⬢ DragonFlyBSD Kernel Audit
DF-3617 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3617",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ath_intrs HAL_INT_SWBA TDMA branch (if_ath.c:2186-2190) passes TAILQ_FIRST(&ic->ic_vaps) unchecked into ath_tdma_beacon_send (which dereferences ATH_VAP(vap)->av_bcbuf) and then dereferences vap->iv_tdma->tdma_bintval. iv_tdma is NULL for every non-TDMA vap (wlan/ieee80211_tdma.c:197 allocates it only for TDMA vaps). sc_tdma is cleared only when sc_nvaps==0 (if_ath.c:1855-1858), so destroying the TDMA vap while a sibling vap remains leaves sc_tdma=1 with a NULL-iv_tdma vap at the list head: the next SWBA interrupt NULL-derefs in hard interrupt context (deterministic given the vap ordering; no timing luck needed). A teardown race variant also exists (an ISR already past ath_hal_intrpend at 2090 keeps running after ath_hal_intrset(ah,0) at 1785; SWBA processing holds no lock that vap detach respects). Not executable on the audit guest: no Atheros NIC means no SWBA can ever be raised (env.txt). Impact class: kernel panic / local DoS requiring admin-level TDMA vap reconfiguration.",
  "exploit_chain": "",
  "evidence": "README.md/VERDICT.md line-cited traces; env.txt (no ath hardware); fix.diff applies clean (git apply --check)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath.c:2186",
    "sys/dev/netif/ath/ath/if_ath.c:2190",
    "sys/dev/netif/ath/ath/if_ath.c:1855",
    "sys/dev/netif/ath/ath/if_ath_tdma.c:615",
    "sys/netproto/802_11/wlan/ieee80211_tdma.c:197"
  ],
  "poc_changes": "n/a - no seeded PoC; analysis-only pack (hardware-interrupt path, no HW on guest)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Fix also recommends clearing sc_tdma when the last TDMA vap (not last vap overall) is destroyed; minimal ISR guard is in fix.diff.",
  "recommended_fix": "Guard vap==NULL/iv_tdma==NULL in the SWBA TDMA branch and clear sc_tdma on last TDMA vap destruction",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds ISR-side guards; applies clean via git apply --check but no ath hardware exists to run baseline/patched comparison",
  "fix_evidence": "findings/poc/DF-3617/fix.diff"
}