{ "finding_id": "DF-3807", "status": "inconclusive", "reproduced": 0, "impact": "none", "confidence": "certain", "verdict": "Mechanism PROVEN on the guest kernel by deterministic replica of if_msk.cs exact mskc_handle_events()/mskc_intr() drain loop over a synthetic 2048-entry status LE ring; msk-specific runtime hardware-gated (inconclusive per family convention). mskc_handle_events (if_msk.c:3137-3238) clears HW_OWNER in a status LE (:3165-3166) and then, when the LEs port bit names a port with no attached interface (single-port adapters: children are created only for attached ports, :1699-1719, registered at :1383; a failed port attach also NULLs the slot, :1469), executes continue (:3174) which skips the loops ONLY consumer-index advance (MSK_INC at :3224). The next iteration re-reads the same LE, sees HW_OWNER clear and breaks (:3156-3157); msk_stat_cons never advances while STAT_PUT_IDX is past it, so the function returns non-zero forever (:3237) and mskc_intrs outer drain while (mskc_handle_events(sc) != 0); (:3291) spins permanently with sc->msk_serializer held (the IRQ is muxed through it, :1729-1731) and before the interrupt is re-enabled (B0_Y2_SP_ICR write at :3297) - hard system hang, both ports wedged. The driver itself anticipates this input (invalid port opcode printf at :3172) but the error handling hangs the box instead of skipping the LE; the rxprog/process_limit bound (:3225) is also skipped and cannot guard it. Replica on the guest (msk_hevent_replica.ko, verbatim loop shape, LE0 = HW_OWNER|port-1, STAT_PUT_IDX=5, port-0 entries after): shipped shape -> drain NEVER returned - 88,046,829,568 outer iterations at ~670M/s with stat_cons=0 idx=5 (no progress), no panic, pure permanent spin that starved userland (ssh dead; serial_console.txt, 1247+ SPINNING markers); fix-shape control (MSK_INC in the NULL-port branch = fix.diff) -> drain returned 0 ... stat_cons=5 idx=5 rx_frames=4 - interrupt re-enabled (B0_Y2_SP_ICR), ISR RETURNS. The real trigger requires the NICs status unit to emit a port-1 LE on a single-port system - faulty/hostile Yukon II or errant DMA, not packet-derived - hardware-gated on this guest (NO_MARVELL_PCI, vtnet0 lo0; src md5 == audited tree).", "exploit_chain": "A faulty or compromised Yukon II (or PCIe DMA corruption) that writes one status LE with the port bit naming an unattached port wedges the interrupt handler permanently: the drain spins forever with the driver serializer held, the IRQ is never re-enabled, both ports of the controller and every serializer-sharing path die, and the spinning ISR context starves the machine. No privilege-escalation primitive; impact is a hard, unrecoverable system hang (DoS) from device-trust input.", "evidence": "run.log (session transcript: fix-shape control mskrep2[fixed]: drain returned 0 after 0 outer iterations, stat_cons=5 idx=5 rx_frames=4 ... ISR RETURNS, then shipped shape SPINNING markers with growing outer counts and stat_cons=0); serial_console.txt (boot.log excerpt: decisive sequence at lines 204-208, 1247+ SPINNING markers, outer up to 88,046,829,568, panic check = 0/none); build.log; env.txt; VERDICT.md (path:line trace); msk_hevent_replica.c; fix.diff (MSK_INC in the NULL-port branch)", "kernel_refs": [ "sys/dev/netif/msk/if_msk.c:1699", "sys/dev/netif/msk/if_msk.c:1383", "sys/dev/netif/msk/if_msk.c:1469", "sys/dev/netif/msk/if_msk.c:1729", "sys/dev/netif/msk/if_msk.c:3137", "sys/dev/netif/msk/if_msk.c:3156", "sys/dev/netif/msk/if_msk.c:3165", "sys/dev/netif/msk/if_msk.c:3174", "sys/dev/netif/msk/if_msk.c:3224", "sys/dev/netif/msk/if_msk.c:3225", "sys/dev/netif/msk/if_msk.c:3237", "sys/dev/netif/msk/if_msk.c:3291", "sys/dev/netif/msk/if_msk.c:3297" ], "poc_changes": "No seed PoC. Authored msk_hevent_replica.ko (out-of-tree kmodule replicating the verbatim mskc_handle_events loop shape + mskc_intrs outer drain over a fake msk_stat_desc ring of MSK_STAT_RING_CNT=2048 entries) because the guest has no Marvell hardware. Documented instrumentation: outer-loop kill flag (module unload escape the real driver lacks), first-error-only printf (console-flood guard), progress kprintf every 2^26 iterations. Build iteration 1 failed -Werror=format= (missing kprintf argument); final build clean.", "attempts": 1, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 900, "guest_dirty": 0, "build_cmd": "cd /root/kmod3807 && make", "run_cmd": "vm.sh run_root: kldload /root/kmod3807/msk_hevent_replica.ko; sysctl kern.mskrep2.mode=1; sysctl kern.mskrep2.run=1; sysctl kern.mskrep2.mode=0; sysctl kern.mskrep2.run=1; sleep 5; dmesg | grep mskrep2 | tail -6 (shipped-shape run starved userland by design; guest recovered with vm.sh reset with-src)", "code_hash": "fabcc4eed273c389a66bf938d475b8af72f76042c6ddc9136bc44efae771f01d", "notes": "Pass-2 finding; pass 1 marked the file clean (DB confirmed zero pass-1 findings to exclude). The shipped-shape run degraded the guest beyond the reach of the instrumentation kill (kernel-priority spin starved userland incl. sshd) - recovered with vm.sh reset with-src; post-reset state verified clean (env.txt). The fix-shape control doubles as live validation of the fix.diff mechanism. Also noted (not filed): mskc_intrs outer while makes process_limit a per-chunk rather than per-interrupt bound (drain-to-empty design shared with upstream FreeBSD).", "recommended_fix": "Advance the consumer index past the offending LE before continuing: add MSK_INC(cons, MSK_STAT_RING_CNT) to the sc_if == NULL branch of mskc_handle_events() (see fix.diff).", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff (git apply --check clean) adds MSK_INC(cons, MSK_STAT_RING_CNT) to the NULL-port branch so the drain always makes progress. The mechanism of the fix is validated live on the guest: the replicas mode=1 control (identical loop with the increment) shows the drain returning 0, the consumer index advancing past the bad LE (stat_cons 0 -> 5, 4 good frames processed) and the interrupt completing. Full driver-level validation is not possible on a guest without Marvell Yukon hardware.", "fix_evidence": "fix.diff; run.log fixed-mode section (mskrep2[fixed]: drain returned 0 after 0 outer iterations, stat_cons=5 idx=5 rx_frames=4 - interrupt re-enabled (B0_Y2_SP_ICR), ISR RETURNS)" }