⬢ DragonFlyBSD Kernel Audit
DF-3700 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3700",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The DragonFly LinuxKPI synchronize_irq() is an empty stub (sys/dev/drm/include/linux/hardirq.h:33-36 - verified verbatim on the guests own /usr/src in run.log), voiding the interrupt-drain barriers i915_irq.c relies on: gen8_irq_power_well_pre_disable (i915_irq.c:3710) can return while gen8_de_irq_handler is still executing, after which the caller powers off the display block and the in-flight handlers MMIO hits an unclocked domain (hard hang on real hardware); gen6_disable_rps_interrupts (i915_irq.c:522 -> cancel_work_sync at :529) and gen9_disable_guc_interrupts (:569) can have schedule_work run after cancel (contract break; benign while loaded, widens DF-3699); intel_runtime_pm_disable_interrupts (:4982) only calls the driver irq_uninstall hook (register reset, no free_irq) so runtime suspend can gate power under a preempted in-flight handler. Not runtime-testable: guest has Bochs VGA and no i915 module. Impact ceiling on real hardware: MMIO-after-poweroff hard hang (hw DoS) and broken cancel_sync contracts; no memory corruption demonstrated.",
  "exploit_chain": "",
  "evidence": "run.log (guest /usr/src shows the empty stub verbatim); VERDICT.md section 2 (per-call-site exposure trace); env.txt (no i915 hw/module)",
  "kernel_refs": [
    "sys/dev/drm/include/linux/hardirq.h:33",
    "sys/dev/drm/i915/i915_irq.c:3710",
    "sys/dev/drm/i915/i915_irq.c:522",
    "sys/dev/drm/i915/i915_irq.c:529",
    "sys/dev/drm/i915/i915_irq.c:569",
    "sys/dev/drm/i915/i915_irq.c:4982"
  ],
  "poc_changes": "n/a - source-analysis finding; trigger.sh reproduces the stub inspection on any DFBSD box with /usr/src",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (no-op)",
  "run_cmd": "sh trigger.sh",
  "code_hash": "",
  "notes": "Stub confirmed at runtime against guest /usr/src (not merely the audit tree). The rps/guc re-arm windows are functionally benign while the driver is loaded because gen6_pm_rps_work re-validates interrupts_enabled under irq_lock (i915_irq.c:1287-1292); the unload path is covered by free_irq + flush_scheduled_work ordering in intel_modeset_cleanup (intel_display.c:16197,16203).",
  "recommended_fix": "Implement synchronize_irq() in the DragonFly LinuxKPI (per-irq in-flight handler refcount + waitqueue in the lkpi irq trampoline) instead of the empty stub in sys/dev/drm/include/linux/hardirq.h:33.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "no fix.diff: proper fix belongs in the lkpi irq trampoline (new infrastructure), not a one-file change; runtime validation impossible without i915 hardware",
  "fix_evidence": "findings/poc/DF-3700/VERDICT.md#5-fix"
}