⬢ DragonFlyBSD Kernel Audit
DF-3904 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3904",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated (no SysKonnect NIC on the audit guest) -> inconclusive per family convention, same treatment as the alc(4) original DF-3761. sk_rxeof (sys/dev/netif/sk/if_sk.c:1820-1888) walks completed RX descriptors in a for(;;) loop whose ONLY exit is the NIC-owned (SK_RXCTL_OWN) bit on the next descriptor (:1833-1837); every processed descriptor is immediately reposted to the NIC (:1862/:1873/:1875), so a line-rate remote flood keeps re-completing descriptors behind the walker and the loop never observes OWN - it runs forever inside sk_intr (:2212-2221) holding the ONE card-global sc->sk_serializer (bus_setup_intr with &sc->sk_serializer at :1514), on both ports of dual-port SK-98xx cards. Remote-unauthenticated RX livelock/DoS: the interrupt CPU is pinned, softclock/netisr and the other port starve. The sibling driver msk(4) bounds the identical walk via sc->msk_process_limit (sys/dev/netif/msk/if_msk.c:3225, tunable mskc.process_limit). fix.diff adds an SK_RX_PROC_MAX=64 budget with the same resume-index protocol the OWN exit already uses (cd->sk_rx_prod = i).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3904/README.md (loop shape + only-exit analysis); findings/poc/DF-3904/sk_rxeof_walk_shape.c (annotated loop shape); findings/poc/DF-3904/fix.diff (budget + resume index, msk-style)",
  "kernel_refs": [
    "sys/dev/netif/sk/if_sk.c:1820",
    "sys/dev/netif/sk/if_sk.c:1833",
    "sys/dev/netif/sk/if_sk.c:1862",
    "sys/dev/netif/sk/if_sk.c:1873",
    "sys/dev/netif/sk/if_sk.c:2212",
    "sys/dev/netif/sk/if_sk.c:1514",
    "sys/dev/netif/msk/if_msk.c:3225"
  ],
  "poc_changes": "No seed PoC. No runnable trigger exists without SysKonnect hardware; the pack documents the source-level loop shape and the msk(4) in-tree precedent for the fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "DF-3761 family (alc) instance in sk(4). The guest lacks sk hardware; DF-3761 itself was likewise persisted inconclusive/hardware-gated. Dual-port aggravation: one ports flood wedges both ports (shared card-global serializer).",
  "recommended_fix": "Bound sk_rxeof with a per-interrupt packet budget (SK_RX_PROC_MAX=64) saving cd->sk_rx_prod before break, mirroring msk(4)s mskc.process_limit.",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (budget + resume-index exit identical in shape to the existing OWN-bit exit). Not runnable on this guest (no sk NIC); the same fix shape is proven in-tree by msk(4).",
  "fix_evidence": "findings/poc/DF-3904/fix.diff"
}