⬢ DragonFlyBSD Kernel Audit
DF-3637 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3637",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-level confirmed (8/8 machine-checked assertions, run.log): ath_tx_start() at sys/dev/netif/ath/ath/if_ath_tx.c:2081-2082 discards the error from ath_tx_normal_setup() (r set at :2021, if (r != 0) goto done; at :2023-2024, done: return 0;), so every setup failure (busdmamap_load NOWAIT ENOMEM, linearize failure, injected type-3 frame) permanently leaks one ath_buf plus its 10-descriptor slab and dmamap, while the caller (ath_raw_xmit :2422 / ath_transmit) believes TX succeeded and even sets the node TIM (:2444). Fixed ATH_TXBUF pool drains to ast_tx_nobuf and the interface wedges - a persistent DoS on ath(4) hosts under memory pressure. Runtime reproduction was impossible: the audit guest (DragonFly 6.5-DEVELOPMENT X86_64_GENERIC) has no Atheros hardware (dev.ath sysctl tree absent, only vtnet0/lo0), so honest status is not_reproduced/hardware-absent; impact none reflects the run, not the defects ceiling (DoS).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3637/run.log (8/8 PASS incl. done: block returns literal 0 (r discarded) citing if_ath_tx.c:2081-2084 and the freed-mbuf error paths of ath_tx_dmasetup at :320/338/349); VERDICT.md narrative; env.txt hardware-absence record for the guest.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath_tx.c:2021",
    "sys/dev/netif/ath/ath/if_ath_tx.c:2023",
    "sys/dev/netif/ath/ath/if_ath_tx.c:2081",
    "sys/dev/netif/ath/ath/if_ath_tx.c:294",
    "sys/dev/netif/ath/ath/if_ath_tx.c:320",
    "sys/dev/netif/ath/ath/if_ath_tx.c:2407",
    "sys/dev/netif/ath/ath/if_ath_tx.c:2422",
    "sys/dev/netif/ath/ath/if_ath_tx.c:2444",
    "sys/dev/netif/ath/ath/if_ath.c:3813"
  ],
  "poc_changes": "No seeded PoC existed; authored a source-level verification script (verify_df3637.py) as the reproducible artifact because the defect is hardware-gated (no ath NIC on guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "python3 findings/poc/DF-3637/verify_df3637.py (no compile: static analysis of read-only sys/ tree)",
  "run_cmd": "sh findings/poc/DF-3637/run.sh",
  "code_hash": "1ca530eef3b81616aaeaf83fc415171233bd8b7e5937129baf7bbdad8b1d41ff",
  "notes": "Pass-2 (GLM 5.3) audit of if_ath_tx.c. Upstream-inherited defect (FreeBSD if_ath_tx.c has the same done: return 0;). Severity Low: resource-exhaustion DoS, requires ath hardware + memory pressure (or root BPF injection of an FC-type-3 frame on the legacy raw path). Fix is a one-liner; not runtime-validatable without hardware.",
  "recommended_fix": "ath_tx_start(): return r instead of 0 at the done: label (if_ath_tx.c:2082).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff changes return 0; to return r; at the done: label - trivially correct since r==0 on the success fall-through; cannot be runtime-validated on the hardware-less guest.",
  "fix_evidence": "findings/poc/DF-3637/fix.diff; control-flow proof in run.log lines 3-4."
}