DragonFlyBSD Kernel Audit
DF-2202 / run.log
← back to finding ↓ download raw
BUILD_EXIT=0
DF-2202 trigger stub — amdgpu df_v1_7 OOB array index
table df_v1_7_channel_number[] has 9 entries (indices 0..8)
IntLvNumChan field is 4-bit -> values 0..15

  field= 0  ->  INDEX  0  IN-BOUNDS  value=1
  field= 1  ->  INDEX  1  IN-BOUNDS  value=2
  field= 2  ->  INDEX  2  IN-BOUNDS  value=0
  field= 3  ->  INDEX  3  IN-BOUNDS  value=4
  field= 4  ->  INDEX  4  IN-BOUNDS  value=0
  field= 5  ->  INDEX  5  IN-BOUNDS  value=8
  field= 6  ->  INDEX  6  IN-BOUNDS  value=0
  field= 7  ->  INDEX  7  IN-BOUNDS  value=16
  field= 8  ->  INDEX  8  IN-BOUNDS  value=2
  field= 9  ->  INDEX  9  OOB  (u32 read at offset 0 word(s) = 0 byte(s) past end)
  field=10  ->  INDEX 10  OOB  (u32 read at offset 1 word(s) = 4 byte(s) past end)
  field=11  ->  INDEX 11  OOB  (u32 read at offset 2 word(s) = 8 byte(s) past end)
  field=12  ->  INDEX 12  OOB  (u32 read at offset 3 word(s) = 12 byte(s) past end)
  field=13  ->  INDEX 13  OOB  (u32 read at offset 4 word(s) = 16 byte(s) past end)
  field=14  ->  INDEX 14  OOB  (u32 read at offset 5 word(s) = 20 byte(s) past end)
  field=15  ->  INDEX 15  OOB  (u32 read at offset 6 word(s) = 24 byte(s) past end)

7 of 16 possible field values land OUT-OF-BOUNDS on the table.
OOB reads land at offset 0..6 u32 words (0..24 bytes) past the end
of the static array, reading whatever 4-byte word lives there.
RUN_EXIT=0