⬢ DragonFlyBSD Kernel Audit
DF-3626 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3626",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime inconclusive: intel_dp_check_mst_status() (sys/dev/drm/i915/intel_dp.c:4294-4323) retries the sink-driven ESI handshake via goto go_again with no iteration bound; drm_dp_mst_hpd_irq() (sys/dev/drm/drm_dp_mst_topology.c:2450-2473) returns handled=true whenever the sink keeps DP_DOWN_REP_MSG_RDY/UP_REQ_MSG_RDY set or toggles the 6-bit sink count, so a malicious MST branch device livelocks the dp_wq hotplug kthread forever, leaks the intel_display_power_get() reference taken at intel_dp.c:5684, and starves all display hotplug handling until reboot. Could not be exercised at runtime because the audit guest is virtio-only (vgapci chip 0x1111:1234): i915 never PCI-attaches and /dev/dri does not exist; however the vulnerable function ships in the stock /boot/kernel/i915.ko (nm: 00000000000cbd80 t intel_dp_check_mst_status; loop debug strings present) and enable_dp_mst defaults to true (i915_params.h:69). Expected impact on real HSW+ hardware: kernel DoS via evil dock/monitor (physical-access vector).",
  "exploit_chain": "evil DP branch device -> advertise DPCD rev>=0x12 + DP_MSTM_CAP(MST) -> i915 enters MST -> device asserts one short HPD -> kernel reads ESI (0x2002..0x200f) -> device always returns esi[1]|DP_DOWN_REP_MSG_RDY and ignores the clear-writes -> intel_dp_check_mst_status() loops go_again forever -> dp_wq kthread busy-spins, display power-well refcount leaked, all-port HPD dead until reboot (DoS). No memory-corruption primitive, no escalation path.",
  "evidence": "VERDICT.md (full path trace table + guest hardware proof); README.md (loop anatomy, attacker spec, consequences); env.txt (guest pci/kld state); fix.diff (bounded-bounce patch). Decisive lines: intel_dp.c:4294 (go_again label), 4306-4322 (handled->clear->re-read->goto), drm_dp_mst_topology.c:2455-2470 (handled set from sink bits only).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_dp.c:4287",
    "sys/dev/drm/i915/intel_dp.c:4294",
    "sys/dev/drm/i915/intel_dp.c:4306",
    "sys/dev/drm/i915/intel_dp.c:4319",
    "sys/dev/drm/i915/intel_dp.c:5684",
    "sys/dev/drm/i915/intel_dp.c:5687",
    "sys/dev/drm/drm_dp_mst_topology.c:2450",
    "sys/dev/drm/drm_dp_mst_topology.c:2462",
    "sys/dev/drm/i915/intel_hotplug.c:496"
  ],
  "poc_changes": "No seed PoC existed; this is a hardware-in-the-loop bug (malicious DP sink). The evidence pack documents the exact evil-sink DPCD behavior spec instead of a runnable host program, plus proof the vulnerable code ships in the default-install kernel module.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff bounds the go_again loop to 8 bounces and emits a hotplug event + DRM_ERROR on exhaustion; could not be build-validated on this guest because the target path requires Intel display hardware (no i915 attach on virtio guest) and a hostile sink to drive it.",
  "fix_evidence": "findings/poc/DF-3626/fix.diff",
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Upstream-inherited bug (Linux 4.14-era intel_dp.c has the identical loop; still present in current Linux). Guest checks: pciconf chip=0x11111234 (virtio), no drm kld loaded, /dev/dri absent, i915.ko present in /boot/kernel with symbol at 0xcbd80.",
  "recommended_fix": "Bound the go_again bounce count (e.g. 8) in intel_dp_check_mst_status(); on exhaustion schedule a full hotplug reprobe instead of looping."
}