⬢ DragonFlyBSD Kernel Audit
DF-3612 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3612",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Same malicious-VBIOS DoS family as DF-1137 (fan-table t_diff) but a distinct sink pair. radeon_atombios_get_asic_ss_info() copies ss->rate from the VBIOS ASIC_InternalSS_Info entry verbatim and returns true; si_calculate_sclk_params:4831 divides by (reference_divider * ss.rate) and si_populate_mclk_value:4931 divides by ss.rate whenever the SS entry matches the target clock (pi->sclk_ss/pi->mclk_ss set from the same VBIOS table). rate==0 -> div -> #DE -> kernel panic during si_dpm_enable power-state upload. Harness executes the exact expressions in forked children: SIGFPE (signal 4) on both sinks == kernel #DE panic. No AMD GPU on the audit guest for a live trigger.",
  "exploit_chain": "crafted VBIOS SS entry with usSpreadRateInKhz=0 + SS tables present -> sclk/mclk SS programming on every power-level conversion -> div by 0 -> #DE -> panic at DPM enable (boot-time DoS)",
  "evidence": "run.log [A1]/[A2]: child died from SIGFPE (signal 4): integer divide by zero at both :4831 and :4931 replicas; [B]: rate=0 -> rc=-1 (SS skipped, no trap)",
  "kernel_refs": [
    "sys/dev/drm/radeon/si_dpm.c:4831",
    "sys/dev/drm/radeon/si_dpm.c:4832",
    "sys/dev/drm/radeon/si_dpm.c:4931",
    "sys/dev/drm/radeon/radeon_atombios.c:1546"
  ],
  "poc_changes": "n/a (pass-2 finding authored with its harness; no seeded PoC to fix)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd findings/poc/DF-3612 && sh build.sh",
  "run_cmd": "cd findings/poc/DF-3612 && sh run.sh",
  "code_hash": "e982fcd8e622970f94a7e4500cc48b47ddc47f35f805f093e090f2b7b82a95e3",
  "notes": "Harness-level reproduction (exact kernel expressions executed with crafted-VBIOS inputs; SIGSEGV/SIGFPE/corruption observed). No AMD SI GPU on the virtio-only QEMU guest -> no live radeon DPM path possible; radeon.ko present at /boot/kernel. Guest /usr/src restored to pristine (sha 774b9b851b3b4ccb...) after fix validation.",
  "recommended_fix": "see fix.diff",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "git apply --check OK (standalone and stacked with the other four si_dpm.c fixes); targeted module TU compile `make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC si_dpm.o` => rc=0, -Werror clean (87080 B). Harness fixed-path shows the primitive gone (fix.diff adds `if (ss.rate == 0) return -EINVAL;` in both SS blocks. git apply --check OK; stacked module TU compile -Werror clean; harness [B] no trap with sane-rate path still rc=0.)",
  "fix_evidence": "fix.diff adds `if (ss.rate == 0) return -EINVAL;` in both SS blocks. git apply --check OK; stacked module TU compile -Werror clean; harness [B] no trap with sane-rate path still rc=0."
}