⬢ DragonFlyBSD Kernel Audit
DF-3702 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3702",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-pointer dereference at driver attach (DF-3685 smu7 twin): vega10_pp_tables_initialize (vega10_processpptables.c:905-922,1107-1128) leaves optional subtable pointers NULL when the corresponding us*TableOffset is 0 and still returns success; vega10_hwmgr_backend_init then dereferences table_info->tdp_table at vega10_hwmgr.c:269 (via :862) and the six dep tables + vddc/vddci/vddmem lookup tables + mm table at :658/:661/:665/:677/:680 (via :876->:734), all before the only NULL asserts in the path (:754-762, reached at :879). Crafted-VBIOS Vega10 -> deterministic kernel panic at attach (DoS). Not reproducible on the audit guest (0 AMD PCI devices; amdgpu.ko present but never binds); cited lines verified byte-identical in guest /usr/src.",
  "exploit_chain": "crafted VBIOS (missing PowerTune/dep/lookup/MM offsets) -> amdgpu attach -> vega10_hwmgr_backend_init :862/:876 -> NULL deref -> panic (DoS); no control-flow hijack demonstrated",
  "evidence": "VERDICT.md proof chain; run.log (guest-src excerpts :269,:658-661, parser NULL-init 905-922); trigger_notes.c (blob recipe); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:269",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:658",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:661",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:665",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:677",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:876",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:905"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented the exact VBIOS offset fields to zero; verified cited lines in guest kernel source",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "n/a (data-only trigger)",
  "run_cmd": "n/a on guest (no AMD hw); guest-src line confirmation in run.log",
  "code_hash": "906d08008ebee9f7a24e16e43658709e605a9da0dad91533bc96d5ef4ac97088",
  "notes": "smu7 checklist item (c). Pass-1 known findings DF-1179..1183 do not cover NULL subtables.",
  "recommended_fix": "Add NULL guards before :269 and inside vega10_patch_voltage_dependency_tables_with_lookup_table (skip absent optional tables; -EINVAL for mandatory ones), mirroring :754-762 asserts",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}