⬢ DragonFlyBSD Kernel Audit
DF-3593 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3593",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-certain NULL-deref/KASSERT panic on duplicate firmware TX-done; the drivers own comment (if_bwn.c:7088-7091) admits duplicates occur in the field. Runtime trigger impossible on the audit guest: virtio-only QEMU box has no Broadcom 802.11 PCI device (see run.log), and the driver is compiled into the stock kernel (X86_64_GENERIC:267-268) with INVARIANTS (:56), so any BCM43xx-equipped stock DF system panics at KASSERT if_bwn.c:5996; non-INVARIANTS builds NULL-deref at if_bwn.c:6012 (meta->mt_ni->ni_vap) or if_bwn.c:6052 (tp->tp_m->m_pkthdr.len). Secondary effect: dr_usedslot double-decrement (if_bwn.c:6024) corrupts TX-ring free-slot accounting (bwn_dma_freeslot at :5425).",
  "exploit_chain": "",
  "evidence": "VERDICT.md full path:line trace; run.log = guest probe (driver resident, hw absent); fix.diff guards duplicate completion state in both DMA and PIO engines",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn.c:5996",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6012",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6024",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6052",
    "sys/dev/netif/bwn/bwn/if_bwn.c:7088"
  ],
  "poc_changes": "No runnable PoC possible without hardware; probe.sh substitutes, proving residency+absence",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC, INVARIANTS)",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level; probe.sh only)",
  "run_cmd": "vm.sh run_root sh probe.sh",
  "code_hash": "1dd0c720eadc950b8900406eb0ca725b8ba6f8b9f6969a1e3214900e2a1dc703",
  "notes": "Distinct from pass-1 DF-1132 (dr==NULL deref on invalid cookie queue nibble in bwn_dma_parse_cookie); this finding is a VALID cookie for an already-completed slot in bwn_dma_handle_txeof/bwn_pio_handle_txeof. No uid0 chain: crash-only primitive, cookie slot stays range-checked.",
  "recommended_fix": "Peek the BODY descriptor (mt_m == NULL) / PIO tp_m == NULL before completing; drop duplicate TX-done statuses",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; cannot baseline-validate without BCM43xx hardware on the guest",
  "fix_evidence": "fix.diff in this pack"
}