⬢ DragonFlyBSD Kernel Audit
DF-1716 / run.log
← back to finding ↓ download raw 
harness.c: In function 'legit_intr':
harness.c:46:30: warning: unused parameter 'a' [-Wunused-parameter]
 static void legit_intr(void *a) { irq_call_count++; }
                        ~~~~~~^
BUILD_EXIT=0
---run---
=== DF-1716 nata AHCI OOB interrupt[] harness ===
ctlr->channels = 32 (from CAP.NP+1 / PI), interrupt[] size = 8 slots
struct intr_slot = 16 bytes, interrupt[] = 128 bytes

--- Phase 1: ata-pci.c:230 attach loop + ata_pci_setup_intr (ata-pci.c:383) ---
[!!] OOB WRITE: interrupt[8] -> byte offset +128 past interrupt[] base (+0 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[9] -> byte offset +144 past interrupt[] base (+16 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[10] -> byte offset +160 past interrupt[] base (+32 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[11] -> byte offset +176 past interrupt[] base (+48 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[12] -> byte offset +192 past interrupt[] base (+64 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[13] -> byte offset +208 past interrupt[] base (+80 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[14] -> byte offset +224 past interrupt[] base (+96 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[15] -> byte offset +240 past interrupt[] base (+112 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[16] -> byte offset +256 past interrupt[] base (+128 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[17] -> byte offset +272 past interrupt[] base (+144 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[18] -> byte offset +288 past interrupt[] base (+160 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[19] -> byte offset +304 past interrupt[] base (+176 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[20] -> byte offset +320 past interrupt[] base (+192 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[21] -> byte offset +336 past interrupt[] base (+208 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[22] -> byte offset +352 past interrupt[] base (+224 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[23] -> byte offset +368 past interrupt[] base (+240 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[24] -> byte offset +384 past interrupt[] base (+256 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[25] -> byte offset +400 past interrupt[] base (+272 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[26] -> byte offset +416 past interrupt[] base (+288 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[27] -> byte offset +432 past interrupt[] base (+304 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[28] -> byte offset +448 past interrupt[] base (+320 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[29] -> byte offset +464 past interrupt[] base (+336 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[30] -> byte offset +480 past interrupt[] base (+352 past object end of interrupt[8])
[!!] OOB WRITE: interrupt[31] -> byte offset +496 past interrupt[] base (+368 past object end of interrupt[8])
Phase 1 result: 24 OOB writes performed (expected 24 for channels=32)

--- Phase 2: ata_generic_intr (ata-pci.c:584-586) on each IRQ ---
[!!] OOB READ + indirect call at interrupt[8]: function=0xaaaaaaaaaaaaaaaa argument=0xaaaaaaaaaaaaaaaa (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[9]: function=0xaaaaaaaaaaaaaaaa argument=0xaaaaaaaaaaaaaaaa (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[10]: function=0xaaaaaaaaaaaaaaaa argument=0xaaaaaaaaaaaaaaaa (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[11]: function=0xaaaaaaaaaaaaaaaa argument=0xaaaaaaaaaaaaaaaa (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[12]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[13]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[14]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[15]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[16]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[17]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[18]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[19]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[20]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[21]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[22]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[23]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[24]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[25]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[26]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[27]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[28]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[29]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[30]: function=0x0 argument=0x0 (attacker-controlled RIP)
[!!] OOB READ + indirect call at interrupt[31]: function=0x0 argument=0x0 (attacker-controlled RIP)
Phase 2 result: 24 OOB-read+call per IRQ (expected 24 for channels=32)
legit IRQ dispatches: 8

VERDICT: BUG CONFIRMED. AHCI reporting 32 channels causes 24 OOB
writes on attach and 24 OOB function-pointer reads+calls per IRQ
(384 bytes heap corruption, full RIP control with heap grooming).
RUN_EXIT=0