⬢ DragonFlyBSD Kernel Audit
DF-3651 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3651",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL deref family. cac_tdp_table is heap-allocated only when the VBIOS extended header (>= V7) carries usPowerTuneTableOffset (r600_dpm.c:1257-1265); otherwise rdev->pm.dpm.dyn_state.cac_tdp_table stays NULL (rdev is zero-allocated). pi->caps_power_containment is nevertheless set true unconditionally (ci_dpm.c:244,251), so ci_dpm_enable unconditionally reaches: ci_populate_bapm_parameters_in_dpm_table -> cac_tdp_table->tdp/configurable_tdp (ci_dpm.c:435-436, called from ci_init_smc_table:3677), ci_populate_tdc_limit -> ->tdc (330), ci_populate_bapm_vddc_base_leakage_sidd -> high/low_cac_leakage (414-415), ci_enable_power_containment -> maximum_power_delivery_limit (666), and ci_power_control_set_level -> configurable_tdp (748). None is NULL-checked; a crafted VBIOS (or simply an early/trimmed PowerTune-less extended header) deterministically panics the kernel at radeon DPM enable. First sink hit in program order is ci_dpm.c:435 during the first ci_init_smc_table. Kernel path unreachable on this GPU-less guest; inconclusive overall.",
  "exploit_chain": "Crafted VBIOS without a PowerTune table (extended header size < V7 or usPowerTuneTableOffset == 0) on a CI-class card -> NULL+offset kernel read at ci_init_smc_table time -> boot/attach panic. DoS only.",
  "evidence": "VERDICT.md (full source trace); env.txt (guest has no AMD GPU: pciconf 0x1002 count=0, /dev/dri absent, no drm kld); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/ci_dpm.c:244",
    "sys/dev/drm/radeon/ci_dpm.c:330",
    "sys/dev/drm/radeon/ci_dpm.c:414",
    "sys/dev/drm/radeon/ci_dpm.c:435",
    "sys/dev/drm/radeon/ci_dpm.c:666",
    "sys/dev/drm/radeon/ci_dpm.c:748",
    "sys/dev/drm/radeon/r600_dpm.c:1257",
    "sys/dev/drm/radeon/r600_dpm.c:1261"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; source-trace only",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "pass 2 radeon/ci_dpm.c; twins: no twin filed. Guest virtio-only per task; harness scratch files under /root removed.",
  "recommended_fix": "NULL-check rdev->pm.dpm.dyn_state.cac_tdp_table (return -EINVAL / skip) at the five deref sites in ci_dpm.c.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation would require a CI-class GPU with a crafted VBIOS (baseline panic/corruption) and a single-fix kernel build; the audit guest is virtio-only, so the fix is source-reviewed only (fix.diff).",
  "fix_evidence": "fix.diff in this pack; not applied to sys/ (read-only audit target)."
}