⬢ DragonFlyBSD Kernel Audit
1085 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
  "finding_id": "DF-1085",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Jul 16 04:51:43 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "code_hash": "046a85d8d2e267316f6f231da3163849673a6c247f1673fe1a46b1ba73a28147",
  "tested_at": "2026-07-16T05:05:00Z",
  "verdict": "REPRODUCED",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "harness prints 'BUG CONFIRMED — crom_parse_text writes out of bounds when crc_len < 2.' for crc_len=0/1; harness_fixed prints 'canary intact' for all cases. Live kernel trigger requires FireWire HW (absent in QEMU)."
  },
  "kernel_refs": [
    "sys/bus/firewire/fwcrom.c:215",
    "sys/bus/firewire/fwcrom.c:224",
    "sys/bus/firewire/firewire.h:122",
    "sys/bus/firewire/iec13213.h:148",
    "sys/dev/disk/sbp/sbp.c:606",
    "sys/dev/disk/sbp/sbp.c:621",
    "sys/dev/disk/sbp/sbp.c:186"
  ],
  "artifacts": [
    {"path": "harness.c",                       "type": "trigger-source",    "desc": "verbatim crom_parse_text userspace repro (BUGGY logic); crafted Config ROM with crc_len<2 text leaf"},
    {"path": "harness_fixed.c",                 "type": "trigger-source",    "desc": "same code + the crc_len<2 guard from fix.diff (FIXED logic)"},
    {"path": "fix.diff",                        "type": "suggested-fix",     "desc": "git-apply-able one-hunk fix: guard crc_len<2 before subtraction at fwcrom.c:215"},
    {"path": "build.sh",                        "type": "build-script",      "desc": "cc -O0 -g -Wall build for both harnesses"},
    {"path": "run.sh",                          "type": "run-script",        "desc": "runs harness then harness_fixed; prints BUG vs canary-intact"},
    {"path": "run.log",                         "type": "run-log",           "desc": "baseline (buggy logic) full output, run 1"},
    {"path": "run.2.log",                       "type": "run-log",           "desc": "baseline (buggy logic) full output, run 2 (determinism)"},
    {"path": "run_fixed.log",                   "type": "run-log",           "desc": "fixed logic full output — canary intact"},
    {"path": "baseline_run.log",                "type": "run-log",           "desc": "re-confirmed BUG CONFIRMED on #0 unpatched kernel after vm.sh reset with-src"},
    {"path": "fix_build.log",                   "type": "build-log",         "desc": "full make -j6 nativekernel output, rc=0 (35855 lines)"},
    {"path": "crom_parse_text_patched.disasm",  "type": "disassembly",       "desc": "objdump of patched crom_parse_text showing cmp $0x1; jbe strncpy_path guard + kern.version #1 + kernel sha256"},
    {"path": "panic.txt",                       "type": "panic-signature",   "desc": "no panic (HW-gated); underflow math + harness observation summary"},
    {"path": "env.txt",                         "type": "environment",       "desc": "uname, cc version, CPU features, kernel config (INVARIANTS, firewire, sbp)"},
    {"path": "VERDICT.md",                      "type": "verdict",           "desc": "full narrative: mechanism, reachability, threat model, fix validation"},
    {"path": "README.md",                       "type": "readme",            "desc": "finding summary + reproduce instructions"},
    {"path": "manifest.json",                   "type": "manifest",          "desc": "this file"}
  ]
}