⬢ DragonFlyBSD Kernel Audit
DF-3936 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-3936",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: requires an ENA PCI function (Amazon Nitro), absent from the audit guest (env.txt). fix.diff is the one-token logic correction (missing !) at ena_com.c:2238, matching the Linux reference driver.",
  "fix_evidence": "findings/poc/DF-3936/fix.diff + VERDICT.md",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ena_com_set_hash_function inverts its device-support check (ena_com.c:2238): it returns ENA_COM_UNSUPPORTED exactly when the device DOES support the selected hash function (Linux has the negated form). On any compliant ENA device the RSS hash function (driver selects CRC32 with init 0xFFFFFFFF via ena.c:3081) is therefore never programmed; ena_rss_init_default tolerates the EOPNOTSUPP (ena.c:3082) so the failure is silent and receive-side steering degrades to whatever the device default is. Pure logic defect on the hypervisor boundary - no memory-safety impact. Hardware-gated (no vendor-0x1d0f function on the guest) => inconclusive, source-certain.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3936/VERDICT.md + fix.diff (1-token diff) + env.txt",
  "kernel_refs": [
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2238",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2323",
    "sys/dev/virtual/amazon/ena/ena.c:3081",
    "sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:175"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. Found while hunting area (d) RSS key/hash functions of ena_com.c.",
  "recommended_fix": "Negate the support check at ena_com.c:2238 (see fix.diff).",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}