pm: NULL deref in ahci_pm_read/ahci_pm_write when CCB pool exhausted
sys/dev/disk/ahci/ahci_pm.c:841
 panic reproduced fixed untriaged — —
DF-1723 Low 4.7 ath_edma_tx: unvalidated hardware-supplied ts_queue_id used to index sc->sc_txq[]
sys/dev/netif/ath/ath/if_ath_tx_edma.c:681
 panic reproduced fixed untriaged — —
DF-1787 Low 4.7 ast_reinit frees softc before ata_reinit calls ast_done/ast_detach -> NULL-deref panic on hot-unplug/reset
sys/dev/disk/nata/atapi-tape.c:210
 panic reproduced fixed untriaged — —
DF-1799 Low 4.7 smu_helper: latent infinite loop in phm_get_voltage_index and smu_get_voltage_dependency_table_ppt_v1 (uint8_t i vs uint32_t count)
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:388
 panic reproduced fixed untriaged — —
DF-1800 Low 4.7 smu_helper: phm_get_lowest_enabled_level infinite-loops when mask==0
sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:520
 panic reproduced fixed untriaged — —
DF-1832 Low 4.7 NULL-pointer deref of intel_connector->encoder in HPD storm re-enable and poll-init workers
sys/dev/drm/i915/intel_hotplug.c:233
 none reproduced not_testable untriaged — —
DF-1856 Low 4.7 Unchecked kzalloc failure in i915 MST fake-encoder init leads to NULL-deref panic on hub plug-in
sys/dev/drm/i915/intel_dp_mst.c:541
 panic reproduced fixed untriaged — —
DF-1908 Low 4.7 get_mfd_cell_dev calls dev_info on possibly-NULL device: NULL-deref on lookup failure
sys/dev/drm/amd/amdgpu/amdgpu_acp.c:165
 panic reproduced fixed untriaged — —
DF-1929 Low 4.7 NULL-pointer dereference in acpi_battery_find_dev when battery devclass is absent
sys/dev/acpica/acpi_battery.c:349
 panic reproduced fixed untriaged — —
DF-1934 Low 4.7 NULL-deref panic in dce4_hdmi_set_color_depth when radeon_get_connector_for_encoder returns NULL
sys/dev/drm/radeon/evergreen_hdmi.c:342
 panic reproduced fixed untriaged — —
DF-1939 Low 4.7 NULL-deref in siba_bwn_read_ivar SIBA_IVAR_PCICORE_REVID when hardware lacks detected PCI/PCIE core
sys/dev/netif/bwn/siba/siba_bwn.c:450
 panic reproduced fixed untriaged — —
DF-1967 Low 4.7 NULL pointer dereference in dm_dp_add_mst_connector on fake-MST encoder allocation failure
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:346
 none reproduced not_testable untriaged — —
DF-1983 Low 4.7 Latent kfree() on embedded drm_framebuffer in amdgpufb_create error path (slab-corruption landmine)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:255
 none reproduced not_testable untriaged — —
DF-2001 Low 4.7 NULL-pointer write in icintr if i2c peer delivers data before SIOCSIFFLAGS allocates the receive buffer
sys/dev/netif/ic/if_ic.c:127
 none reproduced not_testable untriaged — —
DF-2036 Low 4.7 Unguarded divide by pp_table->FanMaximumRpm in vega20_fan_ctrl_get_fan_speed_percent
sys/dev/drm/amd/powerplay/hwmgr/vega20_thermal.c:117
 panic reproduced fixed untriaged — —
DF-2168 Low 4.7 NULL-deref in dal_irq_service_set/ack when info->funcs is NULL on uninitialized table slots
sys/dev/drm/amd/display/dc/irq/irq_service.c:118
 panic reproduced fixed untriaged — —
DF-2208 Low 4.7 Missing NULL checks on kzalloc/kasprintf returns in drm_sysfs_connector_add cause NULL-deref panic under OOM
sys/dev/drm/drm_sysfs.c:39
 — — — untriaged — —
DF-2470 Low 4.7 Infinite loop in response-queue pointer update when target mode advances the output index
sys/dev/disk/isp/isp.c:5113
 — — — untriaged — —
DF-1681 Info 4.7 cs4281: unguarded divide in cs4281_rate_to_rv would panic if rate==0 reaches the driver
sys/dev/sound/pci/cs4281.c:209
 panic reproduced fixed untriaged — —
DF-1729 Info 4.7 ttm_bo_vm: NULL deref panic in iomem fault path when fictitious page lookup misses
sys/dev/drm/ttm/ttm_bo_vm.c:665
 panic reproduced fixed untriaged — —
DF-1279 Medium 4.6 Divide-by-zero panic if malicious IOC reports RequestFrameSize == 0
sys/dev/disk/mpt/mpt.c:2654
 none inconclusive not_testable untriaged — —
DF-1463 Medium 4.6 Divide-by-zero panic in XPT_CALC_GEOMETRY from block_size==0
sys/dev/raid/dpt/dpt_scsi.c:1025
 none inconclusive — untriaged — —
DF-1923 Medium 4.6 Detach loop indexes mem_res[] by slot position rather than slot->num: NULL-deref panic + resource leak after partial slot-init failure
sys/dev/disk/sdhci/sdhci_pci.c:350
 none inconclusive — untriaged — —
DF-1940 Medium 4.6 Divide-by-zero in ata_intel_31244_tf_write via crafted IDENTIFY CHS geometry (heads=0 or sectors=0)
sys/dev/disk/nata/chipsets/ata-intel.c:471
 none inconclusive — untriaged — —
DF-1966 Medium 4.6 NULL pointer dereference in dm_dp_mst_get_modes via unchecked dc_link_add_remote_sink return
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:237
 none inconclusive — untriaged — —
DF-2415 Medium 4.6 Divide-by-zero panic in XPT_CALC_GEOMETRY from device-controlled block_size
sys/dev/disk/advansys/adwcam.c:734
 none not_reproduced not_testable untriaged — —
DF-2491 Medium 4.6 Divide-by-zero panic in CHS-mode ata_tf_write from device-controlled geometry
sys/dev/disk/nata/ata-lowlevel.c:771
 — — — untriaged — —
DF-1549 Low 4.6 OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels
sys/dev/drm/amd/display/dc/dce110/dce110_resource.c:1146
 panic reproduced fixed untriaged — —
DF-1568 Low 4.6 OOB stack read in bw_calcs_data_update_from_pplib when powerplay returns zero clock levels (sibling of DF-1549)
sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1005
 panic reproduced fixed untriaged — —
DF-1777 Low 4.6 radeon_dp_mst: missing NULL check on create_fake_mst_encoder return -> NULL deref on best_encoder callback
sys/dev/drm/radeon/radeon_dp_mst.c:230
 panic reproduced fixed untriaged — —
DF-1812 Low 4.6 nvme_admin: unvalidated NVMe namespace LBA sect_size causes divide-by-zero panic at attach
sys/dev/disk/nvme/nvme_admin.c:673
 none reproduced not_testable untriaged — —
DF-1813 Low 4.6 nvme_admin: admin request leak on IDENTIFY NAMESPACE failure leads to KKASSERT panic via admin-queue exhaustion
sys/dev/disk/nvme/nvme_admin.c:624
 none reproduced not_testable untriaged — —
DF-1903 Low 4.6 nvme_pci_detach dereferences NULL bus handle on BAR(0)-mapping-failure error path: kernel panic
sys/dev/disk/nvme/nvme_attach.c:122
 panic reproduced fixed untriaged — —
DF-2480 Low 4.5 daddr_t (int32) truncation of block address for >1TB MMC/SD media
sys/dev/disk/mmcsd/mmcsd.c:326
 — — — untriaged — —
DF-1204 Medium 4.4 Divide-by-zero in spread spectrum clock calculation via ss.rate == 0
sys/dev/drm/radeon/ni_dpm.c:2044
 none not_reproduced not_testable untriaged — —
DF-1310 Medium 4.4 Signed RX-length overflow in non-mergeable mode leads to NULL-deref panic from crafted device response
sys/dev/virtual/virtio/net/if_vtnet.c:1702
 panic reproduced fixed untriaged — —
DF-1596 Medium 4.4 UVD destroy message lacks filp ownership check (cross-user session kill)
sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:781
 panic reproduced fixed untriaged — —
DF-1678 Medium 4.4 drm_close dereferences ERR_PTR from drm_minor_acquire on device unregister -> kernel panic
sys/dev/drm/drm_file.c:373
 panic reproduced fixed untriaged — —
DF-1682 Medium 4.4 hptmv: unchecked divide by (bArnMember-1) in hpt_rebuild_data_block -> kernel panic (local DoS)
sys/dev/raid/hptmv/ioctl.c:461
 panic reproduced fixed untriaged — —
DF-1801 Medium 4.4 snp: NULL-deref panic when read/kqfilter issued on unattached /dev/snpN device
sys/dev/misc/snp/snp.c:263
 none inconclusive — untriaged — —
DF-1965 Medium 4.4 Unconditional _objcache_destroy in MOD_UNLOAD leaves module obj_cache NULL while still in use
sys/dev/disk/dm/delay/dm_target_delay.c:440
 none inconclusive — untriaged — —
DF-2100 Medium 4.4 intel_vgt_deballoon calls drm_mm_remove_node on unallocated balloon slots, dereferencing NULL mm
sys/dev/drm/i915/i915_vgpu.c:119
 dos reproduced fixed untriaged — —
DF-2183 Medium 4.4 NULL-pointer dereference in backlight_register: make_dev() return value never assigned to sc->cdev
sys/dev/misc/backlight/backlight.c:116
 panic reproduced fixed untriaged — —
DF-1169 Low 4.4 Integer underflow sends 0xFFFFFFFF PCIe DPM level to SMC firmware
sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4382
 none reproduced fixed untriaged — —
DF-1288 Low 4.4 NULL-pointer dereference in mly_user_command error path when command pool exhausted
sys/dev/raid/mly/mly.c:2883
 none reproduced not_testable untriaged — —
DF-1429 Low 4.4 NULL-deref panic in twe_report_request: device_printf(td_disk) when td_disk is NULL
sys/dev/raid/twe/twe.c:1862
 none reproduced fixed untriaged — —
DF-1493 Low 4.4 Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0
sys/dev/disk/ccd/ccd.c:1319
 panic reproduced fixed untriaged — —
DF-1505 Low 4.4 Missing NULL check on dev->si_drv1 in genkbdkqfilter and genkbdfiltdetach (kernel panic on detached kbd)
sys/dev/misc/kbd/kbd.c:839
 panic reproduced fixed untriaged — —
DF-1618 Low 4.4 Integer underflow in dce120_timing_generator_validate_timing defeats the v_blank lower-bound check
sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:107
 panic reproduced fixed untriaged — —
DF-1668 Low 4.4 vmbus: NULL deref in vmbus_msghc_wakeup on host-injected spurious VERSION_RESP
sys/dev/virtual/hyperv/vmbus/vmbus.c:613
 panic reproduced fixed untriaged — —
DF-1807 Low 4.4 amdgpu_fence: power-of-two check accepts 0 -> kcalloc(0) returns ZERO_LENGTH_PTR -> NULL deref panic on first emit
sys/dev/drm/amd/amdgpu/amdgpu_fence.c:424
 panic reproduced fixed untriaged — —
DF-1822 Low 4.4 aac_cam: kernel panic via CAM_SCATTER_VALID flag on pass-through (local DoS)
sys/dev/raid/aac/aac_cam.c:456
 none reproduced not_testable untriaged — —
DF-1853 Low 4.4 NULL-pointer dereference of gIal_Adapter in hptmv ioctl path panics kernel when no adapter attached
sys/dev/raid/hptmv/hptproc.c:309
 panic reproduced fixed untriaged — —
DF-1902 Low 4.4 Host-root triggerable kernel panic via IFM_ETH_MASTER on non-1000baseT media
sys/dev/netif/mii_layer/mii_physubr.c:372
 panic reproduced fixed untriaged — —
DF-1935 Low 4.4 CTLFLAG_ANYBODY on writable brightness/mute sysctls allows unprivileged local writes (variant of DF-1892)
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:167
 none reproduced fixed untriaged — —
DF-2048 Low 4.4 NULL-pointer dereference in TBRIDGE_GETRESULT dereferences tbridge_curtest without NULL check
sys/dev/misc/tbridge/tbridge.c:266
 panic reproduced fixed untriaged — —
DF-2057 Low 4.4 NULL pointer dereference via unvalidated backing-device vnode type in dm_pdev_insert
sys/dev/disk/dm/dm_pdev.c:168
 panic reproduced fixed untriaged — —
DF-2098 Low 4.4 GPIO index unvalidated in 4/5 ar5416 HAL exported functions (HALASSERT compiled out) -> UB shifts -> local DoS
sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:90
 dos reproduced fixed untriaged — —
DF-2212 Low 4.4 ttm_exit() deadlocks forever in uninterruptible wait_event on condition that can never become true
sys/dev/drm/ttm/ttm_module.c:40
 — — — untriaged — —
DF-2392 Low 4.4 Missing zero-validation on machdep.acpi_timer_freq sysctl causes divide-by-zero kernel panic
sys/dev/acpica/acpi_timer.c:310
 — — — untriaged — —
DF-2437 Low 4.4 Module-unload handler destroys shared objcache even when dm_target_remove fails EBUSY causing NULL-deref panic on subsequent I/O
sys/dev/disk/dm/delay/dm_target_delay.c:440
 panic reproduced fixed untriaged — —
DF-2439 Low 4.4 FREEBLKS bio falls through delay target switch and is dispatched to underlying pdev without offset translation
sys/dev/disk/dm/delay/dm_target_delay.c:213
 — — — untriaged — —
DF-2455 Low 4.4 FD_STYPE accepts unvalidated fd_type enabling divide-by-zero panics and shift UB
sys/dev/disk/fd/fd.c:2325
 none not_reproduced not_testable untriaged — —
DF-2483 Low 4.4 mpt_pci_attach returns success on every failure path causing NULL-deref / linked-list corruption on detach
sys/dev/disk/mpt/mpt_pci.c:576
 none not_reproduced not_testable untriaged — —
DF-2540 Low 4.4 Signed integer overflow in amdsb_watchdog() timeout calc programs watchdog count=0 -> deterministic reboot
sys/dev/misc/amdsbwd/amdsbwd.c:217
 none not_reproduced not_testable untriaged — —
DF-2590 Low 4.4 Unchecked AcpiEvaluateObject return in acpi_panasonic_hkey_event causes NULL-deref panic
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:403
 — — — untriaged — —
DF-1788 Info 4.4 acpi_fujitsu: CTLFLAG_ANYBODY sysctls forward unbounded user ints into ACPI control methods
sys/dev/acpica/acpi_fujitsu/acpi_fujitsu.c:415
 none reproduced fixed untriaged — —
DF-1132 Low 4.3 NULL deref / panic in bwn_dma_parse_cookie on unexpected TX-status cookie
sys/dev/netif/bwn/bwn/if_bwn.c:7065
 panic reproduced fixed untriaged — —
DF-1448 Low 4.3 24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID leaks FCP exchange
sys/dev/disk/isp/isp_target.c:187
 none reproduced not_testable untriaged — —
DF-1344 Low 4.2 NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS740 floating-bus nulls ddc_bus but leaves shared_ddc=true)
sys/dev/drm/radeon/radeon_connectors.c:1340
 none reproduced not_testable untriaged — —
DF-1345 Medium 4.1 Divide-by-zero in polaris10_thermal_setup_fan_table from VBIOS-controlled fan temperature points
sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:2048
 dos reproduced fixed untriaged — —
DF-1392 Medium 4.1 Divide-by-zero panic when VBIOS supplies zero SCLK or zero spread-spectrum rate
sys/dev/drm/radeon/rv6xx_dpm.c:411
 none inconclusive — untriaged — —
DF-1497 Medium 4.1 Missing NULL check on voltage_object in atomctrl_get_svi2_info dereferences lookup result
sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1444
 none inconclusive — untriaged — —
DF-1511 Medium 4.1 TOCTOU NULL-pointer dereference of handler in vga_switcheroo_force_migd causes kernel panic
sys/dev/video/vga/vga_switcheroo.c:1231
 none inconclusive — untriaged — —
DF-1821 Medium 4.1 vinumraid5: missing plex->subdisks bounds check enables division-by-zero panic via config-race
sys/dev/raid/vinum/vinumraid5.c:142
 none inconclusive — untriaged — —
DF-2481 Medium 4.1 Divide-by-zero kernel panic via unchecked IOCFACTS RequestFrameSize
sys/dev/disk/mpt/mpt.c:2683
 none not_reproduced not_testable untriaged — —
DF-1129 Low 4.1 Divide-by-zero in si_thermal_setup_fan_table from unvalidated BIOS fan-table temperatures
sys/dev/drm/amd/amdgpu/si_dpm.c:6489
 panic reproduced fixed untriaged — —
DF-1331 Low 4.1 NULL pointer dereference in attach error path when cfg is unset
sys/dev/sound/pci/envy24ht.c:2519
 none reproduced fixed untriaged — —
DF-1426 Low 4.1 Divide-by-zero in iir_init from HBA-supplied mapping fields with zero heads or secs
sys/dev/raid/iir/iir.c:413
 none reproduced fixed untriaged — —
DF-1428 Low 4.1 NULL-deref panic in twe_describe_controller: p[0] from twe_get_param not checked
sys/dev/raid/twe/twe.c:1691
 none reproduced fixed untriaged — —
DF-1550 Low 4.1 NULL pointer dereference of tdp_table from VBIOS PowerPlay table missing usPowerTuneTableOffset
sys/dev/drm/amd/powerplay/hwmgr/vega10_powertune.c:1294
 panic reproduced fixed untriaged — —
DF-1610 Low 4.1 NULL pointer dereference of cac_dtp_table when VBIOS omits usPowerTuneTableOffset (sibling of DF-1550)
sys/dev/drm/amd/powerplay/hwmgr/smu7_powertune.c:1120
 panic reproduced fixed untriaged — —
DF-1653 Low 4.1 sbsh: unbounded spin loop in issue_cx28975_cmd hangs the kernel
sys/dev/netif/sbsh/if_sbsh.c:1042
 dos reproduced fixed untriaged — —
DF-1663 Low 4.1 ttm_page_alloc: fini races vm_lowmem shrinker on static_buf and _manager lifetime
sys/dev/drm/ttm/ttm_page_alloc.c:388
 panic reproduced fixed untriaged — —
DF-1731 Low 4.1 tws_attach arms IRQ and publishes /dev/tws<unit> before sc->reqs allocated -> NULL-deref panic
sys/dev/raid/tws/tws.c:268
 panic reproduced fixed untriaged — —
DF-1735 Low 4.1 vinumio: divide-by-zero panic in set_drive_parms when device reports media_blksize==0
sys/dev/raid/vinum/vinumio.c:119
 panic reproduced fixed untriaged — —
DF-1770 Low 4.1 intel_dsi_vbt: NULL-deref on dsi_hosts[port] in mipi_exec_send_packet
sys/dev/drm/i915/intel_dsi_vbt.c:127
 panic reproduced fixed untriaged — —
DF-1773 Low 4.1 intel_dsi_vbt: NULL-deref on vbt.lfp_lvds_vbt_mode in intel_dsi_vbt_init
sys/dev/drm/i915/intel_dsi_vbt.c:508
 panic reproduced fixed untriaged — —
DF-1785 Low 4.1 radeon_bios: kmalloc-NULL-deref ordering in radeon_acpi_vfct_bios - memcpy before NULL check
sys/dev/drm/radeon/radeon_bios.c:717
 panic reproduced fixed untriaged — —
DF-1865 Low 4.1 Unbounded KCS reply-collection loop hangs kthread on hostile/buggy BMC
sys/dev/misc/ipmi/ipmi_kcs.c:410
 dos reproduced fixed untriaged — —
DF-1866 Low 4.1 ipmi_kcs_probe_align has unbounded polling loops (boot-time DoS)
sys/dev/misc/ipmi/ipmi_kcs.c:527
 dos reproduced fixed untriaged — —
DF-1879 Low 4.1 Missing pipe_bpp!=0 guard in vlv_dsi_get_pclk causes kernel divide-by-zero panic
sys/dev/drm/i915/vlv_dsi_pll.c:325
 panic reproduced fixed untriaged — —
DF-1886 Low 4.1 parityrebuild divides by plex->stripesize and plex->subdisks with no zero guard: div0 panic
sys/dev/raid/vinum/vinumrevive.c:116
 panic reproduced fixed untriaged — —
DF-1937 Low 4.1 Divide-by-zero in spread-spectrum clock math when ATOM BIOS supplies ss.rate==0
sys/dev/drm/radeon/rv730_dpm.c:97
 panic reproduced fixed untriaged — —
DF-1942 Low 4.1 Integer overflow in r600_copy_dma size_in_dw: silent short/zero-length GPU copy with successful fence (latent on R600, live on rv770/evergreen siblings)
sys/dev/drm/radeon/r600_dma.c:457
 panic reproduced fixed untriaged — —
DF-1992 Low 4.1 Divide-by-zero kernel panic via unvalidated VBIOS clock/spread-spectrum divisors in rv740_populate_sclk_value / rv740_populate_mclk_value
sys/dev/drm/radeon/rv740_dpm.c:145
 none reproduced not_testable untriaged — —
DF-2044 Low 4.1 mps_pci_free releases never-allocated IRQ resource panicking kernel on attach-failure paths
sys/dev/raid/mps/mps_pci.c:230
 panic reproduced fixed untriaged — —
DF-2137 Low 4.1 NULL-deref panic via device_get_softc(devclass_get_device(...)) in sc_get_softc and sc_find_softc
sys/dev/misc/syscons/syscons_nexus.c:117
 panic reproduced fixed untriaged — —
DF-2138 Low 4.1 Missing u<0 guard in sc_get_cons_priority allows negative unit to reach sccninit and NULL-deref
sys/dev/misc/syscons/syscons_nexus.c:162
 none reproduced fixed untriaged — —
DF-2377 Low 4.1 Missing cst_cx_count==0 guard causes OOB heap read in set_lowest_oncpu and NULL-deref panic in idle
sys/dev/acpica/acpi_cpu_cstate.c:504
 — — — untriaged — —
DF-2378 Low 4.1 HT-sibling C-state copy in acpi_cst_cx_probe_cst writes another CPU live softc without synchronization
sys/dev/acpica/acpi_cpu_cstate.c:621
 — — — untriaged — —
DF-2408 Low 4.1 tpm_legacy_read unconditionally writes through a NULL count pointer panicking on every multi-chunk read of a legacy TPM
sys/dev/crypto/tpm/tpm.c:1092
 — — — untriaged — —
DF-2477 Low 4.1 md_drvcleanup module-unload path has refcnt TOCTOU that frees md_s out from under a racing mdopen
sys/dev/disk/md/md.c:133
 — — — untriaged — —
DF-2591 Low 4.1 Missing serial lock in acpi_panasonic_shutdown triggers KKASSERT panic on INVARIANTS kernels
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:231
 — — — untriaged — —
DF-1995 Low 4.0 ar5210Attach error path leaks HAL_EEPROM_v1 sub-allocation (missing ath_hal_eepromDetach)
sys/dev/netif/ath/ath_hal/ar5210/ar5210_attach.c:288
 none reproduced not_testable untriaged — —
DF-2508 Low 4.0 u32 integer overflow in afd_sense capabilities-path mediasize calculation
sys/dev/disk/nata/atapi-fd.c:409
 — — — untriaged — —
DF-1791 Low 3.9 puc: NULL-deref kernel panic in puc_config_superio when BAR 0 fails to allocate
sys/dev/misc/puc/puc.c:273
 panic reproduced fixed untriaged — —
DF-1924 Low 3.9 Unbounded hardware spin in tws_init_ctlr hangs kernel at device attach
sys/dev/raid/tws/tws_hdm.c:100
 dos reproduced fixed untriaged — —
DF-1925 Low 3.9 Unbounded hardware spin in tws_ctlr_reset stage-1 hangs kernel during recovery
sys/dev/raid/tws/tws_hdm.c:473
 dos reproduced fixed untriaged — —
DF-1943 Low 3.9 r600_copy_dma under-reserves ring dwords: sync semaphore+fence can overflow reserved count corrupting GPU command stream
sys/dev/drm/radeon/r600_dma.c:459
 panic reproduced fixed untriaged — —
DF-1945 Low 3.8 afd_describe divides by attacker-controlled sectorsize=0: kernel panic at attach (bootverbose only)
sys/dev/disk/nata/atapi-fd.c:383
 panic reproduced fixed untriaged — —
DF-2406 Info 3.7 No RDRAND online health tests (NIST SP 800-90B repetition / adaptive-proportion)
sys/dev/crypto/rdrand/rdrand.c:159
 — — — untriaged — —
DF-1225 Low 3.6 Use of uninitialized stack variable n_entries when icl_get_combo_buf_trans hits default branch
sys/dev/drm/i915/intel_ddi.c:890
 none reproduced fixed untriaged — —
DF-1277 Low 3.6 sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors
sys/dev/netif/sk/if_sk.c:2712
 none reproduced fixed untriaged — —
DF-1757 Low 3.6 radeon_vce: TOCTOU in destroy-session cleanup clears handles reallocated to different filp
sys/dev/drm/radeon/radeon_vce.c:519
 none reproduced fixed untriaged — —
DF-1811 Low 3.6 cardbus_cis: UB in decode_tuple_bar 1<<(ffs(0)-1) when masked BAR probe value is zero
sys/dev/pccard/cardbus/cardbus_cis.c:360
 none reproduced not_testable untriaged — —
DF-1899 Low 3.6 UB left shift 1<<vmid in amdgpu_amdkfd_is_kfd_vmid lets out-of-range VMIDs pass KFD guard (latent: CONFIG_HSA_AMD not defined)
sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:514
 panic reproduced fixed untriaged — —
DF-2018 Low 3.6 drm_is_current_master returns stale is_master flag instead of comparing master pointers, defeating DRM_MASTER privilege revocation
sys/dev/drm/drm_auth.c:333
 none reproduced not_testable untriaged — —
DF-2090 Low 3.6 Unsigned underflow in max_payload_size-1 bypasses HW buffer chunking when HW buffer is empty (dead code today)
sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96
 none reproduced fixed untriaged — —
DF-2513 Low 3.6 Unvalidated device-controlled shift in namespace block-size computation
sys/dev/disk/nvme/nvme_admin.c:673
 — — — untriaged — —
DF-1382 Low 3.4 SIOCSIFMTU sets if_mtu even when MTU exceeds VGE_JUMBO_MTU
sys/dev/netif/vge/if_vge.c:2005
 none reproduced fixed untriaged — —
DF-1405 Low 3.4 cuse_alloc_unit[] global arrays mutated under per-server lock instead of cuse_global_mtx
sys/dev/misc/cuse/cuse.c:181
 none reproduced not_testable untriaged — —
DF-1741 Low 3.4 vinumioctl: VINUM_RESETCONFIG case missing break falls through into VINUM_SETSTATE
sys/dev/raid/vinum/vinumioctl.c:214
 none reproduced fixed untriaged — —
DF-2017 Low 3.4 drm_setmaster_ioctl: disabled dev->master exclusivity check leaks master refcount and silently steals mastership
sys/dev/drm/drm_auth.c:190
 none reproduced not_testable untriaged — —
DF-1652 Info 3.4 sbsh: SIOCLOADFIRMW EBUSY guard is dead code (error clobbered by copyin)
sys/dev/netif/sbsh/if_sbsh.c:405
 none reproduced fixed untriaged — —
DF-1982 Medium 3.3 GEM object refcount leak on amdgpufb_create error path (VRAM buffer permanently leaked)
sys/dev/drm/amd/amdgpu/amdgpu_fb.c:308
 none inconclusive — untriaged — —
DF-1118 Low 3.3 Integer overflow in skl_wm_method1/skl_wm_method2 watermark calculation via downscale-adjusted pixel rate
sys/dev/drm/i915/intel_pm.c:4487
 panic reproduced fixed untriaged — —
DF-1233 Low 3.3 aac_close_aif orphans fibctx list when removing head, leaking every subsequent context permanently
sys/dev/raid/aac/aac.c:3488
 none reproduced fixed untriaged — —
DF-1273 Low 3.3 Stale index used as voltage lookup key in CAC table population (functional correctness)
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:423
 none reproduced fixed untriaged — —
DF-1324 Low 3.3 Wrong loop bound in iceland_populate_smc_mvdd_table uses VddciLevelCount instead of MvddLevelCount
sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:675
 none reproduced fixed untriaged — —
DF-1363 Low 3.3 MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
sys/dev/raid/mps/mps_user.c:765
 none reproduced not_testable untriaged — —
DF-1443 Low 3.3 ATA PASS-16 passthrough drops lba_high_exp (copy-paste bug assigns lba_mid_exp twice)
sys/dev/disk/ahci/ahci_cam.c:1319
 none reproduced fixed untriaged — —
DF-1507 Low 3.3 O_NONBLOCK never honored in vkbd read/write (uses wrong flag constant)
sys/dev/misc/vkbd/vkbd.c:347
 panic reproduced fixed untriaged — —
DF-1605 Low 3.3 NULL-pointer dereference in vtblk_strategy: sc dereferenced before the NULL check
sys/dev/virtual/virtio/block/virtio_blk.c:527
 panic reproduced fixed untriaged — —
DF-1720 Low 3.3 amdgpu_gem: amdgpu_gem_object_open ignores amdgpu_vm_bo_add OOM failure, returns success without bo_va
sys/dev/drm/amd/amdgpu/amdgpu_gem.c:143
 none reproduced fixed untriaged — —
DF-1728 Low 3.3 ttm_bo_vm: BO kref leak on each mmap of already-mapped BO (kernel memory exhaustion DoS)
sys/dev/drm/ttm/ttm_bo_vm.c:420
 dos reproduced fixed untriaged — —
DF-1748 Low 3.3 radeon_gem: integer overflow in radeon_mode_dumb_create size (pitch*height wraps u32)
sys/dev/drm/radeon/radeon_gem.c:764
 panic reproduced fixed untriaged — —
DF-1867 Low 3.3 kcs_start_write uses 1-second busy DELAY inside 10x retry loop: CPU pin for ~minutes per ioctl
sys/dev/misc/ipmi/ipmi_kcs.c:182
 dos reproduced fixed untriaged — —
DF-1969 Low 3.3 GEM object reference leaked on radeonfb_create error path
sys/dev/drm/radeon/radeon_fb.c:322
 none reproduced not_testable untriaged — —
DF-2064 Low 3.3 32-bit integer overflow/underflow bypasses firmware truncation size check
sys/dev/drm/i915/intel_uc_fw.c:83
 none reproduced not_testable untriaged — —
DF-2070 Low 3.3 Incorrect 48-bit LBA reconstruction in tf_read corrupts read-back sector address
sys/dev/disk/nata/chipsets/ata-serverworks.c:179
 dos reproduced fixed untriaged — —
DF-2149 Low 3.3 pps_open is a boolean flag not a reference count; any close tears down the bus/interrupt for all openers
sys/dev/misc/pps/pps.c:118
 dos reproduced fixed untriaged — —
DF-2216 Low 3.3 dmi_match() leaks kgetenv() buffer on every code path
sys/dev/drm/linux_dmi.c:44
 — — — untriaged — —
DF-2434 Low 3.3 ii_index terminator allocation leaked on every CCDIOCSET/CCDIOCCLR cycle (ileave>0)
sys/dev/disk/ccd/ccd.c:629
 — — — untriaged — —
DF-2519 Low 3.3 ATA PASS-THROUGH 16 drops LBA high extension byte (copy-paste defect)
sys/dev/disk/sili/sili_cam.c:1217
 — — — untriaged — —
DF-1698 Info 3.3 mps_sas_lsi: PhysDisk OFFLINE branch uses |= instead of &= ~ to clear RAID_COMPONENT flag, locking disk out of OS permanently
sys/dev/raid/mps/mps_sas_lsi.c:481
 none reproduced fixed untriaged — —
DF-2043 Info 3.3 i915_gem_dmabuf_mmap is a no-op stub that silently misreports success
sys/dev/drm/i915/i915_gem_dmabuf.c:149
 none reproduced fixed untriaged — —
DF-1229 Low 3.0 Untrusted diag BufferType used as fw_diag_buffer_list[3] index (OOB write into mpr_softc)
sys/dev/raid/mpr/mpr.c:2388
 none reproduced fixed untriaged — —
DF-1412 Low 3.0 bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset
sys/dev/drm/i915/intel_panel.c:1674
 none reproduced not_testable untriaged — —
DF-1462 Low 3.0 ATA_PASS_16 FIS lba_high_exp never set due to copy-paste duplication of lba_mid_exp assignment
sys/dev/disk/sili/sili_cam.c:1217
 none reproduced fixed untriaged — —
DF-1956 Low 3.0 Inverted loop condition in psp_v10_0_compare_sram_data bypasses SRAM integrity check
sys/dev/drm/amd/amdgpu/psp_v10_0.c:433
 panic reproduced fixed untriaged — —
DF-2077 Low 3.0 sizespec silently wraps on attacker-controlled length strings (integer overflow + signed-multiplier corruption)
sys/dev/raid/vinum/vinumutil.c:197
 none reproduced fixed untriaged — —
DF-2085 Low 3.0 Operator-precedence error in agp_sis_set_aperture misprograms WINCTRL to 512M and invokes signed-shift UB
sys/dev/agp/agp_sis.c:215
 none reproduced fixed untriaged — —
DF-2527 Low 3.0 vniocattach_file missing positive vn_size check -> signed integer overflow and bogus disk geometry
sys/dev/disk/vn/vn.c:559
 — — — untriaged — —
DF-1147 Info 3.0 EEPROM read timeout detection broken by loop/check bound mismatch
sys/dev/netif/bnx/if_bnx.c:438
 none reproduced not_testable untriaged — —
DF-1202 Info 3.0 scmmap under-bounds offset when framebuffer height*stride is 0 or overflows int
sys/dev/misc/syscons/syscons.c:4089
 none reproduced not_testable untriaged — —
DF-1261 Low 2.5 dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race)
sys/dev/sound/pcm/dsp.c:2370
 none reproduced fixed untriaged — —
DF-1276 Low 2.5 DMA map cleanup loops use wrong array index [i] instead of [j], leaking all created maps
sys/dev/netif/sk/if_sk.c:3120
 none reproduced fixed untriaged — —
DF-1570 Low 2.5 xa_close returns holding xdisk_lk and releases the wrong lock on race paths
sys/dev/disk/xdisk/xdisk.c:767
 dos reproduced fixed untriaged — —
DF-1675 Low 2.5 ar5416_ani: ar5416AniControl OOB array index via untrusted maxLevel (DF-1660 variant)
sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:230
 panic reproduced fixed untriaged — —
DF-1864 Low 2.5 Missing braces in drm_sched_entity_init loop silently drops -ENOMEM, leaving partially-initialized sched entities
sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:174
 panic reproduced fixed untriaged — —
DF-1980 Low 2.5 _create_workqueue_common error path leaks wq->workers array and orphans already-scheduled worker threads
sys/dev/drm/linux_workqueue.c:229
 none reproduced not_testable untriaged — —
DF-2040 Low 2.5 Truncation of mem->num_pages (unsigned long) to unsigned in VRAM-visible accounting and free paths
sys/dev/drm/amd/amdgpu/amdgpu_vram_mgr.c:112
 panic reproduced fixed untriaged — —
DF-1489 Info 2.5 NULL dereference inside warning branch of cbb_cardbus_auto_open (rman_get_start(NULL))
sys/dev/pccard/pccbb/pccbb.c:1028
 none reproduced fixed untriaged — —
DF-2134 Info 2.5 dma_buf_fd silently ignores O_CLOEXEC -- fd leaks across exec()
sys/dev/drm/linux_dma-buf.c:150
 none reproduced fixed untriaged — —
DF-2176 Info 2.5 Missing NULL-buf guard in write-path memcpy diverges from amdgpu fix
sys/dev/drm/radeon/atombios_i2c.c:61
 panic reproduced fixed untriaged — —
DF-2218 Info 2.5 Missing NULL check on nvme_get_admin_request return potential kernel NULL-deref panic
sys/dev/disk/nvme/nvme_ioctl.c:49
 — — — untriaged — —
DF-2451 Info 2.5 Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert
sys/dev/disk/dm/dm_pdev.c:106
 — — — untriaged — —
DF-1778 Low 2.4 radeon_dp_mst: unbounded goto-loop in check_status enables HPD workqueue DoS via malicious hub
sys/dev/drm/radeon/radeon_dp_mst.c:716
 dos reproduced fixed untriaged — —
DF-1446 Low 2.3 DSI host and device allocations leaked on init error path and encoder teardown
sys/dev/drm/i915/vlv_dsi.c:1655
 none reproduced not_testable untriaged — —
DF-1714 Low 2.3 evdev: client memory and lock leak in evdev_open error paths
sys/dev/misc/evdev/cdev.c:117
 dos reproduced fixed untriaged — —
DF-1745 Low 2.3 mpt_pci: DMA tag leak in mpt_dma_mem_alloc error paths
sys/dev/disk/mpt/mpt_pci.c:718
 none reproduced fixed untriaged — —
DF-1890 Low 2.3 Signed integer overflow in amdsb_watchdog period conversion, enabled by 100x-wrong period_max
sys/dev/misc/amdsbwd/amdsbwd.c:217
 panic reproduced fixed untriaged — —
DF-1990 Low 2.3 TPM locality not relinquished on four error paths in tpmcrb_transmit
sys/dev/crypto/tpm/tpm_crb.c:328
 none reproduced not_testable untriaged — —
DF-1991 Low 2.3 Non-interruptible polling in tpm_wait_for_u32 holds dev_lock for up to 40 seconds
sys/dev/crypto/tpm/tpm_crb.c:246
 none reproduced not_testable untriaged — —
DF-2050 Low 2.3 tsleep timeout computed as hz * user-controlled int32 can overflow or go negative
sys/dev/misc/tbridge/tbridge.c:274
 dos reproduced fixed untriaged — —
DF-2112 Low 2.3 Memory leak in led_attach error path when gpio_map fails
sys/dev/misc/gpio/gpio_led.c:190
 none reproduced fixed untriaged — —
DF-2120 Low 2.3 Wrong object unreserved on destination-BO pin failure (lock imbalance)
sys/dev/drm/amd/amdgpu/amdgpu_benchmark.c:114
 none reproduced fixed untriaged — —
DF-2404 Low 2.3 Memory leak of sc->sc_rng_co callout array on driver detach
sys/dev/crypto/rdrand/rdrand.c:126
 — — — untriaged — —
DF-1293 Info 2.3 Unbounded rx_cons from hardware return descriptor used to index fixed-size rxdesc[256] array
sys/dev/netif/age/if_age.c:1997
 none reproduced not_testable untriaged — —
DF-1427 Info 2.3 Broken sense-data copy in iir_intr GDT_GCF_IOCTL: duplicate data copy instead of sense copy
sys/dev/raid/iir/iir.c:1621
 none reproduced not_testable untriaged — —
DF-1743 Info 2.3 vinumioctl: resetstats() switch falls through drive_object->sd_object; reply->error uninitialized on no-match
sys/dev/raid/vinum/vinumioctl.c:427
 none reproduced fixed untriaged — —
DF-2400 Info 2.3 agp_mmap off-by-one allows mapping one physical page past the AGP aperture BAR
sys/dev/agp/agp.c:860
 — — — untriaged — —
DF-1752 Low 2.1 ata-queue: ata_fail_requests leaks controller serialization lock when failing running request
sys/dev/disk/nata/ata-queue.c:577
 dos reproduced fixed untriaged — —
DF-2173 Low 2.1 I/O resources leaked on ata_attach() failure in ata_pccard_attach()
sys/dev/disk/nata/ata-card.c:125
 none reproduced fixed untriaged — —
DF-1972 Info 2.0 u32 to uint16 truncation of pitch into fb_info enables syscons mmap SIZE_MAX underflow
sys/dev/drm/radeon/radeon_fb.c:271
 panic reproduced fixed untriaged — —
DF-1355 Low 1.9 Inverted assertion in vega12_display_configuration_changed_task (functional bug)
sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:2112
 none reproduced fixed untriaged — —
DF-1421 Low 1.9 firmware_get() reference never released on attach-failure or detach (refcount leak)
sys/dev/disk/isp/isp_pci.c:856
 none reproduced not_testable untriaged — —
DF-1705 Low 1.9 virtio_balloon: inverted bounds KASSERT in vtballoon_update_stat disables defense-in-depth check
sys/dev/virtual/virtio/balloon/virtio_balloon.c:474
 panic reproduced fixed untriaged — —
DF-1706 Low 1.9 virtio_balloon: vtballoon_update_stats called from kthread without the serializer it requires
sys/dev/virtual/virtio/balloon/virtio_balloon.c:551
 panic reproduced fixed untriaged — —
DF-1707 Low 1.9 virtio_balloon: vtballoon_detach deadlocks if balloon thread waiting on host or balloon inflated
sys/dev/virtual/virtio/balloon/virtio_balloon.c:379
 dos reproduced fixed untriaged — —
DF-1794 Low 1.9 tw_osl_cam: CAM completion-status fallback is dead code - unhandled CL error codes complete CCB with status 0 (CAM_REQ_INPROG)
sys/dev/raid/twa/tw_osl_cam.c:731
 none reproduced fixed untriaged — —
DF-1846 Low 1.9 gpio_map leaks pin_mapped on partial-failure of the loop, permanently locking out pins
sys/dev/misc/gpio/gpio.c:211
 dos reproduced fixed untriaged — —
DF-1996 Low 1.9 Off-by-one in amdgpu_gfx_kiq_acquire loop invokes test_bit / bit_to_queue with bit = -1 (undefined shift)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:211
 none reproduced not_testable untriaged — —
DF-2022 Low 1.9 Unbounded non-interruptible ACK-poll loop in xgpu_ai_mailbox_trans_msg wedges unkillable kernel thread
sys/dev/drm/amd/amdgpu/mxgpu_ai.c:128
 none reproduced not_testable untriaged — —
DF-2058 Low 1.9 Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART fails at pdev insert time
sys/dev/disk/dm/dm_pdev.c:107
 panic reproduced fixed untriaged — —
DF-2063 Low 1.9 Unchecked adv_attach() return leaks all device resources and leaves interrupt handler active on half-initialized softc
sys/dev/disk/advansys/adv_pci.c:289
 none reproduced not_testable untriaged — —
DF-2197 Low 1.9 kthread_park() returns the wrong value (ts->kt_exitvalue instead of a success code)
sys/dev/drm/linux_kthread.c:103
 none reproduced fixed untriaged — —
DF-2224 Low 1.9 seq_printf forwards __va_list into ksnprintf variadic parameter instead of using kvsnprintf
sys/dev/drm/linux_printf.c:37
 — — — untriaged — —
DF-2438 Low 1.9 Signed integer overflow in delay tick computation produces negative/erratic delays for large user-supplied millisecond values
sys/dev/disk/dm/delay/dm_target_delay.c:140
 — — — untriaged — —
DF-1350 Info 1.9 XPT_CALC_GEOMETRY divides by block_size with no zero check
sys/dev/disk/amd/amd.c:683
 none reproduced fixed untriaged — —
DF-1450 Info 1.9 Missing return after ASSERT_CRITICAL(false) in dc_link_set_drive_settings allows NULL deref fall-through
sys/dev/drm/amd/display/dc/core/dc.c:429
 none reproduced not_testable untriaged — —
DF-1627 Info 1.9 UB: 1<<session_idx executed before no-session guard when session_idx==-1
sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812
 none reproduced not_testable untriaged — —
DF-1630 Info 1.9 KKASSERT bounds checks on pl_links indexing are no-ops in production kernels
sys/dev/acpica/acpi_pci_link.c:235
 none reproduced not_testable untriaged — —
DF-1671 Info 1.9 if_vke: LOW_POW_2(0) undefined shift when nmbclusters < NetifNum*2
sys/dev/virtual/vkernel/net/if_vke.c:89
 panic reproduced fixed untriaged — —
DF-1751 Info 1.9 amdgpu_acpi: wrong allocator - AcpiOsFree(M_ACPICA) on kzalloc(M_DRM) atif memory
sys/dev/drm/amd/amdgpu/amdgpu_acpi.c:755
 panic reproduced fixed untriaged — —
DF-1836 Info 1.9 nsclpcsio unconditional TMS/VLM init writes to 8237A DMA controller when logical devices are disabled
sys/dev/misc/nsclpcsio/nsclpcsio_isa.c:344
 none reproduced not_testable untriaged — —
DF-1847 Info 1.9 pin_mapped/pin_opened protected by two independent locks: mutual-exclusion race
sys/dev/misc/gpio/gpio.c:196
 none reproduced not_testable untriaged — —
DF-1859 Info 1.9 UB shift 1<<biBitCount in splash_bmp ncols computation (folded into DF-1857 fix)
sys/dev/video/fb/bmp/splash_bmp.c:538
 none reproduced fixed untriaged — —
DF-1889 Info 1.9 Timeout-detection mismatch in e1000_load_firmware FW-reset wait loop
sys/dev/netif/ig_hal/e1000_manage.c:508
 none reproduced not_testable untriaged — —
DF-1998 Info 1.9 amdgpu_gfx_kiq_init calls amdgpu_bo_unreserve on unreserved BO (ttm reservation imbalance)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:299
 none reproduced fixed untriaged — —
DF-2088 Info 1.9 ACPI_DEBUG_MEMMAP build reuses a found track by moving it to list head without unlinking, orphaning nodes and risking cycles
sys/dev/acpica/Osd/OsdMemory.c:96
 none reproduced fixed untriaged — —
DF-2099 Info 1.9 ar5416GpioGet reads wrong GPIO input bit on AR9287 (KIWI) due to missing else
sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:192
 none reproduced fixed untriaged — —
DF-2184 Info 1.9 Memory leak in backlight_destroy: softc is never freed
sys/dev/misc/backlight/backlight.c:111
 none reproduced fixed untriaged — —
DF-2431 Info 1.9 parent_dmat DMA tag leaked on all error paths (never destroyed)
sys/dev/disk/buslogic/bt_pci.c:142
 — — — untriaged — —
DF-2441 Info 1.9 dmstrategy and dmdump dereference dev->si_drv1 without NULL check unlike dmsize and disk_ioctl_switch
sys/dev/disk/dm/device-mapper.c:365
 — — — untriaged — —
DF-1893 Info 1.5 Uninitialized UINT32 arg consumed by SET after failed HCI GET in hci_key_action
sys/dev/acpica/acpi_toshiba/acpi_toshiba.c:474
 none reproduced fixed untriaged — —
DF-2190 Low 1.1 vmap() leaks the vmap descriptor when kmem_alloc_nofault fails
sys/dev/drm/linux_vmalloc.c:53
 none reproduced fixed untriaged — —
DF-1746 Info 1.1 ttm_bo_util: ttm_bo_kmap bounds check allows OOB page-array index
sys/dev/drm/ttm/ttm_bo_util.c:584
 panic reproduced fixed untriaged — —
DF-1747 Info 1.1 ttm_bo_util: ttm_bo_move_memcpy error path pairs wrong mem with new_iomap in cleanup
sys/dev/drm/ttm/ttm_bo_util.c:243
 panic reproduced not_testable untriaged — —
DF-2097 Info 1.1 sil164_detect uses uninitialized reg9 when sil164_readb fails (unchecked return)
sys/dev/drm/i915/dvo_sil164.c:176
 none reproduced fixed untriaged — —
DF-2180 Info 1.1 ttm_bo_man_get_node silently swallows allocator errors (returns 0 instead of ret)
sys/dev/drm/ttm/ttm_bo_manager.c:75
 none reproduced fixed untriaged — —
DF-1459 Info 0.8 bzero of softc uses sizeof(pointer) instead of sizeof(struct) - latent garbage init
sys/dev/smbus/cyapa/cyapa.c:488
 none reproduced fixed untriaged — —
DF-1513 Info 0.8 vga_switcheroo_write uses negative errno return convention inconsistent with BSD dev_write
sys/dev/video/vga/vga_switcheroo.c:1112
 none reproduced fixed untriaged — —
DF-2030 Info 0.8 dig_encoder_sel_to_atom discards computed value returns literal 0
sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:154
 none reproduced fixed untriaged — —
DF-1780 Info 0.6 radeon_dp_mst: dead error-threshold check (retries==10000 vs loop bound 50) silently hides SAT timeout
sys/dev/drm/radeon/radeon_dp_mst.c:101
 none reproduced fixed untriaged — —
DF-1558 Info 0.5 HPD enable/disable are silent no-ops: register modification never written back
sys/dev/drm/amd/display/dc/dce/dce_link_encoder.c:1366
 none reproduced not_testable untriaged — —
DF-1677 Info 0.5 nvme: queue alloc/free/create/delete helpers accept uint16_t qid without validating against NVME_MAX_QUEUES
sys/dev/disk/nvme/nvme.c:128
 panic reproduced fixed untriaged — —
DF-1913 Info 0.5 hwmgr_hw_init preflight check dereferences hwmgr_func before its NULL guard (latent)
sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214
 none reproduced not_testable untriaged — —
DF-1970 Info 0.5 Latent kfree() on embedded drm_framebuffer would corrupt slab if reached
sys/dev/drm/radeon/radeon_fb.c:331
 panic reproduced fixed untriaged — —
DF-1997 Info 0.5 amdgpu_gfx_scratch_free performs unbounded 1u << (reg - reg_base) shift (latent UB)
sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:98
 panic reproduced fixed untriaged — —
DF-2109 Info 0.5 Undefined behavior in radix_max when tree height reaches RADIX_TREE_MAX_HEIGHT (shift >= word width)
sys/dev/drm/linux_radix.c:42
 none reproduced fixed untriaged — —
DF-2398 Low — Integer overflow in aperture bounds check in agp_generic_bind_memory
sys/dev/agp/agp.c:520
 — — — untriaged — —
DF-2019 Info — drm_setmaster_ioctl: lessor check and drm_set_master fall-through (lines 215-225) are dead code
sys/dev/drm/drm_auth.c:187
 none reproduced fixed untriaged — —

Base system — bus / platform / cpu 79

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2612 Low 3.3 ses_getputstat swallows all decode/encode/device errors and returns 0 (fail-open enclosure status)
sys/bus/cam/scsi/scsi_ses.c:1268 · pass 2 · new
 none inconclusive not_testable untriaged — —
DF-2348 High 8.4 Dead unsigned comparison in mmap bounds check enables vtophys on wrapped ZERO_LENGTH_PTR - kernel panic / kernel memory exposure
sys/bus/u4b/uvc/uvc_buf.c:107
 none not_reproduced not_testable untriaged — —
DF-1008 Low 6.8 Async packet parser mishandles packets spanning >2 DMA buffers -> buffer leak + forged headers
sys/bus/firewire/fwohci.c:2650
 none reproduced fixed untriaged — —
DF-2274 High 6.5 Divide-by-zero panic from device-supplied block size of zero in READ CAPACITY
sys/bus/cam/scsi/scsi_da.c:2280
 none not_reproduced not_testable untriaged — —
DF-0999 Medium 6.5 Divide-by-zero in rum_set_sleep_time when associated AP advertises zero beacon interval
sys/bus/u4b/wlan/if_rum.c:2184
 none not_reproduced not_testable untriaged — —
DF-1039 Medium 6.2 NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote when CIS lacks VERS_1 tuple
sys/bus/pccard/pccard.c:1020
 none not_reproduced not_testable untriaged — —
DF-2317 Medium 6.2 Kernel panic on attacker-controlled SD CSD structure version
sys/bus/mmc/mmc.c:1056
 none not_reproduced not_testable untriaged — —
DF-2351 Medium 6.2 uint16_t to uint8_t truncation of nfmt/nfrm/nitv causes NULL-deref panic on device attach
sys/bus/u4b/uvc/uvc_drv.c:1737
 — — — untriaged — —
DF-2270 Medium 6.1 Missing bounds check on cesr_element_type in chgetelemstatus allows OOB array index into sc_firsts/sc_counts
sys/bus/cam/scsi/scsi_ch.c:1066
 — — — untriaged — —
DF-0988 Medium 5.7 cdsize accepts blksize=0 from READ_CAPACITY, cdstart divide-by-zero panics on read
sys/bus/cam/scsi/scsi_cd.c:3058
 none not_reproduced not_testable untriaged — —
DF-2297 High 5.5 Divide-by-zero in fwdma_malloc_multiseg when esize is zero
sys/bus/firewire/fwdma.c:153
 — — — untriaged — —
DF-0996 Medium 5.5 pmap_unwire dereferences NULL pte when page table page does not exist -> vkernel crash
sys/platform/vkernel64/platform/pmap.c:2637
 none not_reproduced not_testable untriaged — —
DF-1059 Medium 5.5 FW_SBINDADDR / FW_CBINDADDR dereference ir (= d->ir) without NULL check — local kernel NULL-deref DoS
sys/bus/firewire/fwdev.c:600
 none not_reproduced not_testable untriaged — —
DF-1096 Medium 5.5 Unvalidated XSAVE header in npxpop allows unprivileged user to panic kernel via XRSTOR #GP
sys/platform/pc64/x86_64/npx.c:416
 panic reproduced fixed untriaged — —
DF-1113 Medium 5.5 Unbounded ACPI table Length in sdt_sdth_map enables deterministic boot-time panic DoS
sys/platform/pc64/acpica/acpi_sdt.c:137
 none not_reproduced not_testable untriaged — —
DF-2293 Medium 5.5 Zero bufreq.psize passed to FW_STSTREAM/FW_SRSTREAM causes divide-by-zero panic in fwdma_malloc_multiseg
sys/bus/firewire/fwdev.c:458
 — — — untriaged — —
DF-2294 Medium 5.5 FW_SBINDADDR / FW_CBINDADDR NULL-pointer dereference when receive xferq is uninitialized (local DoS)
sys/bus/firewire/fwdev.c:617
 — — — untriaged — —
DF-2318 Medium 5.5 NULL-pointer dereference in pccard_child_pnpinfo_str via pccard_safe_quote on cards lacking a valid CISTPL_VERS_1
sys/bus/pccard/pccard.c:1001
 — — — untriaged — —
DF-2352 Medium 5.5 Division by zero in uvc_drv_try_frame_interval for continuous-interval frames (bFrameIntervalType==0)
sys/bus/u4b/uvc/uvc_drv.c:1922
 — — — untriaged — —
DF-0979 Low 5.5 Multiple error paths use tsleep(0) infinite-hang instead of panic, enabling silent kernel DoS
sys/platform/pc64/x86_64/pmap.c:2908
 none reproduced fixed untriaged — —
DF-1092 Low 5.5 Unbounded EHCI extended-capability chain traversal allows malicious PCI controller to hang the kernel
sys/bus/u4b/controller/ehci_pci.c:517
 dos reproduced fixed untriaged — —
DF-1021 Low 5.3 Sleeping allocation M_WAITOK inside critical section in fw_get_tlabel -> panic under memory pressure
sys/bus/firewire/firewire.c:1647
 none reproduced fixed untriaged — —
DF-2279 Info 5.1 CAMIOCOMMAND accepts kernel-internal XPT function codes that operate on kernel-only objects
sys/bus/cam/scsi/scsi_pass.c:474
 — — — untriaged — —
DF-1003 Low 4.7 usb_make_dev creates visible cdev before setting si_drv1 -> NULL-deref race in usb_open
sys/bus/u4b/usb_device.c:1991
 none reproduced fixed untriaged — —
DF-1024 Low 4.7 NULL-deref panic in cam_periph_alloc failure path when xpt_create_path fails
sys/bus/cam/cam_periph.c:219
 none reproduced fixed untriaged — —
DF-2299 Low 4.7 Missing NULL check on kmalloc return in fwdma_malloc_multiseg
sys/bus/firewire/fwdma.c:162
 — — — untriaged — —
DF-2302 Low 4.7 NULL pointer dereference in fwohci_db_free when bus_dmamap_create fails partway through initialization
sys/bus/firewire/fwohci.c:1236
 — — — untriaged — —
DF-2329 Low 4.7 Lost-wakeup race in ppb_request_bus() can permanently hang a process opening a parallel port device
sys/bus/ppbus/ppbconf.c:464
 — — — untriaged — —
DF-2355 Low 4.7 Unbounded linear search in mt7601_set_chan reads past mt7601_rf_chan[14]
sys/bus/u4b/wlan/if_mtw.c:3693
 — — — untriaged — —
DF-1017 High 4.6 Untrusted READ_CAPACITY block_len=0 causes kernel divide-by-zero panic (secsize used as divisor without validation)
sys/bus/cam/scsi/scsi_da.c:2280
 none inconclusive not_testable untriaged — —
DF-0990 Medium 4.6 PCI capability-list walk has no cycle detection, malicious device hangs kernel forever
sys/bus/pci/pci.c:847
 none not_reproduced not_testable untriaged — —
DF-1023 Medium 4.6 Kernel panic on unrecognized SD CSD version from malicious SD card (csd_structure=2 or 3 triggers panic not graceful error)
sys/bus/mmc/mmc.c:1056
 none not_reproduced not_testable untriaged — —
DF-1038 Medium 4.6 NULL pointer dereference in wsp_intr_callback when ntouch==0 (malicious USB / TYPE1 regression)
sys/bus/u4b/input/wsp.c:845
 none not_reproduced not_testable untriaged — —
DF-1093 Medium 4.6 NULL pointer dereference in ppb_pnp_detect via crafted IEEE 1284 PnP string
sys/bus/ppbus/ppbconf.c:242
 none not_reproduced fixed untriaged — —
DF-2319 Medium 4.6 NULL pointer dereference in CISTPL_CFTABLE_ENTRY handler when no CISTPL_CONFIG precedes it
sys/bus/pccard/pccard_cis.c:907
 — — — untriaged — —
DF-2324 Medium 4.6 Capability list traversal lacks cycle detection - infinite loop DoS from malicious device with circular capability chain
sys/bus/pci/pci.c:877
 — — — untriaged — —
DF-2338 Medium 4.6 NULL-deref in wsp_intr_callback when first HID report yields ntouch=0 (always for TYPE1 devices)
sys/bus/u4b/input/wsp.c:884
 none not_reproduced not_testable untriaged — —
DF-0991 Low 4.6 EHCI/XHCI early-takeover extended-capability walks have no cycle bound (hang + OOB MMIO reads)
sys/bus/pci/pci.c:2900
 none reproduced fixed untriaged — —
DF-0992 Low 4.6 VPD parser calls krealloc with M_ZERO, panicking INVARIANTS kernels (krealloc explicitly asserts M_ZERO unsupported)
sys/bus/pci/pci.c:1150
 none reproduced fixed untriaged — —
DF-2327 Low 4.6 NULL+1 pointer dereference in ppb_pnp_detect() via malformed PnP string from malicious peripheral
sys/bus/ppbus/ppbconf.c:242
 — — — untriaged — —
DF-2335 Low 4.6 Unbounded unvalidated PCI extended-capability loop in ehci_pci_take_controller (DoS via malicious/fuzzed controller)
sys/bus/u4b/controller/ehci_pci.c:517
 — — — untriaged — —
DF-2341 Low 4.6 NULL-deref panic in if_detach when async PHY-probe attach fails (ether_ifdetach on never-attached ifnet)
sys/bus/u4b/net/usb_ethernet.c:232
 — — — untriaged — —
DF-2272 Low 4.5 TOCTOU on user-supplied chio.h ioctl structs enables re-validation bypass in move/exchange/position/setvoltag
sys/bus/cam/scsi/scsi_ch.c:805
 — — — untriaged — —
DF-1051 Medium 4.4 sgopen unlocks an unheld lock and releases a periph reference that was never acquired
sys/bus/cam/scsi/scsi_sg.c:388
 panic reproduced fixed untriaged — —
DF-1095 Medium 4.4 iicsmb_bwrite leaves I2C bus in STARTED state on write failure — permanent SMBus bridge lockup
sys/bus/iicbus/iicsmb.c:462
 none not_reproduced fixed untriaged — —
DF-2275 Medium 4.4 KKASSERT panic in DAIOCTRIM from non-512-aligned user-supplied offsets
sys/bus/cam/scsi/scsi_da.c:443
 — — — untriaged — —
DF-2276 Medium 4.4 Infinite loop / negative b_bcount in DAIOCTRIM from negative user-supplied length
sys/bus/cam/scsi/scsi_da.c:436
 — — — untriaged — —
DF-2309 Medium 4.4 I2CRDWR ioctl leaks usrbufs array on copyin failure (kernel memory exhaustion DoS)
sys/bus/iicbus/iic.c:351
 — — — untriaged — —
DF-1004 Low 4.4 usb_config_parse INIT zeros target interface endpoints before verifying alt exists -> stale pointers on failure
sys/bus/u4b/usb_device.c:717
 none reproduced fixed untriaged — —
DF-1019 Low 4.4 daioctl uses KKASSERT (debug-only macro) to validate user-controlled DAIOCTRIM alignment -> panic on INVARIANTS, silent bypass on production
sys/bus/cam/scsi/scsi_da.c:443
 none reproduced fixed untriaged — —
DF-1114 Low 4.4 RSDP accepted without checksum or Length validation (firmware-integrity hardening gap)
sys/platform/pc64/acpica/acpi_sdt.c:120
 dos reproduced fixed untriaged — —
DF-2267 Low 4.4 CAMGETPASSTHRU can spin forever holding the SIM lock (privileged local DoS)
sys/bus/cam/cam_periph.c:901
 — — — untriaged — —
DF-2312 Low 4.4 I2CRDWR: no upper-bound validation on nmsgs allows massive kernel allocations (DoS)
sys/bus/iicbus/iic.c:351
 — — — untriaged — —
DF-2360 Low 4.4 Unbounded f_reg()/f_rm() indexing crashes DDB: NULL-deref in Grp7 dispatch and wild-pointer deref via REX.R into 8-element tables
sys/cpu/x86_64/misc/db_disasm.c:908
 — — — untriaged — —
DF-1034 Low 4.1 Boot-time kernel panic on malformed MP-table INT entry (dst_apic_int >= IO-APIC pin count)
sys/platform/pc64/x86_64/mptable.c:1296
 none reproduced fixed untriaged — —
DF-1044 Low 4.1 vkernel busdma bounce-wait path panics via #ifdef notyet stub; return_bounce_pages wakes wrong map
sys/platform/vkernel64/platform/busdma_machdep.c:1094
 panic reproduced not_testable untriaged — —
DF-1049 Low 4.1 Serializer leak on bus_setup_intr failure in ig4iic_attach causes self-deadlock during cleanup
sys/bus/smbus/ichiic/ig4_iic.c:648
 none reproduced fixed untriaged — —
DF-2313 Info 3.9 IIC_LOCK/IIC_UNLOCK are empty no-op macros - all shared state access is unsynchronized
sys/bus/iicbus/iic.c:60
 — — — untriaged — —
DF-1009 Low 3.5 Driver enables FireWire physical-request DMA into host memory by default (PhysUpperBound=0x10000)
sys/bus/firewire/fwohci.c:1864
 none reproduced fixed untriaged — —
DF-1115 Low 3.5 Dead switch-error check in mmc_switch_status compares a status field to a raw bit value
sys/bus/mmc/mmc_subr.c:211
 none reproduced fixed untriaged — —
DF-1026 Info 3.4 cam_periph_unmapbufs silently drops copyout errors -> data loss / inconsistent result
sys/bus/cam/cam_periph.c:829
 none reproduced not_testable untriaged — —
DF-1015 Low 3.3 usb_kqfilter leaks FIFO refcount on filter/mode-mismatch EOPNOTSUPP paths -> permanent USB device detach hang
sys/bus/u4b/usb_dev.c:1175
 none reproduced fixed untriaged — —
DF-1031 Low 3.3 NULL pointer dereference in init_disk makes -c (CD image) always crash the vkernel
sys/platform/vkernel64/platform/init.c:487
 none reproduced fixed untriaged — —
DF-1069 Low 3.3 host_pcib_get_busno returns success without writing *busnum for Intel 82454NX at unexpected slot
sys/bus/pci/pci_pci.c:707
 none reproduced fixed untriaged — —
DF-2283 Low 3.3 sgread: tsleep on local stack address &hstat has no wakeup source; read() blocks indefinitely (local DoS)
sys/bus/cam/scsi/scsi_sg.c:763
 — — — untriaged — —
DF-2287 Low 3.3 Memory leak of targ_cmd_descr in targread abort_queue drain loop
sys/bus/cam/scsi/scsi_target.c:921
 — — — untriaged — —
DF-1014 Low 2.5 sescleanup leaks ses_objmap/ses_private/ses_typidx/ses_eltmap on device removal -> memory exhaustion DoS
sys/bus/cam/scsi/scsi_ses.c:231
 none reproduced fixed untriaged — —
DF-1036 Low 2.5 return_bounce_pages wakes wrong map (typo: passes map instead of wait_map to add_map_callback)
sys/platform/pc64/x86_64/busdma_machdep.c:1306
 none reproduced fixed untriaged — —
DF-2305 Low 2.5 bus_dma_tag_create failure returns without cleanup: leaks BAR IRQ and leaves interrupt handler registered
sys/bus/firewire/fwohci_pci.c:320
 — — — untriaged — —
DF-1053 Low 2.3 SG_DXFER_TO_FROM_DEV silently maps to CAM_DIR_NONE, passing unmapped user pointer to the HBA
sys/bus/cam/scsi/scsi_sg.c:527
 none reproduced fixed untriaged — —
DF-1054 Low 2.3 sgoninvalidate does not abort pending I/O or wake blocked readers, causing permanent hang on device removal
sys/bus/cam/scsi/scsi_sg.c:169
 none reproduced fixed untriaged — —
DF-2311 Low 2.3 iicread() leaks I2C bus lock on iicbus_block_read failure
sys/bus/iicbus/iic.c:253
 — — — untriaged — —
DF-2265 Info 2.3 sasetparams ENODEV early return leaks ccomp allocation
sys/bus/cam/scsi/scsi_sa.c:2757
 — — — untriaged — —
DF-2325 Low 2.0 Signed left-shift undefined behavior in BAR resource sizing when ln2size == 31
sys/bus/pci/pci.c:2644
 — — — untriaged — —
DF-0977 Low 1.9 pmap_change_attr non-atomic read-modify-write on DMAP PDEs (lost A-bit updates, stale cache attr window)
sys/platform/pc64/x86_64/pmap.c:6279
 none reproduced fixed untriaged — —
DF-2344 Info 1.5 Unchecked register read uses uninitialized stack for port-count decision in attach
sys/bus/u4b/serial/umcs.c:301
 — — — untriaged — —
DF-1022 Info 1.1 Integer truncation in fw_xfer_alloc_buf (int -> u_int16_t pay_len) -> length/buffer mismatch for len > 0xFFFF (latent)
sys/bus/firewire/firewire.c:949
 none reproduced not_testable untriaged — —
DF-0976 Info 0.5 pmap_enter user/kernel boundary checks are advisory-only (kprintf, no enforcement)
sys/platform/pc64/x86_64/pmap.c:5074
 none reproduced not_testable untriaged — —
DF-1089 Info 0.5 ioapic_intsrc() indexes ioc_intsrc[] with only a debug-compiled-out bounds guard
sys/platform/pc64/apic/ioapic.c:274
 none reproduced not_testable untriaged — —

Base system — crypto 6

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2367 Medium 4.7 AES T-table lookups are data-dependent leaking key material via cache timing (CCMP always dm-crypt/IPsec on non-AES-NI)
sys/crypto/rijndael/rijndael-alg-fst.c:56
 — — — untriaged — —
DF-0969 Low 3.6 rijndael_padDecrypt MODE_ECB accepts invalid padLen==0 and rejects valid padLen==16 (asymmetric with CBC path, padding-oracle-prone)
sys/crypto/rijndael/rijndael-api-fst.c:390
 none reproduced not_testable untriaged — —
DF-2364 Low 3.6 Silent 64-bit->32-bit length truncation when invoking chacha_encrypt_bytes
sys/crypto/chachapoly.c:127
 — — — untriaged — —
DF-2365 Info 2.9 Decrypted but unauthenticated plaintext written back to mbuf before tag check
sys/crypto/chachapoly.c:349
 — — — untriaged — —
DF-0970 Info 1.9 Poly1305 one-time key (poly_key) left unzeroed on stack after _chacha20poly1305_init returns
sys/crypto/chachapoly.c:52
 none reproduced fixed untriaged — —
DF-2366 Info 1.9 rc4_init lacks keylen>0 validation reading key[0] 256 times for non-positive keylen
sys/crypto/rc4/rc4.c:58
 — — — untriaged — —

Base system — libkern / libprop / ddb 10

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2251 Medium 6.5 Fully reversible non-cryptographic MINSTD PRNG is sole source of randomness for security-sensitive kernel values
sys/libkern/random.c:36
 — — — untriaged — —
DF-2229 Medium 5.5 prop_array_iterator and 3 siblings lack prop_object_is_array NULL/type guard enabling kernel panic via DM ioctl
sys/libprop/prop_array.c:538
 panic reproduced fixed untriaged — —
DF-2230 Medium 5.5 Kernel plist integer parsing silently saturates decimal values exceeding INT64_MAX (unsigned fallback is dead code)
sys/libprop/prop_number.c:519
 — — — untriaged — —
DF-2237 Medium 5.5 iconv_xlat16_conv dereferences d_table[c1] without NULL check after case-conversion mutates c1/c2
sys/libiconv/iconv_xlat16.c:155
 — — — untriaged — —
DF-2250 Medium 4.5 Unsynchronized read-modify-write race on global PRNG state randseed (SMP)
sys/libkern/random.c:36
 — — — untriaged — —
DF-2254 Low 4.1 kqsort_r recurses without depth bound: latent stack-exhaustion DoS (sibling of DF-2245 via shared qsort.c body)
sys/libkern/qsort_r.c:7
 — — — untriaged — —
DF-2243 Medium 4.0 Early-boot RC4 stream keyed with uninitialized kernel stack because read_random() returns 0 before CSPRNG initialized
sys/libkern/arc4random.c:53
 — — — untriaged — —
DF-2242 Info 3.9 Right-shift operator truncates operand to 32 bits (LP64 porting bug)
sys/ddb/db_expr.c:216
 — — — untriaged — —
DF-2240 Info 1.1 prop_array_add_uint{8 16 32 64} stores unsigned values via signed creator breaking roundtrip semantics
sys/libprop/prop_array_util.c:187
 — — — untriaged — —
DF-2244 Info 0.5 karc4random_buf charges only one run regardless of buffer length defeating keystream-limit reseed invariant
sys/libkern/arc4random.c:152
 — — — untriaged — —

Legacy / ancient (PPP, iSCSI, NTFS, SMB…) — deferred 74

PPP, iSCSI, NTFS, SMB and other ancient subsystems. Real but deliberately deferred — not on the first sift.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-1869 Critical 9.8 Remote kernel heap overflow in scsi_decap via attacker-controlled Data-In buffer offset (write-what-where)
sys/dev/disk/iscsi/initiator/iscsi_subr.c:566
 corruption reproduced fixed untriaged — —
DF-2458 Critical 9.8 Target-controlled buffer offset in scsi_decap gives malicious iSCSI target an arbitrary-offset kernel heap write
sys/dev/disk/iscsi/initiator/isc_sm.c:143
 panic reproduced fixed untriaged — —
DF-1870 High 9.1 Remote kernel heap OOB read / info leak in iscsi_r2t via attacker-controlled R2T transfer length
sys/dev/disk/iscsi/initiator/iscsi_subr.c:79
 leak reproduced fixed untriaged — —
DF-0677 High 8.8 sl_compress_init heap overflow via unvalidated max_state from PPP IPCP negotiation
sys/net/ppp_layer/slcompress.c:69
 corruption reproduced fixed untriaged — —
DF-0624 High 8.1 OOB heap read in smb_t2_placedata via malicious TRANS2 response byte counts
sys/netproto/smb/smb_rq.c:436
 panic reproduced fixed untriaged — —
DF-2566 High 8.1 smb_t2_placedata corrupts mbuf m_len on oversized TRANS2 count causing kernel heap OOB read and panic
sys/netproto/smb/smb_rq.c:424
 panic reproduced fixed untriaged — —
DF-0641 High 7.8 Heap buffer overflow in smb_smb_ssnsetup: ntencpass sized from charset-converted password but filled from original
sys/netproto/smb/smb_smb.c:255
 none not_reproduced not_testable untriaged — —
DF-0785 High 7.8 Heap buffer overflow in ntfs_ntlookupfile: rdbuf allocated to ir_size but filled with va_datalen bytes
sys/vfs/ntfs/ntfs_subr.c:867
 uid0 → root reproduced fixed untriaged — —
DF-0871 High 7.8 Heap overflow in $AttrDef name copy via unbounded wchar-to-char do/while walk
sys/vfs/ntfs/ntfs_vfsops.c:444
 panic reproduced fixed untriaged — —
DF-0873 High 7.8 Stack buffer overflow in ntfs_readdir convname via double-wide NTFS_U28 expansion of crafted ie_fnamelen
sys/vfs/ntfs/ntfs_vnops.c:517
 uid0 → root reproduced fixed untriaged — —
DF-0901 High 7.8 Unlocked hash-bucket traversal in smbfs_node_alloc races with smbfs_reclaim freeing smbnode (UAF read)
sys/vfs/smbfs/smbfs_node.c:203
 panic reproduced fixed untriaged — —
DF-2461 High 7.8 i_prepPDU truncates PDU length to u_int and maxBurstLength accepts negative values enabling kernel heap overflow via ISCSISEND
sys/dev/disk/iscsi/initiator/isc_sm.c:291
 panic reproduced fixed untriaged — —
DF-2459 High 7.5 Re-queued NOP-IN PDU in _nop_in causes bcopy(NULL) panic in isc_sendPDU
sys/dev/disk/iscsi/initiator/isc_sm.c:212
 panic reproduced fixed untriaged — —
DF-2460 High 7.5 _reject dereferences pq->mp without NULL check panicking on data-less REJECT from malicious target
sys/dev/disk/iscsi/initiator/isc_sm.c:87
 panic reproduced fixed untriaged — —
DF-1828 Medium 7.5 isc_soc: NULL deref in so_input pdu_alloc retry uses M_NOWAIT (comment says WAITOK) derefs unchecked
sys/dev/disk/iscsi/initiator/isc_soc.c:540
 none inconclusive — untriaged — —
DF-0932 High 7.1 LZ77 back-reference offset not bounded to current output position - heap OOB read before output buffer in NTFS decompression
sys/vfs/ntfs/ntfs_compr.c:74
 leak reproduced fixed untriaged — —
DF-0787 Medium 7.1 Unbounded attribute walk in ntfs_loadntnode: OOB read + infinite loop via fr_attroff/reclen==0
sys/vfs/ntfs/ntfs_subr.c:305
 panic reproduced fixed untriaged — —
DF-0789 Medium 7.1 ntfs_runtovrun walks attacker run buffer with no length bound — OOB read
sys/vfs/ntfs/ntfs_subr.c:582
 panic reproduced fixed untriaged — —
DF-0791 Medium 7.1 Subnode dive in ntfs_ntlookupfile reads 8 bytes OOB when iep->reclen < sizeof(cn_t) or entry straddles buffer end
sys/vfs/ntfs/ntfs_subr.c:900
 leak reproduced fixed untriaged — —
DF-0874 Medium 7.1 Unbounded attr_indexentry walk in ntfs_readdir inner loop reads kernel heap past f_dirblbuf
sys/vfs/ntfs/ntfs_vnops.c:577
 oob_read reproduced fixed untriaged — —
DF-2555 Medium 7.1 Heap buffer overflow in $AttrDef name copy via unterminated wchar name
sys/vfs/ntfs/ntfs_vfsops.c:444
 none reproduced fixed untriaged — —
DF-0884 High 7.0 Use-after-free in smbfs_readvdir via dead-code vnode lock upgrade on read(2) of directory
sys/vfs/smbfs/smbfs_io.c:202
 panic reproduced fixed untriaged — —
DF-0930 Medium 7.0 ntfs_nthashlookup returns unreferenced ntnode after releasing token - UAF in NTFS inode lookup
sys/vfs/ntfs/ntfs_ihash.c:90
 panic reproduced fixed untriaged — —
DF-2462 Medium 7.0 ism_stop frees session while CAM/ic_action and sysctl handlers can still dereference it (UAF)
sys/dev/disk/iscsi/initiator/isc_sm.c:752
 — — — untriaged — —
DF-1827 High 6.7 isc_soc: heap overflow in isc_sendPDU MH_ALIGN misuse leaves no room for AHS or header digest
sys/dev/disk/iscsi/initiator/isc_soc.c:111
 panic reproduced fixed untriaged — —
DF-1703 Medium 6.7 iscsi initiator: heap overflow in i_send via 32-bit truncation in i_prepPDU + signedness bypass of maxBurstLength check
sys/dev/disk/iscsi/initiator/iscsi.c:454
 none inconclusive — untriaged — —
DF-2602 Medium 6.7 Heap buffer overflow in smb_smb_ssnsetup plaintext-password path via iconv length mismatch
sys/netproto/smb/smb_smb.c:268
 panic reproduced fixed untriaged — —
DF-2464 Low 6.6 Unbounded attacker-controlled buffer offset (bo) in so_recv douio path - latent OOB write + latent stack overflow same defect class as scsi_decap DF-2458
sys/dev/disk/iscsi/initiator/isc_soc.c:450
 — — — untriaged — —
DF-0627 High 6.5 mbuf chain leak on duplicate SMB responses enables remote kernel memory-exhaustion DoS
sys/netproto/smb/smb_iod.c:363
 none not_reproduced not_testable untriaged — —
DF-0671 High 6.5 Unbounded recursion in NetBIOS retarget handling causes kernel stack overflow / panic
sys/netproto/smb/smb_trantcp.c:263
 panic reproduced fixed untriaged — —
DF-0673 Medium 6.5 nbssn_recv() leaks mbufs on receive error and on inner-loop sbinit() reset
sys/netproto/smb/smb_trantcp.c:345
 none not_reproduced not_testable untriaged — —
DF-0907 High 6.4 Heap overflow in smbfs_mount: signed underflow in strncpy length when SMB username >= 76 chars
sys/vfs/smbfs/smbfs_vfsops.c:170
 panic reproduced not_testable untriaged — —
DF-0628 Medium 6.4 Use-after-free of struct smbiod on shutdown: destroyer frees iod without waiting for the iod kthread to exit
sys/netproto/smb/smb_iod.c:675
 panic reproduced fixed untriaged — —
DF-1759 Medium 6.4 isc_sm: UAF on pduq via early pdu_free in proc_out racing network-stack ext_free
sys/dev/disk/iscsi/initiator/isc_sm.c:530
 none inconclusive — untriaged — —
DF-1829 Medium 6.4 isc_soc: UAF/refcount corruption via ext_free on reused pduq in send path
sys/dev/disk/iscsi/initiator/isc_soc.c:70
 none inconclusive — untriaged — —
DF-1871 Low 6.4 scsi_encap overflows cmd->cdb on oversized inline CDB from CAM pass-through
sys/dev/disk/iscsi/initiator/iscsi_subr.c:494
 panic reproduced fixed untriaged — —
DF-2171 Low 6.4 i_setopt free-and-reassign of sp->opt strings is unlocked; concurrent ISCSISETOPT ioctls race into double-free / UAF
sys/dev/disk/iscsi/initiator/isc_subr.c:104
 corruption reproduced fixed untriaged — —
DF-0786 Medium 6.3 Off-by-one heap overflow in ntfs_ntlookupattr: NUL terminator written one byte past kmalloc(namelen)
sys/vfs/ntfs/ntfs_subr.c:826
 corruption reproduced not_testable untriaged — —
DF-0934 Medium 6.1 Accumulated input offset never bounded - heap OOB read of compressed input buffer (cup) in NTFS decompression
sys/vfs/ntfs/ntfs_compr.c:55
 panic reproduced fixed untriaged — —
DF-0734 High 6.0 Negative ioc_setupcnt bypasses signed upper-bound check — >131KB kernel stack OOB read exfiltrated to SMB server
sys/netproto/smb/smb_usr.c:299
 panic reproduced fixed untriaged — —
DF-2010 Low 5.8 Lockless read of isp->sessions[] in ic_action allows use-after-free of iSCSI session being torn down
sys/dev/disk/iscsi/initiator/isc_cam.c:210
 none reproduced not_testable untriaged — —
DF-0598 Medium 5.5 smb_sm_lookupint leaks a VC reference on every failed lookup, pinning VCs and hanging teardown
sys/netproto/smb/smb_conn.c:124
 dos reproduced fixed untriaged — —
DF-0599 Medium 5.5 smb_vc_create error path NULL-deferences vc_iod via smb_vc_disconnect (trivially-triggerable kernel panic via invalid charset name)
sys/netproto/smb/smb_conn.c:460
 panic reproduced fixed untriaged — —
DF-0790 Medium 5.5 ATTRLIST parsing DoS in ntfs_ntvattrget: reclen==0 infinite loop or reclen>len NULL deref panic
sys/vfs/ntfs/ntfs_subr.c:186
 dos reproduced fixed untriaged — —
DF-0872 Medium 5.5 Divide-by-zero and undefined-shift in BPB bpmftrec computation from crafted boot sector
sys/vfs/ntfs/ntfs_vfsops.c:343
 panic reproduced fixed untriaged — —
DF-2463 Medium 5.5 NULL-deref panic in so_input: pdu_alloc retry uses M_NOWAIT instead of M_WAITOK then dereferences pq unconditionally
sys/dev/disk/iscsi/initiator/isc_soc.c:540
 none inconclusive not_testable untriaged — —
DF-2554 Medium 5.5 Divide-by-zero kernel panic from unvalidated boot sector bf_bps=0 during mount
sys/vfs/ntfs/ntfs_vfsops.c:331
 panic reproduced fixed untriaged — —
DF-0672 Medium 5.4 Uninitialized struct sockaddr_in passed to soconnect() in retarget path
sys/netproto/smb/smb_trantcp.c:206
 none reproduced not_testable untriaged — —
DF-2567 Low 5.4 Use-after-free read of rqp->sr_flags in smb_t2_request_int error path
sys/netproto/smb/smb_rq.c:740
 — — — untriaged — —
DF-1761 Medium 5.3 isc_sm: remote memory leak / pdu-pool exhaustion via TASK_RSP/default cases never freeing received pduq
sys/dev/disk/iscsi/initiator/isc_sm.c:451
 none inconclusive — untriaged — —
DF-2468 Medium 5.3 getSenseData leaks kernel heap into CCB sense buffer via unvalidated wire sense_len and mis-sized scratch buffer
sys/dev/disk/iscsi/initiator/iscsi_subr.c:152
 leak reproduced not_testable untriaged — —
DF-0718 Medium 5.1 smb_dev2share type-confuses non-vnode fd (socket/pipe/kqueue) as vnode via unchecked fp->f_data cast — kernel panic
sys/netproto/smb/smb_dev.c:395
 panic reproduced fixed untriaged — —
DF-0835 Medium 4.4 smbfs_advlock unconditionally overwrites lock type to SMB_LOCK_EXCL — shared locks become exclusive, unlocks acquire new locks
sys/vfs/smbfs/smbfs_vnops.c:927
 logic/auth violation + remote DoS ceiling reproduced fixed untriaged — —
DF-0674 Low 4.4 nb_put_name() unbounded NetBIOS-name walk: infinite loop on 0xFF and heap OOB read
sys/netproto/smb/smb_trantcp.c:122
 panic reproduced fixed untriaged — —
DF-0715 Low 4.4 smb_memdupin signed-length validation accepts zero (ZERO_LENGTH_PTR panic) and negative (huge kmalloc panic) lengths
sys/netproto/smb/smb_subr.c:136
 panic reproduced fixed untriaged — —
DF-0836 Low 4.4 smbfs_advlock missing break: SEEK_END always returns EINVAL, SEEK_CUR treated as SEEK_SET
sys/vfs/smbfs/smbfs_vnops.c:905
 none reproduced not_testable untriaged — —
DF-2169 Low 4.4 maxluns clamp is a dead store; user-controlled value flows unfiltered into CAM cpi->max_lun, enabling local LUN-scan DoS
sys/dev/disk/iscsi/initiator/isc_subr.c:123
 none reproduced fixed untriaged — —
DF-2466 Low 4.4 Heap overflow in i_send via ahs_len/ds_len padding mismatch with i_prepPDU
sys/dev/disk/iscsi/initiator/iscsi.c:454
 panic reproduced fixed untriaged — —
DF-0737 Low 3.7 Non-constant-time SMB1 signature verification via bcmp — timing side channel for byte-by-byte signature forgery
sys/netproto/smb/smb_crypt.c:304
 leak reproduced not_testable untriaged — —
DF-1830 Low 3.7 isc_soc: so_recv douio block stores stale stack pointer and OOB SCSI buffer offset in pq->iov
sys/dev/disk/iscsi/initiator/isc_soc.c:446
 none reproduced not_testable untriaged — —
DF-0885 Low 3.6 TOCTOU on np->n_fid/n_opencount in smbfs_getpages/smbfs_putpages fid confusion
sys/vfs/smbfs/smbfs_io.c:455
 none reproduced not_testable untriaged — —
DF-0788 Medium 3.3 Heap info leak via resident attribute data offset in ntfs_attrtontvattr — a_dataoff past record boundary
sys/vfs/ntfs/ntfs_subr.c:536
 leak reproduced fixed untriaged — —
DF-0933 Medium 3.3 Compressed NTFS block leaves output tail uninitialized - stale kernel-heap info leak
sys/vfs/ntfs/ntfs_compr.c:70
 leak:4088 reproduced fixed untriaged — —
DF-0837 Low 3.3 smbfs_strategy silently drops async buffer IO returning success without doing work
sys/vfs/smbfs/smbfs_vnops.c:796
 none reproduced not_testable untriaged — —
DF-0916 Low 3.3 smb_time_unix2dos year-computation loop unbounded allows kernel livelock DoS via crafted timestamps
sys/vfs/smbfs/smbfs_subr.c:170
 dos reproduced fixed untriaged — —
DF-1704 Low 3.0 iscsi initiator: heap OOB write of 1-3 NUL bytes in i_send due to padding-calc mismatch when ahs_len not multiple of 4
sys/dev/disk/iscsi/initiator/iscsi.c:461
 panic reproduced fixed untriaged — —
DF-2467 Low 3.0 TOCTOU in i_create_session: sc->sessions[n] assigned outside the search lock
sys/dev/disk/iscsi/initiator/iscsi.c:623
 — — — untriaged — —
DF-0600 Low 2.5 Unvalidated sa_len in dup_sockaddr callers enables heap OOB read of up to ~250 bytes
sys/netproto/smb/smb_conn.c:462
 leak:251 reproduced fixed untriaged — —
DF-1760 Low 2.3 isc_sm: memory leak - proc_out default-error branch leaks non-CCB pduq on any non-EAGAIN/EPIPE send error
sys/dev/disk/iscsi/initiator/isc_sm.c:549
 dos reproduced fixed untriaged — —
DF-2170 Low 2.3 headerDigest/dataDigest strcmp on stack buffer left non-NUL-terminated by ENAMETOOLONG copyinstr
sys/dev/disk/iscsi/initiator/isc_subr.c:85
 none reproduced fixed untriaged — —
DF-2465 Low 2.3 Stack over-read via strcmp/kprintf on non-NUL-terminated copyinstr result in i_setopt digest handling
sys/dev/disk/iscsi/initiator/isc_subr.c:85
 — — — untriaged — —
DF-0716 Low 1.9 smb_strdupin ignores copyin return value — TOCTOU race leaks uninitialized kernel heap memory to SMB server via TRANS2 name
sys/netproto/smb/smb_subr.c:113
 leak:8 reproduced fixed untriaged — —
DF-0719 Low 1.9 nsmb_dev_open races si_drv1 allocation outside any lock — memory leak / stale-pointer window
sys/netproto/smb/smb_dev.c:104
 panic reproduced fixed untriaged — —
DF-0738 Low 1.9 NTLM hashes DES key schedule MD4 state cleartext Unicode password not zeroized after use
sys/netproto/smb/smb_crypt.c:70
 leak reproduced not_testable untriaged — —

Vendored third-party (contrib) 5

Vendored code; fix owner is the upstream project.

ID Sev CVSS Title Impact PoC Fix Triage Owner 💬
DF-2255 Medium 6.8 Stack buffer overflow in ar9300_eeprom_restore_internal_address via unchecked EEPROM compression length field
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3892
 — — — untriaged — —
DF-2256 Low 3.5 ar9300_calibration_data_read_array silently ignores read failures leaving stack buffer uninitialized
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c:3697
 — — — untriaged — —
DF-2258 Low 2.4 OOB read: gain_table_entries[32] via unclamped gain_index in ar9300_paprd_setup_gain_table
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:2003
 — — — untriaged — —
DF-2259 Low 2.4 Uninitialized stack reads in create_pa_curve when training bins lack samples
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c:1398
 — — — untriaged — —
DF-2257 Info 1.6 Unbounded while(1) loop in ar9300_rf_gain_cap_apply can walk past rx_gain_table[256] (defense-in-depth; not exploitable with current static data)
sys/contrib/dev/ath/ath_hal/ar9300/ar9300_attach.c:3397
 — — — untriaged — —