⬢ DragonFlyBSD Kernel Audit
DF-3770 / verdict.json
← back to finding ↓ download raw
{
  "finding_id": "DF-3770",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Upstream-divergence record, source-certain: the DragonFly port deleted the pre-B3 ValleyView PPGTT disable from intel_sanitize_enable_ppgtt (present verbatim in Linux v4.19; captured in upstream_v419_diff.txt). On VLV B0/B2 silicon the driver now enables PPGTT where upstream disables it, enabling GPU-fault/hang wedging by any local render-node user on that specific 2013-era hardware; recoverable via GPU reset, no kernel memory-safety impact (walkers are bounds-correct regardless of the enable bit). Info severity. Runtime verification skipped (no VLV hardware; audit guest is virtio-only with no i915 device or module). Restore the upstream block per fix.diff.",
  "exploit_chain": "",
  "evidence": "README.md, VERDICT.md, upstream_v419_diff.txt (direct v4.19 diff showing the deleted block), fix.diff",
  "kernel_refs": [
    "sys/dev/drm/i915/i915_gem_gtt.c:136",
    "sys/dev/drm/i915/i915_gem_gtt.c:158"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Info finding: divergence with hardware-gated DoS potential (pre-B3 VLV only); no memory-safety consequence. Deletion looks accidental (no rationale; rest of function matches v4.19 modulo renames).",
  "recommended_fix": "Restore the upstream pre-B3 ValleyView disable block in intel_sanitize_enable_ppgtt — see fix.diff",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restores the upstream block verbatim; no runtime validation possible (no VLV hardware)",
  "fix_evidence": "findings/poc/DF-3770/fix.diff"
}