⬢ DragonFlyBSD Kernel Audit
DF-2846 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-2846",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CPU topology sysctl strings (hw.cpu_topology.members, per-cpu physical_siblings/core_siblings) are rendered at SI_BOOT2_CPU_TOPOLOGY while ncpus is still 1 (APs start later at SI_BOOT2_START_APS), so CPUSET_FOREACH only ever tests bit 0 and the exported strings are wrong on every SMP system; proven live on the 6-vCPU QEMU guest (members=cpus(0) vs correct tree cpus(0-5)). Second manifestation: fix_amd_topology()'s lwkt_cpusync is masked to the BSP-only smp_active_mask at that stage, so compute_unit_id is only set on the BSP node and the AMD compute-unit merge degenerates. No memory-safety impact: information-quality/scheduling bug only.",
  "exploit_chain": "",
  "evidence": [
    "run.log: 'hw.ncpu: 6' + 'hw.cpu_topology.members: cpus(0)' + 'cpu1.core_siblings: cpus()' + tree sysctl showing 'cpus(0-5)' + final 'BUG REPRODUCED' line",
    "VERDICT.md: full source trace of the sysinit ordering (kernel.h:156-158, mp_machdep.c:384/544, machdep.c:2687) into CPUSET_FOREACH's ncpus bound (cpu_topology.h:63-65) and into lwkt_cpusync_interlock masking (lwkt_ipiq.c:855-856)"
  ],
  "kernel_refs": [
    "sys/kern/subr_cpu_topology.c:563-610",
    "sys/kern/subr_cpu_topology.c:656-660",
    "sys/kern/subr_cpu_topology.c:727",
    "sys/kern/subr_cpu_topology.c:823-824",
    "sys/kern/subr_cpu_topology.c:285",
    "sys/sys/cpu_topology.h:63-65",
    "sys/sys/kernel.h:156-158",
    "sys/platform/pc64/x86_64/machdep.c:2687",
    "sys/platform/pc64/x86_64/mp_machdep.c:384",
    "sys/platform/pc64/x86_64/mp_machdep.c:544",
    "sys/kern/lwkt_ipiq.c:855-856"
  ],
  "poc_changes": "Seed sketch reduced to a pure-sysctl shell script (no kernel module or build needed); added per-cpu sibling enumeration and an explicit PASS/BUG verdict line comparing against hw.ncpu and the lazily-rendered tree.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "none (sysctl-only)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root 'sh /root/df2846_check.sh'",
  "code_hash": "2c85e2c71091a8260ae03b75d3572aa5bff4ff39212232d8a4cb245f12f4aaa3",
  "notes": "Fix validation via patched-kernel rebuild skipped per contract (mandatory only for reproduced memory-corruption findings); fix.diff authored against read-only sys/ tree, never applied. AMD compute-unit manifestation source-proven only (guest is Intel; fix_amd_topology short-circuits at the vendor check). Guest left clean; no panic; no writes beyond /root/df2846_check.sh.",
  "recommended_fix": "In sbuf_print_cpuset, iterate the full mask width (i < MAXCPU with CPUMASK_TESTBIT) instead of CPUSET_FOREACH's ncpus-bounded loop; separately defer the fix_amd_topology compute-unit pass until after SI_BOOT2_START_APS."
}