⬢ DragonFlyBSD Kernel Audit
DF-3652 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3652",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Functional/logic defect (no memory-safety impact). ci_populate_mvdd_value walks the mvdd dependency table, fills voltage->Voltage on a match (2350), then falls through to return -EINVAL at 2359 even on success - the success return was inverted at some point (the if (i >= count) return -EINVAL guard at 2355-2356 already covers the failure case). The only caller (ci_populate_smc_acpi_level, 3095-3099) therefore always takes the error branch and programs table->MemoryACPILevel.MinMvdd = 0: the ACPI memory level is shipped to the SMC without an MVDD floor. Verified byte-for-byte identical in upstream Linux master (torvalds/linux ci_dpm.c) - an upstream-inherited bug, filed as hardening/correctness for the DFly tree. Note the filled value also skips the VOLTAGE_SCALE multiplication and byte order conversion the caller applies on its own path (3099), consistent with the callers use, so only the return is wrong.",
  "exploit_chain": "No direct security impact: with a genuine MVDD control object the ACPI DPM level requests MinMvdd=0 from the SMC - a functional power-management regression (potential memory instability on downclock), not a kernel memory-safety issue.",
  "evidence": "VERDICT.md (full source trace); env.txt (guest has no AMD GPU: pciconf 0x1002 count=0, /dev/dri absent, no drm kld); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/ci_dpm.c:2341",
    "sys/dev/drm/radeon/ci_dpm.c:2359",
    "sys/dev/drm/radeon/ci_dpm.c:3095",
    "sys/dev/drm/radeon/ci_dpm.c:3099"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; source-trace only",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "pass 2 radeon/ci_dpm.c; twins: upstream Linux master identical (verified). Guest virtio-only per task; harness scratch files under /root removed.",
  "recommended_fix": "Return 0 from ci_populate_mvdd_value when a matching MVDD entry was found (only -EINVAL when the clock is out of range).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation would require a CI-class GPU with a crafted VBIOS (baseline panic/corruption) and a single-fix kernel build; the audit guest is virtio-only, so the fix is source-reviewed only (fix.diff).",
  "fix_evidence": "fix.diff in this pack; not applied to sys/ (read-only audit target)."
}