{
  "finding_id": "DF-2300",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "limited_write",
  "confidence": "certain",
  "verdict": "Operator-group user wrote attacker-chosen 32-bit values into the OHCI DMA context command pointer (0x18c), interrupt mask (0x88), HCC link control (0x50) and version registers, and executed the PHY access ioctls, all through the unmodified fwohci_ioctl (fwohci.c:333-398) reached via the real fwdev.c dispatch (fwdev.c:694) on the /dev/fw0.0 node with stock 0660 root:operator permissions. No privilege check exists anywhere on the path; root cross-check of the emulated register file confirmed every value landed. On real hardware this register set programs the DMA engine (context command pointers to attacker physical addresses): the classic FireWire arbitrary-physical-R/W primitive on non-IOMMU systems, plus controller reset and PHY bus disruption. Hardware impact is assessment on this hardware-less guest; the missing-gate primitive itself is mechanically proven. Also observed: fwdev.c:694 discards fc->ioctl return values, so even the addr>0x800 EINVAL never reaches userspace.",
  "exploit_chain": "unpriv user in operator group -> open /dev/fw0.0 (0660) -> FWOHCI_WRREG{addr<=0x800, data} -> fw_ioctl default -> fwohci_ioctl -> OWRITE into controller register file. On real hardware: program AT/AR/IR context CommandPtr to target physical memory -> DMA engine moves attacker data to/from arbitrary physical addresses -> kernel text/cred overwrite -> uid=0 (assessed, not demonstrable on the QEMU guest without OHCI hardware).",
  "evidence": "run.log: FWOHCI_WRREG(0x18c,0xdeadbee0) rc=0 readback=0xdeadbee0 plus 0x88/0x50/0x00 writes, RDREG read-backs, PHY ioctls rc=0, root CTL_REGRD confirms MMIO file holds attacker values; run_fixed.log: patched kernel - opuser writes no longer land (MMIO unchanged) while root still programs registers",
  "kernel_refs": ["sys/bus/firewire/fwohci.c:333", "sys/bus/firewire/fwohci.c:354", "sys/bus/firewire/fwohci.c:363", "sys/bus/firewire/fwohci.c:381", "sys/bus/firewire/fwohci.c:387", "sys/bus/firewire/fwdev.c:694", "sys/bus/firewire/firewire.h:404"],
  "poc_changes": "Built the OHCI-side verbatim-interposition rig (fwohci_harness.c) extending the DF-2293 fwdev rig: fwohci.c TU-included unmodified, emulated MMIO register file via bst=MEM/bsh=&regs (x86_64 bus_space is a direct KVA dereference), emulated PHY with 1ms completion callout, fabricated parent bus_dma tags, softc injected as unit 0 of the real firewire_devclass, /dev/fw0.0 against stock firewire_ops 0660 root:operator, root-only /dev/fwoctl0 control device; userland trigger fwpoc.c (FWOHCI_* ioctls + rig control).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #4: Sun Oct 18 12:45:22 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/FWO  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=FWO && make installkernel KERNCONF=FWO (harness: prep_guest.sh; userland: cc -O -Wall -o fwpoc fwpoc.c)",
  "run_cmd": "sh /root/fwo/run2300.sh   (opuser via su; root cross-check via /dev/fwoctl0)",
  "code_hash": "32c9c567b4185994d7189b0afb68d72d9d4a3d1c02bdd62424d762a660ee24fd",
  "notes": "Rig PHY-write emulation completes on a 1ms tick while fwphy_wrdata waits only 100us, so the emulated PHY can miss write data; the ioctl path and the absent privilege check are unaffected. The stock kernel links fwohci.c (conf/files: optional firewire) even without hardware; /dev/fw* only appears when a controller attaches.",
  "recommended_fix": "Add caps_priv_check(ap->a_cred, SYSCAP_NODRIVER) gate to fwohci_ioctl before the register/PHY switch (fix.diff)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #4: Sun Oct 18 12:45:22 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWO x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel: identical opuser commands leave the register file untouched (CTL_REGRD shows pre-test values, PHY regs unchanged) while root via /dev/fw0.0 still writes/reads registers normally (0x600d0001 round-trip). Gate effective, functionality preserved.",
  "fix_evidence": "run_fixed.log DF-2300 section: opuser WRREG/RDREG/PHY ioctls no longer modify MMIO; root cross-check CTL_REGRD=0x0; root write+readback works"
}