{
  "finding_id": "DF-3797",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Device-supplied register offsets from ENA CREATE_SQ/CREATE_CQ admin replies (ena_com.c:1156-1159, 1333-1346) are cached unvalidated as write targets; with the ports never-assigned reg_bar (ena.c:3671-3675) they arrive raw and every doorbell/unmask becomes a guest-CPU store at BAR+u32 via bus_space_write_4 (ena_plat.h:325-329). Proven on the audit guest with the drivers real code: full-path replica drove real ena_com_create_io_cq() with a hostile completion (unmask_reg=0x86fc0008) and the real ena_com_unmask_intr() overwrote a chosen kernel-VA sentinel; fatal variant produced Fatal trap 12: supervisor write at BAR+0x7ffffff8 (DDB shows the literal movl); fix.diff validated baseline-overwrite vs patched-EINVAL-no-write.",
  "exploit_chain": "malicious ENA peer returns cq_interrupt_unmask_register_offset/sq_doorbell_offset pointing at target KVA (BAR-relative u32) -> driver caches pointer on queue create -> every MSI-X unmask / TX doorbell writes intr_control (0x40190014, fixed bits) or io_sq->tail (u16 ring position groomable via peer-delivered traffic) at the chosen kernel VA, executed by the guest CPU, bypassing IOMMU containment; deterministic panic variant writes at unmapped KVA. No uid0 chain (needs live malicious peer for value grooming).",
  "evidence": "run.log (full-path baseline VICTIM OVERWRITTEN via device-chosen register offset + inline modes 1/2), panic.txt (Stopped at enarep_run+0x3b9: movl $0x40190014,0x7ffffff8(%rax)), fix_run.log (ena_com_create_io_cq() = 22 ... NO WRITE PERFORMED (fix active)), enafull.c/enarep.c sources, fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1156",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1333",
    "sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:325",
    "sys/dev/virtual/amazon/ena/ena.c:3671",
    "sys/dev/virtual/amazon/ena/ena.c:1813",
    "sys/dev/virtual/amazon/ena/ena.c:1049",
    "sys/cpu/x86_64/include/bus_dma.h:404"
  ],
  "poc_changes": "Seed had no runnable PoC. Built two replicas: (1) inline replica using the drivers real static inlines with hostile reply values; (2) full-path replica compiling the unmodified audited ena-com sources and driving the real admin submit->completion->create_io_cq path with an emulated device completion; required adding ena_log_level/ena_dma_alloc stand-ins (they live in ena.c), device_if/bus_if/pci_if generated headers, and COPTS (not CFLAGS) for the FIXED=1 variant.",
  "attempts": 7,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1740,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod/enarep && make && make -f Makefile.full && (cd ../fixbuild && make -f Makefile.full FIXED=1)",
  "run_cmd": "kldload ./enafull.ko && sysctl hw.enafull=1   (fatal variant: kldload ./enarep.ko && sysctl hw.enarep=3)",
  "code_hash": "656954044fb2cd930f73dc25fc001544474e8492d4cd4668de37c774fb56622e",
  "notes": "Guest has no ENA PCI function (KVM/virtio); replica methodology per DF-3779/DF-3715 runs the drivers real code against hostile peer bytes. ena-com copy shipped in-pack is byte-identical to sys/; ena-com-fix is fix.diff applied. Guest reset (with-src) after the fatal run.",
  "recommended_fix": "Store the register BAR extent (rman_get_size) in ena_com_dev and reject CREATE_SQ/CREATE_CQ replies whose doorbell/unmask/head-db/numa offsets fall outside it (fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "With fix.diff applied to the ena-com copy, the identical hostile CREATE_CQ completion is rejected (ena_com_create_io_cq -> ENA_COM_INVAL=22), unmask_reg stays NULL, no write occurs, guest remains up. Baseline on the same guest overwrote the victim through the real path.",
  "fix_evidence": "fix_run.log: ena_com_create_io_cq() = 22 (io_cq.idx=0 unmask_reg=0) + NO WRITE PERFORMED (fix active) + GUEST_STILL_UP; baseline in run.log: VICTIM OVERWRITTEN ... primitive confirmed; fix_build.log shows -DENAFULL_FIXED build."
}