# env.txt — DF-2323 / DF-2324 / DF-2325 verification environment

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT x86_64, QEMU/KVM (qemu-system-x86_64
-enable-kvm -m 4096 -smp 6), single-tenant audit guest
(dfbsd-qemu/vm.sh lifecycle).

## Kernels exercised (all built on-guest from /usr/src with cc 8.3
[DragonFly] Release/2019-02-22):
- X86_64_GENERIC  (stock, INVARIANTS)          -- pre-rig state
- DFPCI   = X86_64_GENERIC + device dfpcih     -- INVARIANTS, unfixed
- DFPCIP  = DFPCI  minus options INVARIANTS    -- production config, unfixed
- DFPCIPF = DFPCIP  + fix.diff applied         -- production config, FIXED
- DFPCIF  = DFPCI   + fix.diff applied         -- INVARIANTS, FIXED

uname -a on each (from the runs):
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 18:36:44 UTC 2026  DFPCI
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 19:32:11 UTC 2026  DFPCIP
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 19:54:35 UTC 2026  DFPCIPF
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 20:08:25 UTC 2026  DFPCIF
  (all root@dfbsd:/usr/obj/usr/src/sys/<KERNCONF> x86_64)

## Kernel CFLAGS (DF-2325 determinism)
The shipped kernel compile line (cc 8.3) includes -O2 -std=gnu11
-fno-strict-overflow and does NOT include -fwrapv (cflags_evidence.txt,
build log cc line for dfpci_harness.c): signed left-shift into the sign
bit compiles to a plain shl and wraps deterministically on this build.

## Harness
bus/pci/dfpci_harness.c compiled INTO each kernel (conf/files entry
"bus/pci/dfpci_harness.c  optional  dfpcih"); runtime kldload GPFs on
this guest, hence kernel-compiled.  The harness TU = dfpci_pre.c
(rename map + interposition) + VERBATIM extracted pci.c functions
(sha256-gated) + dfpci_post.c (fabricated pcicfg device state, VPD
register-protocol state machine with attacker-set stall point, BAR
sizing readback, kmalloc/krealloc/kfree trackers, hard-IRQ systimer
watchdog, sysctl debug.dfpcih.cmd interface).

Verbatim gates:
  unfixed blob sha256 8ffb21d3a1cf2dd797ce998420cfb8a67a4c5192155a9719abda88f2b6a1e463
  fixed   blob sha256 83f1ae552944335f5546f8142cdd1c6b515cc3804e58ccc2801c7015cc2e45fd
  guest pci.c (unfixed) 198a32bea84f635ab6c2b674094f2d19ed7099ee78efe4f1f7d74c5aa8220aeb
  guest pci.c (fixed)   e641613db50b492c9c42bfd3cfc57b26b86b28a3287f15384bc7b62a568bdcaa

## Reachability honesty (all three findings)
Threat model is a malicious PCI device (AV:P physical / VM with crafted
PCI passthrough), not an unprivileged local user:
- DF-2323/DF-2324 paths run at device enumeration / driver VPD fetch.
  pci_read_vpd is reached lazily via pci_get_vpd_ident/readonly, called
  by in-tree drivers (vga_pci.c:544, if_age.c) on devices that expose a
  VPD capability; pci_read_capabilities/pci_find_extcap_method run for
  every device at attach (boot or hotplug rescan).
- No userland trigger for any of the three on an unmodified system; the
  harness sysctl is the injection point for the fabricated device only.