⬢ DragonFlyBSD Kernel Audit
DF-3915 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3915",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain wild OOB read (CWE-125), pass 2. _mapping_process_dpm_pg0 stores the unchecked DPM DeviceIndex into et_entry->start_index (mpr_mapping.c:2310) together with a valid dpm_entry_num (:2311); when the entrys slot count is zero (:2293-2295 - legal value of the 7-bit slot field) the reservation loop :2328-2347 runs zero iterations, so DF-1282s OOB write never fires and the corrupt entry survives ingestion quietly (init_complete stays 0). mpr_mapping_check_devices (:2481-2493, the only caller) then passes it to _mapping_commit_enc_entry, which dereferences &sc->mapping_table[et_entry->start_index] (:129) and reads mt_entry->id (:130) - a read up to 65535*32 = 2,096,640 bytes past the max_devices*32-byte mapping_table allocation (:2140): kernel panic on unmapped page, or silent garbage persisted into the controllers NVRAM DeviceIndex which re-enters driver state on next boot. Preconditions: Enc/Slot mapping mode, DPM enclosure entry with slot bits==0 and out-of-range DeviceIndex (malicious IOC firmware / NVRAM corruption), and >=1 other enclosure with init_complete (:2438-2446). Not reproduced at kernel level on the QEMU guest: no SAS3 HBA (env.txt); same gate as DF-1282/DF-3800. Primitive proven at object level on the guest: harness demonstrates the zero-iteration reservation loop (DF-1282 bypass) and the :129 indexing resolving +2,096,640 bytes past an 8,448-byte allocation (run.log).",
  "exploit_chain": "Hardware-gated (not executable on this guest): corrupt/malicious DPM pg0 enclosure entry (slot bits 0, DeviceIndex 0xFFF0) -> quiet ingestion via _mapping_process_dpm_pg0 -> device-check callout after MPR_MISSING_CHECK_DELAY -> _mapping_commit_enc_entry wild read -> panic (DoS) or garbage DeviceIndex persisted to controller NVRAM. Read-only primitive; escalation ceiling is DoS + persistent mapping corruption.",
  "evidence": "run.log (guest harness: 0 reservation-loop iterations + read at +2,096,640 bytes), harness_df3915.c (verbatim struct/index replication incl. PROT_NONE guard variant), env.txt (hardware gate), VERDICT.md (line-by-line chain incl. single-caller grep proof), fix.diff + fix_build.log (patched kernel compiled -Werror clean, completed)",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr_mapping.c:129",
    "sys/dev/raid/mpr/mpr_mapping.c:2251",
    "sys/dev/raid/mpr/mpr_mapping.c:2293",
    "sys/dev/raid/mpr/mpr_mapping.c:2310",
    "sys/dev/raid/mpr/mpr_mapping.c:2328",
    "sys/dev/raid/mpr/mpr_mapping.c:2481",
    "sys/dev/raid/mpr/mpr_mapping.c:2491",
    "sys/dev/raid/mpr/mpr_mapping.c:2140"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding). Harness authored against exact struct layout; built and run on the audit guest with cc 8.3.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o harness_df3915 harness_df3915.c",
  "run_cmd": "./harness_df3915",
  "code_hash": "c7e6d55666fe6698146e4ca516d305edc64ebd58b8de54bccf74bdffc4f742e2",
  "notes": "Upstream FreeBSD head shares the unguarded _mapping_commit_enc_entry sink (verified against cgit.freebsd.org). Guest /usr/src restored to pristine after fix build; guest reset with clean-source snapshot performed.",
  "recommended_fix": "Validate et_entry->start_index (!= MPR_MAPTABLE_BAD_IDX and < sc->max_devices) at the top of _mapping_commit_enc_entry before indexing sc->mapping_table.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (guard clause at the top of _mapping_commit_enc_entry) applied to the guest /usr/src copy together with DF-3914s diff; make nativekernel rebuilt mpr_mapping.c with -Werror in both passes and completed the kernel+module link with zero diagnostics (fix_build.log; full log SHA256 55641f6d20f32d6795026dd86d27cd571a9186beb0333830050a386f1fb57368). Runtime fix validation not testable without an mpr(4) HBA serving a malformed DPM page.",
  "fix_evidence": "findings/poc/DF-3915/fix.diff, findings/poc/DF-3915/fix_build.log"
}