⬢ DragonFlyBSD Kernel Audit
DF-3674 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3674",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-deref: mpt_intr() dispatches reply handlers with req=NULL when the IOC-supplied context index exceeds the 512-entry request pool (mpt.c:812-820 WARN path still calls the handler); mpt_scsi_reply_handler dereferences req->state immediately (mpt_cam.c:2649) and mpt_scsi_tgt_reply_handler computes MPT_TGT_STATE(mpt, req) before any NULL check (mpt_cam.c:5204-5208), while the sibling mpt_sata_pass_reply_handler defends with if (req != NULL) (mpt_cam.c:878) \u2014 the asymmetry proves the omission. Trigger requires a faulty/malicious IOC or corrupted reply DMA (hardware trust gap), same threat class as pass-1 DF-1161/DF-2537 but weaker primitive (NULL deref -> panic, not OOB). Not executable on the audit guest: no LSI PCI devices, mpt never attaches. Upstream FreeBSD head has the same missing guards.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line proof incl. the sibling-handler contrast); fix.diff (guards mirroring the sata_pass handler); env.txt (no MPT hardware)",
  "kernel_refs": [
    "sys/dev/disk/mpt/mpt_cam.c:2649",
    "sys/dev/disk/mpt/mpt_cam.c:5204-5208",
    "sys/dev/disk/mpt/mpt_cam.c:874-878",
    "sys/dev/disk/mpt/mpt.c:812-820"
  ],
  "poc_changes": "n/a (no PoC \u2014 interrupt-path, IOC-gated)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "No runnable PoC possible: requires MPT hardware whose IOC emits a reply with req_index >= 512 and the scsi_io/tgt handler byte.",
  "recommended_fix": "Add if (req == NULL) return (TRUE); guards to mpt_scsi_reply_handler and mpt_scsi_tgt_reply_handler, mirroring mpt_sata_pass_reply_handler",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Guard-only diff authored (fix.diff); cannot be exercised without MPT hardware on the guest.",
  "fix_evidence": "fix.diff; env.txt"
}