⬢ DragonFlyBSD Kernel Audit
DF-2612 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
{
  "finding_id": "DF-2612",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CODE-CONFIRMED, LIVE-UNREACHABLE (missing_setup): the fail-open is certain from source — ses_getputstat assigns ENODEV to err at scsi_ses.c:1270/1274 and the SEND_DIAGNOSTIC transport error at :1283, then unconditionally 'return (0)' at :1287, so all four SESIOC vector entries (get_encstat :998-1008 caches 0|ENCI_SVALID, get_objstat :1025-1044 caches zeroed status as valid, set_encstat :1010-1022 and set_objstat :1047-1065 confirm unwritten control ops) report success on malformed/short device data. Live execution requires a SES/SAF-TE enclosure device: the QEMU guest has none (camcontrol devlist shows only a QEMU DVD-ROM; /dev/sesN absent) and QEMU cannot emulate an SES target, so no runtime reproduction was possible. The defect, its root cause, and the one-line fix are verified line-precisely; live impact on real hardware remains unexercised (root-gated 0600 node + crafted enclosure preconditions unchanged).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2612/VERDICT.md — full line-precise trace of the dead err and all four downstream vector entries",
    "findings/poc/DF-2612/env.txt — guest inventory proving the missing-setup blocker (no ses(4) device)",
    "findings/poc/DF-2612/fix.diff — 'return (err);' at scsi_ses.c:1287, dry-run verified against pristine sys/"
  ],
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_ses.c:1268",
    "sys/bus/cam/scsi/scsi_ses.c:1270",
    "sys/bus/cam/scsi/scsi_ses.c:1274",
    "sys/bus/cam/scsi/scsi_ses.c:1283",
    "sys/bus/cam/scsi/scsi_ses.c:1287",
    "sys/bus/cam/scsi/scsi_ses.c:998",
    "sys/bus/cam/scsi/scsi_ses.c:1025",
    "sys/bus/cam/scsi/scsi_ses.c:1010",
    "sys/bus/cam/scsi/scsi_ses.c:1047",
    "sys/bus/cam/scsi/scsi_ses.c:350"
  ],
  "poc_changes": "verify mode, no seed: no PoC was runnable — an availability-check script (check_env.sh) documents the blocker",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "n/a (no SES device to build against; see check_env.sh)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root 'sh findings/poc/DF-2612/check_env.sh'  # exits 1: no /dev/sesN",
  "code_hash": "ce40c5ed0bf84729dcc9e4854bc5a902fa1e50c91a42bcd97c2fad0173c093d4",
  "notes": "missing_setup blocker: guest exposes only <QEMU QEMU DVD-ROM 2.5+> at scbus1 target 0 lun 0 (sg0,pass0,cd0); ses(4) never attaches, /dev/ses* absent; emulating an SES target under QEMU is not possible without fabricating hardware (out of scope). fix_status=not_testable for the same reason. The 'return (err)' fix needs no caller changes (traced: get_objstat returns before caching on error at :1032-1033; set_* propagate at :1017-1019/:1062-1064).",
  "recommended_fix": "scsi_ses.c:1287: return the computed error instead of 0 (return (err);) so SESIOC_GET/SET{ENCSTAT,OBJSTAT} fail closed",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is the mechanical one-liner (return err); applies cleanly (patch -p1 dry-run) but cannot be behavior-validated without an SES device",
  "fix_evidence": "findings/poc/DF-2612/fix.diff"
}