⬢ DragonFlyBSD Kernel Audit
DF-3719 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3719",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated (attach-time path; DF-3573/DF-3631 firmware-file trust family): mxge_load_firmware_helper (if_mxge.c:651-729) takes the claimed uncompressed size from firmware registration metadata (:685 fw->version, the FIRMWS Makefile field), PIO-copies fw_len bytes to sc->sram+MXGE_FW_OFFSET (:713-719) without ever comparing fw_len to the *limit the caller seeded with sc->sram_size (:910-911, overwritten at :721) - a crafted/corrupted image claims > sram_size-1MB and the copy walks off the pmap_mapdev BAR mapping; additionally a zlib stream that legitimately ends short of fw_len (inflate returns Z_STREAM_END with total_out < fw_len) leaves the kmallocd tail uninitialized yet still copied to the NIC, and a NULL version (fw_len=0) reads 4 bytes at +0x3c of a zero-sized allocation (:700). Root-supplied input (kldload), so hardening-grade (Low), same as DF-3573/DF-3631.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3719/VERDICT.md; fix.diff (total_out clamp + SRAM fit check, git-apply clean); env.txt",
  "kernel_refs": [
    "sys/dev/netif/mxge/if_mxge.c:685",
    "sys/dev/netif/mxge/if_mxge.c:700",
    "sys/dev/netif/mxge/if_mxge.c:713",
    "sys/dev/netif/mxge/if_mxge.c:721",
    "sys/dev/netif/mxge/if_mxge.c:910",
    "sys/dev/netif/mxge/if_mxge.c:4290",
    "sys/dev/netif/mxge/fw/mxge_eth_z8e/Makefile"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Shipped images (mxge_eth_z8e=377284 etc.) fit; the check guards build/craft/corruption divergence between metadata and payload.",
  "recommended_fix": "Clamp fw_len to zs.total_out after successful inflate and reject fw_len + MXGE_FW_OFFSET > *limit before the PIO copy loop.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff git apply --check clean; not buildable without mxge hardware.",
  "fix_evidence": "findings/poc/DF-3719/fix.diff"
}