⬢ DragonFlyBSD Kernel Audit
DF-3579 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3579",
  "status": "untested",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "NULL-deref in iwn_ampdu_tx_done(): iwn4965_tx_done/iwn5000_tx_done route any TX_DONE whose firmware qid >= firstaggqueue into iwn_ampdu_tx_done, which dereferences sc->qid2tap[qid] (if_iwn.c:3765-3768) without a NULL check; the pointer is NULL outside an active TX aggregation session (cleared on teardown at if_iwn.c:7463/7532/3303/3874). A stale or forged TX_DONE for an aggregation queue panics the kernel. Untestable on the virtio-only audit guest (no iwn hardware); trigger requires malicious firmware (drivers stated trust boundary, same as DF-1122) or a narrow teardown race with benign firmware \u2014 hence likely, not certain.",
  "exploit_chain": "malicious/buggy firmware emits TX_DONE with qid in [firstaggqueue, 15] while no aggregation session is bound -> iwn_ampdu_tx_done reads tap->txa_tid through NULL -> kernel panic (DoS).",
  "evidence": "VERDICT.md (full source trace), fix.diff (guard), README.md.",
  "kernel_refs": [
    "sys/dev/netif/iwn/if_iwn.c:3587",
    "sys/dev/netif/iwn/if_iwn.c:3600",
    "sys/dev/netif/iwn/if_iwn.c:3617",
    "sys/dev/netif/iwn/if_iwn.c:3635",
    "sys/dev/netif/iwn/if_iwn.c:3765",
    "sys/dev/netif/iwn/if_iwn.c:3766",
    "sys/dev/netif/iwn/if_iwn.c:7440",
    "sys/dev/netif/iwn/if_iwn.c:7532"
  ],
  "poc_changes": "none \u2014 no PoC authored; a userland model of a NULL deref adds nothing over the source trace, and the in-kernel path needs absent hardware.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Sibling of DF-1122 (compressed_ba qid2tap indexing) in the TX_DONE path; distinct function and dispatch condition, not covered by the pass-1 findings text.",
  "recommended_fix": "Add if (qid >= sc->ntxqs || sc->qid2tap[qid] == NULL) return; at the top of iwn_ampdu_tx_done (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (bound + NULL guard) but not validated: no runtime reproduction exists on this guest (no iwn hardware).",
  "fix_evidence": "findings/poc/DF-3579/fix.diff"
}