⬢ DragonFlyBSD Kernel Audit
DF-3821 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3821",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "aac_check_firmware() takes sc->aac_max_fib_size directly from the adapters GETCOMMPREF mailbox (options & 0xFFFF, aac.c:1802) and only clamps an upper bound (aac.c:1809) before dividing PAGE_SIZE by it (aac.c:1811). A zero report panics the kernel at attach (integer divide-by-zero, #DE); a report below sizeof(struct aac_fib) (512) creates FIB slots smaller than the 28-byte struct aac_fib_header that aac_ioctl_sendfib() unconditionally copyins into the last slot of the DMA pool (aac.c:3010), overflowing the bus_dmamem_alloc allocation with user-controlled bytes. Device-gated: no AAC HBA on the audit guest (no /dev/aacd0, zero matching PCI vendors), so the mailbox values cannot be produced; source analysis is certain.",
  "exploit_chain": "faulty/compromised firmware reports max_fib_size in 1..27 -> aac_ioctl_sendfib copyin writes 28 user-controlled bytes into the final slot -> up to 27 bytes past the FIB DMA pool -> adjacent kernel heap corruption.",
  "evidence": "VERDICT.md (five-step proof with line refs); fix.diff (floor clamp); ../DF-3819/env.txt (guest has no AAC hardware)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac.c:1802",
    "sys/dev/raid/aac/aac.c:1809",
    "sys/dev/raid/aac/aac.c:1811",
    "sys/dev/raid/aac/aac.c:1470",
    "sys/dev/raid/aac/aac.c:3010"
  ],
  "poc_changes": "No seed; analysis pack (attach-time device data cannot be synthesized on the guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Buggy-firmware boot panic + sub-header heap overflow; same pattern exists upstream in FreeBSD. Severity Low (device precondition).",
  "recommended_fix": "Clamp aac_max_fib_size into [sizeof(struct aac_fib), PAGE_SIZE] after GETCOMMPREF (aac.c:1809).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Cannot be exercised without an AAC controller answering GETCOMMPREF; absent on the guest. fix.diff adds the floor clamp.",
  "fix_evidence": "fix.diff"
}