⬢ DragonFlyBSD Kernel Audit
DF-3664 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3664",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain (visible asymmetry): bge_nvram_getbyte (sys/dev/netif/bge/if_bge.c:544-592) pairs the BGE_NVRAM_SWARB acquire (SET1, line 551) with release (CLR1, line 588) and the BGE_NVRAM_ACCESS save/restore (561-562 vs 585) on the SUCCESS path \u2014 the discipline the bnx sibling DF-3640 lacked \u2014 but its two error paths return without cleanup: the grant-timeout path at 557-558 leaves the SET1 request latched, and the read-done timeout path at 574-577 additionally leaves BGE_NVRAMACC_ENABLE set while holding the arbiter. Reachable only at attach time on BCM5906 (bge_read_nvram gates on asicrev==BCM5906, if_bge.c:603-604; called from bge_get_eaddr_nvram, if_bge.c:4977-4985). Impact: after one NVRAM timeout (already-malfunctioning hardware) the flash arbiter stays held for the drivers lifetime, starving ASF/management firmware of NVRAM \u2014 device-side functional DoS only, no host memory-safety impact, no unprivileged trigger. Runtime verification honestly inconclusive: the audit guest has virtio-net only; bge is compiled into the kernel (kldstat -v: pci/if_bge id 59) but no Broadcom PCI device exists, so bge_attach/bge_nvram_getbyte are unreachable (run.log: NO_BROADCOM_DEVICE, sysctl hw.bge unknown oid). Guest /usr/src if_bge.c md5 f6c2d771384a52775cd4bb399d5dcab1 is byte-identical to the audited tree.",
  "exploit_chain": "",
  "evidence": "run.log (guest proof: driver in kernel, zero Broadcom devices, no attach, src md5 match, clean -Wall build), VERDICT.md (line-accurate acquire/release asymmetry trace with the paired success path for contrast), trigger.c (annotated hardware-precondition skeleton), fix.diff (git apply --check OK; release/restore added to both error paths)",
  "kernel_refs": [
    "sys/dev/netif/bge/if_bge.c:551",
    "sys/dev/netif/bge/if_bge.c:557",
    "sys/dev/netif/bge/if_bge.c:562",
    "sys/dev/netif/bge/if_bge.c:574",
    "sys/dev/netif/bge/if_bge.c:585",
    "sys/dev/netif/bge/if_bge.c:588",
    "sys/dev/netif/bge/if_bge.c:603",
    "sys/dev/netif/bge/if_bge.c:4984"
  ],
  "poc_changes": "No seed existed (new pass-2 finding); trigger written as an annotated hardware-precondition skeleton per the DF-3639/DF-3640 precedent, built and executed on the guest to prove the code path is unreachable there.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o trigger trigger.c (guest)",
  "run_cmd": "./run.sh via dfbsd-qemu/vm.sh run_root (kldstat/pciconf/sysctl hw.bge/md5 of if_bge.c + trigger)",
  "code_hash": "513feda836e13467136bb8b2c9cdd33b2bcc947d8d36e75a79d556d3884100bb",
  "notes": "Strategy item (b) resolution: bge DOES pair acquire/release on the success path (unlike bnx DF-3640); the residual defect is the error-path leak, which is strictly weaker (error-path-only, BCM5906-only, device-side DoS) \u2014 hence Info rather than DF-3640s Low. bge_resets acquire-without-explicit-release at if_bge.c:2776-2789 is by design (the GRC global reset that immediately follows clears the arbiter; matches Broadcoms own driver) and is NOT filed.",
  "recommended_fix": "In bge_nvram_getbyte, drop the arbitration request (BGE_NVRAMSWARB_CLR1) on the grant-timeout path and both restore BGE_NVRAM_ACCESS and release the lock on the read-timeout path, mirroring the success-path cleanup at if_bge.c:584-589 (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the missing cleanup on both error paths using the exact register sequence of the paired success path (restore ACCESS then CLR1 + flush read; on the grant-timeout path only the request drop since access is not yet saved); git apply --check passes against the pristine tree. Cannot be runtime-validated: the guest has no BCM5906 device so neither baseline nor patched behavior is exercisable.",
  "fix_evidence": "fix.diff (git apply --check OK); baseline absence proof in run.log (NO_BROADCOM_DEVICE, sysctl hw.bge unknown oid)"
}