⬢ DragonFlyBSD Kernel Audit
DF-3736 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3736",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, runtime hardware-gated (same convention as the em(4) twin DF-3713): emx_rxeof (sys/dev/netif/emx/if_emx.c:3337-3468) publishes the 16-bit NIC-DMAd extended-descriptor length with no bound against the posted buffer: len = le16toh(current_desc->rxd_length) at :3369 (rxd_length == wb.upper.length, 16 bits, if_emx.h:207; extended descriptors via E1000_RFCTL_EXTEN :3134; E1000_RCTL_SECRC at :3283 strips CRC in HW so there is no -4 adjustment and no prev_len_adj logic - the em(4)-specific negative-m_len variant does not exist here) -> mp->m_len = len at :3401, m_pkthdr.len =/+= len at :3404/:3413, handoff at :3453. Posted buffer is an MCLBYTES=2048 m_getcl() cluster (emx_newbuf:2908-2916), front-trimmed by ETHER_ALIGN iff hw.mac.max_frame_size <= 2046 (:2918-2919) -> usable DMA span 2046/2048. A faulty/erratum/malicious DMA source writing 0xFFFF into the write-back length makes the stack walk up to 63489 bytes past the cluster (heap OOB read into ether_input/BPF/sockets = kernel heap info leak, or panic). Bound-math harness built and run on the guest (run.harness.log: 63489/63487-byte overshoot claims demonstrated; honest 1500/2048-byte frames verified in-bounds, so the proposed check never rejects legitimate traffic). Device-side injection needs faulty/removal/malicious-PCIe DMA - not present on the audit guest (kldload if_emx loads, no interface attaches) -> inconclusive per family convention.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3736/VERDICT.md; run.harness.log (section [B]: desc_len=0xFFFF -> m_len=65535 claims 63489 bytes past the 2046-byte posted cluster); build.log; env.txt (no emx hardware); fix.diff (discard len==0 or len > trim-aware posted span, git-apply clean)",
  "kernel_refs": [
    "sys/dev/netif/emx/if_emx.c:3369",
    "sys/dev/netif/emx/if_emx.c:3401",
    "sys/dev/netif/emx/if_emx.c:3404",
    "sys/dev/netif/emx/if_emx.c:3413",
    "sys/dev/netif/emx/if_emx.c:3453",
    "sys/dev/netif/emx/if_emx.c:2908",
    "sys/dev/netif/emx/if_emx.c:2918",
    "sys/dev/netif/emx/if_emx.c:3283",
    "sys/dev/netif/emx/if_emx.h:207"
  ],
  "poc_changes": "No seed PoC. emx_bounds_harness.c authored for this finding ([A] excluded - that is the known DF-1197 window, deliberately not re-filed).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /root/emx_bounds_harness /root/emx_bounds_harness.c",
  "run_cmd": "vm.sh run_root kldload if_emx; ifconfig -l; /root/emx_bounds_harness",
  "code_hash": "356904408cabbb1c992f2884313b8aaf987b8ad1940444d26e0de8eeb35da0dc",
  "notes": "Device-trust boundary (descriptor corruption / erratum / malicious or emulated DMA source). Positive-overshoot family: twin of DF-3713; the 2-byte ETHER_ALIGN DMA overflow is DF-1197/DF-3712 and was NOT re-filed.",
  "recommended_fix": "In emx_rxeof(), discard the frame (existing discard: path) when len == 0 or len exceeds the trim-aware posted span MCLBYTES - (max_frame_size <= MCLBYTES - ETHER_ALIGN ? ETHER_ALIGN : 0).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (git apply --check clean); cannot be runtime-validated on a guest without emx hardware. Harness honest-frame cases show the bound never rejects legitimate traffic.",
  "fix_evidence": "findings/poc/DF-3736/fix.diff"
}