⬢ DragonFlyBSD Kernel Audit
DF-3714 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3714",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, runtime hardware-gated: em_tx_collect (sys/dev/netif/em/if_em.c:3275-3335) uses the raw TDH register read (:3284) as the cleanup walk terminator with no range validation. An out-of-range TDH makes while (first != tdh) unreachable: first wrap frees every TX buffer (including hardware-owned descriptors - DMA-after-free), KKASSERT(num_avail < num_tx_desc) at :3302 panics INVARIANTS builds, and on production builds (KKASSERT compiled out, sys/sys/systm.h:117-119) the loop spins forever holding the interface serializer - permanent soft-lockup. Same class in em_82547_move_tail_serialized (:2003-2024): unvalidated TDT-based hw_tdt walk over tx_desc_base[] and an out-of-ring TDT register write. Mirrors DF-3668 (ix) / DF-3680 (igb). Guest-executed bound-math harness demonstrates the non-terminating walk; no em hardware on the audit guest.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3714/VERDICT.md; run.log (probe + harness section [C]: TDH=4096 vs 512-entry ring -> 1,048,576 iterations / 2048 wraps without termination; in-range TDH safe); build.log; fix.diff (bail when (uint32_t)tdh >= num_tx_desc)",
  "kernel_refs": [
    "sys/dev/netif/em/if_em.c:3284",
    "sys/dev/netif/em/if_em.c:3299",
    "sys/dev/netif/em/if_em.c:3302",
    "sys/dev/netif/em/if_em.c:3320",
    "sys/dev/netif/em/if_em.c:2003",
    "sys/dev/netif/em/if_em.c:2007",
    "sys/dev/netif/em/if_em.c:2010",
    "sys/sys/systm.h:117"
  ],
  "poc_changes": "No seed PoC. em_bounds_harness.c section [C] written for this finding.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /root/em_bounds_harness /root/em_bounds_harness.c",
  "run_cmd": "vm.sh run_root ifconfig -l; pciconf -l; ...; harness/module per run.sh",
  "code_hash": "062bd0525775d326bb2d63520b01e5d5600be3d5f77de6e6832f262bf7aecb80",
  "notes": "Device-trust DoS only; em_txeof itself walks driver-internal tx_dd[] and is safe.",
  "recommended_fix": "Bail out of em_tx_collect() when (uint32_t)TDH >= num_tx_desc instead of walking the ring toward an unreachable index.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch --dry-run clean); cannot be validated on a guest without em hardware.",
  "fix_evidence": "findings/poc/DF-3714/fix.diff"
}