⬢ DragonFlyBSD Kernel Audit
DF-3737 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-3737",
  "title": "emx_tx_collect walks the TX ring toward an unvalidated TDH register value (DF-3714 em(4) twin)",
  "verdict": "inconclusive",
  "impact": "none_on_this_guest",
  "reproduce": {
    "build": "cc -O -o /root/emx_bounds_harness /root/emx_bounds_harness.c",
    "run": "/root/emx_bounds_harness   # section [C]",
    "expected": "TDH 0x1000 / 0xFFFFFFFF(-1) vs 512-entry ring: walk never terminates (capped at 4194304 iters / 8192 wraps in the replica; uncapped in the kernel); KKASSERT fires on INVARIANTS at if_emx.c:2835"
  },
  "kernel_refs": [
    "sys/dev/netif/emx/if_emx.c:2817",
    "sys/dev/netif/emx/if_emx.c:2832",
    "sys/dev/netif/emx/if_emx.c:2835",
    "sys/dev/netif/emx/if_emx.c:2838",
    "sys/dev/netif/emx/if_emx.c:2853",
    "sys/dev/netif/emx/if_emx.c:1116",
    "sys/dev/netif/emx/if_emx.c:2888"
  ],
  "artifacts": [
    "emx_bounds_harness.c", "build.sh", "run.sh", "build.log",
    "run.log", "run.harness.log", "env.txt", "fix.diff",
    "VERDICT.md", "README.md", "verdict.json", "manifest.json"
  ]
}