⬢ DragonFlyBSD Kernel Audit
DF-3834 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3834",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "bwn_phy_lp_tblinit_r2 (sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2555) opens with KASSERT(mac->mac_phy.rev < 2, ...) at line 2742, but its sole caller (bwn_phy_lp_tblinit, line 1269) invokes it only when rev >= 2 \u2014 the assertion is inverted and fails unconditionally on the first LP-PHY-rev>=2 (b2063 radio) initialization. Because KASSERT is INVARIANTS-only (sys/sys/systm.h:94-118) stock GENERIC kernels are unaffected, but any INVARIANTS kernel panics deterministically at bwn attach/ifconfig up (bwn is compiled into X86_64_GENERIC, sys/config/X86_64_GENERIC:268). The polarity is proven wrong by the drivers own companions: tblinit_r01 asserts rev < 2 (line 2527, correct for its caller at 1263) and gaintbl_write_r2 asserts rev >= 2 (line 3661). Upstream FreeBSD head carries the identical inversion (verified in its bwn_phy_lp_tblinit_r2) \u2014 inherited, not DF-introduced. Not exercisable on the audit guest: bwn is in the kernel but no Broadcom PCI device exists (env.txt), so the PHY init path never runs.",
  "exploit_chain": "none beyond panic: attach an LP PHY rev>=2 card to an INVARIANTS kernel -> ifconfig bwn0 up -> deterministic panic (availability only, requires the hardware + debug kernel).",
  "evidence": "README.md/VERDICT.md (dispatch at 1262-1270 vs assert at 2742; companion asserts 2527/3661; upstream comparison); env.txt; fix.diff (one-token polarity fix, git-apply --check passes)",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2742",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:1269",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2527",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:3661",
    "sys/sys/systm.h:117",
    "sys/config/X86_64_GENERIC:268"
  ],
  "poc_changes": "No PoC \u2014 needs LP PHY rev>=2 hardware; also note stock GENERIC masks the assert.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 hunt item (a): the rev-indexed PHY init-table walks. Reported against DFs copy; upstream FreeBSD has the same line and should get the same one-token fix.",
  "recommended_fix": "Invert the assertion to KASSERT(mac->mac_phy.rev >= 2, ...) at if_bwn_phy_lp.c:2742 (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline panic and patched non-panic both require an LP rev>=2 radio on an INVARIANTS kernel; no Broadcom hardware on the audit guest (env.txt). fix.diff is git-apply-able (verified).",
  "fix_evidence": "fix.diff"
}