DragonFlyBSD Kernel Audit
DF-1278 / trigger_analysis.c
← back to finding ↓ download raw
/*
 * DF-1278 trigger analysis — INCONCLUSIVE (no MPT HW in guest).
 *
 * The bug is an infinite-recursion / kernel-stack-overflow in mpt_configure_ioc()
 * triggered by an LSI MPT/Fusion HBA that fails mpt_reset / mpt_get_iocfacts /
 * mpt_get_portfacts at attach time. Reproduction requires:
 *   - a DragonFlyBSD system with a (malicious or buggy) MPT/Fusion PCI HBA
 *     attached, OR
 *   - a way to inject faults into mpt_reset / mpt_get_iocfacts at attach.
 *
 * Neither is possible from an unprivileged user, and no MPT PCI device exists
 * in the QEMU audit guest (pciconf -l shows only i440FX/PIIX/ACPI/virtio/
 * std-VGA), so the vulnerable code path is never executed here.
 *
 * This file is therefore a static verification marker, not a runtime trigger.
 * Source-level proof of the bug is in VERDICT.md.
 *
 * Build: N/A (no binary needed; analysis-only).
 * Run  : N/A
 *
 * $DragonFly$
 */
int df1278_trigger_marker = 0;