From 1cd9aa5cbb02434242fd8f3beff78983ac71061a Mon Sep 17 00:00:00 2001 From: Hayzam Sherif Date: Wed, 4 Nov 2026 19:40:56 +0000 Subject: [PATCH] loader: Handle unavailable VBE during mode lookup When VBE is unavailable, vbe_init() frees the controller information buffer and sets vbe to NULL. Console initialization still calls vbe_default_mode(), which reaches an unguarded memset() in vbe_find_mode_xydm(). Under BTX, the null write can overwrite the loader's own code and cause a later protection fault. Guard vbe_default_mode() with vbe_check(), as the other public functions in vbe.c already do, and return 0 to indicate that no graphics mode is available. This allows console initialization to continue on headless systems. Reviewed by: rmoeller, imp MFC ater: 2 weeks Differential Revision: https://reviews.freebsd.org/D61145 --- stand/i386/libi386/vbe.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/stand/i386/libi386/vbe.c b/stand/i386/libi386/vbe.c index 00b9ab7ae0dc..61633567d056 100644 --- a/stand/i386/libi386/vbe.c +++ b/stand/i386/libi386/vbe.c @@ -1125,6 +1125,9 @@ vbe_default_mode(void) int modenum; uint32_t width, height; + if (!vbe_check()) + return (0); + modenum = 0; vbe_get_max_resolution(&width, &height); if (width != 0 && height != 0)