Asking a terminal for its session could crash the kernel
Brief
The ioctl now fails instead of chasing the stale pointer. ## Notes source-changes (deraadt@, 2026-08-15 10:24:25). sys/kern/tty.c. cvsweb.
TIOCGSID could dereference a freed t_session because s_leader was stored in the wrong place. Cold hard crash. Temporary: fail the ioctl. A proper fix is still in progress. From Acts1632, ok kettenis@.
No OpenBSD src SHA on GitHub or Codeberg. Do not invent one.
bluhm@ committed the same fail-the-ioctl text onto the 7.8 and 7.9 branches on 2026-08-20. msg162846 is OPENBSD_7_8 sys/kern/tty.c, named errata/7.8/049_ttyioctl.patch.sig. msg162847 is OPENBSD_7_9 sys/kern/tty.c, named errata/7.9/013_ttyioctl.patch.sig.
The if.c commits that reused this log were backed out. msg162850 and msg162852 say “commit message was wrong.” Different hole. Do not treat 010_ifioctl as this crash.
Official errata79 013 and errata78 049 are RELIABILITY FIX, dated August 22, 2026. Pages Last-Modified Sun 23 Aug 2026 07:08:33 GMT.
Commit msg162771