⬢ DragonFlyBSD Kernel Audit
DF-3937 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3937",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest (no ENA hardware, env.txt). fix.diff moves ENA_WAIT_EVENT_DESTROY under the existing NULL guard at ena_com.c:1585 \u2014 a pure ordering fix authored post-verification.",
  "fix_evidence": "findings/poc/DF-3937/fix.diff + VERDICT.md",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ena_com_admin_destroy dereferences admin_queue->comp_ctx at ena_com.c:1581 (ENA_WAIT_EVENT_DESTROY -> cv_destroy/lockuninit per ena_plat.h:231-234) FOUR LINES BEFORE the NULL check at :1585. Reached from ena_com_admin_inits error unwind (:1761-1762) when ena_com_init_comp_ctxts kmalloc (M_NOWAIT) fails (:302-306) \u2014 i.e. NULL-deref panic in the ena(4) PCI attach path under memory pressure (an unprivileged user can pressure M_DEVBUF around a driver reload to shape this). Secondary: only comp_ctx[0] of the 32 initialized wait events is destroyed. Low severity / certain at source; hardware-gated (no ENA device on guest) => inconclusive runtime classification. Pattern precedent: DF-3799 (dead-code variant, Info).",
  "exploit_chain": "local memory pressure + ena attach/reload -> ena_com_init_comp_ctxt alloc fails -> ena_com_admin_init error path -> ena_com_admin_destroy -> cv_destroy(&NULL->wq) -> kernel panic (DoS)",
  "evidence": "findings/poc/DF-3937/VERDICT.md (5-step trace) + fix.diff + env.txt",
  "kernel_refs": [
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1581",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1585",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:1761",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:302",
    "sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:231",
    "sys/dev/virtual/amazon/ena/ena.c:3220"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. Hunt area (f) DMA memory alloc/free paths of ena_com.c; the rest of the alloc/free unwind (rss_init error paths, io_queue_free, hash_key/ctrl destroy, aenq destroy) was verified correct.",
  "recommended_fix": "Move ENA_WAIT_EVENT_DESTROY inside the comp_ctx NULL guard (fix.diff).",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}