⬢ DragonFlyBSD Kernel Audit
DF-3931 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3931",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: the trigger path requires mly/age hardware absent from the audit guest. fix.diff is mechanical (bounds/termination-only) and authored post-verification against the cited lines.",
  "fix_evidence": "findings/poc/DF-3931/fix.diff + VERDICT.md",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardware-gated + narrow race; confidence likely (all ingredients source-verified; mechanism class proven on this guest by DF-3715s replica). mly_periodic re-arms itself unconditionally (mly.c:1397); mly_shutdown stops it once with callout_stop (mly.c:530) and mly_free never touches it (mly.c:677-733). kern_timeout.cs own comments (840-846, 976-980) state a RESET requested by a racing callback automatically overrides a STOP, so a callback in flight when the stop lands can leave the callout ARMED after mly_shutdown returns; mly_detach then frees the softc/packets/DMA and the 1-second tick fires on freed memory (mly_btl walk, mly_rescan_btl -> alloc/map/start on destroyed queues). Compounding: no drain of mly_busy/mly_complete before free (drivers own XXX at mly.c:514-517), and no production timeout exists at all (MLY_CMD_TIMEOUT handling is #ifdef MLY_DEBUG only, mly.c:119/322-324/2971-2991; no XPT_ABORT support in mly_cam_action) so hung commands block safe detach indefinitely. Admin-gated (kldunload/detach/hot-remove); impact is post-free corruption. Not runtime-reproduced (hardware absent).",
  "exploit_chain": "kldunload/detach racing the 1s periodic or an in-flight completion -> callout/completion task fires after mly_free -> UAF of softc, packets, DMA tags",
  "evidence": "findings/poc/DF-3931/VERDICT.md (incl. kern_timeout.c RESET-overrides-STOP citations); fix.diff (callout_terminate + EBUSY drain gate)",
  "kernel_refs": [
    "sys/dev/raid/mly/mly.c:514",
    "sys/dev/raid/mly/mly.c:530",
    "sys/dev/raid/mly/mly.c:1397",
    "sys/dev/raid/mly/mly.c:677",
    "sys/dev/raid/mly/mly.c:1590",
    "sys/kern/kern_timeout.c:843",
    "sys/kern/kern_timeout.c:1074"
  ],
  "poc_changes": "No seed PoC; trigger is kldunload/detach under load on real hardware.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. The callout half shares its mechanism with the guest-PROVEN DF-3715 family result (RESET overrides STOP in _callout_cancel_or_stop), which is what elevates this from speculative to likely.",
  "recommended_fix": "callout_terminate() the periodic and refuse shutdown/detach while commands are in flight.",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}