⬢ DragonFlyBSD Kernel Audit
DF-3826 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3826",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain semaphore-symmetry defect: e1000_read_i2c_byte_generic() releases the E1000_SWFW_PHY0_SM bit once per failed retry at e1000_82575.c:3333 and then unconditionally again at :3344 (10 releases for 9 acquires), dropping a SW_FW_SYNC bit the function no longer owns and breaking the SW/FW mutual-exclusion protocol shared with management firmware and sibling ports. Proven by a 1:1 control-flow replica (run.log: acquires=9 releases=10) and by contrast with the balanced writer e1000_write_i2c_byte_generic (:3373-3417). Kernel-path reproduction impossible on the audit guest: no Intel 8257x/i350/i210 NIC is present (env.txt pciconf), so the HAL cannot attach; verdict is not_reproduced for the kernel reach with the defect itself certain at source level.",
  "exploit_chain": "",
  "evidence": "run.log (acquires=9 releases=10 -> DOUBLE RELEASE, controls balanced); VERDICT.md (control-flow trace of :3284-3344 and the write-path contrast); env.txt (no igb device on guest)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_82575.c:3333",
    "sys/dev/netif/ig_hal/e1000_82575.c:3344",
    "sys/dev/netif/ig_hal/e1000_82575.c:3284",
    "sys/dev/netif/ig_hal/e1000_82575.c:3417"
  ],
  "poc_changes": "No seed existed; harness authored from scratch. Replicates the do/while(retry<10) structure verbatim with mocked acquire/release and failing I2C primitives.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 42,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/swfw_double_release /tmp/swfw_double_release.c",
  "run_cmd": "/tmp/swfw_double_release; echo exit=$?",
  "code_hash": "103f0b2db16ba78895c3a975bb6dcbf50e1f4285b4e234fa35bfbc71c712a228",
  "notes": "Guest has no igb-attachable device (virtio-only, see env.txt): the in-kernel path cannot execute. All other acquire/release pairs in the file verified balanced (nvm 991/1022, reset_hw_82580 2496/2545, phy wrappers 608/641/2376/2402). Fix-kernel rebuild not meaningful on this guest: nothing observable changes without the device.",
  "recommended_fix": "Gate the post-loop release on status == E1000_SUCCESS (only the break path still holds the semaphore).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff gates the release; validated against the same state-machine replica (releases==acquires for all cases). A patched-kernel build on this guest has no observable behavior difference because the igb device is absent, so hardware fix validation is not_testable here.",
  "fix_evidence": "fix.diff; VERDICT.md Fix validation section"
}