⬢ DragonFlyBSD Kernel Audit
DF-3643 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3643",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain uninitialized-stack-use defect, runtime-untestable on this guest. Five call-site clusters discard the return of hw->phy.ops.read_reg* and then branch on / mask / write back the destination u16, which is uninitialized kernel stack when the read fails: e1000_set_eee_pchlan:959 (data, decl 909) drives the 100M-EEE LPI enable decision; e1000_check_for_copper_link_ich8lan:1617-1626 and 1765-1772 (phy_reg, decl 1552) write stack-garbage-derived values back into I217_PLL_CLOCK_GATE_REG/HV_PM_CTRL and HV_KMRN_FIFO_CTRLSTA; e1000_lv_jumbo_workaround_ich8lan:2771-2773 plus RMW chain 2837-2917 write garbage PHY config under masks. Identical in FreeBSD HEAD (vendor-inherited). Guest has no Intel GbE PHY (virtio only) so the paths never execute there. No userspace copy-out => no direct info leak; ceiling is mis-programmed PHY config (link instability) and KMSAN-class uninit reads. Severity Info (hardening).",
  "exploit_chain": "",
  "evidence": "trace.log (all cited sites with declarations); guest_env.txt (no e1000 hardware); fix.diff (git apply --check clean); VERDICT.md (complete site enumeration + reasoning)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:959",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:1617",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:1765",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:2771",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:2837"
  ],
  "poc_changes": "n/a - no seeded PoC; evidence pack built from scratch as a source-level trace + upstream-identity proof",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "git apply --check findings/poc/DF-3643/fix.diff",
  "run_cmd": "sh findings/poc/DF-3643/trace.sh",
  "code_hash": "51b3dd6a9c5f1515d60143879fcfcb17f0002860a5c232d3233d65d4ec720988",
  "notes": "Complete enumeration of unchecked-read sites in the file; all other read_reg sites either check returns or leave the destination unused on failure. Runtime trigger needs a PHY whose MDIO reads fail (failing/malicious hardware); not present on QEMU guest.",
  "recommended_fix": "Check read_reg return values at the PHY_LP_ABILITY, HV_KMRN_FIFO_CTRLSTA and PHY_REG(769,20) sites and abort on failure; zero-initialize the remaining RMW chain locals.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable on this guest: forcing PHY read failures requires real Intel GbE PHY hardware; guest has virtio only. fix.diff verified to apply cleanly (git apply --check) and reviewed per-site.",
  "fix_evidence": "findings/poc/DF-3643/fix.diff; VERDICT.md; guest_env.txt (hardware absent)"
}