⬢ DragonFlyBSD Kernel Audit
DF-3681 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-3681",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-likely, runtime-inconclusive: igb_timer() (blocking lwkt_serialize_enter at if_igb.c:1313, self re-arm at :1318) and igb_txgc_timer() (goto-done re-arm at :349) are torn down only with callout_stop(), which sys/kern/kern_timeout.c:1087-1098 documents as not interlocking against an in-progress callback; igb_detach() (:742-802) never calls callout_terminate() for either. A callback parked on main_serialize during the detach critical section deterministically re-arms after the serializers are dropped and fires ~1s later into the freed softc/rings (UAF; unmapped text under kldunload). ix(4) already gained callout_terminate for its timer after DF-3669 \u2014 igb lacks it entirely. Guest has no igb hardware so the race cannot be exercised.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3681/VERDICT.md (re-arm sites :1318/:349; stop sites :1436/:1447; detach :742-802 with no terminate; kern_timeout.c callout_stop vs callout_terminate semantics); run.log (no igb device on guest); fix.diff (callout_terminate in detach)",
  "kernel_refs": [
    "sys/dev/netif/igb/if_igb.c:1313",
    "sys/dev/netif/igb/if_igb.c:1318",
    "sys/dev/netif/igb/if_igb.c:327",
    "sys/dev/netif/igb/if_igb.c:337",
    "sys/dev/netif/igb/if_igb.c:349",
    "sys/dev/netif/igb/if_igb.c:742",
    "sys/dev/netif/igb/if_igb.c:784",
    "sys/dev/netif/igb/if_igb.c:1436",
    "sys/dev/netif/igb/if_igb.c:1447",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:1104",
    "sys/dev/netif/ix/if_ix.c:693"
  ],
  "poc_changes": "No runnable PoC without igb hardware; trigger.c documents the kldunload-vs-igb_timer race procedure; run.sh performs the module-presence/device-absence probe.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (no-op: hardware race trigger)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root kldstat | grep -i igb; ifconfig -a | grep -c ^igb; ls -l /boot/kernel/if_igb.ko",
  "code_hash": "",
  "notes": "Trigger requires admin-initiated detach (kldunload/devctl) overlapping a fired timer; impact is UAF on freed softc/ring slab and callout-queue corruption. Consistent with DF-3669 (ix) Low/likely grading.",
  "recommended_fix": "callout_terminate() sc->timer and every tx_gc_timer in igb_detach() after ifnet_deserialize_all(), before ether_ifdetach()/ring free.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree; cannot be validated without igb hardware.",
  "fix_evidence": "findings/poc/DF-3681/fix.diff"
}