⬢ DragonFlyBSD Kernel Audit
DF-3772 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-3772",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ahci_port_intr() KKASSERTs that the hardware CI/SACT snapshot is a subset of the software slot masks (ahci.c:2621-2622), but the drivers own comments and recovery code (ahci.c:3117-3139, ahci.c:3933-3948) document that chipsets (AMD after IFS errors) leave stale CI/SACT bits after a port stop. In the timeout path the software masks are cleared at ahci.c:3902/3905, stale hardware bits are detected at 3940-3948 with only a warning, and the port_intr() call at ahci.c:3951 then trips the assert at 2622 - a recoverable error becomes a guaranteed kernel panic. Same trust model as DF-1210/DF-1211 but panic-only impact. Not reproduced: guest has no AHCI controller (env.txt).",
  "exploit_chain": "",
  "evidence": "VERDICT.md step-by-step chain (ahci.c:3890-3951 -> 2622); drivers own stale-CI documentation at ahci.c:3117-3139; related hardware-fed asserts at ahci.c:3351 and panic at ahci.c:3398",
  "kernel_refs": [
    "sys/dev/disk/ahci/ahci.c:2621",
    "sys/dev/disk/ahci/ahci.c:2622",
    "sys/dev/disk/ahci/ahci.c:3125",
    "sys/dev/disk/ahci/ahci.c:3351",
    "sys/dev/disk/ahci/ahci.c:3398",
    "sys/dev/disk/ahci/ahci.c:3940"
  ],
  "poc_changes": "No runtime PoC possible - no AHCI controller on the audit guest (virtio-blk only).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "KKASSERT is always active in DragonFly production kernels (not INVARIANTS-gated), so this is a shipping panic. All walks downstream of the assert are correctly software-masked, so impact stops at DoS.",
  "recommended_fix": "Replace the CI/SACT subset KKASSERT with mask-and-warn (chipset-stale bits), downgrade get_err_ccb KKASSERT and put_err_ccb panic to warnings + register clear.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate analysis; no hardware to build/boot-test against.",
  "fix_evidence": "fix.diff in this pack."
}