⬢ DragonFlyBSD Kernel Audit
DF-3629 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-3629",
  "status": "inconclusive",
  "reproduced": 0,
  "poc_path": "findings/poc/DF-3629",
  "artifact_dir": "findings/poc/DF-3629",
  "build_cmd": "n/a (no iwm hardware on guest)",
  "run_cmd": "n/a (no iwm hardware on guest)",
  "code_hash": "727da3ca96051da6d4eb49eb17f6d8daff4046d36b22da6bc6e8ee969d5f344d",
  "build_log": null,
  "run_log": null,
  "impact": "none",
  "confidence": "certain",
  "verdict": "iwm_rx_tx_cmd() indexes sc->txq[qid]/ring->data[idx] with qid/idx taken straight from the firmware-DMAd command header (if_iwm.c:3597-3604) with no bounds check; sc->txq[] has IWM_MAX_QUEUES==31 entries (if_iwmvar.h:447, if_iwmreg.h:1923) while qid is a uint8_t, so qid in 31..255 is an OOB ring access that is then WRITTEN (txd->done=1, txd->m=NULL, txd->in=NULL at :3620-3622; --ring->queued at :3627) and dereferenced (wild in->in_ni at :3480-3483,:3624). iwn twin of DF-1122 (High). Not exercisable on the audit guest: if_iwm.ko loads but no Intel Wireless PCI device exists, so the TX-completion path never runs (env.txt). Source-level certainty: the arithmetic and the write sites are unconditional on that path.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (source trace + guest reality); README.md (arithmetic); env.txt (no-device proof); fix.diff (applies clean)",
  "kernel_refs": [
    "sys/dev/netif/iwm/if_iwm.c:3588",
    "sys/dev/netif/iwm/if_iwm.c:3597",
    "sys/dev/netif/iwm/if_iwm.c:3601",
    "sys/dev/netif/iwm/if_iwm.c:3620",
    "sys/dev/netif/iwm/if_iwm.c:3624",
    "sys/dev/netif/iwm/if_iwm.c:5453",
    "sys/dev/netif/iwm/if_iwmvar.h:447",
    "sys/dev/netif/iwm/if_iwmreg.h:1923"
  ],
  "poc_changes": "n/a - source-level verification; no runnable kernel PoC possible without iwm hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "notes": "iwm module loads on guest (kldload if_iwm) but attaches to no device: pciconf shows no Intel Wireless NIC, no wlan interface appears. Verification is source-level (plus the DF-3631 logic-level harness).",
  "recommended_fix": "fix.diff (qid/idx bounds check + drop) applies cleanly to sys/dev/netif/iwm/if_iwm.c",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (qid/idx bounds check + drop) applies cleanly to sys/dev/netif/iwm/if_iwm.c; in-kernel validation impossible - no iwm device on guest to generate TX completions",
  "fix_evidence": "fix.diff verified with patch --dry-run against sys/dev/netif/iwm/if_iwm.c; no kernel-level validation possible (no iwm device)"
}