⬢ DragonFlyBSD Kernel Audit
DF-3867 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3867",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Verification skipped per contract for Low/speculative findings, and doubly gated: the QEMU guest has no Creative Labs PCI device (proven live in the DF-3866 pack: kldload snd_emu10kx attaches nothing), and even on real hardware the race window between the unlocked NULL check of ihandler[i].irq_func (emu10kx.c:995) and the indirect call (emu10kx.c:996) is a few instructions wide against the lock-taking unregistering thread (emu10kx.c:964-967), making userland-triggered reproduction probabilistic. Source-level the race is real: emu_intr() runs INTR_MPSAFE and lockless while emu_intr_unregister() NULLs .irq_func/.softc under sc->lock; worst case is a call through NULL -> panic (DoS), not exploitable control flow.",
  "exploit_chain": "",
  "evidence": "trigger.c (exact trigger shape: concurrent playback for interrupt flow + rec START/STOP loop); DF-3866 pack run.log for the hardware gate; sys/dev/sound/pci/emu10kx.c:993-999 vs :964-967",
  "kernel_refs": [
    "sys/dev/sound/pci/emu10kx.c:993",
    "sys/dev/sound/pci/emu10kx.c:995",
    "sys/dev/sound/pci/emu10kx.c:996",
    "sys/dev/sound/pci/emu10kx.c:964",
    "sys/dev/sound/pci/emu10kx.c:3208"
  ],
  "poc_changes": "n/a (not executed)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o trigger trigger.c",
  "run_cmd": "./trigger /dev/dsp0",
  "code_hash": "62415fd14e0fd194f99d6552bb56200618f5d56536f579f7f06900214925d672",
  "notes": "skip-class finding (Low/speculative). Hardware gate identical to DF-3866 (see findings/poc/DF-3866/run.log GATE lines). code_hash is sha256 of trigger.c (source authored, never compiled on guest).",
  "recommended_fix": "Snapshot irq_func/softc into locals once under sc->lock (or a single atomic load) in emu_intr() before the NULL test and call",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not validated: no baseline repro possible (no hardware), skip-class finding.",
  "fix_evidence": "sys/dev/sound/pci/emu10kx.c:993-999"
}