Linux-Kernel

icmp_timestamp() is implemented in every Linux kernel but never scrutinized at source level. A depth-8 ftrace investigation reveals six RFC 792 deviations: silent payload length threshold, Code field never validated, ts_ori echoed unconditionally across the full 32-bit range, conntrack state creation on Type 13, netfilter hook ordering, and reply generation path that bypasses standard socket accounting. Full call chain mapped: ip_rcv() → icmp_rcv() → icmp_timestamp() → icmp_reply() with all branching conditions documented.

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.

MAX_LFS_FILESIZE only gates the superblock. A poisoned FUSE_GETATTR reply mutates i_size to UINT64_MAX at runtime. The (pos + count - 1) » PAGE_SHIFT arithmetic wraps unsigned, kworker loops become infinite, and vma_merge() degenerates into an arbitrary OOB-write on Maple Tree-backed kernels. Full mm/ subsystem analysis: filemap.c, mmap.c, XArray walk corruption primitives.

struct fuse_req holds inode references without bumping i_count. SIGKILL a stalled reader, trigger drop_caches inode eviction, delay fuse_abort_conn — the freed slab slot gets reallocated as struct cred. The race delivers a refcount double-decrement on whatever credential lands there: full DirtyCred-class LPE primitive. Complete race window analysis, SLUB reallocation timing, and RCU lifetime breakdown.

FUSE daemons control filesystem metadata returned to the kernel via vfs_getattr — including i_size. Setting i_size to an inflated value desynchronizes the kernel’s allocation (kmalloc based on reported size) from its ingestion (copy_from_user of actual bytes), creating a heap under-allocation. kernel_read_file() callers — finit_module(2), firmware loader, kexec_file_load(2) — are turned into kmalloc-4k SLUB slab overflow primitives. VFS trust inversion architecture, TOCTOU window analysis, and virtio-fs shared-memory attack surface covered.

Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.