⬢ DragonFlyBSD Kernel Audit
DF-3570 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3570",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Not runtime-reproducible on the audit guest (virtio-net only, NO_REALTEK_HW in env.txt/run.log); recorded honestly instead of fabricated. Source-level proof is complete and mechanical: MP_ReadOtherFunPciEConfigSpace (re.c:31163-31192) initializes RetVal=0xffffffff at :31171 and returns it at :31191 without ever reading the RE_CSIDR data register (the write twin uses it at :31148), so every caller gets the constant 0xffffffff. Consequence 1 (panic): re_init_software_variable:4456-4457 sees bit0 set in 0xffffffff, skips bus_space_map(:4468); for MACFG_70/71/72 (RTL8168FP/RTL8117, HwSuppDashVer=3 per :4413-4417) re_cmac_handle is assigned the NULL re_mapped_cmac_handle at :4487 (also NULL for non-DASH SKUs since mapping is gated by sc->re_dash at :4451); re_exit_oob:3588-3596 then calls Dash2DisableTxRx at attach (if_re.c:772), whose !re_dash guard is commented out (:3447), producing RE_CMAC_READ_1/WRITE_1 on bus_space handle NULL at offset 0xF8/0xF9/0xFB \u2014 on x86_64 that is *(volatile u_int8_t *)(0+0xF9) (bus_dma.h:135-141) \u2014 a deterministic NULL-page kernel fault at driver attach on that silicon. Consequence 2 (misconfiguration): all live CSIAR read-modify-write consumers (re.c:3891-3893; 14 sites in re_hw_start_unlock incl. 5765/5806/.../6952; 7414 in re_hw_start_unlock_8125) RMW with 0xffffffff, clobbering NIC PCIe config dwords meant to be partially preserved (e.g. 5765-5768 yields 0xffffffff). nm proves the vulnerable functions are compiled into the stock /boot/kernel/if_re.ko on the guest and kldload if_re succeeds (no device match). Severity Low: hardware-gated, not unprivileged-user-triggerable; real-world effect is a boot-time panic on machines with an RTL8117/8168FP and wrong PCIe config on common 8168 chips.",
  "exploit_chain": "",
  "evidence": "proof.log (mechanical re-derivation of every chain link; ALL CHAIN LINKS VERIFIED); run.log + env.txt (guest uname 6.5-DEVELOPMENT, pciconf virtio-only, nm shows MP_ReadOtherFunPciEConfigSpace/Dash2DisableTx/re_rar_set/rtl_set_eaddr in shipped if_re.ko); VERDICT.md (full narrative with path:line); fix.diff (restore RetVal = CSR_READ_4(sc, RE_CSIDR); NULL-handle guards in Dash2*/MACFG_70-72 assignment)",
  "kernel_refs": [
    "sys/dev/netif/re/re.c:31163",
    "sys/dev/netif/re/re.c:31171",
    "sys/dev/netif/re/re.c:31191",
    "sys/dev/netif/re/re.c:4456",
    "sys/dev/netif/re/re.c:4487",
    "sys/dev/netif/re/re.c:3588",
    "sys/dev/netif/re/re.c:3445",
    "sys/dev/netif/re/re.c:3891"
  ],
  "poc_changes": "No runnable PoC exists for userland (fault is at device attach); trigger.c documents the trigger; proof.sh replaces the runtime PoC with a mechanical source-proof harness; guest evidence limited to module symbol presence + kldload per the orchestrators hardware-unreachability guidance.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "n/a (attach-time fault; proof.sh is the verification harness)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l; kldload if_re; nm /boot/kernel/if_re.ko | grep -E \"Dash2|MP_ReadOtherFunPciEConfigSpace\" ; ./findings/poc/DF-3570/proof.sh",
  "code_hash": "c999776722d6cdf8aa2b3a5609f2f728bf60b0d7f715f71c71466444715b8bf5",
  "notes": "Guest kept clean (if_re not left loaded, guest up). DF-1117 (re_rar_set OOB) known from pass 1 and NOT re-reported. Broken-read collateral includes MP_ReadByteFun0PciEConfigSpace consumers (re.c:7414).",
  "recommended_fix": "Add the dropped data-register read (RetVal = CSR_READ_4(sc, RE_CSIDR)) in MP_ReadOtherFunPciEConfigSpace and guard Dash2DisableTx/Rx plus the MACFG_70-72 cmac assignment against a NULL re_cmac_handle.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restores the RE_CSIDR read (mirrors the write path at re.c:31148) and adds NULL-handle guards so Dash2* can never fault through an unmapped CMAC window. Runtime before/after validation requires RTL8168FP/RTL8117 hardware which the audit guest does not have (virtio-net only); validation was therefore not possible and is recorded as not_testable rather than claimed.",
  "fix_evidence": "fix.diff (git-apply-able vs sys/dev/netif/re/re.c); VERDICT.md Fix section; proof.log chain link [1] would flip to FAIL once the read is restored (guard built into proof.sh)."
}