⬢ DragonFlyBSD Kernel Audit
DF-3615 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3615",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Missing driver-side clamp on hardware-fed ts->ts_antenna (uint8_t, ah_desc.h:56) used to index ast_ant_tx[8] and sc_ant_tx[8] at if_ath.c:4198-4199 on every successful TX completion. The RX twin clamps the same-class field because AR9285 NICs shipped bogusly large antenna values and crashed users (if_ath_rx.c:809-835). Not reproducible on the audit guest: no Atheros hardware (env.txt) and the write sits on the hardware TX-completion interrupt path; additionally every in-tree HAL currently emits a bounded value (0..2), making the bug latent today. Corruption geometry was measured on the guest with a KLD built in the kernel environment: ast_ant_tx@7820 with indices 183-246 landing on the sc_rx/sc_tx function-pointer method tables (8552/8736); sc_ant_tx@12832 with index 8 exactly hitting the sc_cabq pointer (12864) and indices >140 writing past the end of the 13392-byte softc heap allocation. If a HAL ever forwards a raw antenna byte (the documented AR9285-class failure mode), this is a remotely-paced kernel memory-corruption primitive.",
  "exploit_chain": "",
  "evidence": "offsets_dmesg.txt + run.log (OFF lines: sizeof=13392, ast_ant_tx=7820, sc_rx=8552, sc_tx=8736, sc_ant_tx=12832, sc_cabq=12864, reach=13852>13392); env.txt (no ath PCI dev, no dev.ath sysctl, if_ath.ko present); if_ath_rx.c:828 clamp precedent; HAL survey in VERDICT.md",
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath.c:4198",
    "sys/dev/netif/ath/ath/if_ath.c:4199",
    "sys/dev/netif/ath/ath/if_ath_rx.c:828",
    "sys/dev/netif/ath/ath_hal/ah_desc.h:56",
    "sys/dev/netif/ath/ath/if_athioctl.h:117",
    "sys/dev/netif/ath/ath/if_athvar.h:815"
  ],
  "poc_changes": "n/a - no seeded PoC; authored a KLD offset-printer (offmod.c) to convert the source-ordering claim into measured offsets",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 1,
  "build_cmd": "make -DNO_WERROR SYSDIR=/usr/src/sys (in /tmp/offmod with generated headers from /usr/obj/usr/src/sys/X86_64_GENERIC)",
  "run_cmd": "kldload ./off.ko; dmesg | grep OFF; kldunload off",
  "code_hash": "c7bd02314fceb446fdb3c8b6b99c67abf61bde85e05be111c044ab87345d4a63",
  "notes": "Latent hardening gap, not live with in-tree HALs - severity reflects that. Same defense-in-depth rationale upstream applied on RX. fix.diff applies clean (git apply --check verified) but cannot be runtime-validated without ath hardware.",
  "recommended_fix": "Clamp ts_antenna to <=7 in ath_tx_update_stats mirroring the RX-side clamp at if_ath_rx.c:828",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (git-apply clean) adds the RX-equivalent clamp; compile-checked by construction against the same tree, but no ath NIC exists on the guest to run a baseline/patched comparison",
  "fix_evidence": "findings/poc/DF-3615/fix.diff; git apply --check output in session log"
}