⬢ DragonFlyBSD Kernel Audit
DF-3907 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3907",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated (no 3Com 3c90x NIC on the audit guest) -> inconclusive per family convention, same treatment as DF-3761 (alc) and DF-3904 (sk). xl_rxeof (sys/dev/netif/xl/if_xl.c:1948) HAS a work-bound parameter but it is only honored when count >= 0 (:1959-1962) and every interrupt-path caller passes -1: xl_intr :2335 (main RX), xl_intr :2340 (the unbounded while(xl_rx_resync(sc)) xl_rxeof(sc,-1) retry loop), xl_start_body :2616 (TX-completion RX assist), xl_watchdog :3123; for non-905B chips a goto-again restart (:2041-2063) further re-runs the walk whenever the uplist stalled - the exact state a line-rate flood produces. The walk executes inside xl_intr holding ifp->if_serializer (bus_setup_intr at :1529-1531), so a remote unauthenticated flood pins the interrupt CPU and serializer indefinitely (RX livelock / remote DoS). The ifpoll path (xl_npoll_compat :2273) proves the bound plumbing works when given a real count. fix.diff passes XL_RX_PROC_MAX=64 from the interrupt-path callers and caps the resync retry loop; ifpoll behavior unchanged.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3907/README.md (all four count=-1 call sites + goto-again analysis); findings/poc/DF-3907/fix.diff (budget via the existing count plumbing)",
  "kernel_refs": [
    "sys/dev/netif/xl/if_xl.c:1958",
    "sys/dev/netif/xl/if_xl.c:1960",
    "sys/dev/netif/xl/if_xl.c:2041",
    "sys/dev/netif/xl/if_xl.c:2062",
    "sys/dev/netif/xl/if_xl.c:2335",
    "sys/dev/netif/xl/if_xl.c:2339",
    "sys/dev/netif/xl/if_xl.c:2616",
    "sys/dev/netif/xl/if_xl.c:3123",
    "sys/dev/netif/xl/if_xl.c:2273"
  ],
  "poc_changes": "No seed PoC; no runnable trigger exists without 3c90x hardware. The defect is the count=-1 constant at four call sites against a bound that the same function already implements for ifpoll.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "DF-3761 family instance in xl(4). RX length itself is properly bounded (XL_MAX_FRAMELEN=1522 < 2046 posted; DF-3604 family NOT present) - this finding is purely the missing work bound.",
  "recommended_fix": "Pass XL_RX_PROC_MAX=64 (instead of -1) from the interrupt-path xl_rxeof call sites and cap the xl_rx_resync retry loop; the count>=0 bound already exists in xl_rxeof.",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree: enables the functions existing count>=0 bound from the interrupt path. Not runnable on this guest (no 3c90x NIC); the same bound is proven live by the ifpoll path in-tree.",
  "fix_evidence": "findings/poc/DF-3907/fix.diff"
}