PK68425: DFHXS0001 ABEND B78 AKEX OFFSET 166A IN MODULE DFHXSCT RACDCERT TO VALIDATE CERTIFICATE MODULE DFHXSSE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Upgrading from CICS 3.1 to CICS 3.2 and recieved the following
  error message:
  DFHXS0001 AN ABEND (CODE B78/AKEX) HAS OCCURRED AT
            OFFSET X'166A' IN MODULE DFHXSCT.
  The B78 abend was on a freemain request and the return code was:
  04       The macro tried to obtain or free storage in an
           undefined subpool.
  
  Review of a dump shows module DFHXSSE at offset 166A has issued
  a freemain request for a buffer and this fails with the
  ABENDB78. The address we are trying to freemain belongs to
  subpool 229 key 0 but we pass subpool 192 on the request.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: When CICS attempts to validate an SSL   *
  *                      certificate label on a system whose     *
  *                      External Security Manager is not RACF,  *
  *                      a B78 SYSTEM abend may be issued.       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  CICS attempts to validate a certificate label by using the
  RACF callable service R_admin (IRRSEQ00) to issue a RACDCERT
  command internally to check whether the certificate exists.
  If the command is successful, it returns a chain of message
  buffers which CICS must freemain. But the command is not valid
  unless the External Security Manager is RACF. The ESM
  sets an error response code, but CICS does not check it.
  CICS assumes that the chain of message buffers exists and
  attempts to release them using invalid pointers, resulting
  in an SB78 system abend in FREEMAIN.
  
  ADDITIONAL KEYWORDS :- MSGDFHXS0001 XS0001 AKEX abendAKEX
                         ABENDSB78
  

Problem conclusion

• DFHXSSE has been changed to initialize the pointer to the
  message chain to zero before calling IRRSEQ00, and will check
  the return codes from IRRSEQ00 before attempting to free the
  message chain. The message chain is only valid if the SAF and
  ESM return codes are both zero or are equal to 8 and 16
  respectively.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK39453 PM07954

Modules/Macros

•    DESXSSE  DFHXSSE
  

Fix information

• Fixed component name

  CICSTS V3 Z/OS

• Fixed component ID

  5655M1500

Applicable component levels

• R500 PSY UK39453

     UP08/09/04 P F809

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.