⬢ DragonFlyBSD Kernel Audit
DF-3928 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3928",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: the trigger path requires mly/age hardware absent from the audit guest. fix.diff is mechanical (bounds/termination-only) and authored post-verification against the cited lines.",
  "fix_evidence": "findings/poc/DF-3928/fix.diff + VERDICT.md",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (no Mylex controller in the audit guest); source-certain. mly_get_controllerinfo (mly.c:744-780) trusts the firmware-DMAd u_int8_t channel counts; mly_cam_attach (mly.c:1947-1961) stores cam_sim pointers into mly_cam_sim[6] for chn up to 509 (~4KB of kernel-pointer writes past the softc) and mly_scan_devices/mly_periodic (mly.c:802-805, 1378-1391) write MLY_BTL_RESCAN across mly_btl[6][16] for bus < mly_cam_channels <= 510 (~290KB strided OOB write past the softc into the heap). Same trust boundary as accepted DF-1290 but attach-time, larger, and pointer-valued. Verified guest has no mly device (virtio-only PCI list), so no runtime trigger exists; per pass-1 family convention (DF-1289/DF-1290) filed not_reproduced with certain source confidence.",
  "exploit_chain": "malicious/buggy controller answers GETCONTROLLERINFO with channel counts > 6 -> attach-time kernel heap corruption (pointer writes + 290KB strided flag writes) -> panic or groomed corruption",
  "evidence": "findings/poc/DF-3928/VERDICT.md (line-cited chain); env.txt (no mly hardware in guest); fix.diff (channel-count validation)",
  "kernel_refs": [
    "sys/dev/raid/mly/mly.c:744",
    "sys/dev/raid/mly/mly.c:1927",
    "sys/dev/raid/mly/mly.c:1947",
    "sys/dev/raid/mly/mly.c:1967",
    "sys/dev/raid/mly/mly.c:802",
    "sys/dev/raid/mly/mly.c:1378",
    "sys/dev/raid/mly/mlyvar.h:206",
    "sys/dev/raid/mly/mlyreg.h:576"
  ],
  "poc_changes": "No seed PoC; hardware-gated attach-time defect - evidence pack documents the exact lab reproduction (QEMU device-model answering GETCONTROLLERINFO with virtual_channels_present=255).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. Excluded knowns DF-1288..DF-1291. Negative checks: mly_describe_code returns the post-NULL sentinel string (mly_tables.h:44-51) so event printing cannot NULL-deref; mly_cam_action_ios invalid-bus branch (mly.c:2187-2190) is unreachable because cam_sim_bus(sim) is always a registered channel.",
  "recommended_fix": "Validate physical+virtual channel counts against MLY_MAX_CHANNELS right after GETCONTROLLERINFO and fail attach (EIO).",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}