⬢ DragonFlyBSD Kernel Audit
DF-3706 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3706",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap OOB read: vega10_setup_default_pcie_table asserts only bios_pcie_table->count != 0 (:1228) then loops i < NUM_LINK_LEVELS(=2, smu9_driver_if.h:44) reading bios_pcie_table->entries[i] (:1238/:1244/:1251); the parser allocates exactly ucNumEntries records (vega10_processpptables.c:772-783), so a 1-entry VBIOS PCIE table makes entries[1] an OOB read whose garbage gen/lane/lclk is uploaded to the SMC (populate_smc_link_levels :1480-1504, count forced to 2 at :1254). Not reproducible on the virtio-only audit guest (0 AMD PCI devices); lines verified in guest /usr/src.",
  "exploit_chain": "crafted VBIOS (1-entry PCIE table) -> OOB read -> wrong PCIe link state programmed to SMC (misbehavior/DoS-adjacent); no write primitive",
  "evidence": "VERDICT.md; run.log (guest-src excerpts :1228-1232, NUM_LINK_LEVELS def); trigger_notes.c; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1228",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1232",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1238",
    "sys/dev/drm/amd/powerplay/inc/smu9_driver_if.h:44"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented VBIOS recipe",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "n/a (data trigger)",
  "run_cmd": "n/a on guest (no AMD hw)",
  "code_hash": "ddeea190bfa592d31cc997afd44905feeb473f38f218d52c6e0f4cf3b0d6a2ba",
  "notes": "smu7 checklist item (h) pcie variant.",
  "recommended_fix": "Clamp loop to min(NUM_LINK_LEVELS, bios count) and let populate_smc_link_levels pad (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}