⬢ DragonFlyBSD Kernel Audit
DF-3716 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3716",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated (family convention DF-3604/3639/3663/3679/3713): mxge_clean_rx_done (if_mxge.c:2345-2356) bounds only the small-buffer dispatch path (length <= MXGE_RX_SMALL_BUFLEN, :91); every other NIC-DMAd 16-bit length - up to 65535 - flows into mxge_rx_done_big which assigns it straight to m->m_len/m_pkthdr.len (:2261) on an mbuf backed by exactly rx->cl_size bytes (2048 via m_getcl for MTU<=2027, 4096 via m_getjcl up to max_mtu 4075; posted by mxge_get_buf_big :2101-2116, sized by mxge_choose_params :3228-3239). The stack then reads up to ~63.5KB past the 2/4KiB cluster (mxge_rx_csum :2150-2176 and mxge_vlan_tag_remove :2178-2220 parse at fixed offsets; if_input consumers copy m_len bytes) - heap OOB read / kernel info leak, DF-3604 family shape. Guest has no Myricom NIC (no 0x14c1 device; if_mxge.ko unloaded) so no runtime reproduction is possible; the rx_done ring is device-write-only, so there is no software-only trigger.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3716/VERDICT.md (four-step source proof); fix.diff (git-apply clean bound check before the refill, mirroring the existing recycle-on-failure path); env.txt (no-hardware presence probe)",
  "kernel_refs": [
    "sys/dev/netif/mxge/if_mxge.c:2345",
    "sys/dev/netif/mxge/if_mxge.c:2350",
    "sys/dev/netif/mxge/if_mxge.c:2261",
    "sys/dev/netif/mxge/if_mxge.c:2101",
    "sys/dev/netif/mxge/if_mxge.c:3228",
    "sys/dev/netif/mxge/if_mxge.c:4429",
    "sys/dev/netif/mxge/if_mxge.c:91",
    "sys/dev/netif/mxge/mxge_mcp.h:56"
  ],
  "poc_changes": "No seed PoC; hardware-gated finding - evidence pack documents the source-level proof and the one-line bound fix per family convention.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Small path is correctly bounded at :2350, proving the big-path omission is an oversight. Impact ceiling: hostile/compromised device or device-side length bug -> heap disclosure to receiving sockets, plausible panic via mbuf invariants.",
  "recommended_fix": "In mxge_rx_done_big, drop (ierrors++) when len > (uint32_t)rx->cl_size - MXGEFW_PAD, before the refill.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree, git apply --check clean; cannot be build/run without mxge hardware.",
  "fix_evidence": "findings/poc/DF-3716/fix.diff"
}